aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-12-12Merge tag 'hwmon-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fix from Guenter Roeck: "Fix HIH-6130 driver to work with BeagleBone" * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: HIH-6130: Support I2C bus drivers without I2C_FUNC_SMBUS_QUICK
2013-12-12Merge branch 'hwmon-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging Pull hwmon fixes from Jean Delvare. * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: hwmon: Prevent some divide by zeros in FAN_TO_REG() hwmon: (w83l768ng) Fix fan speed control range hwmon: (w83l786ng) Fix fan speed control mode setting and reporting hwmon: (lm90) Unregister hwmon device if interrupt setup fails
2013-12-12word-at-a-time: provide generic big-endian zero_bytemask implementationWill Deacon
Whilst architectures may be able to do better than this (which they can, by simply defining their own macro), this is a generic stab at a zero_bytemask implementation for the asm-generic, big-endian word-at-a-time implementation. On arm64, a clz instruction is used to implement the fls efficiently. Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-12-12dcache: allow word-at-a-time name hashing with big-endian CPUsWill Deacon
When explicitly hashing the end of a string with the word-at-a-time interface, we have to be careful which end of the word we pick up. On big-endian CPUs, the upper-bits will contain the data we're after, so ensure we generate our masks accordingly (and avoid hashing whatever random junk may have been sitting after the string). This patch adds a new dcache helper, bytemask_from_count, which creates a mask appropriate for the CPU endianness. Cc: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-12-12Merge tag 'iommu-fixes-for-v3.13-rc4' of git://github.com/awilliam/linux-vfioLinus Torvalds
Pull iommu fixes from Alex Williamson: "arm/smmu driver updates via Will Deacon fixing locking around page table walks and a couple other issues" * tag 'iommu-fixes-for-v3.13-rc4' of git://github.com/awilliam/linux-vfio: iommu/arm-smmu: fix error return code in arm_smmu_device_dt_probe() iommu/arm-smmu: remove potential NULL dereference on mapping path iommu/arm-smmu: use mutex instead of spinlock for locking page tables
2013-12-12Merge tag 'keys-devel-20131210' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull misc keyrings fixes from David Howells: "These break down into five sets: - A patch to error handling in the big_key type for huge payloads. If the payload is larger than the "low limit" and the backing store allocation fails, then big_key_instantiate() doesn't clear the payload pointers in the key, assuming them to have been previously cleared - but only one of them is. Unfortunately, the garbage collector still calls big_key_destroy() when sees one of the pointers with a weird value in it (and not NULL) which it then tries to clean up. - Three patches to fix the keyring type: * A patch to fix the hash function to correctly divide keyrings off from keys in the topology of the tree inside the associative array. This is only a problem if searching through nested keyrings - and only if the hash function incorrectly puts the a keyring outside of the 0 branch of the root node. * A patch to fix keyrings' use of the associative array. The __key_link_begin() function initially passes a NULL key pointer to assoc_array_insert() on the basis that it's holding a place in the tree whilst it does more allocation and stuff. This is only a problem when a node contains 16 keys that match at that level and we want to add an also matching 17th. This should easily be manufactured with a keyring full of keyrings (without chucking any other sort of key into the mix) - except for (a) above which makes it on average adding the 65th keyring. * A patch to fix searching down through nested keyrings, where any keyring in the set has more than 16 keyrings and none of the first keyrings we look through has a match (before the tree iteration needs to step to a more distal node). Test in keyutils test suite: http://git.kernel.org/cgit/linux/kernel/git/dhowells/keyutils.git/commit/?id=8b4ae963ed92523aea18dfbb8cab3f4979e13bd1 - A patch to fix the big_key type's use of a shmem file as its backing store causing audit messages and LSM check failures. This is done by setting S_PRIVATE on the file to avoid LSM checks on the file (access to the shmem file goes through the keyctl() interface and so is gated by the LSM that way). This isn't normally a problem if a key is used by the context that generated it - and it's currently only used by libkrb5. Test in keyutils test suite: http://git.kernel.org/cgit/linux/kernel/git/dhowells/keyutils.git/commit/?id=d9a53cbab42c293962f2f78f7190253fc73bd32e - A patch to add a generated file to .gitignore. - A patch to fix the alignment of the system certificate data such that it it works on s390. As I understand it, on the S390 arch, symbols must be 2-byte aligned because loading the address discards the least-significant bit" * tag 'keys-devel-20131210' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: KEYS: correct alignment of system_certificate_list content in assembly file Ignore generated file kernel/x509_certificate_list security: shmem: implement kernel private shmem inodes KEYS: Fix searching of nested keyrings KEYS: Fix multiple key add into associative array KEYS: Fix the keyring hash function KEYS: Pre-clear struct key on allocation
2013-12-12Merge tag 'xfs-for-linus-v3.13-rc4' of git://oss.sgi.com/xfs/xfsLinus Torvalds
Pull xfs bugfixes from Ben Myers: - fix for buffer overrun in agfl with growfs on v4 superblock - return EINVAL if requested discard length is less than a block - fix possible memory corruption in xfs_attrlist_by_handle() * tag 'xfs-for-linus-v3.13-rc4' of git://oss.sgi.com/xfs/xfs: xfs: growfs overruns AGFL buffer on V4 filesystems xfs: don't perform discard if the given range length is less than block size xfs: underflow bug in xfs_attrlist_by_handle()
2013-12-12futex: move user address verification up to common codeLinus Torvalds
When debugging the read-only hugepage case, I was confused by the fact that get_futex_key() did an access_ok() only for the non-shared futex case, since the user address checking really isn't in any way specific to the private key handling. Now, it turns out that the shared key handling does effectively do the equivalent checks inside get_user_pages_fast() (it doesn't actually check the address range on x86, but does check the page protections for being a user page). So it wasn't actually a bug, but the fact that we treat the address differently for private and shared futexes threw me for a loop. Just move the check up, so that it gets done for both cases. Also, use the 'rw' parameter for the type, even if it doesn't actually matter any more (it's a historical artifact of the old racy i386 "page faults from kernel space don't check write protections"). Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-12-12futex: fix handling of read-only-mapped hugepagesLinus Torvalds
The hugepage code had the exact same bug that regular pages had in commit 7485d0d3758e ("futexes: Remove rw parameter from get_futex_key()"). The regular page case was fixed by commit 9ea71503a8ed ("futex: Fix regression with read only mappings"), but the transparent hugepage case (added in a5b338f2b0b1: "thp: update futex compound knowledge") case remained broken. Found by Dave Jones and his trinity tool. Reported-and-tested-by: Dave Jones <davej@fedoraproject.org> Cc: stable@kernel.org # v2.6.38+ Acked-by: Thomas Gleixner <tglx@linutronix.de> Cc: Mel Gorman <mgorman@suse.de> Cc: Darren Hart <dvhart@linux.intel.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-12-12hwmon: Prevent some divide by zeros in FAN_TO_REG()Dan Carpenter
The "rpm * div" operations can overflow here, so this patch adds an upper limit to rpm to prevent that. Jean Delvare helped me with this patch. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Roger Lucas <vt8231@hiddenengine.co.uk> Cc: stable@vger.kernel.org Signed-off-by: Jean Delvare <khali@linux-fr.org>
2013-12-12hwmon: (w83l768ng) Fix fan speed control rangeJean Delvare
