Michael Kerrisk [Fri, 10 Sep 2010 20:26:56 +0000 (20:26 +0000)]
ipv4: enable getsockopt() for IP_NODEFRAG
While integrating your man-pages patch for IP_NODEFRAG, I noticed
that this option is settable by setsockopt(), but not gettable by
getsockopt(). I suppose this is not intended. The (untested,
trivial) patch below adds getsockopt() support.
Signed-off-by: Michael kerrisk <mtk.manpages@gmail.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Bob Arendt [Mon, 13 Sep 2010 19:56:03 +0000 (12:56 -0700)]
ipv4: force_igmp_version ignored when a IGMPv3 query received
After all these years, it turns out that the
/proc/sys/net/ipv4/conf/*/force_igmp_version
parameter isn't fully implemented.
*Symptom*:
When set force_igmp_version to a value of 2, the kernel should only perform
multicast IGMPv2 operations (IETF rfc2236). An host-initiated Join message
will be sent as a IGMPv2 Join message. But if a IGMPv3 query message is
received, the host responds with a IGMPv3 join message. Per rfc3376 and
rfc2236, a IGMPv2 host should treat a IGMPv3 query as a IGMPv2 query and
respond with an IGMPv2 Join message.
*Consequences*:
This is an issue when a IGMPv3 capable switch is the querier and will only
issue IGMPv3 queries (which double as IGMPv2 querys) and there's an
intermediate switch that is only IGMPv2 capable. The intermediate switch
processes the initial v2 Join, but fails to recognize the IGMPv3 Join responses
to the Query, resulting in a dropped connection when the intermediate v2-only
switch times it out.
*Identifying issue in the kernel source*:
The issue is in this section of code (in net/ipv4/igmp.c), which is called when
an IGMP query is received (from mainline 2.6.36-rc3 gitweb):
...
A IGMPv3 query has a length >= 12 and no sources. This routine will exit after
line 880, setting the general query timer (random timeout between 0 and query
response time). This calls igmp_gq_timer_expire():
...
.. which only sends a v3 response. So if a v3 query is received, the kernel
always sends a v3 response.
IGMP queries happen once every 60 sec (per vlan), so the traffic is low. A
IGMPv3 query *is* a strict superset of a IGMPv2 query, so this patch properly
short circuit's the v3 behaviour.
One issue is that this does not address force_igmp_version=1. Then again, I've
never seen any IGMPv1 multicast equipment in the wild. However there is a lot
of v2-only equipment. If it's necessary to support the IGMPv1 case as well:
837 if (len == 8 || IGMP_V2_SEEN(in_dev) || IGMP_V1_SEEN(in_dev)) {
Signed-off-by: David S. Miller <davem@davemloft.net>
Dan Carpenter [Fri, 10 Sep 2010 01:58:10 +0000 (01:58 +0000)]
ppp: potential NULL dereference in ppp_mp_explode()
Smatch complains because we check whether "pch->chan" is NULL and then
dereference it unconditionally on the next line. Partly the reason this
bug was introduced is because code was too complicated. I've simplified
it a little.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dan Carpenter [Fri, 10 Sep 2010 01:56:16 +0000 (01:56 +0000)]
net/llc: make opt unsigned in llc_ui_setsockopt()
The members of struct llc_sock are unsigned so if we pass a negative
value for "opt" it can cause a sign bug. Also it can cause an integer
overflow when we multiply "opt * HZ".
CC: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Sun, 12 Sep 2010 18:56:44 +0000 (11:56 -0700)]
sch_atm: Fix potential NULL deref.
The list_head conversion unearther an unnecessary flow
check. Since flow is always NULL here we don't need to
see if a matching flow exists already.
Reported-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Fri, 10 Sep 2010 04:59:51 +0000 (21:59 -0700)]
Merge branch 'vhost-net' of git://git./linux/kernel/git/mst/vhost
Dan Williams [Wed, 8 Sep 2010 07:50:47 +0000 (07:50 +0000)]
ipheth: remove incorrect devtype to WWAN
The 'wwan' devtype is meant for devices that require preconfiguration
and *every* time setup before the ethernet interface can be used, like
cellular modems which require a series of setup commands on serial ports
or other mechanisms before the ethernet interface will handle packets.
As ipheth only requires one-per-hotplug pairing setup with no
preconfiguration (like APN, phone #, etc) and the network interface is
usable at any time after that initial setup, remove the incorrect
devtype wwan.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Joe Perches [Tue, 7 Sep 2010 20:33:24 +0000 (20:33 +0000)]
MAINTAINERS: Add CAIF
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Joe Perches [Wed, 8 Sep 2010 11:04:21 +0000 (11:04 +0000)]
sctp: fix test for end of loop
Add a list_has_sctp_addr function to simplify loop
Based on a patches by Dan Carpenter and David Miller
Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Thu, 9 Sep 2010 06:49:04 +0000 (23:49 -0700)]
Merge branch 'master' of /linux/kernel/git/torvalds/linux-2.6
Eric Dumazet [Wed, 8 Sep 2010 13:26:55 +0000 (13:26 +0000)]
KS8851: Correct RX packet allocation
Use netdev_alloc_skb_ip_align() helper and do correct allocation
Tested-by: Abraham Arce <x0066660@ti.com>
Signed-off-by: Abraham Arce <x0066660@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Wed, 8 Sep 2010 05:08:44 +0000 (05:08 +0000)]
udp: add rehash on connect()
commit
30fff923 introduced in linux-2.6.33 (udp: bind() optimisation)
added a secondary hash on UDP, hashed on (local addr, local port).
Problem is that following sequence :
fd = socket(...)
connect(fd, &remote, ...)
not only selects remote end point (address and port), but also sets
local address, while UDP stack stored in secondary hash table the socket
while its local address was INADDR_ANY (or ipv6 equivalent)
Sequence is :
- autobind() : choose a random local port, insert socket in hash tables
[while local address is INADDR_ANY]
- connect() : set remote address and port, change local address to IP
given by a route lookup.
When an incoming UDP frame comes, if more than 10 sockets are found in
primary hash table, we switch to secondary table, and fail to find
socket because its local address changed.
One solution to this problem is to rehash datagram socket if needed.
We add a new rehash(struct socket *) method in "struct proto", and
implement this method for UDP v4 & v6, using a common helper.
This rehashing only takes care of secondary hash table, since primary
hash (based on local port only) is not changed.
Reported-by: Krzysztof Piotr Oledzki <ole@ans.pl>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Krzysztof Piotr Oledzki <ole@ans.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jianzhao Wang [Wed, 8 Sep 2010 21:35:43 +0000 (14:35 -0700)]
net: blackhole route should always be recalculated
Blackhole routes are used when xfrm_lookup() returns -EREMOTE (error
triggered by IKE for example), hence this kind of route is always
temporary and so we should check if a better route exists for next
packets.
Bug has been introduced by commit
d11a4dc18bf41719c9f0d7ed494d295dd2973b92.
Signed-off-by: Jianzhao Wang <jianzhao.wang@6wind.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jarek Poplawski [Tue, 7 Sep 2010 07:51:17 +0000 (07:51 +0000)]
ipv4: Suppress lockdep-RCU false positive in FIB trie (3)
Hi,
Here is one more of these warnings and a patch below:
Sep 5 23:52:33 del kernel: [46044.244833] ===================================================
Sep 5 23:52:33 del kernel: [46044.269681] [ INFO: suspicious rcu_dereference_check() usage. ]
Sep 5 23:52:33 del kernel: [46044.277000] ---------------------------------------------------
Sep 5 23:52:33 del kernel: [46044.285185] net/ipv4/fib_trie.c:1756 invoked rcu_dereference_check() without protection!
