Commit graph

322941 commits

Author SHA1 Message Date
Stephen Warren
a32826e4ae ASoC: tegra: fix maxburst settings in dmaengine code
The I2S controllers are programmed with an "attention" level of 4 DWORDs.
This must match the configuration passed to the DMA driver, so that when
they burst in data, they don't overflow the available FIFO space. Also,
the burst size is relevant to the destination for playback, and source
for capture, not vice-versa as originally written.

Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: stable@vger.kernel.org
2012-09-07 09:52:02 +08:00
Linus Torvalds
bf71d0e18e Bug-fixes:
* Fix for TLB flushing introduced in v3.6
  * Fix Xen-SWIOTLB not using proper DMA mask - device had 64bit but
    in a 32-bit kernel we need to allocate for coherent pages from a
    32-bit pool.
  * When trying to re-use P2M nodes we had a one-off error and triggered
    a BUG_ON check with specific CONFIG_ option.
  * When doing FLR in Xen-PCI-backend we would first do FLR then save the
    PCI configuration space. We needed to do it the other way around.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQEcBAABAgAGBQJQSS7TAAoJEFjIrFwIi8fJOBQH/03JBKBbFvewhop8T5Jww2c9
 SWmMgzDm5HkxeWj5XnM+zlLoHrYFFu7tyuRLiny4weE0LdRl4adJ1TVpStxap/b6
 MSQKe+tZevslaReBOsMpbCk3z7fEWNlAcpm6wMp1xYmLoHcr0JMpOCmzigbf7dwM
 F4UWULheih9ME3UeqDAU8qgvfv6ccZ9vempO4TDWKjxfxfWODCNMRx+Ny+C7NNRk
 QeoInHJUqcRkg0q0OIciF/YYDmn8hIH7HgfqomuMb6rEv2LOieLnWVuniEPWM75s
 lECxro7v2Z9s1Std0WWKcFp8VZpI2scnQYU8aL8TpewHcbzKHQYyipuKPu7FiEQ=
 =GfLE
 -----END PGP SIGNATURE-----

Merge tag 'stable/for-linus-3.6-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

Pull Xen bug-fixes from Konrad Rzeszutek Wilk:
 * Fix for TLB flushing introduced in v3.6
 * Fix Xen-SWIOTLB not using proper DMA mask - device had 64bit but
   in a 32-bit kernel we need to allocate for coherent pages from a
   32-bit pool.
 * When trying to re-use P2M nodes we had a one-off error and triggered
   a BUG_ON check with specific CONFIG_ option.
 * When doing FLR in Xen-PCI-backend we would first do FLR then save the
   PCI configuration space. We needed to do it the other way around.

* tag 'stable/for-linus-3.6-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/pciback: Fix proper FLR steps.
  xen: Use correct masking in xen_swiotlb_alloc_coherent.
  xen: fix logical error in tlb flushing
  xen/p2m: Fix one-off error in checking the P2M tree directory.
2012-09-06 17:16:42 -07:00
Linus Torvalds
f8b9cf0f31 PCI updates for v3.6:
Power management
     - PCI/PM: Enable D3/D3cold by default for most devices
     - PCI/PM: Keep parent bridge active when probing device
     - PCI/PM: Fix config reg access for D3cold and bridge suspending
     - PCI/PM: Add ABI document for sysfs file d3cold_allowed
   Core
     - PCI: Don't print anything while decoding is disabled
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.10 (GNU/Linux)
 
 iQIcBAABAgAGBQJQSQ9nAAoJEPGMOI97Hn6zc+EQAMWlPJUAUR0uY2mnz9KANGxQ
 7yHsgoCj1lbMNMrlyD9CveE1b5PCUwL8oiSnsLvqUwsdvNr14FGhCCtTYotoDEBh
 2QuSkI2rG1y+2Kr9Lrd4TrzdcCfBjQ3vUIhU1va2uPjrf8fsPQCvm0Yn8gC/SKDg
 qV452021IFxkeO0PIZ9z7H4uaOIuqqb1mnqXImKZ3zUMNfNl0xLaZfrWUK5DG6qn
 Mgm25qCNZ70Hj5mM/AqhKLsWH2ruMsZuA/5QvdHHJmi0pGF8OkFtvcKNv785Ajlg
 Ar5YOtLaeszyVpueNAWzevH+1m86D6USW1yKnlxgVigVpxFNhHs2OHr4kU1IzwKU
 AkMdDCyGCBXoEBiXwozsMSVX4gi87k91ETpe8E/WlU5gkLN8hqBO8TJlCsLBAXGV
 7RIWJPeoem6UjoYYbqUe8Z4/ZPbSgWgdVkSI9PLcVsVrPQZR0Z7f3JM5Kcdgooc9
 iPQleMK0x5YPtsFHVqCJLD6A4xaWR8VZaK3hHSziYlyOjPpIJ0vErh5uxh6pWBWo
 wAzQDp/dfmOBhld7RzzQQrOyHHIPR7+jHghH7/zpgAhaaGhAeqMXX4Y+R2CKt9yR
 iNW6QlHasaBPQHehWjstMKlwR7iXZDORMtEv+tAyg2m1ZmgWi7Aut2Mk/6e3Z3Jy
 +d2tn7b5aBTc3y8dcVBP
 =zFNa
 -----END PGP SIGNATURE-----

Merge tag '3.6-pci-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci

Pull PCI updates from Bjorn Helgaas:
 "Power management
    - PCI/PM: Enable D3/D3cold by default for most devices
    - PCI/PM: Keep parent bridge active when probing device
    - PCI/PM: Fix config reg access for D3cold and bridge suspending
    - PCI/PM: Add ABI document for sysfs file d3cold_allowed
  Core
    - PCI: Don't print anything while decoding is disabled"

* tag '3.6-pci-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  PCI: Don't print anything while decoding is disabled
  PCI/PM: Add ABI document for sysfs file d3cold_allowed
  PCI/PM: Fix config reg access for D3cold and bridge suspending
  PCI/PM: Keep parent bridge active when probing device
  PCI/PM: Enable D3/D3cold by default for most devices
2012-09-06 17:15:49 -07:00
Ben Collins
3b75a2c126 crypto/caam: Export gen_split_key symbol for other modules
In 3.6-rc3, without this patch, the following error occurs with a modular build:

ERROR: "gen_split_key" [drivers/crypto/caam/caamhash.ko] undefined!
ERROR: "gen_split_key" [drivers/crypto/caam/caamalg.ko] undefined!

Signed-off-by: Ben Collins <ben.c@servergy.com>
Cc: Yuan Kang <Yuan.Kang@freescale.com>
Acked-by: Kim Phillips <kim.phillips@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2012-09-07 04:07:35 +08:00
Weston Andros Adamson
01913b49cf NFS: return error from decode_getfh in decode open
If decode_getfh failed, nfs4_xdr_dec_open would return 0 since the last
decode_* call must have succeeded.

