Florian Fainelli [Sat, 28 Nov 2009 13:57:00 +0000 (13:57 +0000)]
ep93xx-eth: check for zero MAC address on probe, not on device open
If we happen to have registered the driver without passing
a MAC address, we will print a zero MAC address and register
the interface with this invalid address, this is confusin. This
patch moves the checking of a valid ethernet address and the
generation of a random one down from the open function to
the probe function.
smc91x.h defines SMC_IRQ_FLAGS to be -1 when it wants the interrupt
flags to be taken from the resource structure. However, d280ead
changed this to checking for non-zero resource flags.
Unfortunately, this means that on some platforms, we end up passing
'-1' to request_irq rather than the desired result. Combine the two
conditions into one so that the IRQ flags are taken from the resource
if either SMC_IRQ_FLAGS is -1 or the resource flags specify an
interrupt trigger.
This restores network on at least the Versatile platform.
smsc9420: prevent BUG() if ethtool is called with interface down
This patch fixes a null pointer dereference BUG() if ethtool is used on
an smsc9420 interface while it is down, because the phy_dev is only
allocated while the interface is up.
Ivan Vecera [Mon, 30 Nov 2009 07:12:52 +0000 (23:12 -0800)]
r8169: restore mac addr in rtl8169_remove_one and rtl_shutdown
The newer chipsets (all PCI-E) are known that they need full power cycle
(AC or battery removal) to reset MAC address to a hardwired one. Previous
patch to address this problem loads the original MAC address from EEPROM.
But it brought other problem for which it is necessary to introduce a new
module parameter.
However, it might suffice to restore the initial MAC address before
shutdown/reboot/kexec and when removing the module.
David Ford [Mon, 30 Nov 2009 07:02:22 +0000 (23:02 -0800)]
ipv4: additional update of dev_net(dev) to struct *net in ip_fragment.c, NULL ptr OOPS
ipv4 ip_frag_reasm(), fully replace 'dev_net(dev)' with 'net', defined
previously patched into 2.6.29.
Between 2.6.28.10 and 2.6.29, net/ipv4/ip_fragment.c was patched,
changing from dev_net(dev) to container_of(...). Unfortunately the goto
section (out_fail) on oversized packets inside ip_frag_reasm() didn't
get touched up as well. Oversized IP packets cause a NULL pointer
dereference and immediate hang.
I discovered this running openvasd and my previous email on this is
titled: NULL pointer dereference at 2.6.32-rc8:net/ipv4/ip_fragment.c:566
Roger Oksanen [Mon, 30 Nov 2009 01:17:29 +0000 (17:17 -0800)]
e100: Use pci pool to work around GFP_ATOMIC order 5 memory allocation failure
pci_alloc_consistent uses GFP_ATOMIC allocation that may fail on some systems
with limited memory (Bug #14265). pci_pool_alloc allows waiting with
GFP_KERNEL.
Alan Stern [Wed, 25 Nov 2009 00:06:37 +0000 (01:06 +0100)]
PM: fix irq enable/disable in runtime PM code
This patch (as1305) fixes a bug in the irq-enable settings and removes
some related overhead in the runtime PM code.
In __pm_runtime_resume(), within the scope of the original
spin_lock_irq(), we know that irqs are disabled. There's no
reason to go through a pair of enable/disable cycles when
acquiring and releasing the parent's lock.
In __pm_runtime_set_status(), irqs are already disabled when
the parent's lock is acquired, and they must remain disabled
when it is released.
sctp: on T3_RTX retransmit all the in-flight chunks
When retransmitting due to T3 timeout, retransmit all the
in-flight chunks for the corresponding transport/path, including
chunks sent less then 1 rto ago.
This is the correct behaviour according to rfc4960 section 6.3.3
E3 and
"Note: Any DATA chunks that were sent to the address for which the
T3-rtx timer expired but did not fit in one MTU (rule E3 above)
should be marked for retransmission and sent as soon as cwnd
allows (normally, when a SACK arrives). ".
