Marcel Holtmann [Mon, 15 Mar 2010 21:12:58 +0000 (14:12 -0700)]
Bluetooth: Fix potential bad memory access with sysfs files
When creating a high number of Bluetooth sockets (L2CAP, SCO
and RFCOMM) it is possible to scribble repeatedly on arbitrary
pages of memory. Ensure that the content of these sysfs files is
always less than one page. Even if this means truncating. The
files in question are scheduled to be moved over to debugfs in
the future anyway.
Based on initial patches from Neil Brown and Linus Torvalds
netfilter: ctnetlink: fix reliable event delivery if message building fails
This patch fixes a bug that allows to lose events when reliable
event delivery mode is used, ie. if NETLINK_BROADCAST_SEND_ERROR
and NETLINK_RECV_NO_ENOBUFS socket options are set.
netlink: fix NETLINK_RECV_NO_ENOBUFS in netlink_set_err()
Currently, ENOBUFS errors are reported to the socket via
netlink_set_err() even if NETLINK_RECV_NO_ENOBUFS is set. However,
that should not happen. This fixes this problem and it changes the
prototype of netlink_set_err() to return the number of sockets that
have set the NETLINK_RECV_NO_ENOBUFS socket option. This return
value is used in the next patch in these bugfix series.
Under NET_DMA, data transfer can grind to a halt when userland issues a
large read on a socket with a high RCVLOWAT (i.e., 512 KB for both).
This appears to be because the NET_DMA design queues up lots of memcpy
operations, but doesn't issue or wait for them (and thus free the
associated skbs) until it is time for tcp_recvmesg() to return.
The socket hangs when its TCP window goes to zero before enough data is
available to satisfy the read.
Periodically issue asynchronous memcpy operations, and free skbs for ones
that have completed, to prevent sockets from going into zero-window mode.
Lennart Schulte [Wed, 17 Mar 2010 02:16:29 +0000 (02:16 +0000)]
tcp: Fix tcp_mark_head_lost() with packets == 0
A packet is marked as lost in case packets == 0, although nothing should be done.
This results in a too early retransmitted packet during recovery in some cases.
This small patch fixes this issue by returning immediately.
mfc_parent of cache entries is used to index into the vif_table and is
initialised from mfcctl->mfcc_parent. This can take values of to 2^16-1,
while the vif_table has only MAXVIFS (32) entries. The same problem
affects ip6mr.
Refuse invalid values to fix a potential out-of-bounds access. Unlike
the other validity checks, this is checked in ipmr_mfc_add() instead of
the setsockopt handler since its unused in the delete path and might be
uninitialized.
Greg Rose [Fri, 19 Mar 2010 02:59:52 +0000 (02:59 +0000)]
ixgbevf: Fix VF Stats accounting after reset
The counters in the 82599 Virtual Function are not clear on read. They
accumulate to the maximum value and then roll over. They are also not
cleared when the VF executes a soft reset, so it is possible they are
non-zero when the driver loads and starts. This has all been accounted
for in the code that keeps the stats up to date but there is one case
that is not. When the PF driver is reset the counters in the VF are
all reset to zero. This adds an additional accounting overhead into
the VF driver when the PF is reset under its feet. This patch adds
additional counters that are used by the VF driver to accumulate and
save stats after a PF reset has been detected. Prior to this patch
displaying the stats in the VF after the PF has reset would show
bogus data.
Vasu Dev [Fri, 19 Mar 2010 04:33:10 +0000 (04:33 +0000)]
ixgbe: fix for real_num_tx_queues update issue
Currently netdev_features_change is called before fcoe tx queues
setup is done, so this patch moves calling of netdev_features_change
after tx queues setup is done in ixgbe_init_interrupt_scheme, so
that real_num_tx_queues is updated correctly on each fcoe enable
or disable.
This allows additional fcoe queues updated correctly in vlan driver
for their correct queue selection.