Cc: stable@vger.kernel.org
Signed-off-by: Weston Andros Adamson <dros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
2012-09-06 16:01:33 -04:00
Pavel Shilovsky
b2ede58e98 CIFS: Fix endianness conversion
Signed-off-by: Pavel Shilovsky <pshilovsky@etersoft.ru>
Signed-off-by: Steve French <smfrench@gmail.com>
2012-09-06 12:42:35 -05:00
Pavel Shilovsky
e2f2886a82 CIFS: Fix error handling in cifs_push_mandatory_locks
Cc: <stable@vger.kernel.org>
Signed-off-by: Pavel Shilovsky <pshilovsky@etersoft.ru>
Signed-off-by: Steve French <smfrench@gmail.com>
2012-09-06 12:42:31 -05:00
Linus Torvalds
eeea3ac912 arm-soc: bug fixes for v3.6-rc5
Mostly Renesas and Atmel bugfixes this time, targeting boot and build
 problems. A couple of patches for gemini and kirkwood as well. On a
 whole nothing very controversial.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJQR+5tAAoJEIwa5zzehBx37ucQAIoOkQN6RqzXDkM4o6uhgtrS
 Fqt231762msmrrMpFwH/o0slgtyNIogHZfykoy2H8EXxJC93ZLYyVaqii+D2/H9O
 hRn7F6JGZ2R/h0+bYWAf3skX1ecRikxOF+knPmD4aolsnkddBeP6Rb0KIDgRqwRb
 pJxmlD8M68Dq7oKCMIT3EWP8pzXjJlVeS5Zli/X3XIxE5iTELQltK4St8oZWE2S1
 O2uOj/GuGgERiq39lIbf1YggEQZrZVf0a3a4koVFMCQ/kmT7LE1bzVp2lqsUNKpB
 2KG2GllTac2excjeg8Oyd4apy2mmGQimnIdKf1W3RfpVlnXUySw1XaPbjU1L6IcO
 xgZoLsxLgpeohK1T1mUsKEBtHWPKTBOTqGvquuvf8h7CAqRVPzX0nNmIt+JcfaTN
 lcdflHEks55eZfEad794DjwZdCG6/RXY5wDFeZKOzUTWK2//hlsRVlYHumpiRXIe
 UaVdFB//N2bzZiz+HYVBpd4TgEDhGm6WM3REYhMNVtnie/ubg/CiMW1cLuA3Xouk
 STvZ6EM/G0bwAM3PZOnBWxKlv7jAN0Zwhw0meK7W1Go1FrQsdroVmOMDL7PzPIWI
 kgtDzxLa6VV77EvBVJAPs2JZqdsRTa7r/AZLaBne/VvhikUVOdo2aOROPyn/vJqy
 /8Atzs6hU2BqDYStyK/z
 =hMrY
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC bug fixes from Olof Johansson:
 "Mostly Renesas and Atmel bugfixes this time, targeting boot and build
  problems.  A couple of patches for gemini and kirkwood as well.  On a
  whole nothing very controversial."

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: gemini: fix the gemini build
  ARM: shmobile: armadillo800eva: enable rw rootfs mount
  ARM: Kirkwood: Fix 'SZ_1M' undeclared here for db88f6281-bp-setup.c
  ARM: shmobile: mackerel: fixup usb module order
  ARM: shmobile: armadillo800eva: fixup: sound card detection order
  ARM: shmobile: marzen: fixup smsc911x id for regulator
  ARM: at91/feature-removal-schedule: delay at91_mci removal
  ARM: mach-shmobile: armadillo800eva: Enable power button as wakeup source
  ARM: mach-shmobile: armadillo800eva: Fix GPIO buttons descriptions
  ARM: at91/dts: remove partial parameter in at91sam9g25ek.dts
  ARM: at91/clock: fix PLLA overclock warning
  ARM: at91: fix rtc-at91sam9 irq issue due to sparse irq support
  ARM: at91: fix system timer irq issue due to sparse irq support
  ARM: shmobile: sh73a0: fixup RELOC_BASE of intca_irq_pins_desc
2012-09-06 10:23:58 -07:00
Bjørn Mork
60e233a566 kobject: fix oops with "input0: bad kobj_uevent_env content in show_uevent()"
Fengguang Wu <fengguang.wu@intel.com> writes:

> After the __devinit* removal series, I can still get kernel panic in
> show_uevent(). So there are more sources of bug..
>
> Debug patch:
>
> @@ -343,8 +343,11 @@ static ssize_t show_uevent(struct device
>                 goto out;
>
>         /* copy keys to file */
> -       for (i = 0; i < env->envp_idx; i++)
> +       dev_err(dev, "uevent %d env[%d]: %s/.../%s\n", env->buflen, env->envp_idx, top_kobj->name, dev->kobj.name);
> +       for (i = 0; i < env->envp_idx; i++) {
> +               printk(KERN_ERR "uevent %d env[%d]: %s\n", (int)count, i, env->envp[i]);
>                 count += sprintf(&buf[count], "%s\n", env->envp[i]);
> +       }
>
> Oops message, the env[] is again not properly initilized:
>
> [   44.068623] input input0: uevent 61 env[805306368]: input0/.../input0
> [   44.069552] uevent 0 env[0]: (null)

This is a completely different CONFIG_HOTPLUG problem, only
demonstrating another reason why CONFIG_HOTPLUG should go away.  I had a
hard time trying to disable it anyway ;-)

The problem this time is lots of code assuming that a call to
add_uevent_var() will guarantee that env->buflen > 0.  This is not true
if CONFIG_HOTPLUG is unset.  So things like this end up overwriting
env->envp_idx because the array index is -1:

	if (add_uevent_var(env, "MODALIAS="))
		return -ENOMEM;
        len = input_print_modalias(&env->buf[env->buflen - 1],
				   sizeof(env->buf) - env->buflen,
				   dev, 0);

Don't know what the best action is, given that there seem to be a *lot*
of this around the kernel.  This patch "fixes" the problem for me, but I
don't know if it can be considered an appropriate fix.

[ It is the correct fix for now, for 3.7 forcing CONFIG_HOTPLUG to
always be on is the longterm fix, but it's too late for 3.6 and older
kernels to resolve this that way - gregkh ]

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Tested-by: Fengguang Wu <fengguang.wu@intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-09-06 10:13:58 -07:00
Pratyush Anand
f4a53c5511 usb: dwc3: gadget: fix pending isoc handling
If xfernotready is received and there is no request in request_list then
REQUEST_PENDING flag must be set, so that next request in ep queue is executed.

In case of isoc transfer, if xfernotready is already elapsed and even first
request has not been queued to request_list, then issue END TRANSFER, so that
you can receive xfernotready again and can have notion of current microframe.

Signed-off-by: Pratyush Anand <pratyush.anand@st.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:30 +03:00
Kuninori Morimoto
77975eec14 usb: renesas_usbhs: fixup DMA transport data alignment
renesas_usbhs dma can transport 8byte alignment data, not 4byte.
This patch fixup it.

