Commits on Jun 17, 2012
  1. @gregkh

    Linux 3.0.35

    gregkh committed Jun 17, 2012
  2. @gregkh

    hugetlb: fix resv_map leak in error path

    commit c50ac05 and
    4523e14 upstream.
    When called for anonymous (non-shared) mappings, hugetlb_reserve_pages()
    does a resv_map_alloc().  It depends on code in hugetlbfs's
    vm_ops->close() to release that allocation.
    However, in the mmap() failure path, we do a plain unmap_region() without
    the remove_vma() which actually calls vm_ops->close().
    This is a decent fix.  This leak could get reintroduced if new code (say,
    after hugetlb_reserve_pages() in hugetlbfs_file_mmap()) decides to return
    an error.  But, I think it would have to unroll the reservation anyway.
    Christoph's test case:

    This patch applies to 3.4 and later.  A version for earlier kernels is at
    Signed-off-by: Dave Hansen <>
    Acked-by: Mel Gorman <>
    Acked-by: KOSAKI Motohiro <>
    Reported-by: Christoph Lameter <>
    Tested-by: Christoph Lameter <>
    Cc: Andrea Arcangeli <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
    Dave Hansen committed with gregkh May 29, 2012
  3. @gregkh

    mm: fix faulty initialization in vmalloc_init()

    commit dbda591 upstream.
    The transfer of ->flags causes some of the static mapping virtual
    addresses to be prematurely freed (before the mapping is removed) because
    VM_LAZY_FREE gets "set" if tmp->flags has VM_IOREMAP set.  This might
    cause subsequent vmalloc/ioremap calls to fail because it might allocate
    one of the freed virtual address ranges that aren't unmapped.
    va->flags has different types of flags from tmp->flags.  If a region with
    VM_IOREMAP set is registered with vm_area_add_early(), it will be removed
    by __purge_vmap_area_lazy().
    Fix vmalloc_init() to correctly initialize vmap_area for the given
    Also initialise va->vm.  If it is not set, find_vm_area() for the early
    vm regions will always fail.
    Signed-off-by: KyongHo Cho <>
    Cc: "Olav Haugan" <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
    KyongHo committed with gregkh May 29, 2012
  4. @minchank @gregkh

    mm/vmalloc.c: change void* into explict vm_struct*

    commit db1aeca upstream.
    vmap_area->private is void* but we don't use the field for various purpose
    but use only for vm_struct.  So change it to a vm_struct* with naming to
    improve for readability and type checking.
    Signed-off-by: Minchan Kim <>
    Acked-by: David Rientjes <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
    minchank committed with gregkh Jan 10, 2012
  5. @gregkh

    e1000: save skb counts in TX to avoid cache misses

    commit 31c15a2 upstream.
    Virtual Machines with emulated e1000 network adapter running on Parallels'
    server were seeing kernel panics due to the e1000 driver dereferencing an
    unexpected NULL pointer retrieved from buffer_info->skb.
    The problem has been addressed for the e1000e driver, but not for the e1000.
    Since the two drivers share similar code in the affected area, a port of the
    following e1000e driver commit solves the issue for the e1000 driver:
    commit 9ed318d
    Author: Tom Herbert <>
    Date:   Wed May 5 14:02:27 2010 +0000
        e1000e: save skb counts in TX to avoid cache misses
        In e1000_tx_map, precompute number of segements and bytecounts which
        are derived from fields in skb; these are stored in buffer_info.  When
        cleaning tx in e1000_clean_tx_irq use the values in the associated
        buffer_info for statistics counting, this eliminates cache misses
        on skb fields.
    Signed-off-by: Dean Nelson <>
    Acked-by: Jeff Kirsher <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Roman Kagan <>
    Dean Nelson committed with gregkh Aug 25, 2011
  6. @piastry @gregkh

