Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Commits on Feb 13, 2012
  1. @gregkh

    Linux 3.0.21

    gregkh authored
  2. @gregkh

    net: fix NULL dereferences in check_peer_redir()

    Eric Dumazet authored gregkh committed
    [ Upstream commit d3aaeb3, along
      with dependent backports of commits:
         69cce1d
         9de79c1
         218fa90
         580da35
         f7e5704
         e049f28 ]
    
    Gergely Kalman reported crashes in check_peer_redir().
    
    It appears commit f39925d (ipv4: Cache learned redirect
    information in inetpeer.) added a race, leading to possible NULL ptr
    dereference.
    
    Since we can now change dst neighbour, we should make sure a reader can
    safely use a neighbour.
    
    Add RCU protection to dst neighbour, and make sure check_peer_redir()
    can be called safely by different cpus in parallel.
    
    As neighbours are already freed after one RCU grace period, this patch
    should not add typical RCU penalty (cache cold effects)
    
    Many thanks to Gergely for providing a pretty report pointing to the
    bug.
    
    Reported-by: Gergely Kalman <synapse@hippy.csoma.elte.hu>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  3. @gregkh

    powernow-k8: Fix indexing issue

    Andreas Herrmann authored gregkh committed
    commit a8eb284 upstream.
    
    The driver uses the pstate number from the status register as index in
    its table of ACPI pstates (powernow_table). This is wrong as this is
    not a 1-to-1 mapping.
    
    For example we can have _PSS information to just utilize Pstate 0 and
    Pstate 4, ie.
    
      powernow-k8: Core Performance Boosting: on.
      powernow-k8:    0 : pstate 0 (2200 MHz)
      powernow-k8:    1 : pstate 4 (1400 MHz)
    
    In this example the driver's powernow_table has just 2 entries. Using
    the pstate number (4) as index into this table is just plain wrong.
    
    Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
    Signed-off-by: Dave Jones <davej@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  4. @gregkh

    powernow-k8: Avoid Pstate MSR accesses on systems supporting CPB

    Andreas Herrmann authored gregkh committed
    commit 201bf0f upstream.
    
    Due to CPB we can't directly map SW Pstates to Pstate MSRs. Get rid of
    the paranoia check. (assuming that the ACPI Pstate information is
    correct.)
    
    Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
    Signed-off-by: Dave Jones <davej@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  5. @AxelLin @gregkh

    mmc: cb710 core: Add missing spin_lock_init for irq_lock of struct cb…

    AxelLin authored gregkh committed
    …710_chip
    
    commit b5266ea upstream.
    
    Signed-off-by: Axel Lin <axel.lin@gmail.com>
    Acked-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  6. @gregkh

    USB: add new zte 3g-dongle's pid to option.c

    Rui li authored gregkh committed
    commit 1608ea5 upstream.
    
    As ZTE have and will use more pid for new products this year,
    so we need to add some new zte 3g-dongle's pid on option.c ,
    and delete one pid 0x0154 because it use for mass-storage port.
    
    Signed-off-by: Rui li <li.rui27@zte.com.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  7. @milon21 @gregkh

    USB: usbserial: add new PID number (0xa951) to the ftdi driver

    milon21 authored gregkh committed
    commit 90451e6 upstream.
    
    Signed-off-by: Milan Kocian <milon@wq.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  8. @gregkh

    usb: Skip PCI USB quirk handling for Netlogic XLP

    Jayachandran C authored gregkh committed
    commit e4436a7 upstream.
    
    The Netlogic XLP SoC's on-chip USB controller appears as a PCI
    USB device, but does not need the EHCI/OHCI handoff done in
    usb/host/pci-quirks.c.
    
    The pci-quirks.c is enabled for all vendors and devices, and is
    enabled if USB and PCI are configured.
    
    If we do not skip the qurik handling on XLP, the readb() call in
    ehci_bios_handoff() will cause a crash since byte access is not
    supported for EHCI registers in XLP.
    