Reported-by: Sugnan Prabhu S <sugnan.prabhu@renesasmobile.com>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:30 +03:00
Sebastian Andrzej Siewior
f3bb8e63a8 usb: gadget: at91udc: Don't check for ep->ep.desc
Earlier we used to check for ep->ep.desc to figure out if this ep has
already been enabled and if so, abort.
Ido Shayevitz removed the usb_endpoint_descriptor from private udc
structure 5a6506f00 ("usb: gadget: Update at91_udc to use
usb_endpoint_descriptor	inside the struct usb_ep") but did not fix up
the ep_enable condition because _now_ the member is always true and we
can't check if this ep is enabled twice.

Cc: Ido Shayevitz <idos@codeaurora.org>
Tested-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Tested-by: Mario Isidoro <Mario.Isidoro@tecmic.pt>
Cc: <stable@kernel.org> # v3.5
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:29 +03:00
Sebastian Andrzej Siewior
8b7dda554c usb: gadget: at91udc: don't overwrite driver data
The driver was converted to the new start/stop interface in f3d8bf34c2
("usb: gadget: at91_udc: convert to new style start/stop interface").
I overlooked that the driver is overwritting the private data which is
used by the composite framework. The udc driver doesn't read it, it is
only written here.

Tested-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Tested-by: Mario Isidoro <Mario.Isidoro@tecmic.pt>
Cc: <stable@kernel.org> # v3.5
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:29 +03:00
Kishon Vijay Abraham I
066618bc35 usb: dwc3: core: fix incorrect usage of resource pointer
Populate the resources for xhci afresh instead of directly using the
*struct resource* of core. *resource* structure has parent, sibling,
child pointers which should be filled only by resource API's. By
directly using the *resource* pointer of core in xhci, these parent,
sibling, child pointers are already populated even before
*platform_device_add* causing side effects.

Cc: stable@vger.kernel.org # v3.4, v3.5
Reported-by: Ruchika Kharwar <ruchika@ti.com>
Tested-by: Moiz Sonasath <m-sonasath@ti.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:28 +03:00
Sergei Shtylyov
7effdbd651 usb: musb: musbhsdma: fix IRQ check
dma_controller_create() in this MUSB DMA driver only regards 0 as a wrong IRQ
number, despite platform_get_irq_byname() that it calls returns -ENXIO in that
case. It leads to calling request_irq() with a negative IRQ number, and when it
naturally fails, the following is printed to the console:

request_irq -6 failed!

and the DMA controller is not created.

Fix this function to filter out the error values as well as 0.

Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:28 +03:00
Sergei Shtylyov
ff41aaa3b6 usb: musb: tusb6010: fix error path in tusb_probe()
On platform_device_add() failure, the TUSB6010 glue layer forgets to call
platform_device_put() -- probably due to a typo...

Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:27 +03:00
yuzheng ma
3067779b15 usb: musb: host: fix for musb_start_urb Oops
when using musb_urb_enqueue to submit three urbs to the same endpoint, when
hep->hcpriv is NULL, qh will be allocated when the first urb is completed.

When the IRQ completes the next two urbs, qh->hep->hcpriv will be set to NULL.
Now the second urb get musb->lock and executes musb_schedule(), but
next_urb(qh) is NULL, so musb_start_urb will Oops.

[ balbi@ti.com : practically rewrote commit log so it makes sense ]

Signed-off-by: mayuzheng <myz147@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:26 +03:00
Sebastian Andrzej Siewior
3b9c1c5ba7 usb: gadget: dummy_hcd: add support for USB_DT_BOS on rh
Without a reply for USB_DT_BOS the USB3 mode does not work since
448b6eb1 ("USB: Make sure to fetch the BOS desc for roothubs.).

Cc: stable@vger.kernel.org #v3.5
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:26 +03:00
Sebastian Andrzej Siewior
1b68a4ca2d usb: gadget: dummy_hcd: fixup error probe path
If USB2 host controller probes fine but USB3 does not then we don't
remove the USB controller properly and lock up the system while the HUB
code will try to enumerate the USB2 controller and access memory which
is no longer available in case the dummy_hcd was compiled as a module.

This is a problem since 448b6eb1 ("USB: Make sure to fetch the BOS desc
for roothubs.) if used in USB3 mode because dummy does not provide this
descriptor and explodes later.

Cc: stable@vger.kernel.org # v3.5
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:25 +03:00
Julia Lawall
c8e6507bde usb: gadget: s3c-hsotg.c: fix error return code
Convert a 0 error return code to a negative one, as returned elsewhere in the
function.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
identifier ret;
expression e,e1,e2,e3,e4,x;
@@

(
if (\(ret != 0\|ret < 0\) || ...) { ... return ...; }
|
ret = 0
)
... when != ret = e1
*x = \(kmalloc\|kzalloc\|kcalloc\|devm_kzalloc\|ioremap\|ioremap_nocache\|devm_ioremap\|devm_ioremap_nocache\)(...);
... when != x = e2
    when != ret = e3
*if (x == NULL || ...)
{
  ... when != ret = e4
*  return ret;
}
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:25 +03:00
Pratyush Anand
0416e494ce usb: dwc3: ep0: correct cache sync issue in case of ep0_bounced
In case of ep0 out, if length is not aligned to maxpacket size then we use
dwc->ep_bounce_addr for dma transfer and not request->dma. Since, we have
alreday done memcpy from dwc->ep0_bounce to request->buf, so we do not need to
issue cache sync function. In fact, cache sync function will bring wrong data
in request->buf from request->dma in this scenario.

So, cache sync function must not be executed in case of ep0 bounced.

Cc: <stable@vger.kernel.org> # v3.4 v3.5
Signed-off-by: Pratyush Anand <pratyush.anand@st.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:24 +03:00
Andrzej Pietrasiewicz
ea0e627623 usb: gadget: add multiple definition guards
If f_fs.c and u_serial.c are combined together using #include, which has
been a common practice so far, the pr_vdebug macro is defined multiple
times. Define it only once.

Acked-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
2012-09-06 19:52:23 +03:00
Linus Torvalds
c7c6bf1e8c One patch, fixing DIV_ROUND_CLOSEST to support negative dividends.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJQSCWfAAoJEMsfJm/On5mBvicP/0CmzUgasB1MVpBpxZeaLrcf
 buGw5GZpH/Kh7h+4mdfY5egzvn0J9lFt9gWB58lw1xaQhHgihaus/h63K9nDQpyb
 NhsuGDY628st9cJWBFU18KcnSjVKNSEdVOZLtSkqzpbtAiy6zH0pQGfNPCSZaJuo
 XngjHAyIHZaAyORgwudGm9hrTqTGNUdaLPp1NbXO1N7+/Upnm5f237XUWqgboTgK
 4BGVOG6Prjm6ytJqc+eXg/iUACPgdG8Fe8rQMhRm0HjIEdX58+xfjrOZ3IPqxqcX
 F+ri3W615PazVi27wC6Afk9NqssvJagImEzRh7DbbMAeTesh0vAPMb8UihhhX4M6
 BsWU8zE1UVBEHJmi0ZT/Q+5v3heLbBd2kbmyorSBvHZyH+zFaAgvWVSqMCWguKO+
 CBptQnFhFY209Pi3S79tZFe7g5T6xMFddGW+0Wpp7pdT+BgC9EL7UBJGctCzO7Yq
 ipfCtRzZmJO7HnQic9T7XQhQvmCNjZEXHIooFZgZ6uF3GJL0Ipetc3t/uHwZ2C+E
 TwX4eNJH/IxgyRJszjCyKWs6iu7RaRQu7lq4a6ZpROmQJIW64pEF/ZWQ2+QULwnN
 pX2j2mLPltidjUiJ6uAIyzZr8FL97uLSLDkWhc4fZTsDC+2NOLwaK7nPErO1M6Rc
 C9fde4G5GOhkCaGrZX83
 =eZQ4
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull a hwmon fix from Guenter Roeck:
 "One patch, fixing DIV_ROUND_CLOSEST to support negative dividends.