Sep 5 23:52:33 del kernel: [46044.293627]
Sep 5 23:52:33 del kernel: [46044.293632] other info that might help us debug this:
Sep 5 23:52:33 del kernel: [46044.293634]
Sep 5 23:52:33 del kernel: [46044.325333]
Sep 5 23:52:33 del kernel: [46044.325335] rcu_scheduler_active = 1, debug_locks = 0
Sep 5 23:52:33 del kernel: [46044.348013] 1 lock held by pppd/1717:
Sep 5 23:52:33 del kernel: [46044.357548] #0: (rtnl_mutex){+.+.+.}, at: [<
c125dc1f>] rtnl_lock+0xf/0x20
Sep 5 23:52:33 del kernel: [46044.367647]
Sep 5 23:52:33 del kernel: [46044.367652] stack backtrace:
Sep 5 23:52:33 del kernel: [46044.387429] Pid: 1717, comm: pppd Not tainted 2.6.35.4.4a #3
Sep 5 23:52:33 del kernel: [46044.398764] Call Trace:
Sep 5 23:52:33 del kernel: [46044.409596] [<
c12f9aba>] ? printk+0x18/0x1e
Sep 5 23:52:33 del kernel: [46044.420761] [<
c1053969>] lockdep_rcu_dereference+0xa9/0xb0
Sep 5 23:52:33 del kernel: [46044.432229] [<
c12b7235>] trie_firstleaf+0x65/0x70
Sep 5 23:52:33 del kernel: [46044.443941] [<
c12b74d4>] fib_table_flush+0x14/0x170
Sep 5 23:52:33 del kernel: [46044.455823] [<
c1033e92>] ? local_bh_enable_ip+0x62/0xd0
Sep 5 23:52:33 del kernel: [46044.467995] [<
c12fc39f>] ? _raw_spin_unlock_bh+0x2f/0x40
Sep 5 23:52:33 del kernel: [46044.480404] [<
c12b24d0>] ? fib_sync_down_dev+0x120/0x180
Sep 5 23:52:33 del kernel: [46044.493025] [<
c12b069d>] fib_flush+0x2d/0x60
Sep 5 23:52:33 del kernel: [46044.505796] [<
c12b06f5>] fib_disable_ip+0x25/0x50
Sep 5 23:52:33 del kernel: [46044.518772] [<
c12b10d3>] fib_netdev_event+0x73/0xd0
Sep 5 23:52:33 del kernel: [46044.531918] [<
c1048dfd>] notifier_call_chain+0x2d/0x70
Sep 5 23:52:33 del kernel: [46044.545358] [<
c1048f0a>] raw_notifier_call_chain+0x1a/0x20
Sep 5 23:52:33 del kernel: [46044.559092] [<
c124f687>] call_netdevice_notifiers+0x27/0x60
Sep 5 23:52:33 del kernel: [46044.573037] [<
c124faec>] __dev_notify_flags+0x5c/0x80
Sep 5 23:52:33 del kernel: [46044.586489] [<
c124fb47>] dev_change_flags+0x37/0x60
Sep 5 23:52:33 del kernel: [46044.599394] [<
c12a8a8d>] devinet_ioctl+0x54d/0x630
Sep 5 23:52:33 del kernel: [46044.612277] [<
c12aabb7>] inet_ioctl+0x97/0xc0
Sep 5 23:52:34 del kernel: [46044.625208] [<
c123f6af>] sock_ioctl+0x6f/0x270
Sep 5 23:52:34 del kernel: [46044.638046] [<
c109d2b0>] ? handle_mm_fault+0x420/0x6c0
Sep 5 23:52:34 del kernel: [46044.650968] [<
c123f640>] ? sock_ioctl+0x0/0x270
Sep 5 23:52:34 del kernel: [46044.663865] [<
c10c3188>] vfs_ioctl+0x28/0xa0
Sep 5 23:52:34 del kernel: [46044.676556] [<
c10c38fa>] do_vfs_ioctl+0x6a/0x5c0
Sep 5 23:52:34 del kernel: [46044.688989] [<
c1048676>] ? up_read+0x16/0x30
Sep 5 23:52:34 del kernel: [46044.701411] [<
c1021376>] ? do_page_fault+0x1d6/0x3a0
Sep 5 23:52:34 del kernel: [46044.714223] [<
c10b6588>] ? fget_light+0xf8/0x2f0
Sep 5 23:52:34 del kernel: [46044.726601] [<
c1241f98>] ? sys_socketcall+0x208/0x2c0
Sep 5 23:52:34 del kernel: [46044.739140] [<
c10c3eb3>] sys_ioctl+0x63/0x70
Sep 5 23:52:34 del kernel: [46044.751967] [<
c12fca3d>] syscall_call+0x7/0xb
Sep 5 23:52:34 del kernel: [46044.764734] [<
c12f0000>] ? cookie_v6_check+0x3d0/0x630
-------------->
This patch fixes the warning:
===================================================
[ INFO: suspicious rcu_dereference_check() usage. ]
---------------------------------------------------
net/ipv4/fib_trie.c:1756 invoked rcu_dereference_check() without protection!
other info that might help us debug this:
rcu_scheduler_active = 1, debug_locks = 0
1 lock held by pppd/1717:
#0: (rtnl_mutex){+.+.+.}, at: [<
c125dc1f>] rtnl_lock+0xf/0x20
stack backtrace:
Pid: 1717, comm: pppd Not tainted 2.6.35.4a #3
Call Trace:
[<
c12f9aba>] ? printk+0x18/0x1e
[<
c1053969>] lockdep_rcu_dereference+0xa9/0xb0
[<
c12b7235>] trie_firstleaf+0x65/0x70
[<
c12b74d4>] fib_table_flush+0x14/0x170
...
Allow trie_firstleaf() to be called either under rcu_read_lock()
protection or with RTNL held. The same annotation is added to
node_parent_rcu() to prevent a similar warning a bit later.
Followup of commits
634a4b20 and
4eaa0e3c.
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ben Hutchings [Tue, 7 Sep 2010 04:35:19 +0000 (04:35 +0000)]
niu: Fix kernel buffer overflow for ETHTOOL_GRXCLSRLALL
niu_get_ethtool_tcam_all() assumes that its output buffer is the right
size, and warns before returning if it is not. However, the output
buffer size is under user control and ETHTOOL_GRXCLSRLALL is an
unprivileged ethtool command. Therefore this is at least a local
denial-of-service vulnerability.
Change it to check before writing each entry and to return an error if
the buffer is already full.
Compile-tested only.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Julian Anastasov [Sun, 5 Sep 2010 18:02:29 +0000 (18:02 +0000)]
ipvs: fix active FTP
- Do not create expectation when forwarding the PORT
command to avoid blocking the connection. The problem is that
nf_conntrack_ftp.c:help() tries to create the same expectation later in
POST_ROUTING and drops the packet with "dropping packet" message after
failure in nf_ct_expect_related.
- Change ip_vs_update_conntrack to alter the conntrack
for related connections from real server. If we do not alter the reply in
this direction the next packet from client sent to vport 20 comes as NEW
connection. We alter it but may be some collision happens for both
conntracks and the second conntrack gets destroyed immediately. The
connection stucks too.