    Signed-off-by: Jayachandran C <jayachandranc@netlogicmicro.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  9. @lindi2 @gregkh

    usb: gadget: zero: fix bug in loopback autoresume handling

    lindi2 authored gregkh committed
    commit 683da59 upstream.
    
    ab943a2 (USB: gadget: gadget zero uses new suspend/resume hooks)
    introduced a copy-paste error where f_loopback.c writes to a variable
    declared in f_sourcesink.c. This prevents one from creating gadgets
    that only have a loopback function.
    
    Signed-off-by: Timo Juhani Lindfors <timo.lindfors@iki.fi>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  10. @lwfinger @gregkh

    staging: r8712u: Add new Sitecom UsB ID

    lwfinger authored gregkh committed
    commit 1793bf1 upstream.
    
    Add USB ID for SITECOM WLA-1000 V1 001 WLAN
    
    Reported-and-tested-by: Roland Gruber <post@rolandgruber.de>
    Reported-and-tested-by: Dario Lucia <dario.lucia@gmail.com>
    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  11. @ppaalanen @gregkh

    Staging: asus_oled: fix NULL-ptr crash on unloading

    ppaalanen authored gregkh committed
    commit 3589e74 upstream.
    
    Asus_oled triggers the following bug on module unloading:
    
     usbcore: deregistering interface driver asus-oled
     BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
     IP: [<ffffffff8111292b>] sysfs_delete_link+0x30/0x66
    
     Call Trace:
      [<ffffffff81225373>] device_remove_class_symlinks+0x6b/0x70
      [<ffffffff812256a8>] device_del+0x9f/0x1ab
      [<ffffffff812257c5>] device_unregister+0x11/0x1e
      [<ffffffffa000cb82>] asus_oled_disconnect+0x4f/0x9e [asus_oled]
      [<ffffffff81277430>] usb_unbind_interface+0x54/0x103
      [<ffffffff812276c4>] __device_release_driver+0xa2/0xeb
      [<ffffffff81227794>] driver_detach+0x87/0xad
      [<ffffffff812269e9>] bus_remove_driver+0x91/0xc1
      [<ffffffff81227fb4>] driver_unregister+0x66/0x6e
      [<ffffffff812771ed>] usb_deregister+0xbb/0xc4
      [<ffffffffa000ce87>] asus_oled_exit+0x2f/0x31 [asus_oled]
      [<ffffffff81068365>] sys_delete_module+0x1b8/0x21b
      [<ffffffff810ae3de>] ? do_munmap+0x2ef/0x313
      [<ffffffff813699bb>] system_call_fastpath+0x16/0x1b
    
    This is due to an incorrect destruction sequence in asus_oled_exit().
    
    Fix the order, fixes the bug. Tested on an Asus G50V laptop only.
    
    Cc: Jakub Schmidtke <sjakub@gmail.com>
    Signed-off-by: Pekka Paalanen <pq@iki.fi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  12. @ppaalanen @gregkh

    Staging: asus_oled: fix image processing

    ppaalanen authored gregkh committed
    commit 635032c upstream.
    
    Programming an image was broken, because odev->buf_offs was not advanced
    for val == 0 in append_values(). This regression was introduced in:
    
     commit 1ff12a4
     Author: Kevin A. Granade <kevin.granade@gmail.com>
     Date:   Sat Sep 5 01:03:39 2009 -0500
    
         Staging: asus_oled: Cleaned up checkpatch issues.
    
    Fix the image processing by special-casing val == 0.
    
    I have tested this change on an Asus G50V laptop only.
    
    Cc: Jakub Schmidtke <sjakub@gmail.com>
    Cc: Kevin A. Granade <kevin.granade@gmail.com>
    Signed-off-by: Pekka Paalanen <pq@iki.fi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  13. @rolandd @gregkh

    target: Correct sense key for INVALID FIELD IN {PARAMETER LIST,CDB}

    rolandd authored gregkh committed
    commit 9fbc890 upstream.
    