The W83L786NG stores the fan speed on 4 bits while the sysfs interface uses a 0-255 range. Thus the driver should scale the user input down to map it to the device range, and scale up the value read from the device before presenting it to the user. The reserved register nibble should be left unchanged. Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: stable@vger.kernel.org Reviewed-by: Guenter Roeck <linux@roeck-us.net>
2013-12-12hwmon: (w83l786ng) Fix fan speed control mode setting and reportingBrian Carnes
The wrong mask is used, which causes some fan speed control modes (pwmX_enable) to be incorrectly reported, and some modes to be impossible to set. [JD: add subject and description.] Signed-off-by: Brian Carnes <bmcarnes@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Jean Delvare <khali@linux-fr.org>
2013-12-12hwmon: (lm90) Unregister hwmon device if interrupt setup failsGuenter Roeck
Commit 109b1283fb (hwmon: (lm90) Add support to handle IRQ) introduced interrupt support. Its error handling code fails to unregister the already registered hwmon device. Fixes: 109b1283fb532ac773a076748ffccf76a7067cab Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Jean Delvare <khali@linux-fr.org>
2013-12-11hwmon: HIH-6130: Support I2C bus drivers without I2C_FUNC_SMBUS_QUICKJosé Miguel Gonçalves
Some I2C bus drivers do not allow zero-length data transfers which are required to start a measurement with the HIH6130/1 sensor. Nevertheless, we can overcome this limitation by writing a zero dummy byte. This byte is ignored by the sensor and was verified to be working with the OMAP I2C bus driver in a BeagleBone board. Signed-off-by: José Miguel Gonçalves <jose.goncalves@inov.pt> [Guenter Roeck: Simplified complexity of write_length initialization] Cc: stable@vger.kernel.org # v3.10+ Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2013-12-10Merge git://www.linux-watchdog.org/linux-watchdogLinus Torvalds
Pull watchdog fixes from Wim Van Sebroeck: "Drop the unnecessary miscdevice.h includes that we forgot in commit 487722cf2d66 ("watchdog: Get rid of MODULE_ALIAS_MISCDEV statements") and fix an oops for the sc1200_wdt driver" * git://www.linux-watchdog.org/linux-watchdog: sc1200_wdt: Fix oops watchdog: Drop unnecessary include of miscdevice.h
2013-12-10Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/egtvedt/linux-avr32 Pull AVR32 fixes from Hans-Christian Egtvedt. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/egtvedt/linux-avr32: avr32: favr-32: clk_round_rate() can return a zero upon error avr32: remove deprecated IRQF_DISABLED cpufreq_ at32ap-cpufreq.c: Fix section mismatch avr32: pm: Fix section mismatch avr32: Kill CONFIG_MTD_PARTITIONS
2013-12-10Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: "One patch to increase the number of possible CPUs to 256, with the latest machine a single LPAR can have up to 101 CPUs. Plus a number of bug fixes, the clock_gettime patch fixes a regression added in the 3.13 merge window" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/time,vdso: fix clock_gettime for CLOCK_MONOTONIC s390/vdso: ectg gettime support for CLOCK_THREAD_CPUTIME_ID s390/vdso: fix access-list entry initialization s390: increase CONFIG_NR_CPUS limit s390/smp,sclp: fix size of sclp_cpu_info structure s390/sclp: replace uninitialized early_event_mask_sccb variable with sccb_early s390/dasd: fix memory leak caused by dangling references to request_queue
2013-12-10KEYS: correct alignment of system_certificate_list content in assembly fileHendrik Brueckner
Apart from data-type specific alignment constraints, there are also architecture-specific alignment requirements. For example, on s390 symbols must be on even addresses implying a 2-byte alignment. If the system_certificate_list_end symbol is on an odd address and if this address is loaded, the least-significant bit is ignored. As a result, the load_system_certificate_list() fails to load the certificates because of a wrong certificate length calculation. To be safe, align system_certificate_list on an 8-byte boundary. Also improve the length calculation of the system_certificate_list content. Introduce a system_certificate_list_size (8-byte aligned because of unsigned long) variable that stores the length. Let the linker calculate this size by introducing a start and end label for the certificate content. Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com> Signed-off-by: David Howells <dhowells@redhat.com>