This fixes problems when more then one path is present and the T3
retransmission of the first chunk that timeouts stops the T3 timer
for the initial active path, leaving all the other in-flight
chunks waiting forever or until a new chunk is transmitted on the
same path and timeouts (and this will happen only if the cwnd
allows sending new chunks, but since cwnd was dropped to MTU by
the timeout => it will wait until the first heartbeat).
Example: 10 packets in flight, sent at 0.1 s intervals on the
primary path. The primary path is down and the first packet
timeouts. The first packet is retransmitted on another path, the
T3 timer for the primary path is stopped and cwnd is set to MTU.
All the other 9 in-flight packets will not be retransmitted
(unless more new packets are sent on the primary path which depend
on cwnd allowing it, and even in this case the 9 packets will be
retransmitted only after a new packet timeouts which even in the
best case would be more then RTO).
p.s The problem is not only when multiple paths are there. It
can happen in a single homed environment. If the application
stops sending data, it possible to have a hung association.
Alan Cox [Thu, 26 Nov 2009 15:22:11 +0000 (12:22 -0300)]
V4L/DVB (13530): Fix wrong parameter order in memset
Edwin Török found the following:
In function ‘memset’,
inlined from ‘ir_input_init’ at drivers/media/common/ir-functions.c:67:
/home/edwin/builds/linux-2.6/arch/x86/include/asm/string_64.h:61:
warning: call to ‘__warn_memset_zero_len’ declared with attribute
warning: memset used with constant zero length parameter; this could be
due to transposed parameters
memset(ir->ir_codes, sizeof(ir->ir_codes), 0);
In actual practice the only caller I can find happens to already have cleared
the buffer before calling ir_input_init.
V4L/DVB (13412): SMS_SIANO_MDTV should depend on HAS_DMA
When building for Sun 3:
drivers/built-in.o: In function `smscore_unregister_device':
drivers/media/dvb/siano/smscoreapi.c:723: undefined reference to `dma_free_coherent'
drivers/built-in.o: In function `smscore_register_device':
drivers/media/dvb/siano/smscoreapi.c:365: undefined reference to `dma_alloc_coherent'
Csaba Henk [Fri, 27 Nov 2009 14:00:14 +0000 (19:30 +0530)]
fuse: reject O_DIRECT flag also in fuse_create
The comment in fuse_open about O_DIRECT:
"VFS checks this, but only _after_ ->open()"
also holds for fuse_create, however, the same kind of check was missing there.
As an impact of this bug, open(newfile, O_RDWR|O_CREAT|O_DIRECT) fails, but a
stub newfile will remain if the fuse server handled the implied FUSE_CREATE
request appropriately.
Other impact: in the above situation ima_file_free() will complain to open/free
imbalance if CONFIG_IMA is set.
The vpif_config struct was renamed to vpif_display_config, but there
is still a stray vpif_config *config pointer in vpif_display.c, preventing
it from compiling.
V4L/DVB (13344): soc-camera: properly initialise the device object when reusing
Commit ef373189f62413803b7b816c972fc154c488cdc0 "fix use-after-free Oops,
resulting from a driver-core API change" fixed the Oops, but didn't correct
missing device object initialisation. This patch makes unloading and reloading
of soc-camera host- and client-drivers possible again.
Alexey Kuznetsov [Tue, 17 Nov 2009 22:10:11 +0000 (14:10 -0800)]
[SCSI] fix crash when disconnecting usb storage
__scsi_remove_device() in scsi_forget_host() is executed out of scan_mutex
and races with scsi_destroy_sdev() <- scsi_sysfs_add_devices() <-
scsi_finish_async_scan(). The result is use after free and/or double
free, oops.
The fix is simple, move scsi_forget_host() under scan_mutex.
scsi_forget_host() is just sequence of __scsi_remove_device(). All
another calls of __scsi_remove_device() are made under scan_mutex. So
that it is safe.