    According to SPC-4, the sense key for commands that are failed with
    INVALID FIELD IN PARAMETER LIST and INVALID FIELD IN CDB should be
    ILLEGAL REQUEST (5h) rather than ABORTED COMMAND (Bh).  Without this
    patch, a tcm_loop LUN incorrectly gives:
    
        # sg_raw -r 1 -v /dev/sda 3 1 0 0 ff 0
        Sense Information:
         Fixed format, current;  Sense key: Aborted Command
         Additional sense: Invalid field in cdb
         Raw sense data (in hex):
                70 00 0b 00 00 00 00 0a  00 00 00 00 24 00 00 00
                00 00
    
    While a real SCSI disk gives:
    
        Sense Information:
         Fixed format, current;  Sense key: Illegal Request
         Additional sense: Invalid field in cdb
         Raw sense data (in hex):
                70 00 05 00 00 00 00 18  00 00 00 00 24 00 00 00
                00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
    
    with the main point being that the real disk gives a sense key of
    ILLEGAL REQUEST (5h).
    
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  14. @gregkh

    target: Allow PERSISTENT RESERVE IN for non-reservation holder

    Marco Sanvido authored gregkh committed
    commit 6816966 upstream.
    
    Initiators that aren't the active reservation holder should be able to
    do a PERSISTENT RESERVE IN command in all cases, so add it to the list
    of allowed CDBs in core_scsi3_pr_seq_non_holder().
    
    Signed-off-by: Marco Sanvido <marco@purestorage.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  15. @gregkh

    target: Use correct preempted registration sense code

    Marco Sanvido authored gregkh committed
    commit 9e08e34 upstream.
    
    The comments quote the right parts of the spec:
    
       * d) Establish a unit attention condition for the
       *    initiator port associated with every I_T nexus
       *    that lost its registration other than the I_T
       *    nexus on which the PERSISTENT RESERVE OUT command
       *    was received, with the additional sense code set
       *    to REGISTRATIONS PREEMPTED.
    
    and
    
       * e) Establish a unit attention condition for the initiator
       *    port associated with every I_T nexus that lost its
       *    persistent reservation and/or registration, with the
       *    additional sense code set to REGISTRATIONS PREEMPTED;
    
    but the actual code accidentally uses ASCQ_2AH_RESERVATIONS_PREEMPTED
    instead of ASCQ_2AH_REGISTRATIONS_PREEMPTED.  Fix this.
    
    Signed-off-by: Marco Sanvido <marco@purestorage.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  16. @gregkh

    mm: fix UP THP spin_is_locked BUGs

    Hugh Dickins authored gregkh committed
    commit b9980cd upstream.
    
    Fix CONFIG_TRANSPARENT_HUGEPAGE=y CONFIG_SMP=n CONFIG_DEBUG_VM=y
    CONFIG_DEBUG_SPINLOCK=n kernel: spin_is_locked() is then always false,
    and so triggers some BUGs in Transparent HugePage codepaths.
    
    asm-generic/bug.h mentions this problem, and provides a WARN_ON_SMP(x);
    but being too lazy to add VM_BUG_ON_SMP, BUG_ON_SMP, WARN_ON_SMP_ONCE,
    VM_WARN_ON_SMP_ONCE, just test NR_CPUS != 1 in the existing VM_BUG_ONs.
    
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  17. @gregkh

    mm: compaction: check for overlapping nodes during isolation for migr…

    Mel Gorman authored gregkh committed
    …ation
    
    commit dc90860 upstream.
    
    When isolating pages for migration, migration starts at the start of a
    zone while the free scanner starts at the end of the zone.  Migration
    avoids entering a new zone by never going beyond the free scanned.
    