  While the changes are not in the drivers/hwmon directory, the problem
  primarily affects hwmon drivers, and it makes sense to push the patch
  through the hwmon tree."

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  linux/kernel.h: Fix DIV_ROUND_CLOSEST to support negative dividends
2012-09-06 09:39:47 -07:00
Linus Torvalds
bd12ce8cc2 Merge branch 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild
Pull kbuild fixes from Michal Marek:
 "These are two fixes that should go into 3.6.  The link-vmlinux.sh one
  is obvious.

  The other one fixes make firmware_install with certain configurations,
  where a file in the toplevel firmware tree gets installed first, and
  $(INSTALL_FW_PATH)/$$(dir <file>) results in /lib/firmware/./, which
  confuses make 3.82 for some reason."

* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  firmware: fix directory creation rule matching with make 3.82
  link-vmlinux.sh: Fix stray "echo" in error message
2012-09-06 09:38:25 -07:00
Dave Jones
80de7c3138 Remove user-triggerable BUG from mpol_to_str
Trivially triggerable, found by trinity:

  kernel BUG at mm/mempolicy.c:2546!
  Process trinity-child2 (pid: 23988, threadinfo ffff88010197e000, task ffff88007821a670)
  Call Trace:
    show_numa_map+0xd5/0x450
    show_pid_numa_map+0x13/0x20
    traverse+0xf2/0x230
    seq_read+0x34b/0x3e0
    vfs_read+0xac/0x180
    sys_pread64+0xa2/0xc0
    system_call_fastpath+0x1a/0x1f
  RIP: mpol_to_str+0x156/0x360

Cc: stable@vger.kernel.org
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-09-06 09:37:58 -07:00
Trond Myklebust
1f1ea6c2d9 NFSv4: Fix buffer overflow checking in __nfs4_get_acl_uncached
Pass the checks made by decode_getacl back to __nfs4_get_acl_uncached
so that it knows if the acl has been truncated.

The current overflow checking is broken, resulting in Oopses on
user-triggered nfs4_getfacl calls, and is opaque to the point
where several attempts at fixing it have failed.
This patch tries to clean up the code in addition to fixing the
Oopses by ensuring that the overflow checks are performed in
a single place (decode_getacl). If the overflow check failed,
we will still be able to report the acl length, but at least
we will no longer attempt to cache the acl or copy the
truncated contents to user space.

Reported-by: Sachin Prabhu <sprabhu@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Tested-by: Sachin Prabhu <sprabhu@redhat.com>
2012-09-06 11:11:53 -04:00
Konrad Rzeszutek Wilk
80ba77dfbc xen/pciback: Fix proper FLR steps.
When we do FLR and save PCI config we did it in the wrong order.
The end result was that if a PCI device was unbind from
its driver, then binded to xen-pciback, and then back to its
driver we would get:

> lspci -s 04:00.0
04:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection
13:42:12 # 4 :~/
> echo "0000:04:00.0" > /sys/bus/pci/drivers/pciback/unbind
> modprobe e1000e
e1000e: Intel(R) PRO/1000 Network Driver - 2.0.0-k
e1000e: Copyright(c) 1999 - 2012 Intel Corporation.
e1000e 0000:04:00.0: Disabling ASPM L0s L1
e1000e 0000:04:00.0: enabling device (0000 -> 0002)
xen: registering gsi 48 triggering 0 polarity 1
Already setup the GSI :48
e1000e 0000:04:00.0: Interrupt Throttling Rate (ints/sec) set to dynamic conservative mode
e1000e: probe of 0000:04:00.0 failed with error -2

This fixes it by first saving the PCI configuration space, then
doing the FLR.

Reported-by: Ren, Yongjie <yongjie.ren@intel.com>
Reported-and-Tested-by: Tobias Geiger <tobias.geiger@vido.info>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
CC: stable@vger.kernel.org
2012-09-06 09:22:02 -04:00
Takashi Iwai
1213a205f9 ALSA: usb-audio: Fix bogus error messages for delay accounting
The recent fix for the missing fine delayed time adjustment gives
strange error messages at each start of the playback stream, such as
  delay: estimated 0, actual 352
  delay: estimated 353, actual 705

These come from the sanity check in retire_playback_urb().  Before the
stream is activated via start_endpoints(), a few silent packets have
been already sent.  And at this point the delay account is still in
the state as if the new packets are just queued, so the driver gets
confused and spews the bogus error messages.

For fixing the issue, we just need to check whether the received
packet is valid, whether it's zero sized or not.

Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Cc: <stable@vger.kernel.org> [v3.5+]
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-09-06 15:00:15 +02:00
Eric Dumazet
0626af3139 netfilter: take care of timewait sockets
Sami Farin reported crashes in xt_LOG because it assumes skb->sk is a
full blown socket.

Since (41063e9 ipv4: Early TCP socket demux), we can have skb->sk
pointing to a timewait socket.

Same fix is needed in nfnetlink_log.

Diagnosed-by: Florian Westphal <fw@strlen.de>
Reported-by: Sami Farin <hvtaifwkbgefbaei@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-09-06 14:28:18 +02:00
Dylan Reid
57b2d68863 ASoC: samsung dma - Don't indicate support for pause/resume.
The pause and resume operations indicate that the stream can be
un-paused/resumed from the exact location they were paused/suspended.
This is not true for this driver, the pause and suspend triggers share
the same code path with stop, they flush all pending DMA transfers.
This drops all pending samples.  The pause_release/resume triggers are
the same as start, except that prepare won't be called beforehand,
nothing will be enqueued to the DMA engine and nothing will happen (no
audio).  Removing the pause flag will let apps know that it isn't
supported.  Removing the resume flag will cause user space to call
prepare and start instead of resume, so audio will continue playing when
the system wakes up.

Before removing the pause and resume flags, I tested this on an exynos
5250, using 'aplay -i'. Pause/un-pause leads to silence followed by a
write error.  Suspend/resume testing led to the same result.  Removing
the two flags fixes suspend/resume (since snd_pcm_prepare is called
again). And leads to a proper reporting of pause not supported.