    fuse: fix stat call on 32 bit platforms

    commit 45c72cd upstream.
    Now we store attr->ino at inode->i_ino, return attr->ino at the
    first time and then return inode->i_ino if the attribute timeout
    isn't expired. That's wrong on 32 bit platforms because attr->ino
    is 64 bit and inode->i_ino is 32 bit in this case.
    Fix this by saving 64 bit ino in fuse_inode structure and returning
    it every time we call getattr. Also squash attr->ino into inode->i_ino
    Signed-off-by: Pavel Shilovsky <>
    Signed-off-by: Miklos Szeredi <>
    Signed-off-by: Greg Kroah-Hartman <>
    piastry committed with gregkh May 10, 2012
  7. @gregkh

    x86, MCE, AMD: Make APIC LVT thresholding interrupt optional

    commit f227d43 upstream.
    Currently, the APIC LVT interrupt for error thresholding is implicitly
    enabled. However, there are models in the F15h range which do not enable
    it. Make the code machinery which sets up the APIC interrupt support
    an optional setting and add an ->interrupt_capable member to the bank
    representation mirroring that capability and enable the interrupt offset
    programming only if it is true.
    Simplify code and fixup comment style while at it.
    Signed-off-by: Borislav Petkov <>
    Signed-off-by: Robert Richter <>
    Borislav Petkov committed with gregkh Apr 16, 2012
  8. @gregkh

    iwlwifi: don't mess up the SCD when removing a key

    commit d6ee27e upstream.
    When we remove a key, we put a key index which was supposed
    to tell the fw that we are actually removing the key. But
    instead the fw took that index as a valid index and messed
    up the SRAM of the device.
    This memory corruption on the device mangled the data of
    the SCD. The impact on the user is that SCD queue 2 got
    stuck after having removed keys.
    The message is the log that was printed is:
    Queue 2 stuck for 10000ms
    This doesn't seem to fix the higher queues that get stuck
    from time to time.
    Reviewed-by: Meenakshi Venkataraman <>
    Signed-off-by: Emmanuel Grumbach <>
    Signed-off-by: Johannes Berg <>
    Signed-off-by: John W. Linville <>
    Signed-off-by: Greg Kroah-Hartman <>
    Emmanuel Grumbach committed with gregkh Jun 6, 2012
  9. @gregkh

    sched: Fix the relax_domain_level boot parameter

    commit a841f8c upstream.
    It does not get processed because sched_domain_level_max is 0 at the
    time that setup_relax_domain_level() is run.
    Simply accept the value as it is, as we don't know the value of
    sched_domain_level_max until sched domain construction is completed.
    Fix sched_relax_domain_level in cpuset.  The build_sched_domain() routine calls
    the set_domain_attribute() routine prior to setting the sd->level, however,
    the set_domain_attribute() routine relies on the sd->level to decide whether
    idle load balancing will be off/on.
    Signed-off-by: Dimitri Sivanich <>
    Signed-off-by: Peter Zijlstra <>
    Signed-off-by: Ingo Molnar <>
    Signed-off-by: Greg Kroah-Hartman <>
    Dimitri Sivanich committed with gregkh Jun 5, 2012
  10. @gregkh

    acpi_video: fix leaking PCI references

    commit cfb46f4 upstream.
    Signed-off-by: Alan Cox <>
    Acked-by: Matthew Garrett <>
    Signed-off-by: Len Brown <>
    Signed-off-by: Greg Kroah-Hartman <>
    Alan Cox committed with gregkh Apr 25, 2012
  11. @aprzywar @gregkh

    hwmon: (fam15h_power) Increase output resolution

    commit 941a956 upstream.
    On high CPU load the accumulating values in the running_avg_cap
    register are very low (below 10), so averaging them too early leads
    to unnecessary poor output resolution. Since we pretend to output
    micro-Watt we better keep all the bits we have as long as possible.
    Signed-off-by: Andre Przywara <>
    Signed-off-by: Andreas Herrmann <>
    Acked-by: Guenter Roeck <>
    Signed-off-by: Jean Delvare <>
    Signed-off-by: Tim Gardner <>
    Signed-off-by: Greg Kroah-Hartman <>
    aprzywar committed with gregkh Mar 23, 2012
  12. @AnilKumarCh @gregkh

    can: c_can: fix race condition in c_can_open()