Timo Teräs [Thu, 18 Mar 2010 23:20:20 +0000 (23:20 +0000)]
ipv4: check rt_genid in dst_check
Xfrm_dst keeps a reference to ipv4 rtable entries on each
cached bundle. The only way to renew xfrm_dst when the underlying
route has changed, is to implement dst_check for this. This is
what ipv6 side does too.
The problems started after 87c1e12b5eeb7b30b4b41291bef8e0b41fc3dde9
("ipsec: Fix bogus bundle flowi") which fixed a bug causing xfrm_dst
to not get reused, until that all lookups always generated new
xfrm_dst with new route reference and path mtu worked. But after the
fix, the old routes started to get reused even after they were expired
causing pmtu to break (well it would occationally work if the rtable
gc had run recently and marked the route obsolete causing dst_check to
get called).
* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
serial: sh-sci: remove duplicated #include
sh: Export uncached helper symbols.
sh: Fix up NUMA build for 29-bit.
serial: sh-sci: Fix build failure for non-sh architectures.
sh: Fix up uncached offset for legacy 29-bit mode.
sh: Support CPU affinity masks for INTC controllers.
Linus Torvalds [Fri, 19 Mar 2010 20:49:29 +0000 (13:49 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6:
alpha: fix compile errors in dma-mapping-common.h
alpha: remove trailing spaces in messages
alpha: use __ratelimit
Linus Torvalds [Fri, 19 Mar 2010 20:42:43 +0000 (13:42 -0700)]
Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc: Remove IOMMU_VMERGE config option
powerpc: Fix swiotlb to respect the boot option
powerpc: Do not call prink when CONFIG_PRINTK is not defined
powerpc: Use correct ccr bit for syscall error status
powerpc/fsl-booke: Get coherent bit from PTE
powerpc/85xx: Make sure lwarx hint isn't set on ppc32
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
tty_port,usb-console: Fix usb serial console open/close regression
tty: cpm_uart: use resource_size()
tty_buffer: Fix distinct type warning
hvc_console: Fix race between hvc_close and hvc_remove
uartlite: Fix build on sparc.
tty: Take a 256 byte padding into account when buffering below sub-page units
Revert "tty: Add a new VT mode which is like VT_PROCESS but doesn't require a VT_RELDISP ioctl call"
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6:
driver core: numa: fix BUILD_BUG_ON for node_read_distance
driver-core: document ERR_PTR() return values
kobject: documentation: Update to refer to kset-example.c.
sysdev: the cpu probe/release attributes should be sysdev_class_attributes
kobject: documentation: Fix erroneous example in kobject doc.
driver-core: fix missing kernel-doc in firmware_class
Driver core: Early platform kernel-doc update
sysfs: fix sysfs lockdep warning in mlx4 code
sysfs: fix sysfs lockdep warning in infiniband code
sysfs: fix sysfs lockdep warning in ipmi code
sysfs: Initialised pci bus legacy_mem field before use
sysfs: use sysfs_bin_attr_init in firmware class driver
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (45 commits)
USB: gadget/multi: cdc_do_config: remove redundant check
usb: r8a66597-hcd: fix removed from an attached hub
USB: xhci: Make endpoint interval debugging clearer.
USB: Fix usb_fill_int_urb for SuperSpeed devices
USB: cp210x: Remove double usb_control_msg from cp210x_set_config
USB: Remove last bit of CONFIG_USB_BERRY_CHARGE
USB: gadget: add gadget controller number for s3c-hsotg driver
USB: ftdi_sio: Fix locking for change_speed() function
USB: g_mass_storage: fixed module name in Kconfig
USB: gadget: f_mass_storage::fsg_bind(): fix error handling
USB: g_mass_storage: fix section mismatch warnings
USB: gadget: fix Blackfin builds after gadget cleansing
USB: goku_udc: remove potential null dereference
USB: option.c: Add Pirelli VID/PID and indicate Pirelli's modem interface is 0xff
USB: serial: Fix module name typo for qcaux Kconfig entry.
usb: cdc-wdm: Fix deadlock between write and resume
usb: cdc-wdm: Fix order in disconnect and fix locking
usb: cdc-wdm:Fix loss of data due to autosuspend
usb: cdc-wdm: Fix submission of URB after suspension
usb: cdc-wdm: Fix race between disconnect and debug messages
...