2013-12-10Ignore generated file kernel/x509_certificate_listRusty Russell
$ git status # On branch pending-rebases # Untracked files: # (use "git add <file>..." to include in what will be committed) # # kernel/x509_certificate_list nothing added to commit but untracked files present (use "git add" to track) $ Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: David Howells <dhowells@redhat.com>
2013-12-10xfs: growfs overruns AGFL buffer on V4 filesystemsDave Chinner
This loop in xfs_growfs_data_private() is incorrect for V4 superblocks filesystems: for (bucket = 0; bucket < XFS_AGFL_SIZE(mp); bucket++) agfl->agfl_bno[bucket] = cpu_to_be32(NULLAGBLOCK); For V4 filesystems, we don't have a agfl header structure, and so XFS_AGFL_SIZE() returns an entire sector's worth of entries, which we then index from an offset into the sector. Hence: buffer overrun. This problem was introduced in 3.10 by commit 77c95bba ("xfs: add CRC checks to the AGFL") which changed the AGFL structure but failed to update the growfs code to handle the different structures. Fix it by using the correct offset into the buffer for both V4 and V5 filesystems. Cc: <stable@vger.kernel.org> Signed-off-by: Dave Chinner <dchinner@redhat.com> Reviewed-by: Jie Liu <jeff.liu@oracle.com> Signed-off-by: Ben Myers <bpm@sgi.com> (cherry picked from commit b7d961b35b3ab69609aeea93f870269cb6e7ba4d)
2013-12-10xfs: don't perform discard if the given range length is less than block sizeJie Liu
For discard operation, we should return EINVAL if the given range length is less than a block size, otherwise it will go through the file system to discard data blocks as the end range might be evaluated to -1, e.g, # fstrim -v -o 0 -l 100 /xfs7 /xfs7: 9811378176 bytes were trimmed This issue can be triggered via xfstests/generic/288. Also, it seems to get the request queue pointer via bdev_get_queue() instead of the hard code pointer dereference is not a bad thing. Signed-off-by: Jie Liu <jeff.liu@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Ben Myers <bpm@sgi.com> (cherry picked from commit f9fd0135610084abef6867d984e9951c3099950d)
2013-12-10xfs: underflow bug in xfs_attrlist_by_handle()Dan Carpenter
If we allocate less than sizeof(struct attrlist) then we end up corrupting memory or doing a ZERO_PTR_SIZE dereference. This can only be triggered with CAP_SYS_ADMIN. Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Fabian Yamaguchi <fabs@goesec.de> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Dave Chinner <dchinner@redhat.com> Signed-off-by: Ben Myers <bpm@sgi.com> (cherry picked from commit 071c529eb672648ee8ca3f90944bcbcc730b4c06)
2013-12-10sc1200_wdt: Fix oopsAlan
If loaded with isapnp = 0 the driver explodes. This is catching people out now and then. What should happen in the working case is a complete mystery and the code appears terminally confused, but we can at least make the error path work properly. Signed-off-by: Alan Cox <alan@linux.intel.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@iguana.be> Partially-Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=53991
2013-12-10watchdog: Drop unnecessary include of miscdevice.hGuenter Roeck
After commit 487722cf2 (watchdog: Get rid of MODULE_ALIAS_MISCDEV statements) the affected drivers no longer need to include miscdevice.h. Only exception is rt2880_wdt.c which never needed it. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Jean Delvare <jdelvare@suse.de> Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
2013-12-10avr32: favr-32: clk_round_rate() can return a zero upon errorPaul Walmsley