    commit f461f27 upstream.
    Fix the issue of C_CAN interrupts getting disabled forever when canconfig
    utility is used multiple times. According to NAPI usage we disable all
    the hardware interrupts in ISR and re-enable them in poll(). Current
    implementation calls napi_enable() after hardware interrupts are enabled.
    If we get any interrupts between these two steps then we do not process
    those interrupts because napi is not enabled. Mostly these interrupts
    come because of STATUS is not 0x7 or ERROR interrupts. If napi_enable()
    happens before HW interrupts enabled then c_can_poll() function will be
    called eventual re-enabling.
    This patch moves the napi_enable() call before interrupts enabled.
    Signed-off-by: AnilKumar Ch <>
    Acked-by: Wolfgang Grandegger <>
    Signed-off-by: Marc Kleine-Budde <>
    Signed-off-by: Greg Kroah-Hartman <>
    AnilKumarCh committed with gregkh May 23, 2012
  13. @AnilKumarCh @gregkh

    can: c_can: fix an interrupt thrash issue with c_can driver

    commit 148c87c upstream.
    This patch fixes an interrupt thrash issue with c_can driver.
    In c_can_isr() function interrupts are disabled and enabled only in
    c_can_poll() function. c_can_isr() & c_can_poll() both read the
    irqstatus flag. However, irqstatus is always read as 0 in c_can_poll()
    because all C_CAN interrupts are disabled in c_can_isr(). This causes
    all interrupts to be re-enabled in c_can_poll() which in turn causes
    another interrupt since the event is not really handled. This keeps
    happening causing a flood of interrupts.
    To fix this, read the irqstatus register in isr and use the same cached
    value in the poll function.
    Signed-off-by: AnilKumar Ch <>
    Acked-by: Wolfgang Grandegger <>
    Signed-off-by: Marc Kleine-Budde <>
    Signed-off-by: Greg Kroah-Hartman <>
    AnilKumarCh committed with gregkh May 23, 2012
  14. @AnilKumarCh @gregkh

    can: c_can: fix "BUG! echo_skb is occupied!" during transmit

    commit 617cacc upstream.
    This patch fixes an issue with transmit routine, which causes
    "can_put_echo_skb: BUG! echo_skb is occupied!" message when
    using "cansequence -p" on D_CAN controller.
    In c_can driver, while transmitting packets tx_echo flag holds
    the no of can frames put for transmission into the hardware.
    As the comment above c_can_do_tx() indicates, if we find any packet
    which is not transmitted then we should stop looking for more.
    In the current implementation this is not taken care of causing the
    said message.
    Also, fix the condition used to find if the packet is transmitted
    or not. Current code skips the first tx message object and ends up
    checking one extra invalid object.
    While at it, fix the comment on top of c_can_do_tx() to use the
    terminology "packet" instead of "package" since it is more
    Signed-off-by: AnilKumar Ch <>
    Acked-by: Wolfgang Grandegger <>
    Signed-off-by: Marc Kleine-Budde <>
    Signed-off-by: Greg Kroah-Hartman <>
    AnilKumarCh committed with gregkh May 23, 2012
  15. @bmork @gregkh

    net: sierra_net: device IDs for Aircard 320U++

    commit dd03cff upstream.
    Adding device IDs for Aircard 320U and two other devices
    found in the out-of-tree version of this driver.
    Cc: Autif Khan <>
    Cc: Tom Cassidy <>
    Signed-off-by: Bjørn Mork <>
    Acked-by: Greg Kroah-Hartman <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Greg Kroah-Hartman <>
    bmork committed with gregkh Jun 5, 2012
  16. @jmberg @gregkh

    cfg80211: fix interface combinations check

    commit 463454b upstream.
    If a given interface combination doesn't contain
    a required interface type then we missed checking
    that and erroneously allowed it even though iface
    type wasn't there at all. Add a check that makes
    sure that all interface types are accounted for.
    Reported-by: Mohammed Shafi Shajakhan <>
    Signed-off-by: Johannes Berg <>
    Signed-off-by: John W. Linville <>
    Signed-off-by: Greg Kroah-Hartman <>
    jmberg committed with gregkh Jun 5, 2012
  17. @jmberg @gregkh