Linus Torvalds [Fri, 19 Mar 2010 16:43:06 +0000 (09:43 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: (205 commits)
ceph: update for write_inode API change
ceph: reset osd after relevant messages timed out
ceph: fix flush_dirty_caps race with caps migration
ceph: include migrating caps in issued set
ceph: fix osdmap decoding when pools include (removed) snaps
ceph: return EBADF if waiting for caps on closed file
ceph: set osd request message front length correctly
ceph: reset front len on return to msgpool; BUG on mismatched front iov
ceph: fix snaptrace decoding on cap migration between mds
ceph: use single osd op reply msg
ceph: reset bits on connection close
ceph: remove bogus mds forward warning
ceph: remove fragile __map_osds optimization
ceph: fix connection fault STANDBY check
ceph: invalidate_authorizer without con->mutex held
ceph: don't clobber write return value when using O_SYNC
ceph: fix client_request_forward decoding
ceph: drop messages on unregistered mds sessions; cleanup
ceph: fix comments, locking in destroy_inode
ceph: move dereference after NULL test
...
Fix trivial conflicts in Documentation/ioctl/ioctl-number.txt
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
cifs: trivial white space
[CIFS] checkpatch cleanup
cifs: add cifs_revalidate_file
cifs: add a CIFSSMBUnixQFileInfo function
cifs: add a CIFSSMBQFileInfo function
cifs: overhaul cifs_revalidate and rename to cifs_revalidate_dentry
Sarah Sharp [Tue, 16 Mar 2010 19:59:24 +0000 (12:59 -0700)]
USB: xhci: Make endpoint interval debugging clearer.
The xHCI hardware can only handle polling intervals that are a power of
two. When we add a new endpoint during a bandwidth allocation, and the
polling interval is rounded down to a power of two, print the original
polling interval in the endpoint descriptor.
Matthew Wilcox [Tue, 16 Mar 2010 19:55:44 +0000 (12:55 -0700)]
USB: Fix usb_fill_int_urb for SuperSpeed devices
USB 3 and Wireless USB specify a logarithmic encoding of the endpoint
interval that matches the USB 2 specification. usb_fill_int_urb() didn't
know that and was filling in the interval as if it was USB 1.1. Fix
usb_fill_int_urb() for SuperSpeed devices, but leave the wireless case
alone, because David Vrabel wants to keep the old encoding.
Update the struct urb kernel doc to note that SuperSpeed URBs must have
urb->interval specified in microframes.
Add a missing break statement in the usb_submit_urb() interrupt URB
checking, since wireless USB and SuperSpeed USB encode urb->interval
differently. This allows xHCI roothubs to actually register with khubd.
Michael Brunner [Wed, 10 Mar 2010 22:26:37 +0000 (23:26 +0100)]
USB: cp210x: Remove double usb_control_msg from cp210x_set_config
This patch removes a double usb_control_msg that sets the cp210x
configuration registers a second time when calling cp210x_set_config.
For data sizes >2 the second write gets corrupted.
The patch has been created against 2.6.34-rc1, but all cp210x driver
revisions are affected.
Contrary to the comment in fsg_add, fsg_bind calls fsg_unbind on errors,
which decreases refcount and frees the fsg_dev structure, causing trouble
when fsg_add does the same.