    Unfortunately, in very rare cases nodes can overlap.  When this happens,
    migration isolates pages without the LRU lock held, corrupting lists
    which will trigger errors in reclaim or during page free such as in the
    following oops
    
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
      IP: [<ffffffff810f795c>] free_pcppages_bulk+0xcc/0x450
      PGD 1dda554067 PUD 1e1cb58067 PMD 0
      Oops: 0000 [#1] SMP
      CPU 37
      Pid: 17088, comm: memcg_process_s Tainted: G            X
      RIP: free_pcppages_bulk+0xcc/0x450
      Process memcg_process_s (pid: 17088, threadinfo ffff881c2926e000, task ffff881c2926c0c0)
      Call Trace:
        free_hot_cold_page+0x17e/0x1f0
        __pagevec_free+0x90/0xb0
        release_pages+0x22a/0x260
        pagevec_lru_move_fn+0xf3/0x110
        putback_lru_page+0x66/0xe0
        unmap_and_move+0x156/0x180
        migrate_pages+0x9e/0x1b0
        compact_zone+0x1f3/0x2f0
        compact_zone_order+0xa2/0xe0
        try_to_compact_pages+0xdf/0x110
        __alloc_pages_direct_compact+0xee/0x1c0
        __alloc_pages_slowpath+0x370/0x830
        __alloc_pages_nodemask+0x1b1/0x1c0
        alloc_pages_vma+0x9b/0x160
        do_huge_pmd_anonymous_page+0x160/0x270
        do_page_fault+0x207/0x4c0
        page_fault+0x25/0x30
    
    The "X" in the taint flag means that external modules were loaded but but
    is unrelated to the bug triggering.  The real problem was because the PFN
    layout looks like this
    
      Zone PFN ranges:
        DMA      0x00000010 -> 0x00001000
        DMA32    0x00001000 -> 0x00100000
        Normal   0x00100000 -> 0x01e80000
      Movable zone start PFN for each node
      early_node_map[14] active PFN ranges
          0: 0x00000010 -> 0x0000009b
          0: 0x00000100 -> 0x0007a1ec
          0: 0x0007a354 -> 0x0007a379
          0: 0x0007f7ff -> 0x0007f800
          0: 0x00100000 -> 0x00680000
          1: 0x00680000 -> 0x00e80000
          0: 0x00e80000 -> 0x01080000
          1: 0x01080000 -> 0x01280000
          0: 0x01280000 -> 0x01480000
          1: 0x01480000 -> 0x01680000
          0: 0x01680000 -> 0x01880000
          1: 0x01880000 -> 0x01a80000
          0: 0x01a80000 -> 0x01c80000
          1: 0x01c80000 -> 0x01e80000
    
    The fix is straight-forward.  isolate_migratepages() has to make a
    similar check to isolate_freepage to ensure that it never isolates pages
    from a zone it does not hold the LRU lock for.
    
    This was discovered in a 3.0-based kernel but it affects 3.1.x, 3.2.x
    and current mainline.
    
    Signed-off-by: Mel Gorman <mgorman@suse.de>
    Acked-by: Michal Nazarewicz <mina86@mina86.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18. @gregkh

    pcmcia: fix socket refcount decrementing on each resume

    Russell King authored gregkh committed
    commit 025e4ab upstream.
    
    This fixes a memory-corrupting bug: not only does it cause the warning,
    but as a result of dropping the refcount to zero, it causes the
    pcmcia_socket0 device structure to be freed while it still has
    references, causing slab caches corruption.  A fatal oops quickly
    follows this warning - often even just a 'dmesg' following the warning
    causes the kernel to oops.
    
    While testing suspend/resume on an ARM device with PCMCIA support, and a
    CF card inserted, I found that after five suspend and resumes, the
    kernel would complain, and shortly die after with slab corruption.
    