    mac80211: clean up remain-on-channel on interface stop

    commit 71ecfa1 upstream.
    When any interface goes down, it could be the one that we
    were doing a remain-on-channel with. We therefore need to
    cancel the remain-on-channel and flush the related work
    structs so they don't run after the interface has been
    removed or even destroyed.
    It's also possible in this case that an off-channel SKB
    was never transmitted, so free it if this is the case.
    Note that this can also happen if the driver finishes
    the off-channel period without ever starting it.
    Reported-by: Nirav Shah <>
    Signed-off-by: Johannes Berg <>
    Signed-off-by: John W. Linville <>
    Signed-off-by: Greg Kroah-Hartman <>
    jmberg committed with gregkh May 31, 2012
  18. @minipli @gregkh

    crypto: aesni-intel - fix unaligned cbc decrypt for x86-32

    commit 7c8d518 upstream.
    The 32 bit variant of cbc(aes) decrypt is using instructions requiring
    128 bit aligned memory locations but fails to ensure this constraint in
    the code. Fix this by loading the data into intermediate registers with
    load unaligned instructions.
    This fixes reported general protection faults related to aesni.
    Reported-by: Daniel <>
    Signed-off-by: Mathias Krause <>
    Signed-off-by: Herbert Xu <>
    Signed-off-by: Greg Kroah-Hartman <>
    minipli committed with gregkh May 29, 2012
  19. @gregkh

    powerpc: Fix kernel panic during kernel module load

    commit 3c75296 upstream.
    This fixes a problem which can causes kernel oopses while loading
    a kernel module.
    According to the PowerPC EABI specification, GPR r11 is assigned
    the dedicated function to point to the previous stack frame.
    In the powerpc-specific kernel module loader, do_plt_call()
    (in arch/powerpc/kernel/module_32.c), GPR r11 is also used
    to generate trampoline code.
    This combination crashes the kernel, in the case where the compiler
    chooses to use a helper function for saving GPRs on entry, and the
    module loader has placed the .init.text section far away from the
    .text section, meaning that it has to generate a trampoline for
    functions in the .init.text section to call the GPR save helper.
    Because the trampoline trashes r11, references to the stack frame
    using r11 can cause an oops.
    The fix just uses GPR r12 instead of GPR r11 for generating the
    trampoline code.  According to the statements from Freescale, this is
    safe from an EABI perspective.
    I've tested the fix for kernel 2.6.33 on MPC8541.
    Signed-off-by: Steffen Rumler <>
    [ reworded the description]
    Signed-off-by: Paul Mackerras <>
    Signed-off-by: Greg Kroah-Hartman <>
    Steffen Rumler committed with gregkh Jun 6, 2012
  20. @rolandd @gregkh

    btree: fix tree corruption in btree_get_prev()

    commit cbf8ae3 upstream.
    The memory the parameter __key points to is used as an iterator in
    btree_get_prev(), so if we save off a bkey() pointer in retry_key and
    then assign that to __key, we'll end up corrupting the btree internals
    when we do eg
    	longcpy(__key, bkey(geo, node, i), geo->keylen);
    to return the key value.  What we should do instead is use longcpy() to
    copy the key value that retry_key points to __key.
    This can cause a btree to get corrupted by seemingly read-only
    operations such as btree_for_each_safe.
    [ avoid the double longcpy()]
    Signed-off-by: Roland Dreier <>
    Acked-by: Joern Engel <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
    rolandd committed with gregkh Jun 7, 2012
  21. @gregkh

    char/agp: add another Ironlake host bridge

    commit 67384fe upstream.
    This seems to come on Gigabyte H55M-S2V and was discovered through the debugging.
    Signed-off-by: Eugeni Dodonov <>
    Signed-off-by: Daniel Vetter <>
    Signed-off-by: Greg Kroah-Hartman <>
    Eugeni Dodonov committed with gregkh Jun 6, 2012
Commits on Jun 9, 2012
  1. @gregkh