The recent commit (0e530b45783f75) that moved usb_ep_autoconfig from the
__devinit section to the __init section missed the mass storage device.
Its fsg_bind() function uses the usb_ep_autoconfig() function from non
__init context leading to:
WARNING: drivers/usb/gadget/g_mass_storage.o(.text): Section mismatch in
reference from the function _fsg_bind()
to the function .init.text:_usb_ep_autoconfig()
Mike Frysinger [Tue, 9 Mar 2010 05:35:22 +0000 (00:35 -0500)]
USB: gadget: fix Blackfin builds after gadget cleansing
The recent change to clean out dead gadget drivers (90f7976880bbbf99)
missed the call to gadget_is_musbhsfc() behind CONFIG_BLACKFIN. This
causes Blackfin gadget builds to fail since the function no longer
exists anywhere.
Mike Frysinger [Fri, 12 Mar 2010 08:27:23 +0000 (10:27 +0200)]
USB: musb: fix warnings in Blackfin regs
The recent commit "usb: musb: Add context save and restore support" added
some stubs for the Blackfin code so things would compile, but it also
added a bunch of warnings due to missing return statements.
Mike Frysinger [Fri, 12 Mar 2010 08:27:21 +0000 (10:27 +0200)]
usb: musb: abstract out ULPI_BUSCONTROL register reads/writes
The USB PHY on current Blackfin processors is a UTMI+ level 2 PHY.
However, it has no ULPI support - so there are no registers at all.
That means accesses to ULPI_BUSCONTROL have to be abstracted away
like other MUSB registers.
Tony Lindgren [Fri, 12 Mar 2010 08:35:20 +0000 (10:35 +0200)]
usb: musb: Fix compile error for omaps for musb_hdrc
CONFIG_ARCH_OMAP34XX is now CONFIG_ARCH_OMAP3.
But since drivers/usb/musb/omap2430.c use CONFIG_PM for these
registers and functions, do the same for the header.
Otherwise we get the following for most omap3 defconfigs:
drivers/usb/musb/omap2430.c:261: error: expected identifier or '(' before 'do'
drivers/usb/musb/omap2430.c:261: error: expected identifier or '(' before 'while'
drivers/usb/musb/omap2430.c:268: error: expected identifier or '(' before 'do'
drivers/usb/musb/omap2430.c:268: error: expected identifier or '(' before 'while'
Andiry Xu [Fri, 12 Mar 2010 09:10:04 +0000 (17:10 +0800)]
USB: xHCI: re-initialize cmd_completion
When a signal interrupts a Configure Endpoint command, the cmd_completion used
in xhci_configure_endpoint() is not re-initialized and the
wait_for_completion_interruptible_timeout() will return failure. Initialize
cmd_completion in xhci_configure_endpoint().
Sonic Zhang [Mon, 8 Mar 2010 16:26:01 +0000 (11:26 -0500)]
USB: musb: fix build error introduced by isoc change
The recent commit "usb: musb: Fix for isochronous IN transfer" (f82a689fa)
seems to have been against an older kernel version. It uses the old style
naming of variables. Unfortunately, this breaks building for most MUSB
users out there since "bDesiredMode" has been renamed to "desired_mode".
Clemens Ladisch [Mon, 1 Mar 2010 16:18:56 +0000 (17:18 +0100)]
USB: EHCI: adjust ehci_iso_stream for changes in ehci_qh
The EHCI driver stores in usb_host_endpoint.hcpriv a pointer to either
an ehci_qh or an ehci_iso_stream structure, and uses the contents of the
hw_info1 field to distinguish the two cases.
After ehci_qh was split into hw and sw parts, ehci_iso_stream must also
be adjusted so that it again looks like an ehci_qh structure.
This fixes a NULL pointer access in ehci_endpoint_disable() when it
tries to access qh->hw->hw_info1.
Clemens Ladisch [Mon, 1 Mar 2010 08:12:50 +0000 (09:12 +0100)]
USB: EHCI: fix ITD list order
When isochronous URBs are shorter than one frame and when more than one
ITD in a frame has been completed before the interrupt can be handled,
scan_periodic() completes the URBs in the order in which they are found
in the descriptor list. Therefore, the descriptor list must contain the
ITDs in the correct order, i.e., a new ITD must be linked in after any
previous ITDs of the same endpoint.