      WARNING: at include/linux/kref.h:41 kobject_get+0x28/0x50()
    
    As the message doesn't give a clue about which kobject, and the built-in
    debugging in drivers/base/power/main.c happens too late, this was added
    right before each get_device():
    
      printk("%s: %p [%s] %u\n", __func__, dev, kobject_name(&dev->kobj), atomic_read(&dev->kobj.kref.refcount));
    
    and on the 3rd s2ram cycle, the following behaviour observed:
    
    On the 3rd suspend/resume cycle:
    
      dpm_prepare: c1a0d998 [pcmcia_socket0] 3
      dpm_suspend: c1a0d998 [pcmcia_socket0] 3
      dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 3
      dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 3
      dpm_resume: c1a0d998 [pcmcia_socket0] 3
      dpm_complete: c1a0d998 [pcmcia_socket0] 2
    
    4th:
    
      dpm_prepare: c1a0d998 [pcmcia_socket0] 2
      dpm_suspend: c1a0d998 [pcmcia_socket0] 2
      dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 2
      dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 2
      dpm_resume: c1a0d998 [pcmcia_socket0] 2
      dpm_complete: c1a0d998 [pcmcia_socket0] 1
    
    5th:
    
      dpm_prepare: c1a0d998 [pcmcia_socket0] 1
      dpm_suspend: c1a0d998 [pcmcia_socket0] 1
      dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 1
      dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 1
      dpm_resume: c1a0d998 [pcmcia_socket0] 1
      dpm_complete: c1a0d998 [pcmcia_socket0] 0
      ------------[ cut here ]------------
      WARNING: at include/linux/kref.h:41 kobject_get+0x28/0x50()
      Modules linked in: ucb1x00_core
      Backtrace:
      [<c0212090>] (dump_backtrace+0x0/0x110) from [<c04799dc>] (dump_stack+0x18/0x1c)
      [<c04799c4>] (dump_stack+0x0/0x1c) from [<c021cba0>] (warn_slowpath_common+0x50/0x68)
      [<c021cb50>] (warn_slowpath_common+0x0/0x68) from [<c021cbdc>] (warn_slowpath_null+0x24/0x28)
      [<c021cbb8>] (warn_slowpath_null+0x0/0x28) from [<c0335374>] (kobject_get+0x28/0x50)
      [<c033534c>] (kobject_get+0x0/0x50) from [<c03804f4>] (get_device+0x1c/0x24)
      [<c0388c90>] (dpm_complete+0x0/0x1a0) from [<c0389cc0>] (dpm_resume_end+0x1c/0x20)
      ...
    
    Looking at commit 7b24e79 ("pcmcia: split up central event handler"),
    the following change was made to cs.c:
    
                    return 0;
            }
     #endif
    -
    -       send_event(skt, CS_EVENT_PM_RESUME, CS_EVENT_PRI_LOW);
    +       if (!(skt->state & SOCKET_CARDBUS) && (skt->callback))
    +               skt->callback->early_resume(skt);
            return 0;
     }
    
    And the corresponding change in ds.c is from:
    
    -static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
    -{
    -       struct pcmcia_socket *s = pcmcia_get_socket(skt);
    ...
    -       switch (event) {
    ...
    -       case CS_EVENT_PM_RESUME:
    -               if (verify_cis_cache(skt) != 0) {
    -                       dev_dbg(&skt->dev, "cis mismatch - different card\n");
    -                       /* first, remove the card */
    -                       ds_event(skt, CS_EVENT_CARD_REMOVAL, CS_EVENT_PRI_HIGH);
    -                       mutex_lock(&s->ops_mutex);
    -                       destroy_cis_cache(skt);
    -                       kfree(skt->fake_cis);
    -                       skt->fake_cis = NULL;
    -                       s->functions = 0;
    -                       mutex_unlock(&s->ops_mutex);
    -                       /* now, add the new card */
    -                       ds_event(skt, CS_EVENT_CARD_INSERTION,
    -                                CS_EVENT_PRI_LOW);
    -               }
    -               break;
    ...
    -    }
    
    -    pcmcia_put_socket(s);
    