Signed-off-by: Dylan Reid <dgreid@chromium.org>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: stable@vger.kernel.org
2012-09-06 18:55:59 +08:00
Takashi Iwai
ab548d2dba ALSA: hda - Fix missing Master volume for STAC9200/925x
With the commit [2faa3bf: ALSA: hda - Rewrite the mute-LED hook with
vmaster hook in patch_sigmatel.c], the former Master volume control
was converted to PCM.  This was supposed to be covered by the vmaster
control.  But due to the lack of "PCM" slave definition, this didn't
happen properly.  The patch fixes the missing entry.

Reported-by: Andrew Shadura <bugzilla@tut.by>
Cc: <stable@vger.kernel.org> [v3.4+]
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-09-06 10:10:11 +02:00
Linus Torvalds
0809095036 MMC fixes for 3.6-rc5:
- a firmware bug on several Samsung MoviNAND eMMC models causes
    permanent corruption on the device when secure erase and secure trim
    requests are made, so we disable those requests on these eMMC devices.
  - atmel-mci: fix a hang with some SD cards by waiting for not-busy flag.
  - dw_mmc: low-power mode breaks SDIO interrupts; fix PIO error handling;
    fix handling of error interrupts.
  - mxs-mmc: fix deadlocks; fix compile error due to dma.h arch change.
  - omap: fix broken PIO mode causing memory corruption.
  - sdhci-esdhc: fix card detection.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJQR/7BAAoJEHNBYZ7TNxYMT3gQANQDdD/wvYFgUvssIAgdQJdl
 KORu7ke5ks2Gvx0Ef0Ch+GXIFFDoqH0zMkQMXc+c0BdhR4BF/vNBbBYZoVYyvmgK
 GUHK740nznwp9edIVbGbRm+FSxDG7ZpjUlFq+SInBOehIw7tQAep3Tbv1rYZzu6M
 SUBGc31Nif9eCvTKzGU195qbutAhvcGmqEvi/ALP9bUCYR7QaTt/oD3YYuUD/ZjV
 O/mf3R30vrV+R1lrQRqzXIi8vCojPMzkVU8x+C8PdOTjewvYviM0huW9+Lv6WsxK
 DzhCgoNvrB1Q/rYtiNZ1gyWd5cTZWns308slREEwywD5IBQJMo5T68Q/D+h2PkS9
 JCvtiZ+ryycvINyUn2JxEZuygseUiT/nMS0ijSidQY7vrZlNR8JrrK3qf0vRDkWo
 0mXhQG5DvxDN6Dx9K15OgTAuABek1CEdKFD0R/a3X41H/KUvKQwWPWmdTybBriAo
 8jkUl64YMpFt+LZqrmeQ1oOcwc8BvMvcM4dnMbkXrHvBb926fENBIMGNeI7O10o8
 597dEpLlKNZj8e8YxJjbqaCuFhOp/pHRQy+rxdjP28V4mfHASQGgsnFAO4qV7B24
 1wqtSu5ZCor4K616wfDvMYgL88pMg7fVEV3nN9Cc/WpsBaBPZv7vOQbp/f40rKWa
 GRb9+9NC0WU0CP28GlCq
 =n1hi
 -----END PGP SIGNATURE-----

Merge tag 'mmc-fixes-for-3.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc

Pull MMC fixes from Chris Ball:
 - a firmware bug on several Samsung MoviNAND eMMC models causes
   permanent corruption on the device when secure erase and secure trim
   requests are made, so we disable those requests on these eMMC devices.
 - atmel-mci: fix a hang with some SD cards by waiting for not-busy flag.
 - dw_mmc: low-power mode breaks SDIO interrupts; fix PIO error handling;
   fix handling of error interrupts.
 - mxs-mmc: fix deadlocks; fix compile error due to dma.h arch change.
 - omap: fix broken PIO mode causing memory corruption.
 - sdhci-esdhc: fix card detection.

* tag 'mmc-fixes-for-3.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc:
  mmc: omap: fix broken PIO mode
  mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption.
  mmc: dw_mmc: Disable low power mode if SDIO interrupts are used
  mmc: dw_mmc: fix error handling in PIO mode
  mmc: dw_mmc: correct mishandling error interrupt
  mmc: dw_mmc: amend using error interrupt status
  mmc: atmel-mci: not busy flag has also to be used for read operations
  mmc: sdhci-esdhc: break out early if clock is 0
  mmc: mxs-mmc: fix deadlock caused by recursion loop
  mmc: mxs-mmc: fix deadlock in SDIO IRQ case
  mmc: bfin_sdh: fix dma_desc_array build error
2012-09-05 19:41:58 -07:00
Miklos Szeredi
bc6c83641e uml: fix compile error in deliver_alarm()
Fix the following compile error on UML.

  arch/um/os-Linux/time.c: In function 'deliver_alarm':
  arch/um/os-Linux/time.c:117:3: error: too few arguments to function 'alarm_handler'
  arch/um/os-Linux/internal.h:1:6: note: declared here

The error was introduced by commit d3c1cfcd ("um: pass siginfo to guest
process") in 3.6-rc1.

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: Martin Pärtel <martin.partel@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-09-05 19:40:59 -07:00
Alan Cox
8a55ade765 dj: memory scribble in logi_dj
Allocate a structure not a pointer to it !

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-09-05 19:37:08 -07:00
Linus Torvalds
cb4f9a2964 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
Pull powerpc fixes from Benjamin Herrenschmidt:
 "Here are a few fixes for 3.6 that were piling up while I was away or
  busy (I was mostly MIA a week or two before San Diego).

  Some fixes from Anton fixing up issues with our relatively new DSCR
  control feature, and a few other fixes that are either regressions or
  bugs nasty enough to warrant not waiting."