    Linux 3.0.34

    gregkh committed Jun 9, 2012
  2. @taoma-tm @gregkh

    ext4: don't set i_flags in EXT4_IOC_SETFLAGS

    commit b22b1f1 upstream.
    Commit 7990696 uses the ext4_{set,clear}_inode_flags() functions to
    change the i_flags automatically but fails to remove the error setting
    of i_flags.  So we still have the problem of trashing state flags.
    Fix this by removing the assignment.
    Signed-off-by: Tao Ma <>
    Signed-off-by: "Theodore Ts'o" <>
    Signed-off-by: Greg Kroah-Hartman <>
    taoma-tm committed with gregkh Jun 7, 2012
  3. @notaz @gregkh

    wl1251: fix oops on early interrupt

    commit f380f2c upstream.
    This driver disables interrupt just after requesting it and enables it
    later, after interface is up. However currently there is a time window
    between request_irq() and disable_irq() where if interrupt arrives, the
    driver oopses because it's not yet ready to process it. This can be
    reproduced by inserting the module, associating and removing the module
    multiple times.
    Eliminate this race by setting IRQF_NOAUTOEN flag before request_irq().
    Signed-off-by: Grazvydas Ignotas <>
    Signed-off-by: John W. Linville <>
    Signed-off-by: Greg Kroah-Hartman <>
    notaz committed with gregkh May 18, 2012
  4. @gregkh

    ACPI battery: only refresh the sysfs files when pertinent information…

    … changes
    commit c597145 upstream.
    We only need to regenerate the sysfs files when the capacity units
    change, avoid the update otherwise.
    The origin of this issue is dates way back to 2.6.38:
    (ACPI / Battery: Update information on info notification and resume)
    Signed-off-by: Andy Whitcroft <>
    Tested-by: Ralf Jung <>
    Signed-off-by: Len Brown <>
    Signed-off-by: Greg Kroah-Hartman <>
    Andy Whitcroft committed with gregkh May 3, 2012
  5. @gregkh

    drm/radeon/kms: add new BTC PCI ids

    commit a2bef8c upstream.
    Signed-off-by: Alex Deucher <>
    Signed-off-by: Dave Airlie <>
    Signed-off-by: Greg Kroah-Hartman <>
    Alex Deucher committed with gregkh Jun 5, 2012
  6. @sqazi @gregkh

    ext4: remove mb_groups before tearing down the buddy_cache

    commit 9559996 upstream.
    We can't have references held on pages in the s_buddy_cache while we are
    trying to truncate its pages and put the inode.  All the pages must be
    gone before we reach clear_inode.  This can only be gauranteed if we
    can prevent new users from grabbing references to s_buddy_cache's pages.
    The original bug can be reproduced and the bug fix can be verified by:
    while true; do mount -t ext4 /dev/ram0 /export/hda3/ram0; \
    	umount /export/hda3/ram0; done &
    while true; do cat /proc/fs/ext4/ram0/mb_groups; done
    Signed-off-by: Salman Qazi <>
    Signed-off-by: "Theodore Ts'o" <>
    Signed-off-by: Greg Kroah-Hartman <>
    sqazi committed with gregkh Jun 1, 2012
  7. @sqazi @gregkh

    ext4: add ext4_mb_unload_buddy in the error path

    commit 02b7831 upstream.
    ext4_free_blocks fails to pair an ext4_mb_load_buddy with a matching
    ext4_mb_unload_buddy when it fails a memory allocation.
    Signed-off-by: Salman Qazi <>
    Signed-off-by: "Theodore Ts'o" <>
    Signed-off-by: Greg Kroah-Hartman <>
    sqazi committed with gregkh Jun 1, 2012
  8. @tytso @gregkh

    ext4: don't trash state flags in EXT4_IOC_SETFLAGS

    commit 7990696 upstream.
    In commit 353eb83 we removed i_state_flags with 64-bit longs, But
    when handling the EXT4_IOC_SETFLAGS ioctl, we replace i_flags
    directly, which trashes the state flags which are stored in the high
    32-bits of i_flags on 64-bit platforms.  So use the the
    ext4_{set,clear}_inode_flags() functions which use atomic bit
    manipulation functions instead.
    Reported-by: Tao Ma <>
    Signed-off-by: "Theodore Ts'o" <>
    Signed-off-by: Greg Kroah-Hartman <>
    tytso committed with gregkh Jun 1, 2012
  9. @tytso @gregkh