    -    return 0;
    -} /* ds_event */
    
    to:
    
    +static int pcmcia_bus_early_resume(struct pcmcia_socket *skt)
    +{
    +       if (!verify_cis_cache(skt)) {
    +               pcmcia_put_socket(skt);
    +               return 0;
    +       }
    
    +       dev_dbg(&skt->dev, "cis mismatch - different card\n");
    
    +       /* first, remove the card */
    +       pcmcia_bus_remove(skt);
    +       mutex_lock(&skt->ops_mutex);
    +       destroy_cis_cache(skt);
    +       kfree(skt->fake_cis);
    +       skt->fake_cis = NULL;
    +       skt->functions = 0;
    +       mutex_unlock(&skt->ops_mutex);
    
    +       /* now, add the new card */
    +       pcmcia_bus_add(skt);
    +       return 0;
    +}
    
    As can be seen, the original function called pcmcia_get_socket() and
    pcmcia_put_socket() around the guts, whereas the replacement code
    calls pcmcia_put_socket() only in one path.  This creates an imbalance
    in the refcounting.
    
    Testing with pcmcia_put_socket() put removed shows that the bug is gone:
    
      dpm_suspend: c1a10998 [pcmcia_socket0] 5
      dpm_suspend_noirq: c1a10998 [pcmcia_socket0] 5
      dpm_resume_noirq: c1a10998 [pcmcia_socket0] 5
      dpm_resume: c1a10998 [pcmcia_socket0] 5
      dpm_complete: c1a10998 [pcmcia_socket0] 5
    
    Tested-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Cc: Dominik Brodowski <linux@dominikbrodowski.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  19. @gregkh

    ASoC: wm8962: Fix word length configuration

    Susan Gao authored gregkh committed
    commit 2b6712b upstream.
    
    Signed-off-by: Susan Gao <sgao@opensource.wolfsonmicro.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  20. @broonie @gregkh

    ASoC: wm_hubs: Correct line input to line output 2 paths

    broonie authored gregkh committed
    commit 43b6cec upstream.
    
    The second line output mixer has the controls for the line input bypasses
    in the opposite order.
    
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21. @broonie @gregkh

    ASoC: wm_hubs: Fix routing of input PGAs to line output mixer

    broonie authored gregkh committed
    commit ee76744 upstream.
    
    IN1L/R is routed to both line output mixers, we don't route IN1 to LINEOUT1
    and IN2 to LINEOUT2.
    
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22. @groeck @gregkh

    hwmon: (w83627ehf) Fix number of fans for NCT6776F

    groeck authored gregkh committed
    commit 585c0fd upstream.
    
    NCT6776F can select fan input pins for fans 3 to 5 with a secondary set of
    chip register bits. Check that second set of bits in addition to the first set
    to detect if fans 3..5 are monitored.
    
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Acked-by: Jean Delvare <khali@linux-fr.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23. @gregkh

    lockdep, bug: Exclude TAINT_FIRMWARE_WORKAROUND from disabling lockdep

    Peter Zijlstra authored gregkh committed
    commit df754e6 upstream.
    
    It's unlikely that TAINT_FIRMWARE_WORKAROUND causes false
    lockdep messages, so do not disable lockdep in that case.
    We still want to keep lockdep disabled in the
    TAINT_OOT_MODULE case:
    
      - bin-only modules can cause various instabilities in
        their and in unrelated kernel code
    
      - they are impossible to debug for kernel developers
    
      - they also typically do not have the copyright license
        permission to link to the GPL-ed lockdep code.
    
    Suggested-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Link: http://lkml.kernel.org/n/tip-xopopjjens57r0i13qnyh2yo@git.kernel.org
    Signed-off-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  24. @hfeurstein @gregkh

    atmel_lcdfb: fix usage of CONTRAST_CTR in suspend/resume

    hfeurstein authored gregkh committed
    commit 9f10650 upstream.
    