This should fix garbled capture data in the USB audio drivers.
Johan Hovold [Sat, 27 Feb 2010 15:24:49 +0000 (16:24 +0100)]
USB: serial: use port endpoint size to determine if ep is available
It is possible to have a multi-port device with a port lacking an in or
out bulk endpoint. Only checking for num_bulk_in or num_bulk_out is thus not
sufficient to determine whether a specific port has an in or out bulk
endpoint.
This fixes potential null pointer dereferences in the generic open and
write routines, as well as access to uninitialised fifo in write_room
and chars_in_buffer.
Also let write fail with ENODEV (instead of 0) on missing out endpoint
(also on zero-length writes).
Alan Stern [Sat, 6 Mar 2010 20:04:03 +0000 (15:04 -0500)]
USB: fix usbfs regression
This patch (as1352) fixes a bug in the way isochronous input data is
returned to userspace for usbfs transfers. The entire buffer must be
copied, not just the first actual_length bytes, because the individual
packets will be discontiguous if any of them are short.
Jason Wessel [Tue, 9 Mar 2010 03:50:11 +0000 (21:50 -0600)]
tty_port,usb-console: Fix usb serial console open/close regression
Commit e1108a63e10d344284011cccc06328b2cd3e5da3 ("usb_serial: Use the
shutdown() operation") breaks the ability to use a usb console
starting in 2.6.33. This was observed when using
console=ttyUSB0,115200 as a boot argument with an FTDI device. The
error is:
The handling of the ASYNCB_INITIALIZED changed in 2.6.32 such that in
tty_port_shutdown() it always clears the flag if it is set. The fix
is to add a variable to the tty_port struct to indicate when the tty
port is a console.
Fang Wenqi [Tue, 9 Mar 2010 10:54:28 +0000 (18:54 +0800)]
tty_buffer: Fix distinct type warning
CC drivers/char/tty_buffer.o
drivers/char/tty_buffer.c: In function ‘tty_insert_flip_string_fixed_flag’:
drivers/char/tty_buffer.c:251: warning: comparison of distinct pointer types lacks a cast
drivers/char/tty_buffer.c: In function ‘tty_insert_flip_string_flags’:
drivers/char/tty_buffer.c:288: warning: comparison of distinct pointer types lacks a cast
Fix it by replacing min() with min_t() in tty_insert_flip_string_flags and
tty_insert_flip_string_fixed_flag().
Amit Shah [Fri, 12 Mar 2010 06:23:15 +0000 (11:53 +0530)]
hvc_console: Fix race between hvc_close and hvc_remove
Alan pointed out a race in the code where hvc_remove is invoked. The
recent virtio_console work is the first user of hvc_remove().
Alan describes it thus:
The hvc_console assumes that a close and remove call can't occur at the
same time.
In addition tty_hangup(tty) is problematic as tty_hangup is asynchronous
itself....
So this can happen
hvc_close hvc_remove
hung up ? - no
lock
tty = hp->tty
unlock
lock
hp->tty = NULL
unlock
notify del
kref_put the hvc struct
close completes
tty is destroyed
tty_hangup dead tty
tty->ops will be NULL
NULL->...
This patch adds some tty krefs and also converts to using tty_vhangup().
Mel Gorman [Tue, 2 Mar 2010 22:24:19 +0000 (22:24 +0000)]
tty: Take a 256 byte padding into account when buffering below sub-page units
The TTY layer takes some care to ensure that only sub-page allocations
are made with interrupts disabled. It does this by setting a goal of
"TTY_BUFFER_PAGE" to allocate. Unfortunately, while TTY_BUFFER_PAGE takes the
size of tty_buffer into account, it fails to account that tty_buffer_find()
rounds the buffer size out to the next 256 byte boundary before adding on
the size of the tty_buffer.