James Bottomley [Thu, 19 Nov 2009 22:48:29 +0000 (17:48 -0500)]
[SCSI] fix async scan add/remove race resulting in an oops
Async scanning introduced a very wide window where the SCSI device is
up and running but has not yet been added to sysfs. We delay the
adding until all scans have completed to retain the same ordering as
sync scanning.
This delay in visibility causes an oops if a device is removed before
we make it visible because the SCSI removal routines have an inbuilt
assumption that if a device is in SDEV_RUNNING state, it must be
visible (which is not necessarily true in the async scanning case).
Fix this by introducing an additional is_visible flag which we can use
to condition the tear down so we do the right thing for running but
not yet made visible.
sd_dif.c was not updated to return -EILSEQ, leading to error handling
failures in applications which provide their own integrity metadata (as
opposed to being protected by the block layer functions).
Wolfram Sang [Thu, 26 Nov 2009 08:22:33 +0000 (09:22 +0100)]
at24: Use timeout also for read
Writes may take some time on EEPROMs, so for consecutive writes, we already
have a loop waiting for the EEPROM to become ready. Use such a loop for reads,
too, in case somebody wants to immediately read after a write. Detailed bug
report and test case can be found here:
Jean Delvare [Thu, 26 Nov 2009 08:22:33 +0000 (09:22 +0100)]
i2c: Fix userspace_device list corruption
Fix userspace_device list corruption. The corruption was caused by
clients not being removed when adapters with such clients were
themselves removed. Something like the following would trigger it
(assuming i2c-stub gets adapter number 3):
According to the TAOS Application Note 'Controlling a Backlight with
the TSL2550 Ambient Light Sensor' (page 14), the actual lux value in
extended mode should be obtained multiplying the calculated lux value
by 5.
Keysyms stored in key_map[] are not simply K() values, but U(K()) values,
as can be seen in the KDSKBENT ioctl handler. The kernel-generated
braille keysyms thus need a U() call too.
Hemant Pedanekar [Wed, 25 Nov 2009 23:04:54 +0000 (15:04 -0800)]
ide: fix ioctl to pass requested transfer mode to ide_find_dma_mode instead of UDMA6
Currently, ide_cmd_ioctl when invoked for setting DMA transfer mode calls
ide_find_dma_mode with requested mode as XFER_UDMA_6. This prevents setting DMA
mode to any other value than the default (maximum) supported by the device (or
UDMA6, if supported) irrespective of the actual requested transfer mode and
returns error.
For example, setting mode to UDMA2 using hdparm, where UDMA4 is the default
transfer mode gives following error:
# ./hdparm -d1 -Xudma2 /dev/hda
/dev/hda:hda: UDMA/66 mode selected
setting using_dma to 1 (on)
hda: UDMA/66 mode selected
setting xfermode to 66 (UltraDMA mode2)
HDIO_DRIVE_CMD(setxfermode) failed: Invalid argument
using_dma = 1 (on)
Zhenyu Wang [Wed, 11 Nov 2009 02:30:50 +0000 (02:30 +0000)]
drm/i915: Fix CRT hotplug detect by checking really no channels attached
For CRT hotplug detect status, we have four test results as blue
channel only, green channel only, both blue and green channel, and
no channel attached. Origin code only marks both blue and green channel
case as connected, but ignore other possible connected states. This one
trys to detect CRT by checking no channel attached case instead.
Graf Yang [Mon, 21 Sep 2009 11:51:31 +0000 (11:51 +0000)]
Blackfin: fix SMP build error in start_thread()
Commit d5ce528c8e46fa5afb9 (Blackfin: convert irq/process to asm-generic)
incorrectly merged the smp and non-smp cases of start_thread() causing the
L1 stack to be setup on the SMP port instead of the UP port.
Jie Zhang [Fri, 20 Nov 2009 22:52:08 +0000 (22:52 +0000)]
Blackfin: fix typo in ptrace poking
Commit c014e15a2f667f9 (Blackfin: convert ptrace to new memory functions)
introduced a copy & paste typo in the ptrace poke data/text handling. The
access_process_vm() function call was telling it to read instead of write.