    ext4: add missing save_error_info() to ext4_error()

    commit f3fc021 upstream.
    The ext4_error() function is missing a call to save_error_info().
    Since this is the function which marks the file system as containing
    an error, this oversight (which was introduced in 2.6.36) is quite
    significant, and should be backported to older stable kernels with
    high urgency.
    Reported-by: Ken Sumrall <>
    Signed-off-by: "Theodore Ts'o" <>
    Signed-off-by: Greg Kroah-Hartman <>
    tytso committed with gregkh May 31, 2012
  10. @gregkh

    ext4: force ro mount if ext4_setup_super() fails

    commit 7e84b62 upstream.
    If ext4_setup_super() fails i.e. due to a too-high revision,
    the error is logged in dmesg but the fs is not mounted RO as
    Tested by:
    # mkfs.ext4 -r 4 /dev/sdb6
    # mount /dev/sdb6 /mnt/test
    # dmesg | grep "too high"
    [164919.759248] EXT4-fs (sdb6): revision level too high, forcing read-only mode
    # grep sdb6 /proc/mounts
    /dev/sdb6 /mnt/test2 ext4 rw,seclabel,relatime,data=ordered 0 0
    Reviewed-by: Andreas Dilger <>
    Signed-off-by: Eric Sandeen <>
    Signed-off-by: "Theodore Ts'o" <>
    Signed-off-by: Greg Kroah-Hartman <>
    Eric Sandeen committed with gregkh May 28, 2012
  11. @gregkh

    xfrm: take net hdr len into account for esp payload size calculation

    [ Upstream commit 91657ea ]
    Corrects the function that determines the esp payload size. The calculations
    done in esp{4,6}_get_mtu() lead to overlength frames in transport mode for
    certain mtu values and suboptimal frames for others.
    According to what is done, mainly in esp{,6}_output() and tcp_mtu_to_mss(),
    net_header_len must be taken into account before doing the alignment
    Signed-off-by: Benjamin Poirier <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Greg Kroah-Hartman <>
    Benjamin Poirier committed with gregkh May 24, 2012
  12. @gregkh

    skb: avoid unnecessary reallocations in __skb_cow

    [ Upstream commit 617c8c1 ]
    At the beginning of __skb_cow, headroom gets set to a minimum of
    NET_SKB_PAD. This causes unnecessary reallocations if the buffer was not
    cloned and the headroom is just below NET_SKB_PAD, but still more than the
    amount requested by the caller.
    This was showing up frequently in my tests on VLAN tx, where
    vlan_insert_tag calls skb_cow_head(skb, VLAN_HLEN).
    Locally generated packets should have enough headroom, and for forward
    paths, we already have NET_SKB_PAD bytes of headroom, so we don't need to
    add any extra space here.
    Signed-off-by: Felix Fietkau <>
    Signed-off-by: Eric Dumazet <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Greg Kroah-Hartman <>
    Felix Fietkau committed with gregkh May 29, 2012
  13. @NicolasDichtel @gregkh

    sctp: check cached dst before using it

    [ Upstream commit e026886 ]
    dst_check() will take care of SA (and obsolete field), hence
    IPsec rekeying scenario is taken into account.
    Signed-off-by: Nicolas Dichtel <>
    Acked-by: Vlad Yaseivch <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Greg Kroah-Hartman <>
    NicolasDichtel committed with gregkh May 4, 2012
  14. @davem330 @gregkh

    Revert "net: maintain namespace isolation between vlan and real device"

    [ Upstream commit 59b9997 ]
    This reverts commit 8a83a00.
    It causes regressions for S390 devices, because it does an
    unconditional DST drop on SKBs for vlans and the QETH device
    needs the neighbour entry hung off the DST for certain things
    on transmit.
    Arnd can't remember exactly why he even needed this change.
    Signed-off-by: David S. Miller <>
    Signed-off-by: Greg Kroah-Hartman <>
    davem330 committed with gregkh May 11, 2012