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jarek Poplawski [Sat, 4 Sep 2010 10:34:29 +0000 (10:34 +0000)]
gro: Re-fix different skb headrooms
The patch: "gro: fix different skb headrooms" in its part:
"2) allocate a minimal skb for head of frag_list" is buggy. The copied
skb has p->data set at the ip header at the moment, and skb_gro_offset
is the length of ip + tcp headers. So, after the change the length of
mac header is skipped. Later skb_set_mac_header() sets it into the
NET_SKB_PAD area (if it's long enough) and ip header is misaligned at
NET_SKB_PAD + NET_IP_ALIGN offset. There is no reason to assume the
original skb was wrongly allocated, so let's copy it as it was.
bugzilla : https://bugzilla.kernel.org/show_bug.cgi?id=16626
fixes commit:
3d3be4333fdf6faa080947b331a6a19bce1a4f57
Reported-by: Plamen Petrov <pvp-lsts@fs.uni-ruse.bg>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
CC: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Plamen Petrov <pvp-lsts@fs.uni-ruse.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Tue, 7 Sep 2010 23:00:17 +0000 (16:00 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jbarnes/pci-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
PCI: bus speed strings should be const
PCI hotplug: Fix build with CONFIG_ACPI unset
PCI: PCIe: Remove the port driver module exit routine
PCI: PCIe: Move PCIe PME code to the pcie directory
PCI: PCIe: Disable PCIe port services during port initialization
PCI: PCIe: Ask BIOS for control of all native services at once
ACPI/PCI: Negotiate _OSC control bits before requesting them
ACPI/PCI: Do not preserve _OSC control bits returned by a query
ACPI/PCI: Make acpi_pci_query_osc() return control bits
ACPI/PCI: Reorder checks in acpi_pci_osc_control_set()
PCI: PCIe: Introduce commad line switch for disabling port services
PCI: PCIe AER: Introduce pci_aer_available()
x86/PCI: only define pci_domain_nr if PCI and PCI_DOMAINS are set
PCI: provide stub pci_domain_nr function for !CONFIG_PCI configs
Linus Torvalds [Tue, 7 Sep 2010 22:44:28 +0000 (15:44 -0700)]
Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
* 'for-linus' of git://oss.sgi.com/xfs/xfs:
xfs: Make fiemap work with sparse files
xfs: prevent 32bit overflow in space reservation
xfs: Disallow 32bit project quota id
xfs: improve buffer cache hash scalability
Linus Torvalds [Tue, 7 Sep 2010 21:48:44 +0000 (14:48 -0700)]
Merge branch 'for-linus' of git://android./kernel/tegra
* 'for-linus' of git://android.kernel.org/kernel/tegra:
[ARM] tegra: Add ZRELADDR default for ARCH_TEGRA
Linus Torvalds [Tue, 7 Sep 2010 21:38:54 +0000 (14:38 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/mattst88/alpha-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6:
alpha: Fix printk format errors
alpha: convert perf_event to use local_t
Fix call to replaced SuperIO functions
alpha: remove homegrown L1_CACHE_ALIGN macro
Linus Torvalds [Tue, 7 Sep 2010 21:38:21 +0000 (14:38 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/ericvh/v9fs
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
9p: potential ERR_PTR() dereference
Linus Torvalds [Tue, 7 Sep 2010 21:37:34 +0000 (14:37 -0700)]
Merge branch 'for-linus' of git://neil.brown.name/md
* 'for-linus' of git://neil.brown.name/md:
md: resolve confusion of MD_CHANGE_CLEAN
md: don't clear MD_CHANGE_CLEAN in md_update_sb() for external arrays
Move .gitignore from drivers/md to lib/raid6
Linus Torvalds [Tue, 7 Sep 2010 21:35:16 +0000 (14:35 -0700)]
Merge git://git./linux/kernel/git/herbert/crypto-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
Revert "hwrng: n2-drv - remove casts from void*"
crypto: testmgr - Default to no tests
crypto: testmgr - Fix test disabling option
crypto: hash - Fix handling of small unaligned buffers
Linus Torvalds [Tue, 7 Sep 2010 21:34:37 +0000 (14:34 -0700)]
Merge branch 'merge' of git://git./linux/kernel/git/benh/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc/pseries: Correct rtas_data_buf locking in dlpar code
powerpc/85xx: Add P1021 PCI IDs and quirks
arch/powerpc/sysdev/qe_lib/qe.c: Add of_node_put to avoid memory leak
arch/powerpc/platforms/83xx/mpc837x_mds.c: Add missing iounmap
fsl_rio: fix compile errors
powerpc/85xx: Fix compile issue with p1022_ds due to lmb rename to memblock
powerpc/85xx: Fix compilation of mpc85xx_mds.c
powerpc: Don't use kernel stack with translation off
powerpc/perf_event: Reduce latency of calling perf_event_do_pending
powerpc/kexec: Adds correct calling convention for kexec purgatory
Linus Torvalds [Tue, 7 Sep 2010 21:08:37 +0000 (14:08 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/tj/percpu
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu:
percpu: fix a mismatch between code and comment
percpu: fix a memory leak in pcpu_extend_area_map()
percpu: add __percpu notations to UP allocator
percpu: handle __percpu notations in UP accessors
Linus Torvalds [Tue, 7 Sep 2010 21:08:17 +0000 (14:08 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/tj/wq
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
workqueue: use zalloc_cpumask_var() for gcwq->mayday_mask
workqueue: fix GCWQ_DISASSOCIATED initialization
workqueue: Add a workqueue chapter to the tracepoint docbook
workqueue: fix cwq->nr_active underflow
workqueue: improve destroy_workqueue() debuggability
workqueue: mark lock acquisition on worker_maybe_bind_and_lock()
workqueue: annotate lock context change
workqueue: free rescuer on destroy_workqueue
Linus Torvalds [Tue, 7 Sep 2010 21:06:10 +0000 (14:06 -0700)]
Merge git://git./linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (26 commits)
pkt_sched: Fix lockdep warning on est_tree_lock in gen_estimator
ipvs: avoid oops for passive FTP
Revert "sky2: don't do GRO on second port"
gro: fix different skb headrooms
bridge: Clear INET control block of SKBs passed into ip_fragment().
3c59x: Remove incorrect locking; correct documented lock hierarchy
sky2: don't do GRO on second port
ipv4: minor fix about RPF in help of Kconfig
xfrm_user: avoid a warning with some compiler
net/sched/sch_hfsc.c: initialize parent's cl_cfmin properly in init_vf()
pxa168_eth: fix a mdiobus leak
net sched: fix kernel leak in act_police
vhost: stop worker only if created
MAINTAINERS: Add ehea driver as Supported
ath9k_hw: fix parsing of HT40 5 GHz CTLs
ath9k_hw: Fix EEPROM uncompress block reading on AR9003
wireless: register wiphy rfkill w/o holding cfg80211_mutex
netlink: Make NETLINK_USERSOCK work again.
irda: Correctly clean up self->ias_obj on irda_bind() failure.
wireless extensions: fix kernel heap content leak
...
Linus Torvalds [Tue, 7 Sep 2010 21:05:22 +0000 (14:05 -0700)]
Merge git://git./linux/kernel/git/gregkh/staging-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6:
Staging: wlan-ng: Explicitly set some fields in cfg80211 interface
Staging: octeon: depends on NETDEVICES
Staging: spectra: depend on X86_MRST
Staging: zram: free device memory when init fails
Staging: rt2870sta: Add more device IDs from vendor drivers
staging: comedi das08_cs.c: Fix io_req_t conversion
staging: spectra needs <linux/slab.h>
staging: hv: Fixed lockup problem with bounce_buffer scatter list
staging: hv: Increased storvsc ringbuffer and max_io_requests
staging: hv: Fixed the value of the 64bit-hole inside ring buffer
staging: hv: Fixed bounce kmap problem by using correct index
staging: hv: Fix missing functions for net_device_ops
Linus Torvalds [Tue, 7 Sep 2010 21:04:59 +0000 (14:04 -0700)]
Merge git://git./linux/kernel/git/gregkh/driver-core-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6:
sysfs: checking for NULL instead of ERR_PTR
Linus Torvalds [Tue, 7 Sep 2010 21:04:34 +0000 (14:04 -0700)]
Merge git://git./linux/kernel/git/gregkh/usb-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
USB: ftdi_sio: Added custom PIDs for ChamSys products
USB: cdc-acm: Fixing crash when ACM probing interfaces with no endpoint descriptors.