Treat both negative and zero return values from clk_round_rate() as errors. This is needed since subsequent patches will convert clk_round_rate()'s return value to be an unsigned type, rather than a signed type, since some clock sources can generate rates higher than (2^31)-1 Hz. Eventually, when calling clk_round_rate(), only a return value of zero will be considered a error. All other values will be considered valid rates. The comparison against values less than 0 is kept to preserve the correct behavior in the meantime. Signed-off-by: Paul Walmsley <paul@pwsan.com> Cc: Nicolas Ferre <nicolas.ferre@atmel.com> Cc: Håvard Skinnemoen <hskinnemoen@gmail.com> Cc: Hans-Christian Egtvedt <egtvedt@samfundet.no> Cc: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Acked-by: Hans-Christian Egtvedt <egtvedt@samfundet.no>
2013-12-10avr32: remove deprecated IRQF_DISABLEDMichael Opdenacker
This patch proposes to remove the use of the IRQF_DISABLED flag It's a NOOP since 2.6.35 and it will be removed one day. Signed-off-by: Michael Opdenacker <michael.opdenacker@free-electrons.com> Acked-by: Hans-Christian Egtvedt <egtvedt@samfundet.no>
2013-12-10cpufreq_ at32ap-cpufreq.c: Fix section mismatchMatthias Brugger
The function at32_cpufreq_driver_init was marked as __init but will be called from inside the cpufreq framework. This lead to the following a section mismatch during compilation: WARNING: drivers/built-in.o(.data+0x2448): Section mismatch in reference from the variable at32_driver to the function .init.text:at32_cpufreq_driver_init() The variable at32_driver references the function __init at32_cpufreq_driver_init() If the reference is valid then annotate the variable with __init* or __refdata (see linux/init.h) or name the variable: *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
2013-12-10avr32: pm: Fix section mismatchMatthias Brugger
The power management has a section mismatch which leads to the following warning during compilation: WARNING: arch/avr32/mach-at32ap/built-in.o(.text+0x16d4): Section mismatch in reference from the function avr32_pm_offset() to the function .init.text:pm_exception() The function avr32_pm_offset() references the function __init pm_exception(). Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com> Acked-by: Hans-Christian Egtvedt <hegtvedt@cisco.com>
2013-12-10avr32: Kill CONFIG_MTD_PARTITIONSEunbong Song
This patch removes CONFIG_MTD_PARTITIONS in config files for avr32. Because CONFIG_MTD_PARTITIONS was removed by commit 6a8a98b22b10f1560d5f90aded4a54234b9b2724. Signed-off-by: Eunbong Song <eunb.song@samsung.com> Acked-by: Hans-Christian Egtvedt <hegtvedt@cisco.com>
2013-12-09Merge branch 'merge' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc Pull powerpc fixes from Ben Herrenschmidt: "Here are a handful of powerpc fixes for 3.13. The patches are reasonably trivial and self contained. Note the offb patches outside of arch/powerpc, they are LE fixes for our open-firmware 'dumb' framebuffer" * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc: Fix up the kdump base cap to 128M powernv: Fix VFIO support with PHB3 powerpc/52xx: Re-enable bestcomm driver in defconfigs powerpc/pasemi: Turn on devtmpfs in defconfig offb: Add palette hack for little endian offb: Little endian fixes powerpc: Fix PTE page address mismatch in pgtable ctor/dtor powerpc/44x: Fix ocm_block allocation powerpc: Fix build break with PPC_EARLY_DEBUG_BOOTX=y powerpc/512x: dts: remove misplaced IRQ spec from 'soc' node
2013-12-10powerpc: Fix up the kdump base cap to 128MMahesh Salgaonkar
The current logic sets the kdump base to min of 2G or ppc64_rma_size/2. On PowerNV kernel the first memory block 'memory@0' can be very large, equal to the DIMM size with ppc64_rma_size value capped to 1G. Hence on PowerNV, kdump base is set to 512M resulting kdump to fail while allocating paca array. This is because, paca need its memory from RMA region capped at 256M (see allocate_pacas()). This patch lowers the kdump base cap to 128M so that kdump kernel can successfully get memory below 256M for paca allocation. Signed-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-12-10powernv: Fix VFIO support with PHB3Thadeu Lima de Souza Cascardo