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc: Don't use __put_user() in patch_instruction
  powerpc: Make sure IPI handlers see data written by IPI senders
  powerpc: Restore correct DSCR in context switch
  powerpc: Fix DSCR inheritance in copy_thread()
  powerpc: Keep thread.dscr and thread.dscr_inherit in sync
  powerpc: Update DSCR on all CPUs when writing sysfs dscr_default
  powerpc/powernv: Always go into nap mode when CPU is offline
  powerpc: Give hypervisor decrementer interrupts their own handler
  powerpc/vphn: Fix arch_update_cpu_topology() return value
2012-09-05 18:41:32 -07:00
Linus Torvalds
813e64382a These are some GPIO regression fixes for v3.6:
- Erroneous debug message from of_get_named_gpio_flags()
 - Make sure the MC9S08DZ60 GPIO driver depend on I2C being
   compiled in (not module) or allmodconfig breaks.
 - Check return value from irq_alloc_descs() in the Emma
   Mobile GPIO driver.
 - Assign the owner field for the rdc321x driver so the
   module won't be removed if it has active GPIOs.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJQRuO5AAoJEEEQszewGV1zxw0QAMvCidLRwqdoHfWOIPx3YI7x
 lp44BteGZagQrELvVo/16+P5/eRumOo4Pyd/KFIZjmwhKAtHjbl0j01fAijTy0XN
 bAYPHoIhekwXr1PPVRFCcqqQFxa8JkY6lPVx3fRoCAiyBeoj3RXTElaE6NmqE81I
 ZGSAul2WOKzHjSn2aKGc5ciwiC5sbsI/KxxnZZxv4Mrqz32l71dn8AmqazTXVSBA
 Mr7hrr8N2sO1O5SIMcdH1VjLsN73XPDuwSKHJw55uAA4TqxZ5Z0T1HYERxh97Nql
 p//x4wMDV5orBIkQQROFu2FjxHiPDcnEp8bFq5oU/QnC9jJSH3qiTvJhK3OkdN4r
 W+hhs26iD31fJG/nK3NVWd0JIe8dJm6gh/dDo6sQXQKnaUospZayoz5M8DkFiyo8
 Ba6nrSAssIdwoY+cYwo4q+VN63qAEKFC/PolehKayUoB0RWdV178DX6v4Dl9TwHs
 UeGIGzR2ymiAZJsMBZYP/simRgdljNgcr7EuhAecpI9CYnV7fsuOBEQydcmOsIHq
 t2YTtzRkX/RUiKcFieXOoGv0ixnrYam4VLGBHQuDRikvyyS6mlh6KDrnWlrko4al
 atObhaEgOJ+NUz1izIZvg8J4t/AMybNYRdZl8xW9s3YgUFne1wBCdmxxL9Cyax/3
 jHL99DkmoYVISU0uOyPG
 =QDOR
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio

Pull GPIO fixes from Linus Walleij:
 "These are some GPIO regression fixes for v3.6:
   - Erroneous debug message from of_get_named_gpio_flags()
   - Make sure the MC9S08DZ60 GPIO driver depend on I2C being compiled
     in (not module) or allmodconfig breaks.
   - Check return value from irq_alloc_descs() in the Emma Mobile GPIO
     driver.
   - Assign the owner field for the rdc321x driver so the module won't
     be removed if it has active GPIOs."

* tag 'gpio-fixes-for-v3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  gpio: rdc321x: Prevent removal of modules exporting active GPIOs
  gpio: em: Fix checking return value of irq_alloc_descs
  gpio: mc9s08dz60: Fix build error if I2C=m
  gpio: Fix debug message in of_get_named_gpio_flags()
2012-09-05 18:40:12 -07:00
Linus Torvalds
5e682c0e54 Sound fixes for 3.6-rc5
There are nothing scaring, contains only small fixes for HD-audio and
 USB-audio:
 - EPSS regression fix and GPIO fix for HD-audio IDT codecs
 - A series of USB-audio regression fixes that are found since 3.5 kernel
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.19 (GNU/Linux)
 
 iQIcBAABAgAGBQJQRZeCAAoJEGwxgFQ9KSmkPikP/2ZpK3xvf1WnEJT+K+2ErsI+
 KEChW70QNRcghvbOa0viUx6v3B8tkPhDuo6YgTIjiP+yde0BjVujSXYAOvznvHxy
 ea8xX7hR0j0G9y0FVb0oYlj+CIZWupChz9V2uSB7EudMvYPUBUzkkDtrpsb4+t3z
 0e/4VEEkWIVhVyuPEnaL8fdzYPLs7UA6/QotC/SLxnFSmbaGvUuryssEmb99vl0h
 xQHr8FuIF12DTS1ZwdCYcL9VTFriXcYeIWf+ThaoY3evSeStCUuboHf69RUy1WR9
 JAn0hArI358m/Xicmr6pG6y0VqIPqfFLgsjXgt8/Fe0ljTcYbXoWL09MXVSL40wA
 2jFWAizPe8/OAASHpgzWNb/8WWDFL/XWoeefSwL1lOIArlZhe07b61bA69s2GG0k
 /rwZn058ZgQCgqC5Dph7RD7squ0ANg6WIq8obdJevLgekw/MCkKUPNA6N2lXjboT
 KaKEouLUff72A2WKiE7W6ykNATWjqteDe7+11HhDC543lAKBnq/Zyv8zjsqhzPuU
 TnxA0W1pcfc4GLRBaedIH2AeEzQc/aT0RE79sGGzPSB4SG0MLTRWT3yUXMiVTeWB
 vBb4ZuEvGeo6i81QovIN/y1m/kEljaSu7uSi0Kzopq663HsUEvJ1BvLAviZsJZ01
 pSNAne3Ze7kWQwyWkVDQ
 =AbfN
 -----END PGP SIGNATURE-----

Merge tag 'sound-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "There are nothing scaring, contains only small fixes for HD-audio and
  USB-audio:
   - EPSS regression fix and GPIO fix for HD-audio IDT codecs
   - A series of USB-audio regression fixes that are found since 3.5
     kernel"

* tag 'sound-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: snd-usb: fix cross-interface streaming devices
  ALSA: snd-usb: fix calls to next_packet_size
  ALSA: snd-usb: restore delay information
  ALSA: snd-usb: use list_for_each_safe for endpoint resources
  ALSA: snd-usb: Fix URB cancellation at stream start
  ALSA: hda - Don't trust codec EPSS bit for IDT 92HD83xx & co
  ALSA: hda - Avoid unnecessary parameter read for EPSS
  ALSA: hda - Do not set GPIOs for speakers on IDT if there are no speakers
2012-09-05 18:38:52 -07:00
Linus Torvalds
6d1a05033b fbdev fixes for 3.6
- a fix by Paul Cercueil to prevent a possible buffer overflow
 - a fix by Bruno Prémont to prevent a rare sleep in invalid context
 - a fix by Julia Lawall for a double free in auo_k190x
 - a fix by Dan Carpenter to prevent a division by zero in mb862xxfb
 - a regression fix by Tomi Valkeinen for the SDI output in OMAP
 - a fix by Grazvydas Ignotas to fix the console colors in OMAP
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJQRdW3AAoJECSVL5KnPj1PKpcQAJn9tS3BeTi9zcV5sk31U1Jy
 kc72y318bg5jpJPDgWOfM+9CY3yhezVi2q9odiTUtuhx5WzWbOJh7/TuUGoWGKaY
 dUvTqen83hFGKfTs+eujTbAgAH3+PGIGo5VmTyx1TVj5Vnb1m3wsU6jwDzalfox8
 MChhoOyrCpn6wxiqSuF6eoqZ01jASsNDW1rQaxi6AdaKKxJXrG22phMpwmfZz9Mt
 naIx1aI8aowkZ5gEBlOsnX6O0kjPVyQWlXqljGuZxRJZD+x9MKj/8nU1PITi0Pz2
 DNAQz3ZU/apAooLCFsBF7oGtMUJ6e/v61LdIcMZZzw569tCtnmidwdU0ss2JJhAP
 aDhdtWESbxFbpggOEWD36Wq6Z5ekCW5xfTR+ZASiknSMAT6rmqfX4NPJ3750jjVb
 Aa9Ds37KQgfUrQIEhKCoZPyPTtCK98fQUHhxlf2I0TbuCGBvbZEAnRpuc1eelNo9
 G9IJKG1vnea2x+DmsR1OEqFpHU3fn82T7RYm3SYc6ZDJwU58GxEvTzytGBs5YxLe
 bTTM2mTT3m23l8BBp6UPZjESJoBv2bd+cY70MCxhVIKHXbQYdzet0DDEDA6t2UQK
 isIOLXMGqxTXNZq7bM+q9UuYUuAkTUv1VmwGy5YJOD1JtOhFGQtxBe59OMmrC1H5
 aU+GP6btV/biv8cTs/JG
 =8eFG
 -----END PGP SIGNATURE-----