This patch adjusts the TTY_BUFFER_PAGE calculation to take into account the
size of the tty_buffer and the padding. Once applied, tty_buffer_alloc()
should not require high-order allocations.
Ari writes as the reason this should be reverted:
The problems with this patch include:
1. There's at least one subtlety I overlooked - switching
between X servers (i.e. from one X VT to another) still requires
the cooperation of both X servers. I was assuming that KMS
eliminated this.
2. It hasn't been tested at all (no X server patch exists which
uses the new mode).
As he was the original author of the patch, I'll revert it.
Stephen Rothwell [Mon, 15 Mar 2010 23:33:32 +0000 (10:33 +1100)]
sysdev: the cpu probe/release attributes should be sysdev_class_attributes
This fixes these warnings:
drivers/base/cpu.c:264: warning: initialization from incompatible pointer type
drivers/base/cpu.c:265: warning: initialization from incompatible pointer type
This fixes a sysfs lockdep warning in the ipmi code.
Thanks to Eric Biederman and Yinghai Lu for the original versions of the
patch, unfortunatly they did not submit them in a form they could be
applied in.
Mel Gorman [Wed, 10 Mar 2010 22:48:34 +0000 (22:48 +0000)]
sysfs: Initialised pci bus legacy_mem field before use
PPC64 is failing to boot the latest mmotm due to an uninitialised pointer in
pci_create_legacy_files(). The surprise is that machines boot at all and it
would appear to affect current mainline as well. This patch fixes the problem.
FUJITA Tomonori [Tue, 2 Mar 2010 14:25:38 +0000 (14:25 +0000)]
powerpc: Remove IOMMU_VMERGE config option
The description says:
Cause IO segments sent to a device for DMA to be merged virtually
by the IOMMU when they happen to have been allocated contiguously.
This doesn't add pressure to the IOMMU allocator. However, some
drivers don't support getting large merged segments coming back
from *_map_sg().
Most drivers don't have this problem; it is safe to say Y here.
It's out of date. Long ago, drivers didn't have a way to tell IOMMUs
about their segment length limit (that is, the maximum segment length
that they can handle). So IOMMUs merged as many segments as possible
and gave too large segments to drivers.
dma_get_max_seg_size() was introduced to solve the above
problem. Device drives can use the API to tell IOMMU about the maximum
segment length that they can handle. In addition, the default limit
(64K) should be safe for everyone.
So this config option seems to be unnecessary.
Note that this config option just enables users to disable the virtual
merging by default. Users can still disable the virtual merging by the
boot parameter.
FUJITA Tomonori [Tue, 16 Mar 2010 13:16:25 +0000 (13:16 +0000)]
powerpc: Fix swiotlb to respect the boot option
powerpc initializes swiotlb before parsing the kernel boot options so
swiotlb options (e.g. specifying the swiotlb buffer size) are ignored.
Any time before freeing bootmem works for swiotlb so this patch moves
powerpc's swiotlb initialization after parsing the kernel boot
options, mem_init (as x86 does).
Márton Németh [Sat, 6 Mar 2010 22:43:55 +0000 (22:43 +0000)]
powerpc: Do not call prink when CONFIG_PRINTK is not defined
When printk() is disabled (CONFIG_PRINTK) at menu item
General setup
-> Configure standard kernel features (for small systems)
-> Enable support for printk
then there should be no printk() calls at all.
Nathan Lynch [Fri, 12 Mar 2010 13:16:02 +0000 (13:16 +0000)]
powerpc: Use correct ccr bit for syscall error status
The powerpc implementations of syscall_get_error and
syscall_set_return_value should use CCR0:S0 (0x10000000) for testing
and setting syscall error status. Fortunately these APIs don't seem
to be used at the moment.
smsc95xx: Fix tx checksum offload for small packets
TX checksum offload does not work properly when transmitting
UDP packets with 0, 1 or 2 bytes of data. This patch works
around the problem by calculating checksums for these packets
in the driver.
projects / linux.git / log