USB: cdc-acm: Add pseudo modem without AT command capabilities
USB: cxacru: Use a bulk/int URB to access the command endpoint
usb: serial: mos7840: Add USB IDs to support more B&B USB/RS485 converters.
USB: cdc-acm: Adding second ACM channel support for various Nokia and one Samsung phones
usb: serial: mos7840: Add USB ID to support the B&B Electronics USOPTL4-2P.
USB: ssu100: turn off debug flag
usb: allow drivers to use allocated bandwidth until unbound
USB: cp210x usb driver: add USB_DEVICE for Pirelli DP-L10 mobile.
USB: cp210x: Add B&G H3000 link cable ID
USB: CP210x Add new device ID
USB: option: fix incorrect novatel entries
USB: Fix kernel oops with g_ether and Windows
USB: rndis: section mismatch fix
USB: ehci-ppc-of: problems in unwind
USB: s3c-hsotg: Remove DEBUG define
Linus Torvalds [Tue, 7 Sep 2010 21:04:09 +0000 (14:04 -0700)]
Merge git://git./linux/kernel/git/gregkh/tty-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
tty: fix tty_line must not be equal to number of allocated tty pointers in tty driver
serial: bfin_sport_uart: restore transmit frame sync fix
serial: fix port type conflict between NS16550A & U6_16550A
MAINTAINERS: orphan isicom
vt: Fix console corruption on driver hand-over.
Linus Torvalds [Tue, 7 Sep 2010 21:02:09 +0000 (14:02 -0700)]
Merge branch 'linux-next' of git://git.infradead.org/ubi-2.6
* 'linux-next' of git://git.infradead.org/ubi-2.6:
UBI: do not oops when erroneous PEB is scheduled for scrubbing
UBI: fix kconfig unmet dependency
UBI: fix forward compatibility
UBI: eliminate update of list_for_each_entry loop cursor
Linus Torvalds [Tue, 7 Sep 2010 21:01:50 +0000 (14:01 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/ryusuke/nilfs2
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2:
nilfs2: fix leak of shadow dat inode in error path of load_nilfs
Linus Torvalds [Tue, 7 Sep 2010 21:00:43 +0000 (14:00 -0700)]
Merge branch 'drm-intel-fixes' of git://anongit.freedesktop.org/~ickle/drm-intel
* 'drm-intel-fixes' of git://anongit.freedesktop.org/~ickle/drm-intel: (25 commits)
intel_agp,i915: Add more sandybridge graphics device ids
drm/i915: Enable MI_FLUSH on Sandybridge
agp/intel: Fix cache control for Sandybridge
agp/intel: use #ifdef idiom for intel-agp.h
agp/intel: fix physical address mask bits for sandybridge
drm/i915: Prevent double dpms on
drm/i915: Avoid use of uninitialised values when disabling panel-fitter
drm/i915: Avoid pageflipping freeze when we miss the flip prepare interrupt
drm/i915: Tightly scope intel_encoder to prevent invalid use
drm/i915: Allocate the PCI resource for the MCHBAR
drm/i915/dp: Really try 5 times before giving up.
drm/i915/sdvo: Restore guess of the DDC bus in absence of VBIOS
drm/i915/dp: Boost timeout for enabling transcoder to 100ms
drm/i915: Re-use set_base_atomic to share setting of the display registers
drm/i915: Fix offset page-flips on i965+
drm/i915: Include a generation number in the device info
i915: return -EFAULT if copy_to_user fails
i915: return -EFAULT if copy_to_user fails
agp/intel: Promote warning about failure to setup flush to error.
drm/i915: overlay on gen2 can't address above 1G
...
Linus Torvalds [Tue, 7 Sep 2010 20:59:49 +0000 (13:59 -0700)]
Merge branch 'drm-fixes' of git://git./linux/kernel/git/airlied/drm-2.6
* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
drm: Do not force 1024x768 modes on unknown connectors
drm/kms: Add a module parameter to disable polling
drm/radeon/kms: fix tv-out on avivo asics
drm/radeon/kms/evergreen: fix gpu hangs in userspace accel code
drm/nv50: initialize ramht_refs list for faked 0 channel
drm/nouveau: Don't take struct_mutex around the pushbuf IOCTL.
drm/nouveau: Take fence spinlock before reading the last sequence.
drm/radeon/kms/evergreen: work around bad data in some i2c tables
drm/radeon/kms: properly set crtc high base on r7xx
drm/radeon/kms: fix tv module parameter
drm/radeon/kms: force legacy pll algo for RV515 LVDS
drm/radeon/kms: remove useless clock code
drm/radeon/kms: fix a regression on r7xx AGP due to the HDP flush fix
drm/radeon/kms: use tracked values for sclk and mclk
David S. Miller [Tue, 7 Sep 2010 20:49:44 +0000 (13:49 -0700)]
via-velocity: Turn scatter-gather support back off.
It causes all kinds of DMA API debugging assertions and
all straight-forward attempts to fix it have failed.
So turn off SG, and we'll tackle making this work
properly in net-next-2.6
Reported-by: Dave Jones <davej@redhat.com>
Tested-by: Dave Jones <davej@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Tue, 7 Sep 2010 05:36:19 +0000 (22:36 -0700)]
ipv4: Fix reverse path filtering with multipath routing.
Actually iterate over the next-hops to make sure we have
a device match. Otherwise RP filtering is always elided
when the route matched has multiple next-hops.
Reported-by: Igor M Podlesny <for.poige@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Tetsuo Handa [Sat, 4 Sep 2010 01:34:28 +0000 (01:34 +0000)]
UNIX: Do not loop forever at unix_autobind().
We assumed that unix_autobind() never fails if kzalloc() succeeded.
But unix_autobind() allows only
1048576 names. If /proc/sys/fs/file-max is
larger than
1048576 (e.g. systems with more than 10GB of RAM), a local user can
consume all names using fork()/socket()/bind().
If all names are in use, those who call bind() with addr_len == sizeof(short)
or connect()/sendmsg() with setsockopt(SO_PASSCRED) will continue
while (1)
yield();
loop at unix_autobind() till a name becomes available.
This patch adds a loop counter in order to give up after
1048576 attempts.
Calling yield() for once per 256 attempts may not be sufficient when many names
are already in use, for __unix_find_socket_byname() can take long time under
such circumstance. Therefore, this patch also adds cond_resched() call.
Note that currently a local user can consume 2GB of kernel memory if the user
is allowed to create and autobind
1048576 UNIX domain sockets. We should
consider adding some restriction for autobind operation.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Mark Lord [Sat, 4 Sep 2010 14:17:59 +0000 (14:17 +0000)]
PATCH: b44 Handle RX FIFO overflow better (simplified)
This patch is a simplified version of the original patch from James Courtier-Dutton.
>From: James Courtier-Dutton
>Subject: [PATCH] Fix b44 RX FIFO overflow recovery.
>Date: Wednesday, June 30, 2010 - 1:11 pm
>
>This patch improves the recovery after a RX FIFO overflow on the b44
>Ethernet NIC.
>Before it would do a complete chip reset, resulting is loss of link
>for a few seconds.
>This patch improves this to do recovery in about 20ms without loss of link.
>
>Signed off by: James@superbug.co.uk
Signed-off-by: Mark Lord <mlord@pobox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dan Carpenter [Sat, 4 Sep 2010 03:14:35 +0000 (03:14 +0000)]
irda: off by one
This is an off by one. We would go past the end when we NUL terminate
the "value" string at end of the function. The "value" buffer is
allocated in irlan_client_parse_response() or
irlan_provider_parse_command().