Mike Frysinger [Sun, 15 Nov 2009 23:18:41 +0000 (18:18 -0500)]
Blackfin: update anomaly lists
Add some recently documented anomalies (473, 474, 475, 477). Also stick
a "do not edit" notice in here so people know these are copies of some
master version.
Blackfin: fix suspend/resume failure with some on-chip ROMs
Some Blackfin on-chip ROMs utilize some MDMA channels during the suspend
and resume process, but don't clean up after themselves. So manually
clear all DMA channels when resuming since no DMA could have been running
at this point in time. Now Linux should be able to work regardless of any
laziness on the part of the on-chip ROM or boot loader.
There is a problem in the quirk tables used by tpacpi_is_fw_known() and
tpacpi_check_outdated_fw(), which causes outdated BIOSes that are lacking
the EC firmware ID DMI field to never match.
This breaks module loading on, e.g. a T23 with outdated BIOS, and the
module will refuse to load unless the "force_load=1" parameter is given.
Fix the quirk tables so that they can also match the outdated BIOSes,
which in turn will both fix the module loading, and also warn the user
that he is using outdated firmware and should upgrade.
ACPICA: Silence the warning about _BIF returning the buffer
_BIF was returning buffer instead of a string since day 1 of ACPI.
Adding a warning for that is noble, but people don't like
when someone cries wolf in a production system.
Reference: http://bugzilla.kernel.org/show_bug.cgi?id=14379 Signed-off-by: Alexey Starikovskiy <[email protected]> Signed-off-by: Len Brown <[email protected]>
Steve French [Tue, 24 Nov 2009 22:49:37 +0000 (22:49 +0000)]
[CIFS] Duplicate data on appending to some Samba servers
SMB writes are sent with a starting offset and length. When the server
supports the newer SMB trans2 posix open (rather than using the SMB
NTCreateX) a file can be opened with SMB_O_APPEND flag, and for that
case Samba server assumes that the offset sent in SMBWriteX is unneeded
since the write should go to the end of the file - which can cause
problems if the write was cached (since the beginning part of a
page could be written twice by the client mm). Jeff suggested that
masking the flag on posix open on the client is easiest for the time
being. Note that recent Samba server also had an unrelated problem with
SMB NTCreateX and append (see samba bugzilla bug number 6898) which
should not affect current Linux clients (unless cifs Unix Extensions
are disabled).
The cifs client did not send the O_APPEND flag on posix open
before 2.6.29 so the fix is unneeded on early kernels.
In the future, for the non-cached case (O_DIRECT, and forcedirectio mounts)
it would be possible and useful to send O_APPEND on posix open (for Windows
case: FILE_APPEND_DATA but not FILE_WRITE_DATA on SMB NTCreateX) but for
cached writes although the vfs sets the offset to end of file it
may fragment a write across pages - so we can't send O_APPEND on
open (could result in sending part of a page twice).
Steve French [Tue, 24 Nov 2009 22:17:59 +0000 (22:17 +0000)]
[CIFS] fix oops in cifs_lookup during net boot
Fixes bugzilla.kernel.org bug number 14641
Lookup called during network boot (network root filesystem
for diskless workstation) has case where nd is null in
lookup. This patch fixes that in cifs_lookup.
(Shirish noted that 2.6.30 and 2.6.31 stable need the same check)
David S. Miller [Tue, 24 Nov 2009 22:12:50 +0000 (14:12 -0800)]
sunsu: Use sunserial_console_termios() in sunsu_console_setup().
Be like the other Sun serial drivers otherwise the special handling of
OpenFirmware options and hard-coded overrides for LOM/RSC consoles
will not be handled.
David S. Miller [Tue, 24 Nov 2009 22:09:56 +0000 (14:09 -0800)]
serial: suncore: Fix RSC/LOM handling in sunserial_console_termios().