I have recently found out that no iommu_groups could be found under /sys/ on a P8. That prevents PCI passthrough from working. During my investigation, I found out there seems to be a missing iommu_register_group for PHB3. The following patch seems to fix the problem. After applying it, I see iommu_groups under /sys/kernel/iommu_groups/, and can also bind vfio-pci to an adapter, which gives me a device at /dev/vfio/. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-12-10powerpc/52xx: Re-enable bestcomm driver in defconfigsAnatolij Gustschin
The bestcomm driver has been moved to drivers/dma, so to select this driver by default additionally CONFIG_DMADEVICES has to be enabled. Currently it is not enabled in the config despite existing CONFIG_PPC_BESTCOMM=y in the config files. Fix it. Signed-off-by: Anatolij Gustschin <agust@denx.de> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-12-10powerpc/pasemi: Turn on devtmpfs in defconfigOlof Johansson
At least some distros expect it these days; turn it on. Also, random churn from doing a savedefconfig for the first time in a year or so. Signed-off-by: Olof Johansson <olof@lixom.net> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-12-10offb: Add palette hack for little endianCedric Le Goater
The pseudo palette color entries need to be ajusted for little endian. This patch byteswaps the values in the pseudo palette depending on the host endian order and the screen depth. Signed-off-by: Cédric Le Goater <clg@fr.ibm.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-12-10offb: Little endian fixesCedric Le Goater
The "screen" properties : depth, width, height, linebytes need to be converted to the host endian order when read from the device tree. The offb_init_palette_hacks() routine also made assumption on the host endian order. Signed-off-by: Cédric Le Goater <clg@fr.ibm.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-12-10powerpc: Fix PTE page address mismatch in pgtable ctor/dtorHong H. Pham
In pte_alloc_one(), pgtable_page_ctor() is passed an address that has not been converted by page_address() to the newly allocated PTE page. When the PTE is freed, __pte_free_tlb() calls pgtable_page_dtor() with an address to the PTE page that has been converted by page_address(). The mismatch in the PTE's page address causes pgtable_page_dtor() to access invalid memory, so resources for that PTE (such as the page lock) is not properly cleaned up. On PPC32, only SMP kernels are affected. On PPC64, only SMP kernels with 4K page size are affected. This bug was introduced by commit d614bb041209fd7cb5e4b35e11a7b2f6ee8f62b8 "powerpc: Move the pte free routines from common header". On a preempt-rt kernel, a spinlock is dynamically allocated for each PTE in pgtable_page_ctor(). When the PTE is freed, calling pgtable_page_dtor() with a mismatched page address causes a memory leak, as the pointer to the PTE's spinlock is bogus. On mainline, there isn't any immediately obvious symptoms, but the problem still exists here. Fixes: d614bb041209fd7c "powerpc: Move the pte free routes from common header" Cc: Paul Mackerras <paulus@samba.org> Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: linux-stable <stable@vger.kernel.org> # v3.10+ Signed-off-by: Hong H. Pham <hong.pham@windriver.com> Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-12-10powerpc/44x: Fix ocm_block allocationIlia Mirkin
Allocate enough memory for the ocm_block structure, not just a pointer to it. Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-12-10powerpc: Fix build break with PPC_EARLY_DEBUG_BOOTX=yMichael Ellerman
A kernel configured with PPC_EARLY_DEBUG_BOOTX=y but PPC_PMAC=n and PPC_MAPLE=n will fail to link: btext.c:(.text+0x2d0fc): undefined reference to `.rmci_off' btext.c:(.text+0x2d214): undefined reference to `.rmci_on' Fix it by making the build of rmci_on/off() depend on PPC_EARLY_DEBUG_BOOTX, which also enable the only code that uses them. Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2013-12-10Merge remote-tracking branch 'agust/merge' into mergeBenjamin Herrenschmidt