CC: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ben Hutchings [Tue, 7 Sep 2010 01:28:56 +0000 (18:28 -0700)]
3c59x: Fix deadlock in vortex_error()
This fixes a bug introduced in commit
de847272149365363a6043a963a6f42fb91566e2
"3c59x: Use fine-grained locks for MII and windowed register access".
vortex_interrupt() holds vp->window_lock over multiple register
accesses to reduce locking overhead. However it also needs to call
vortex_error() sometimes, and that uses the regular functions for
access to windowed registers, which will try to acquire window_lock
again.
Therefore, drop window_lock around the call to vortex_error() and set
the window afterward reacquiring the lock. Since vortex_error() may
call vortex_rx(), which *does* require its caller to hold window_lock,
lift that call up into vortex_interrupt(). This also removes the
potential for calling vortex_rx() on a later-generation NIC.
Reported-and-tested-by: Jens Schüßler <jgs@trash.net> [in Debian's 2.6.32]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Nicolas Dichtel [Fri, 3 Sep 2010 05:13:07 +0000 (05:13 +0000)]
netfilter: discard overlapping IPv6 fragment
RFC5722 prohibits reassembling IPv6 fragments when some data overlaps.
Bug spotted by Zhang Zuotao <zuotao.zhang@6wind.com>.
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Nicolas Dichtel [Fri, 3 Sep 2010 05:13:05 +0000 (05:13 +0000)]
ipv6: discard overlapping fragment
RFC5722 prohibits reassembling fragments when some data overlaps.
Bug spotted by Zhang Zuotao <zuotao.zhang@6wind.com>.
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Helmut Schaa [Fri, 3 Sep 2010 02:39:56 +0000 (02:39 +0000)]
net: fix tx queue selection for bridged devices implementing select_queue
When a net device is implementing the select_queue callback and is part of
a bridge, frames coming from the bridge already have a tx queue associated
to the socket (introduced in commit
a4ee3ce3293dc931fab19beb472a8bde1295aebe,
"net: Use sk_tx_queue_mapping for connected sockets"). The call to
sk_tx_queue_get will then return the tx queue used by the bridge instead
of calling the select_queue callback.
In case of mac80211 this broke QoS which is implemented by using the
select_queue callback. Furthermore it introduced problems with rt2x00
because frames with the same TID and RA sometimes appeared on different
tx queues which the hw cannot handle correctly.
Fix this by always calling select_queue first if it is available and only
afterwards use the socket tx queue mapping.
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jiri Bohac [Thu, 2 Sep 2010 05:45:54 +0000 (05:45 +0000)]
bonding: Fix jiffies overflow problems (again)
The time_before_eq()/time_after_eq() functions operate on unsigned
long and only work if the difference between the two compared values
is smaller than half the range of unsigned long (31 bits on i386).
Some of the variables (slave->jiffies, dev->trans_start, dev->last_rx)
used by bonding store a copy of jiffies and may not be updated for a
long time. With HZ=1000, time_before_eq()/time_after_eq() will start
giving bad results after ~25 days.
jiffies will never be before slave->jiffies, dev->trans_start,
dev->last_rx by more than possibly a couple ticks caused by preemption
of this code. This allows us to detect/prevent these overflows by
replacing time_before_eq()/time_after_eq() with time_in_range().
Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Giuseppe Cavallaro [Mon, 6 Sep 2010 03:02:11 +0000 (05:02 +0200)]
stmmac: fix sleep inside atomic
We cannot use spinlock when kmalloc is invoked with
GFP_KERNEL flag because it can sleep.
So this patch reviews the usage of spinlock within the
stmmac_resume function avoing this bug.
Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Reported-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Greg Ungerer [Fri, 3 Sep 2010 01:15:19 +0000 (11:15 +1000)]
m68knommu: fix missing linker segments
Recent changes to linker segments that hold per-cpu data broke linking
for m68knommu targets:
LD vmlinux
/usr/local/bin/m68k-uclinux-ld.real: error: no memory region specified for loadable section `.data..shared_aligned'
Add missing segments into the m68knommu linker script.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Howells [Tue, 31 Aug 2010 15:52:21 +0000 (16:52 +0100)]
h8300: Fix missing consts in kernel_execve()
Fix missing consts in h8300's kernel_execve():
arch/h8300/kernel/sys_h8300.c: In function 'kernel_execve':
arch/h8300/kernel/sys_h8300.c:59: warning: initialization from incompatible pointer type
arch/h8300/kernel/sys_h8300.c:60: warning: initialization from incompatible pointer type
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Howells [Tue, 31 Aug 2010 15:52:16 +0000 (16:52 +0100)]
h8300: Fix die()
Fix h8300's die() to take care of a number of problems:
CC arch/h8300/kernel/traps.o
In file included from arch/h8300/include/asm/bitops.h:10,
from include/linux/bitops.h:22,
from include/linux/kernel.h:17,
from include/linux/sched.h:54,
from arch/h8300/kernel/traps.c:18:
arch/h8300/include/asm/system.h:136: warning: 'struct pt_regs' declared inside parameter list
arch/h8300/include/asm/system.h:136: warning: its scope is only this definition or declaration, which is probably not what you want
arch/h8300/kernel/traps.c:100: error: conflicting types for 'die'
arch/h8300/include/asm/system.h:136: error: previous declaration of 'die' was here
make[2]: *** [arch/h8300/kernel/traps.o] Error 1
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Howells [Tue, 31 Aug 2010 15:52:11 +0000 (16:52 +0100)]
h8300: IRQ flags should be stored in an unsigned long
Fix h8300's asm/atomic.h to store the IRQ flags in an unsigned long to deal
with warnings of the following type:
arch/h8300/include/asm/atomic.h: In function 'atomic_add_return':
arch/h8300/include/asm/atomic.h:22: warning: comparison of distinct pointer types lacks a cast
arch/h8300/include/asm/atomic.h:24: warning: comparison of distinct pointer types lacks a cast
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Valerie Aurora [Thu, 26 Aug 2010 18:07:22 +0000 (11:07 -0700)]
VFS: Sanity check mount flags passed to change_mnt_propagation()
Sanity check the flags passed to change_mnt_propagation(). Exactly
one flag should be set. Return EINVAL otherwise.
Userspace can pass in arbitrary combinations of MS_* flags to mount().
do_change_type() is called if any of MS_SHARED, MS_PRIVATE, MS_SLAVE,
or MS_UNBINDABLE is set. do_change_type() clears MS_REC and then
calls change_mnt_propagation() with the rest of the user-supplied
flags. change_mnt_propagation() clearly assumes only one flag is set
but do_change_type() does not check that this is true. For example,
mount() with flags MS_SHARED | MS_RDONLY does not actually make the
mount shared or read-only but does clear MNT_UNBINDABLE.
Signed-off-by: Valerie Aurora <vaurora@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Zhenyu Wang [Tue, 7 Sep 2010 05:45:32 +0000 (13:45 +0800)]
intel_agp,i915: Add more sandybridge graphics device ids
New pci ids for GT2 and GT2+ on desktop and mobile sandybridge,
and graphics device ids for server sandybridge. Also rename original
ids string to reflect GT1 version.
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: stable@kernel.org
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Zhenyu Wang [Mon, 30 Aug 2010 08:12:42 +0000 (16:12 +0800)]
drm/i915: Enable MI_FLUSH on Sandybridge
MI_FLUSH is being deprecated, but still available on Sandybridge.
Make sure it's enabled as userspace still uses MI_FLUSH.