RSC and LOM devices have fixed speed settings.
We already had some code to match and handle "rsc" named devices on
E250 systems, but we also have to handle 'rsc-console', 'rsc-control',
and 'lom-console'.
Also, in order to get this right regardless of what 'output-device'
happens to be, explicitly pass the UART device node pointer to this
routine.
David S. Miller [Tue, 24 Nov 2009 21:58:52 +0000 (13:58 -0800)]
sunsu: Fix detection of SU ports which are RSC console or control.
These device nodes are named "rsc-console" and "rsc-control" rather
than 'serial', but the device_type property is 'serial' so we'll
tip off of that for detection.
David S. Miller [Tue, 24 Nov 2009 21:56:39 +0000 (13:56 -0800)]
sunsab: Do not set sunsab_reg.cons right before registering minors.
Other Sun serial drivers do not do this, and if we keep it this way
it ends up registering all serial devices as consoles rather than
just the one which we explicitly register via sunserial_console_match()
which uses add_preferred_console().
Harald Welte [Tue, 24 Nov 2009 15:53:00 +0000 (16:53 +0100)]
[CPUFREQ] Enable ACPI PDC handshake for VIA/Centaur CPUs
In commit 0de51088e6a82bc8413d3ca9e28bbca2788b5b53, we introduced the
use of acpi-cpufreq on VIA/Centaur CPU's by removing a vendor check for
VENDOR_INTEL. However, as it turns out, at least the Nano CPU's also
need the PDC (processor driver capabilities) handshake in order to
activate the methods required for acpi-cpufreq.
Since arch_acpi_processor_init_pdc() contains another vendor check for
Intel, the PDC is not initialized on VIA CPU's. The resulting behavior
of a current mainline kernel on such systems is: acpi-cpufreq
loads and it indicates CPU frequency changes. However, the CPU stays at
a single frequency
This trivial patch ensures that init_intel_pdc() is called on Intel and
VIA/Centaur CPU's alike.
When the framebuffer driver does not publish detailed timing information
for the current video mode, the correct value for the pixclock field is
zero, not -1.
Since pixclock is actually unsigned, the value -1 would be interpreted
as 4294967295 picoseconds (i.e., about 4 milliseconds) by
register_framebuffer() and userspace programs.
drm: make sure page protections are updated after changing vm_flags
Some architectures compute ->vm_page_prot depending on ->vm_flags, so we
need to update the protections after adjusting the flags.
AFAIK this only affects running X under Xen; without this patch you get
lots of coloured blobs on the screen, or maybe a complete lockup. Or
anything really.
But that still depends on lots of out-of-tree stuff, so I don't think
there are any consequences for anyone else. But it is wrong in principle.
Jerome Glisse [Thu, 12 Nov 2009 13:13:53 +0000 (14:13 +0100)]
drm/radeon/kms: Report vga connector is connected according to ddc_probe
On broken EDID we were reporting vga connector to be disconnected
even if ddc probe did found a monitor. This patch report that the
connector is connected on such case. This allow drm to add a fail
safe mode (800x600 at the time of this patch) thus user can boot
and later add a mode which match its monitor capabilities.
Jerome Glisse [Fri, 13 Nov 2009 19:56:58 +0000 (20:56 +0100)]
drm: mm always protect change to unused_nodes with unused_lock spinlock
unused_nodes modification needs to be protected by unused_lock spinlock.
Here is an example of an usage where there is no such protection without
this patch.
Process 1: 1-drm_mm_pre_get(this function modify unused_nodes list)
2-spin_lock(spinlock protecting mm struct)
3-drm_mm_put_block(this function might modify unused_nodes
list but doesn't protect modification with unused_lock)
4-spin_unlock(spinlock protecting mm struct)
Process2: 1-drm_mm_pre_get(this function modify unused_nodes list)
At this point Process1 & Process2 might both be doing modification to
unused_nodes list. This patch add unused_lock protection into
drm_mm_put_block to avoid such issue.