    An error was existing in the saving of CONTRAST_CTR register
    across suspend/resume.
    
    Signed-off-by: Hubert Feurstein <h.feurstein@gmail.com>
    Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
    Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  25. @shirishpargaonkar @gregkh

    cifs: Fix oops in session setup code for null user mounts

    shirishpargaonkar authored gregkh committed
    commit de47a41 upstream.
    
    For null user mounts, do not invoke string length function
    during session setup.
    
    Reported-and-Tested-by: Chris Clayton <chris2553@googlemail.com>
    Acked-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
    Signed-off-by: Steve French <smfrench@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  26. @gregkh

    eCryptfs: Infinite loop due to overflow in ecryptfs_write()

    Li Wang authored gregkh committed
    commit 684a3ff upstream.
    
    ecryptfs_write() can enter an infinite loop when truncating a file to a
    size larger than 4G. This only happens on architectures where size_t is
    represented by 32 bits.
    
    This was caused by a size_t overflow due to it incorrectly being used to
    store the result of a calculation which uses potentially large values of
    type loff_t.
    
    [tyhicks@canonical.com: rewrite subject and commit message]
    Signed-off-by: Li Wang <liwang@nudt.edu.cn>
    Signed-off-by: Yunchuan Wen <wenyunchuan@kylinos.com.cn>
    Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  27. @gregkh

    drm/i915: handle 3rd pipe

    Eugeni Dodonov authored gregkh committed
    commit 07c1e8c upstream.
    
    We don't need to check 3rd pipe specifically, as it shares PLL with some
    other one.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=41977
    Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
    Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  28. @vivijim @gregkh

    drm/i915: Fix TV Out refresh rate.

    vivijim authored gregkh committed
    commit 23bd15e upstream.
    
    TV Out refresh rate was half of the specification for almost all modes.
    Due to this reason pixel clock was so low for some modes causing flickering screen.
    
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi@gmail.com>
    Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  29. @danvet @gregkh

    drm/i915: check ACTHD of all rings

    danvet authored gregkh committed
    commit 097354e upstream.
    
    Otherwise hangcheck spuriously fires when running blitter/bsd-only
    workloads.
    
    Contrary to a similar patch by Ben Widawsky this does not check
    INSTDONE of the other rings. Chris Wilson implied that in a failure to
    detect a hang, most likely because INSTDONE was fluctuating. Thus only
    check ACTHD, which as far as I know is rather reliable. Also, blitter
    and bsd rings can't launch complex tasks from a single instruction
    (like 3D_PRIM on the render with complex or even infinite shaders).
    
    This fixes spurious gpu hang detection when running
    tests/gem_hangcheck_forcewake on snb/ivb.
    
    Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  30. @fengguang @gregkh

    drm/i915: DisplayPort hot remove notification to audio driver

    fengguang authored gregkh committed
    commit 832afda upstream.
    
    On DP monitor hot remove, clear DP_AUDIO_OUTPUT_ENABLE accordingly,
    so that the audio driver will receive hot plug events and take action
    to refresh its device state and ELD contents.
    
    Note that the DP_AUDIO_OUTPUT_ENABLE bit may be enabled or disabled
    only when the link training is complete and set to "Normal".
    
    Tested OK for both hot plug/remove and DPMS on/off.
    
    Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  31. @fengguang @gregkh

    drm/i915: HDMI hot remove notification to audio driver

    fengguang authored gregkh committed
    commit 2deed76 upstream.
    
    On HDMI monitor hot remove, clear SDVO_AUDIO_ENABLE accordingly, so that
    the audio driver will receive hot plug events and take action to refresh
    its device state and ELD contents.
    
    The cleared SDVO_AUDIO_ENABLE bit needs to be restored to prevent losing
    HDMI audio after DPMS on.
    
    CC: Wang Zhenyu <zhenyu.z.wang@intel.com>
    Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  32. @jankara @gregkh

    udf: Mark LVID buffer as uptodate before marking it dirty

    jankara authored gregkh committed
    commit 853a0c2 upstream.
    