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: stable@kernel.org
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Zhenyu Wang [Fri, 27 Aug 2010 03:08:57 +0000 (11:08 +0800)]
agp/intel: Fix cache control for Sandybridge
Sandybridge GTT has new cache control bits in PTE, which controls
graphics page cache in LLC or LLC/MLC, so we need to extend the mask
function to respect the new bits.
And set cache control to always LLC only by default on Gen6.
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: stable@kernel.org
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Zhenyu Wang [Fri, 27 Aug 2010 03:06:48 +0000 (11:06 +0800)]
agp/intel: use #ifdef idiom for intel-agp.h
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: stable@kernel.org
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Zhenyu Wang [Mon, 23 Aug 2010 06:37:52 +0000 (14:37 +0800)]
agp/intel: fix physical address mask bits for sandybridge
It should shift bit 39-32 into pte's bit 11-4.
Reported-by:Takashi Iwai <tiwai@suse.de>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: stable@kernel.org
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Chris Wilson [Mon, 6 Sep 2010 15:17:22 +0000 (16:17 +0100)]
drm/i915: Prevent double dpms on
Arguably this is a bug in drm-core in that we should not be called twice
in succession with DPMS_ON, however this is still occuring and we see
FDI link training failures on the second call leading to the occassional
blank display. For the time being ignore the repeated call.
Original patch by Dave Airlie <airlied@redhat.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org
Chris Wilson [Sun, 5 Sep 2010 09:01:13 +0000 (10:01 +0100)]
drm/i915: Avoid use of uninitialised values when disabling panel-fitter
We were passing garbage values into the panel-fitter control register
when disabling it on Ironlake - those values (filter modes and reserved
MBZ bits) would have then be re-used the next time panel-fitting was
enabled.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Simon Farnsworth [Wed, 1 Sep 2010 16:47:52 +0000 (17:47 +0100)]
drm/i915: Avoid pageflipping freeze when we miss the flip prepare interrupt
When we miss the flip prepare interrupt, we never get into the
software state needed to restart userspace, resulting in a freeze of a
full-screen OpenGL application (such as a compositor).
Work around this by checking DSPxSURF/DSPxBASE to see if the page flip
has actually happened. If it has, do the work we would have done when
the flip prepare interrupt comes in.
Also, add debugfs information to tell us what's going on (based on the
patch from Chris Wilson attached to bugs.fdo bug #29798).
Signed-off-by: Simon Farnsworth <simon.farnsworth@onelan.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Chris Wilson [Sun, 22 Aug 2010 09:54:23 +0000 (10:54 +0100)]
drm/i915: Tightly scope intel_encoder to prevent invalid use
We reset intel_encoder for every matching encoder whilst iterating over
the encoders attached to this crtc when changing mode. As such in a
cloned configuration intel_encoder may not correspond to the correct
is_edp encoder.
By scoping intel_encoder to the loop, not only is the compiler able to
spot this mistake, we also improve readiability for ourselves.
[It might not be a mistake, within this function it is unclear as to
whether it is permissable for eDP to be cloned...]
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Chris Wilson [Fri, 20 Aug 2010 13:36:45 +0000 (14:36 +0100)]
drm/i915: Allocate the PCI resource for the MCHBAR
We were failing when trying to allocate the resource for MMIO of the
MCHBAR because we forgot to specify what type of resource we wanted.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: stable@kernel.org
Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Chris Wilson [Wed, 18 Aug 2010 17:12:56 +0000 (18:12 +0100)]
drm/i915/dp: Really try 5 times before giving up.
Only stop trying if the aux channel sucessfully reports that the
transmission was completed, otherwise try again. On the 5th failure,
bail and report that something is amiss.
This fixes a sporadic failure in reading the EDID for my external panel
over DP.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org
Chris Wilson [Thu, 12 Aug 2010 14:26:41 +0000 (15:26 +0100)]
drm/i915/sdvo: Restore guess of the DDC bus in absence of VBIOS
If the VBIOS tells us the mapping of the SDVO device onto the DDC bus,
use it. However, if there is no VBIOS available that mapping is
uninitialised and we should fallback to our earlier guess.
Fix regression introduced in
b1083333 (which in turn is a fix for the
regression caused by the introduction of this guess,
14571b4).
References:
Bug 29499 - [945GM] Screen disconnected because of missing VBIOS
https://bugs.freedesktop.org/show_bug.cgi?id=29499
Bug 15109 - i945GM fails to detect EDID on DVI port
https://bugzilla.kernel.org/show_bug.cgi?id=15109
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reported-and-tested-by: Paul Neumann <paul104x@yahoo.de>
Cc: Adam Jackson <ajax@redhat.com>
Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: stable@kernel.org
Chris Wilson [Mon, 9 Aug 2010 16:21:44 +0000 (17:21 +0100)]
drm/i915/dp: Boost timeout for enabling transcoder to 100ms
Adam Hill reported that his Arrandale system required a much longer, up
to 200x500us, wait for the panel to initialise or else modesetting would
fail.
References:
https://bugs.freedesktop.org/show_bug.cgi?id=29141
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reported-and-tested-by: Adam Hill <sidepipeuk@yahoo.co.uk>
Chris Wilson [Sun, 8 Aug 2010 12:20:19 +0000 (13:20 +0100)]
drm/i915: Re-use set_base_atomic to share setting of the display registers
Lets try to avoid repeating old bugs.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Chris Wilson [Sun, 8 Aug 2010 09:15:59 +0000 (10:15 +0100)]
drm/i915: Fix offset page-flips on i965+
i965 uses the Display Registers to compute the offset from the display
base so the new base does not need adjusting when flipping. The older
chipsets use a fence to access the display and so do perceive the
surface as linear and have a single base register which is reprogrammed
using the flip.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Reported-by: Marty Jack <martyj19@comcast.net>
Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Chris Wilson [Wed, 11 Aug 2010 08:59:24 +0000 (09:59 +0100)]
drm/i915: Include a generation number in the device info
To simplify the IS_GEN[234] macros and to enable switching.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Dan Carpenter [Wed, 23 Jun 2010 17:03:01 +0000 (19:03 +0200)]
i915: return -EFAULT if copy_to_user fails
copy_to_user() returns the number of bytes remaining to be copied and
I'm pretty sure we want to return a negative error code here.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org
Dan Carpenter [Sat, 19 Jun 2010 13:12:51 +0000 (15:12 +0200)]
i915: return -EFAULT if copy_to_user fails
copy_to_user returns the number of bytes remaining to be copied, but we
want to return a negative error code here. These are returned to
userspace.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org
Chris Wilson [Sat, 4 Sep 2010 13:57:27 +0000 (14:57 +0100)]
agp/intel: Promote warning about failure to setup flush to error.
Make sure we always detect when we fail to correctly allocate the Isoch
Flush Page and print an error to warn the user about the likely memory
corruption that will result in invalid rendering or worse.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org
Daniel Vetter [Mon, 30 Aug 2010 19:25:23 +0000 (21:25 +0200)]
drm/i915: overlay on gen2 can't address above 1G
So set the coherent dma mask accordingly. This dma mask is only used
for physical objects, so it won't really matter allocation-wise.
Now this never really surfaced because sane 32bit kernels only have 1G
of lowmem. But some eager testers (distros?) still carry around the patch
to adjust lowmem via a kconfig option. And the kernel seems to favour
high allocations on boot-up, hence the overlay blowing up reliably.
Because the patch is tiny and nicely shows how broken gen2 is it's imho
worth to merge despite the fact that mucking around with the lowmem/
highmem division is (no longer) supported.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=28318
Cc: stable@kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Chris Wilson [Sun, 5 Sep 2010 19:25:43 +0000 (20:25 +0100)]
drm/i915: Clear the vblank status bit before polling for the next vblank
The vblank status bit is a sticky bit that must be cleared with a write
of '1' prior to polling for the next vblank.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Tested-by: Sitsofe Wheeler <sitsofe@yahoo.com>
jbarnes: I'd still rather see a lock, but I think you're right that
we don't generally wait in code that needs not to miss an interrupt.
Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Pekka Enberg [Sat, 4 Sep 2010 16:24:04 +0000 (19:24 +0300)]
i915: Fix spurious TV detection after
9d0498a2bf +
9559fcdbff
Partial revert of
9d0498a2bf.
Signed-off-by: Pekka Enberg <penberg@kernel.org>
Tested-by: Hugh Dickins <hughd@google.com>
Tested-by: Sven Joachim <svenjoac@gmx.de>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Pavel Roskin [Thu, 2 Sep 2010 18:46:34 +0000 (14:46 -0400)]
i915: revert some checks added by commit
32aad86f
This fixes blur-like screen corruption on the following card:
VGA compatible controller [0300]: Intel Corporation 82G33/G31 Express
Integrated Graphics Controller [8086:29c2] (rev 10)
intel_sdvo_mode_set() should not return prematurely just because some
features are not supported.
https://bugzilla.kernel.org/show_bug.cgi?id=17151
Signed-off-by: Pavel Roskin <proski@gnu.org>
Reported-by: Jonathan Corbet <corbet@lwn.net>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
[ickle: Relax a couple more checks for failing LVDS modesetting]
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Chris Wilson [Mon, 6 Sep 2010 13:44:14 +0000 (14:44 +0100)]
Revert "drm/i915: Unreference object not handle on creation"
This reverts commit
86f100b136626e91f4f66f3776303475e2e58998.
The kref API requires the handlecount to be initialised to one on object
creation (so that kref_get() doesn't complain upon first use) so the
dalliance in the drivers is required in order to sink the initial
floating reference.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@kernel.org
Andrew Morton [Tue, 24 Aug 2010 23:35:52 +0000 (16:35 -0700)]
drivers/gpu/drm/i915/intel_overlay.c needs seq_file.h
drivers/gpu/drm/i915/intel_overlay.c: In function 'intel_overlay_print_error_state':
drivers/gpu/drm/i915/intel_overlay.c:1467: error: implicit declaration of function 'seq_printf'
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16811
Reported-by: Martin Ziegler <ziegler@uni-freiburg.de>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Eric Anholt <eric@anholt.net>
Cc: Dave Airlie <airlied@linux.ie>
Cc: Andre Muller <andremuellerster@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Chris Wilson [Sun, 5 Sep 2010 15:55:25 +0000 (16:55 +0100)]
drm: Do not force 1024x768 modes on unknown connectors
Only fallback to a set of default modes on a connector iff that
connector is known to be connected. The issue occurs that with limited
hardware which cannot probe a connector and so reports the
connector status as unknown will then attempt to retrieve the modes for
it during drm_helper_probe_single_connector_modes(). Should that fail,
the helper then generates a default set which fools the fb_helper and
causes havoc with the console and beyond.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Chris Wilson [Fri, 20 Aug 2010 08:13:36 +0000 (09:13 +0100)]
drm/kms: Add a module parameter to disable polling
Polling for a VGA device on an old system can be quite expensive,
causing latencies on the order of 600ms. As we hold the mode mutex for
this time and also need the same mutex to move the cursor, we trigger a
user-visible stall.
The real solution would involve improving the granulatity of the
locking and so perhaps performing some of the probing not under the lock
or some other updates can be done under different locks. Also reducing the
cost of probing for a non-existent monitor would be worthwhile. However,
exposing a parameter to disable polling is a simple workaround in the
meantime.
In order to accommodate users turning polling on and off at runtime, the
polling is potentially re-enabled on every probe. This is coupled to
the user calling xrandr, which seems to be a vaild time to reset the
polling timeout since the information on the connection has just been
updated. (The presumption being that all connections are probed in a
single xrandr pass, which is currently valid.)
References:
Bug 29536 - 2.6.35 causes ~600ms latency every 10s
https://bugs.freedesktop.org/show_bug.cgi?id=29536
Bug 16265 - Why is kslowd accumulating so much CPU time?
https://bugzilla.kernel.org/show_bug.cgi?id=16265
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reported-and-tested-by: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Fri, 3 Sep 2010 19:52:53 +0000 (15:52 -0400)]
drm/radeon/kms: fix tv-out on avivo asics
digital underscan support regressed tv-out.
fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=29985
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Alex Deucher [Fri, 3 Sep 2010 01:32:32 +0000 (21:32 -0400)]
drm/radeon/kms/evergreen: fix gpu hangs in userspace accel code
These VGT regs need to be programmed via the ring rather than
MMIO as on previous asics (r6xx/r7xx).
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Michael S. Tsirkin [Thu, 2 Sep 2010 11:16:36 +0000 (14:16 +0300)]
vhost: error handling fix
vhost should set worker to NULL on cgroups attach failure,
so that we won't try to destroy the worker again on close.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Michael S. Tsirkin [Thu, 2 Sep 2010 11:05:30 +0000 (14:05 +0300)]
vhost: fix attach to cgroups regression
Since 2.6.36-rc1, non-root users of vhost-net fail to attach
if they are in any cgroups.
The reason is that when qemu uses vhost, vhost wants to attach
its thread to all cgroups that qemu has. But we got the API backwards,
so a non-priveledged process (Qemu) tried to control
the priveledged one (vhost), which fails.
Fix this by switching to the new cgroup_attach_task_all,
and running it from the vhost thread.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Michael S. Tsirkin [Thu, 5 Aug 2010 22:59:14 +0000 (01:59 +0300)]
cgroups: fix API thinko
cgroup_attach_task_current_cg API that have upstream is backwards: we
really need an API to attach to the cgroups from another process A to
the current one.
In our case (vhost), a priveledged user wants to attach it's task to cgroups
from a less priveledged one, the API makes us run it in the other
task's context, and this fails.
So let's make the API generic and just pass in 'from' and 'to' tasks.
Add an inline wrapper for cgroup_attach_task_current_cg to avoid
breaking bisect.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Paul Menage <menage@google.com>
Karl Relton [Wed, 11 Aug 2010 17:16:08 +0000 (18:16 +0100)]
Staging: wlan-ng: Explicitly set some fields in cfg80211 interface
The cfg80211 api has introduced a few new fields. Rather than assume
what cfg80211 api does by default, set these explicitly.
Signed-off-by: Karl Relton <karllinuxtest.relton@ntlworld.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Randy Dunlap [Tue, 24 Aug 2010 21:09:40 +0000 (14:09 -0700)]
Staging: octeon: depends on NETDEVICES
OCTEON_ETHERNET should depend on NETDEVICES.
Fixes this kconfig warning:
warning: (NET_DSA && NET && EXPERIMENTAL && NETDEVICES && !S390 || ...
|| OCTEON_ETHERNET && STAGING && !STAGING_EXCLUDE_BUILD && CPU_CAVIUM_OCTEON) selects PHYLIB which has unmet direct dependencies (!S390 && NETDEVICES)
Reported-by: Arnaud Lacombe <lacombar@gmail.com>
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: support@caviumnetworks.com
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Jeff Mahoney [Tue, 24 Aug 2010 16:12:26 +0000 (12:12 -0400)]
Staging: spectra: depend on X86_MRST
lld_nand fails to build on arches without virt_to_bus. Since this driver
is specifically for hardware enablment on Moorestown, this patch adds
Moorestown MID support as a dependency.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Shahar Havivi [Sat, 28 Aug 2010 07:09:05 +0000 (10:09 +0300)]
Staging: zram: free device memory when init fails
Signed-off-by: Shahar Havivi <shaharh@redhat.com>
Cc: Nitin Gupta <ngupta@vflare.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Ben Hutchings [Sun, 29 Aug 2010 01:13:11 +0000 (02:13 +0100)]
Staging: rt2870sta: Add more device IDs from vendor drivers
Taken from DPO_RT3070_LinuxSTA_V2.3.0.4_20100604.tar.bz2 and
2010_0709_RT2870_Linux_STA_v2.4.0.1.tar.bz2, with duplicates removed.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Andreas Bombe [Sat, 14 Aug 2010 01:24:22 +0000 (03:24 +0200)]
staging: comedi das08_cs.c: Fix io_req_t conversion
Commit
90abdc3b9 converted all PCMCIA users away from io_req_t. In
das08_cs.c the converted IO lines mask setting was added but the old
line using the now inexistent p_dev->io was not removed.