Jerome Glisse [Fri, 13 Nov 2009 19:56:35 +0000 (20:56 +0100)]
drm/radeon/kms: Disable TV load detect on RS400,RC410,RS480
RS400,RC410,RS480 chipset seems to report a lot of false positive
with load detect on TV output. We haven't yet found a way to make
load detect reliable on those chipset, thus just disable it for TV
output. Would avoid user to experience phantom screen because X
believe there is a monitor connected to the TV output.
Dave Airlie [Thu, 12 Nov 2009 05:53:44 +0000 (15:53 +1000)]
drm/radeon/kms: read back register before writing in IIO.
This fixes RH bugzilla #527874.
On resume the atom posting wasn't working, however vbe posting was
going fine, after 2 weeks over irc, and 8 hrs with the hardware,
I tracked it down to the memory device table and it access the MC
registers via IIO, it appears the rv515 atom iio table might not
be fully functional, so adding a readback before doing a write
either provides enough delay to make things resume correctly.
Thanks to Peng Huang at Red Hat for coming to Brisbane.
David S. Miller [Tue, 24 Nov 2009 00:38:56 +0000 (16:38 -0800)]
sparc64: Fix definition of VMEMMAP_SIZE.
This was the cause of various boot failures on V480, V880, etc.
systems.
Kernel image memory was being overwritten because the vmemmap[]
array was being sized to small. So if you had physical memory
addresses past a certain point, the early bootup would spam
all over variables in the kernel data section.
The vmemmap mappings map page structs, not page struct pointers.
And that was the key thinko in the macro definition.
This was fixable thanks to the help, reports, and tireless patience
of Hermann Lauer.
David Daney [Mon, 12 Oct 2009 19:04:32 +0000 (12:04 -0700)]
Staging: octeon-ethernet: Assign proper MAC addresses.
Allocate MAC addresses using the same method as the bootloader. This
avoids changing the MAC between bootloader and kernel operation as
well as avoiding duplicates and use of addresses outside of the
assigned range.
Eric Dumazet [Mon, 23 Nov 2009 01:44:37 +0000 (01:44 +0000)]
pktgen: Fix device name compares
Commit e6fce5b916cd7f7f7 (pktgen: multiqueue etc.) tried to relax
the pktgen restriction of one device per kernel thread, adding a '@'
tag to device names.
Problem is we dont perform check on full pktgen device name.
This allows adding many time same 'device' to pktgen thread
pgset "add_device eth0@0"
one session later :
pgset "add_device eth0@0"
(This doesnt find previous device)
This consumes ~1.5 MBytes of vmalloc memory per round and also triggers
this warning :
Mark Brown [Mon, 23 Nov 2009 13:11:53 +0000 (13:11 +0000)]
ASoC: Fix suspend with active audio streams
When we get a stream suspend event force the power down since otherwise
the stream would remain marked as active. In future we'll probably want
to make this stream-specific and add an interface to make the power down
of other widgets optional in order to support leaving bypass paths
active while suspending the processor.
Andreas Lohre reported that the driver crashes when trying
to register_netdev(), he sugessted to move dev->netdev_ops initialization
before calling register_netdev(), it worked for him.
Narender Kumar [Fri, 20 Nov 2009 22:08:57 +0000 (22:08 +0000)]
netxen : fix BOND_MODE_TLB/ALB mode.
o Along with netdev->perm_addr, mac address will be
maintained in device private structure.
o Device limitation: We need to set mac address when ever
interface comes up.
In ALB/TAL mode, bonding driver calls set_mac for all slave with bond mac address.
But bonding driver set netdev->dev_addr field to its original value,
after enslaving interfaces.
When ever active slave changes, it swap dev_addr of inactive slave with active.
Yet it doesn't notify driver about change in netdev->dev_addr.
As netxen driver need to set mac addr when ever interface comes up,
it can't rely on netdev->dev_addr field. Specially in case of bonding mode ALB/TLB.
projects / linux.git / log