    When we hit EIO while writing LVID, the buffer uptodate bit is cleared.
    This then results in an anoying warning from mark_buffer_dirty() when we
    write the buffer again. So just set uptodate flag unconditionally.
    
    Reviewed-by: Namjae Jeon <linkinjeon@gmail.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Cc: Dave Jones <davej@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  33. @broonie @gregkh

    ASoC: Ensure we generate a driver name

    broonie authored gregkh committed
    commit f0e8ed8 upstream.
    
    Commit 873bd4c (ASoC: Don't set invalid name string to snd_card->driver
    field) broke generation of a driver name for all ASoC cards relying on the
    automatic generation of one. Fix this by using the old default with spaces
    replaced by underscores.
    
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Acked-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  34. @gregkh

    sched/rt: Fix task stack corruption under __ARCH_WANT_INTERRUPTS_ON_C…

    Chanho Min authored gregkh committed
    …TXSW
    
    commit cb297a3 upstream.
    
    This issue happens under the following conditions:
    
     1. preemption is off
     2. __ARCH_WANT_INTERRUPTS_ON_CTXSW is defined
     3. RT scheduling class
     4. SMP system
    
    Sequence is as follows:
    
     1.suppose current task is A. start schedule()
     2.task A is enqueued pushable task at the entry of schedule()
       __schedule
        prev = rq->curr;
        ...
        put_prev_task
         put_prev_task_rt
          enqueue_pushable_task
     4.pick the task B as next task.
       next = pick_next_task(rq);
     3.rq->curr set to task B and context_switch is started.
       rq->curr = next;
     4.At the entry of context_swtich, release this cpu's rq->lock.
       context_switch
        prepare_task_switch
         prepare_lock_switch
          raw_spin_unlock_irq(&rq->lock);
     5.Shortly after rq->lock is released, interrupt is occurred and start IRQ context
     6.try_to_wake_up() which called by ISR acquires rq->lock
        try_to_wake_up
         ttwu_remote
          rq = __task_rq_lock(p)
          ttwu_do_wakeup(rq, p, wake_flags);
            task_woken_rt
     7.push_rt_task picks the task A which is enqueued before.
       task_woken_rt
        push_rt_tasks(rq)
         next_task = pick_next_pushable_task(rq)
     8.At find_lock_lowest_rq(), If double_lock_balance() returns 0,
       lowest_rq can be the remote rq.
      (But,If preemption is on, double_lock_balance always return 1 and it
       does't happen.)
       push_rt_task
        find_lock_lowest_rq
         if (double_lock_balance(rq, lowest_rq))..
     9.find_lock_lowest_rq return the available rq. task A is migrated to
       the remote cpu/rq.
       push_rt_task
        ...
        deactivate_task(rq, next_task, 0);
        set_task_cpu(next_task, lowest_rq->cpu);
        activate_task(lowest_rq, next_task, 0);
     10. But, task A is on irq context at this cpu.
         So, task A is scheduled by two cpus at the same time until restore from IRQ.
         Task A's stack is corrupted.
    
    To fix it, don't migrate an RT task if it's still running.
    
    Signed-off-by: Chanho Min <chanho.min@lge.com>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Acked-by: Steven Rostedt <rostedt@goodmis.org>
    Link: http://lkml.kernel.org/r/CAOAMb1BHA=5fm7KTewYyke6u-8DP0iUuJMpgQw54vNeXFsGpoQ@mail.gmail.com
    Signed-off-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  35. @gregkh

    drm/radeon/kms: disable output polling when suspended

    Seth Forshee authored gregkh committed
    commit 86698c2 upstream.
    
    Polling the outputs when the device is suspended can result in erroneous
    status updates. Disable output polling during suspend to prevent this
    from happening.
    
    Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Something went wrong with that request. Please try again.