Merge tag 'fbdev-fixes-for-3.6-1' of git://github.com/schandinat/linux-2.6

Pull fbdev fixes from Florian Tobias Schandinat:
 - a fix by Paul Cercueil to prevent a possible buffer overflow
 - a fix by Bruno Prémont to prevent a rare sleep in invalid context
 - a fix by Julia Lawall for a double free in auo_k190x
 - a fix by Dan Carpenter to prevent a division by zero in mb862xxfb
 - a regression fix by Tomi Valkeinen for the SDI output in OMAP
 - a fix by Grazvydas Ignotas to fix the console colors in OMAP

* tag 'fbdev-fixes-for-3.6-1' of git://github.com/schandinat/linux-2.6:
  OMAPFB: fix framebuffer console colors
  OMAPDSS: Fix SDI PLL locking
  video: mb862xxfb: prevent divide by zero bug
  drivers/video/auo_k190x.c: drop kfree of devm_kzalloc's data
  fbcon: Fix bit_putcs() call to kmalloc(s, GFP_KERNEL)
  fbcon: prevent possible buffer overflow.
2012-09-05 18:38:02 -07:00
Linus Torvalds
50234c58d3 A single small fix for memory deallocation: we allocated memory using
'kmem_cache_alloc()' but were freeing it using 'kfree()' in some cases.
 Now we fix this by using 'kmem_cache_free()' instead.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJQRaL3AAoJECmIfjd9wqK01AMP+wazg4SPSPoyj8HJFOHy/ZWu
 Y18TNMtiSQDL2i9cH34rj6sxdNZYy+tHYt64VGQ+jBDTXIOJyZ9HhmPVcAuK5/CJ
 ol7YzFRsKCF7dLps3MmUejgf15nnTVgQAMzXTbJ5Cv9FB+pex87XaObOK8phUk4r
 k0o5ORwViZRXm9KPqIv65iviAw6fnzJDVaFy8WGGk3WX+gBUZq+pz78gB96N2LKE
 rHjD2SyzAIam9Mv8kcJRvJ4TjWAJrPMxAAF9uGzxx/D9UbpiArmu233qCeGTXO+p
 3v94lyLcWPsMA+ugwT3taHH0HgpXM1DFQb6ln/SRtMwiITi5mFY+O1MORQlb8llB
 gyOUKKHeTBhD8myoStZH3lwN0lelyhcKO/s9WRZ6pPaV9992UVau+dWBTNCswckw
 N+qKQHJNQEw47OaqOhYKY7lIjxRQIVZZTffJuTJWz3Ck+d63b2U46pke91G7pqrI
 YiJ8MukunurXyK4ItwJ1XKvpjgrayABGhHAR8tzFQAlIy7a74T9J1qKlXSfIoB0T
 L0DA30Txwb5wbfjX6unoGsVLv8Uo7oh5JltZJ2GCrL3eNS4iIW6nitGX5juWZFBl
 GcarWW6lIeg9qYlz1jG5+Iqckb+IGCJqBrHrFNP9E6jpigw3K6pVxch81N3tBBld
 2aq3PcZ0e0TAGokunElP
 =Bin1
 -----END PGP SIGNATURE-----

Merge tag 'upstream-3.6-rc5' of git://git.infradead.org/linux-ubi

Pull ubi fix from Artem Bityutskiy:
 "A single small fix for memory deallocation: we allocated memory using
  'kmem_cache_alloc()' but were freeing it using 'kfree()' in some
  cases.  Now we fix this by using 'kmem_cache_free()' instead."

* tag 'upstream-3.6-rc5' of git://git.infradead.org/linux-ubi:
  UBI: fix a horrible memory deallocation bug
2012-09-05 18:37:16 -07:00
Mikulas Patocka
ed6fe9d614 Fix order of arguments to compat_put_time[spec|val]
Commit 644595f896 ("compat: Handle COMPAT_USE_64BIT_TIME in
net/socket.c") introduced a bug where the helper functions to take
either a 64-bit or compat time[spec|val] got the arguments in the wrong
order, passing the kernel stack pointer off as a user pointer (and vice
versa).

Because of the user address range check, that in turn then causes an
EFAULT due to the user pointer range checking failing for the kernel
address.  Incorrectly resuling in a failed system call for 32-bit
processes with a 64-bit kernel.

On odder architectures like HP-PA (with separate user/kernel address
spaces), it can be used read kernel memory.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-09-05 18:34:13 -07:00
Greg Kroah-Hartman
7f7cd3cac9 xHCI 3.6 bug fixes.
Hi Greg,
 
 Here's seven bugfixes for 3.6.  All of them are marked for stable, and
 most are vendor-specific fixes.
 
 Details:
 --------
 
  - Commits 052c7f9 and 2963657 fix a couple stupid mistakes I made in a
    Intel xHCI bug fix patch I pushed just before I left for vacation.
 
  - Commits 29d2145 and a96874a fix issues with the Intel Panther Point
    EHCI to xHCI port switchover.
 
  - Commit 71c731a adds the work-around for the TI redriver "dead port"
    issue.
 
  - Commit 319acdf adds a fix for non-PCI xHCI platform drivers.
 
  - Commit e955a1c works around the UEFI issue with the xHCI host
    sometimes returning 0xff's in the MMIO on boot.
 