Signed-off-by: Andreas Bombe <aeb@debian.org>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Geert Uytterhoeven [Mon, 30 Aug 2010 06:57:49 +0000 (08:57 +0200)]
staging: spectra needs <linux/slab.h>
On one of my m68k test builds I get:
drivers/staging/spectra/ffsport.c: In function ‘ioctl_read_page_data’:
drivers/staging/spectra/ffsport.c:196: error: implicit declaration of function ‘kmalloc’
drivers/staging/spectra/ffsport.c:196: warning: assignment makes pointer from integer without a cast
drivers/staging/spectra/ffsport.c:212: error: implicit declaration of function ‘kfree’
drivers/staging/spectra/ffsport.c: In function ‘ioctl_write_page_data’:
drivers/staging/spectra/ffsport.c:229: warning: assignment makes pointer from integer without a cast
drivers/staging/spectra/ffsport.c: In function ‘SBD_setup_device’:
drivers/staging/spectra/ffsport.c:637: warning: assignment makes pointer from integer without a cast
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Pekka Enberg <penberg@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Hank Janssen [Wed, 1 Sep 2010 18:10:41 +0000 (11:10 -0700)]
staging: hv: Fixed lockup problem with bounce_buffer scatter list
Fixed lockup problem with bounce_buffer scatter list which caused
crashes in heavy loads. And minor code indentation cleanup in effected
area.
Removed whitespace and noted minor indentation changes in description as
pointed out by Joe Perches. (Thanks for reviewing Joe)
Signed-off-by: Hank Janssen <hjanssen@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Hank Janssen [Thu, 5 Aug 2010 19:30:31 +0000 (19:30 +0000)]
staging: hv: Increased storvsc ringbuffer and max_io_requests
Increased storvsc ringbuffer and max_io_requests. This now more
closely mimics the numbers on Hyper-V. And will allow more IO requests
to take place for the SCSI driver.
Max_IO is set to double from what it was before, Hyper-V allows it and
we have had appliance builder requests to see if it was a problem to
increase the number.
Ringbuffer size for storvsc is now increased because I have seen A few buffer
problems on extremely busy systems. They were Set pretty low before.
And since max_io_requests is increased I Really needed to increase the buffer
as well.
Signed-off-by:Hank Janssen <hjanssen@microsoft.com>
Signed-off-by:Haiyang Zhang <haiyangz@microsoft.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Haiyang Zhang [Thu, 5 Aug 2010 19:30:01 +0000 (19:30 +0000)]
staging: hv: Fixed the value of the 64bit-hole inside ring buffer
Fixed the value of the 64bit-hole inside ring buffer, this
caused a problem on Hyper-V when running checked Windows builds.
Checked builds of Windows are used internally and given to external
system integrators at times. They are builds that for example that all
elements in a structure follow the definition of that Structure. The bug
this fixed was for a field that we did not fill in at all (Because we do
Not use it on the Linux side), and the checked build of windows gives
errors on it internally to the Windows logs.
This fixes that error.
Signed-off-by:Hank Janssen <hjanssen@microsoft.com>
Signed-off-by:Haiyang Zhang <haiyangz@microsoft.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Hank Janssen [Thu, 5 Aug 2010 19:29:44 +0000 (19:29 +0000)]
staging: hv: Fixed bounce kmap problem by using correct index
Fixed bounce offset kmap problem by using correct index.
The symptom of the problem is that in some NAS appliances this problem
represents Itself by a unresponsive VM under a load with many clients writing
small files.
Signed-off-by:Hank Janssen <hjanssen@microsoft.com>
Signed-off-by:Haiyang Zhang <haiyangz@microsoft.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Haiyang Zhang [Tue, 3 Aug 2010 19:15:31 +0000 (19:15 +0000)]
staging: hv: Fix missing functions for net_device_ops
Fix missing functions for net_device_ops.
It's a bug when porting the drivers from 2.6.27 to 2.6.32. In 2.6.27,
the default functions for Ethernet, like eth_change_mtu(), were assigned
by ether_setup(). But in 2.6.32, these function pointers moved to
net_device_ops structure and no longer be assigned in ether_setup(). So
we need to set these functions in our driver code. It will ensure the
MTU won't be set beyond 1500. Otherwise, this can cause an error on the
server side, because the HyperV linux driver doesn't support jumbo frame
yet.
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Hank Janssen <hjanssen@microsoft.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Luke Lowrey [Thu, 2 Sep 2010 10:39:49 +0000 (11:39 +0100)]
USB: ftdi_sio: Added custom PIDs for ChamSys products
Added the 0xDAF8 to 0xDAFF PID range for ChamSys limited USB interface/wing products
Signed-off-by: Luke Lowrey <luke@chamsys.co.uk>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Toby Gray [Thu, 2 Sep 2010 09:46:20 +0000 (10:46 +0100)]
USB: cdc-acm: Fixing crash when ACM probing interfaces with no endpoint descriptors.
Certain USB devices, such as the Nokia X6 mobile phone, don't expose any
endpoint descriptors on some of their interfaces. If the ACM driver is forced
to probe all interfaces on a device the a NULL pointer dereference will occur
when the ACM driver attempts to use the endpoint of the alternative settings.
One way to get the ACM driver to probe all the interfaces is by using the
/sys/bus/usb/drivers/cdc_acm/new_id interface.
This patch checks that the endpoint pointer for the current alternate settings
is non-NULL before using it.
Signed-off-by: Toby Gray <toby.gray@realvnc.com>
Cc: Oliver Neukum <oliver@neukum.name>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Philippe Corbes [Tue, 31 Aug 2010 17:31:32 +0000 (19:31 +0200)]
USB: cdc-acm: Add pseudo modem without AT command capabilities
cdc-acm.c : Manage pseudo-modem without AT commands capabilities
Enable to drive electronic simple gadgets based on microcontrolers.
The Interface descriptor is like this:
bInterfaceClass 2 Communications
bInterfaceSubClass 2 Abstract (modem)
bInterfaceProtocol 0 None
Signed-off-by: Philippe Corbes <philippe.corbes@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Simon Arlott [Wed, 1 Sep 2010 17:37:12 +0000 (18:37 +0100)]
USB: cxacru: Use a bulk/int URB to access the command endpoint
The command endpoint is either a bulk or interrupt endpoint, but using
the wrong type of transfer causes an error if CONFIG_USB_DEBUG is
enabled after commit
f661c6f8c67bd55e93348f160d590ff9edf08904, which
checks for this mismatch.
Detect which type of endpoint it is and use a bulk/int URB as
appropriate. There are other function calls specifying a bulk pipe,
but usb_clear_halt doesn't use the pipe type (only the endpoint) and
usb_bulk_msg auto-detects interrupt transfers.
Signed-off-by: Simon Arlott <simon@fire.lp0.eu>
Cc: stable <stable@kernel.org> [.34 and newer]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>