 Sarah Sharp
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJQR/DPAAoJEBMGWMLi1Gc5OeIP/2MsrUYUXi8TXHmyYrSYryVb
 +fIHky+qmAP6OTHgNm6J2hyfUYWCOZ1yBg61xXyDSLyX9lF21dA37Q5BEhtEL2VC
 /mxrXr2/iH72JpTuiptXuaxsolGlMy1V+M0CRkKc++1xbh9gqm9n+4h/VcXdKxjG
 hrYECWTKECAlsE8GMFSxN+m237WDSOq8+j39RlEY8Qp2+z3XGSiYVDX71gfH4OSG
 Cra8Lwg9u/IHJunNw6QsLtcPN/SHLLX431VQzwxDMeOyJHmD63+dPn0F18Dsf5Bj
 R030ovh4OZl9cPa5RrlT3U1Pucl16wySOzpE8KWgSlcX//2zY5f6ljo7xIDRQ3AV
 EGxvJ5w6VexJWvQL3bMBpcc8uqLnIxG+xI0k1zRikQ9CJ8qfbcJj/TnE/CW2e51A
 ICY47UkvCZf3hPEh6aEGYJxzwbPEcuVwtJ5G9TIxurc3fYlWal11kvxw30vQpHw4
 A2WFVPjWFPvVeWEsIJ8n3y/zjyqM/T6vF24jzTW+uiTUuzm6UjSkXV07lE/3DSNo
 yCvGEXfgDncvUdFsUItey4RmRc7TZs+a68Ym3id27+HFWqjkjokCotsYSV1Xoi6I
 cRDrdCugfVW6zB1JH1Ys7YDN9nGPv13db1NEn11kT1NOyAflrbPRvHWcKdO6J4hN
 tz99e1nKL7QDnfxUQRmJ
 =124d
 -----END PGP SIGNATURE-----

Merge tag 'for-usb-linus-2012-09-05' of git://git.kernel.org/pub/scm/linux/kernel/git/sarah/xhci into usb-linus

xHCI 3.6 bug fixes.

Hi Greg,

Here's seven bugfixes for 3.6.  All of them are marked for stable, and
most are vendor-specific fixes.

Details:
--------

 - Commits 052c7f9 and 2963657 fix a couple stupid mistakes I made in a
   Intel xHCI bug fix patch I pushed just before I left for vacation.

 - Commits 29d2145 and a96874a fix issues with the Intel Panther Point
   EHCI to xHCI port switchover.

 - Commit 71c731a adds the work-around for the TI redriver "dead port"
   issue.

 - Commit 319acdf adds a fix for non-PCI xHCI platform drivers.

 - Commit e955a1c works around the UEFI issue with the xHCI host
   sometimes returning 0xff's in the MMIO on boot.

Sarah Sharp
2012-09-05 18:10:11 -07:00
Paolo Bonzini
d5829eac5f target: fix use-after-free with PSCSI sense data
The pointer to the sense buffer is fetched by transport_get_sense_data,
but this is called by target_complete_ok_work long after pscsi_req_done
has freed the struct that contains it.

Pass instead the fabric's sense buffer to transport_complete,
and copy the data to it directly in transport_complete.  Setting
SCF_TRANSPORT_TASK_SENSE also becomes a duty of transport_complete.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2012-09-05 17:20:28 -07:00
Paolo Bonzini
27a2709912 target: simplify code around transport_get_sense_data
The error conditions in transport_get_sense_data are superfluous
and complicate the code unnecessarily:

* SCF_TRANSPORT_TASK_SENSE is checked in the caller;

* it's simply part of the invariants of dev->transport->get_sense_buffer
  that it must be there if transport_complete ever returns 1, and that
  it must not return NULL.  Besides, the entire callback will disappear
  with the next patch.

* similarly in the caller we can expect that sense data is only sent
  for non-zero cmd->scsi_status.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2012-09-05 17:20:19 -07:00
Paolo Bonzini
6138ed2ab8 target: move transport_get_sense_data
We will be calling it from transport_complete_cmd, avoid forward
declarations.  No semantic change.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2012-09-05 17:19:46 -07:00
Fabio Estevam
37f45cc54c ASoC: mc13783: Remove mono support
Playing a mono track on a mc13783 codec results in incorrect playback rate.

Remove mono support so that a mono track can be played correctly.

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Tested-by: Gaëtan Carlier <gcembed@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2012-09-06 08:17:12 +08:00
Alan Stern
92fc7a8b0f USB: add device quirk for Joss Optical touchboard
This patch (as1604) adds a CONFIG_INTF_STRINGS quirk for the Joss
infrared touchboard device.  The device doesn't like to be asked for
its interface strings.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: adam ? <adam3337@wp.pl>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-09-05 16:56:58 -07:00
Nicolas Ferre
6fffb77c83 USB: ohci-at91: fix PIO handling in relation with number of ports
If the number of ports present on the SoC/board is not the maximum
and that the platform data is not filled with all data, there is
an easy way to mess the PIO setup for this interface.
This quick fix addresses mis-configuration in USB host platform data
that is common in at91 boards since commit 0ee6d1e (USB: ohci-at91:
change maximum number of ports) that did not modified the associatd
board files.

Reported-by: Klaus Falkner <klaus.falkner@solectrix.de>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Cc: Stable <stable@vger.kernel.org> [3.4+]
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-09-05 16:56:58 -07:00
Horst Schirmeier
26a538b9ea USB: ftdi_sio: PID for NZR SEM 16+ USB
This adds the USB PID for the NZR SEM 16+ USB energy monitor device
<http://www.nzr.de>.  It works perfectly with the GPL software on
<http://schou.dk/linux/sparometer/>.

Signed-off-by: Horst Schirmeier <horst@schirmeier.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-09-05 16:43:49 -07:00
Éric Piel
dafc4f7be1 USB: ftdi-sio: add support for more Physik Instrumente devices
Commit b69cc67205 added support for the E-861.  After acquiring a C-867, I
realised that every Physik Instrumente's device has a different PID. They are
listed in the Windows device driver's .inf file. So here are all PIDs for the
current (and probably future) USB devices from Physik Instrumente.

Compiled, but only actually tested on the E-861 and C-867.

Signed-off-by: Éric Piel <piel@delmic.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-09-05 16:43:49 -07:00
Tejun Heo
ec58815ab0 workqueue: fix possible deadlock in idle worker rebinding
Currently, rebind_workers() and idle_worker_rebind() are two-way
interlocked.  rebind_workers() waits for idle workers to finish
rebinding and rebound idle workers wait for rebind_workers() to finish
rebinding busy workers before proceeding.

Unfortunately, this isn't enough.  The second wait from idle workers
is implemented as follows.

	wait_event(gcwq->rebind_hold, !(worker->flags & WORKER_REBIND));

rebind_workers() clears WORKER_REBIND, wakes up the idle workers and
then returns.  If CPU hotplug cycle happens again before one of the
idle workers finishes the above wait_event(), rebind_workers() will
repeat the first part of the handshake - set WORKER_REBIND again and
wait for the idle worker to finish rebinding - and this leads to
deadlock because the idle worker would be waiting for WORKER_REBIND to
clear.

This is fixed by adding another interlocking step at the end -
rebind_workers() now waits for all the idle workers to finish the
above WORKER_REBIND wait before returning.  This ensures that all
rebinding steps are complete on all idle workers before the next
hotplug cycle can happen.

This problem was diagnosed by Lai Jiangshan who also posted a patch to
fix the issue, upon which this patch is based.

This is the minimal fix and further patches are scheduled for the next
merge window to simplify the CPU hotplug path.

Signed-off-by: Tejun Heo <tj@kernel.org>
Original-patch-by: Lai Jiangshan <laijs@cn.fujitsu.com>
LKML-Reference: <1346516916-1991-3-git-send-email-laijs@cn.fujitsu.com>
2012-09-05 16:10:15 -07:00