Anatolij Gustschin says: << Please pull a device tree fix for v3.13. The booting on mpc512x is broken since v3.13-rc1, this patch repairs it. >>
2013-12-09Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds
Pull drm fixes from Dave Airlie: "This is probably a bit big, but just because I fell behind last week and didn't get to doing any pulls, so stuff backed up behind me, I actually should have sent this for -rc3 but failed to even manage that. So this has radeon, intel, nouveau, vmware, exynos and tegra fixes in it, and the line count isn't all the bad in the end" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (50 commits) drm: fix the addition of the side-by-side (half) flag for extra 3D modes drm/edid: fix length check when adding extra 3D modes drm/radeon/atom: fix bus probes when hw_i2c is set (v2) drm/radeon: fix null pointer dereference in dce6+ audio code drm/radeon: fixup bad vram size on SI udl: fix issue with imported prime buffers drm/vmwgfx: Add our connectors to sysfs drm/vmwgfx: Fix dma buffer memory size accounting drm/vmwgfx: Fix up and comment the dumb buffer implementation drm/vmwgfx: Correctly set the enabled state on crtcs drm/nv50/disp: min/max are reversed in nv50_crtc_gamma_set() drm/nouveau/sw: fix oops if gpu has its display block disabled drm/nouveau: unreference fence after syncing drm/nouveau/kms: send timestamp data for correct head in flip completion events drm/nouveau/clk: Add support for NVAA/NVAC drm/nouveau/fifo: Hook up pause and resume for NV50 and NV84+ drm/nv10/plane: some chipsets don't support NV12 drm/nv10/plane: add downscaling restrictions drm/nv10/plane: fix format computation drm/nv04-nv30/clk: provide an empty domain list ...
2013-12-09Merge tag 'mfd-fixes-3.13-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-fixes Pull mfd fixes from Samuel Ortiz: "This is the first 3.13 pull request for MFD fixes. We have: - A ti-ssp build failure fix - An as3722 build failure fix - An lpc_ich copy paste error fix" * tag 'mfd-fixes-3.13-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-fixes: mfd: lpc_ich: Fix Wildcat Point info name field mfd: ti-ssp: Fix build mfd: Make MFD_AS3722 depend on I2C=y
2013-12-09Merge tag 'pm-3.13-rc3-fixup' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixup from Rafael Wysocki: "This reverts two cpufreq commits that fixed issues for some people, but broke things for others, so revert them and we'll need to fix the original problems differently" * tag 'pm-3.13-rc3-fixup' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "cpufreq: fix garbage kobjects on errors during suspend/resume" Revert "cpufreq: suspend governors on system suspend/hibernate"
2013-12-09Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "An update to ALPS to support devices on Dell XT2 (hopefully working better this time around and although it is largish it should not affect any other ALPS devices) and a tiny update to Elantech driver to support newer devices as well. Also a coupe of new input event codes have been defined" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ALPS - add support for DualPoint device on Dell XT2 model Input: elantech - add support for newer (August 2013) devices Input: add SW_MUTE_DEVICE switch definition Input: usbtouchscreen - separate report and transmit buffer size handling Input: sur40 - suppress false uninitialized variable warning Input: add key code for ambient light sensor button Input: keyboard - "keycode & KEY_MAX" changes some keycode values
2013-12-09Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds
Pull crypto fix from Herbert Xu: "Unfortunately the last push that fixed a crash in the crypto scatterwalk code introduced a new crash when SG debugging is enabled. This fixes that" * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: scatterwalk - Use sg_chain_ptr on chain entries
2013-12-09crypto: scatterwalk - Use sg_chain_ptr on chain entriesTom Lendacky
Now that scatterwalk_sg_chain sets the chain pointer bit the sg_page call in scatterwalk_sg_next hits a BUG_ON when CONFIG_DEBUG_SG is enabled. Use sg_chain_ptr instead of sg_page on a chain entry. Cc: stable@vger.kernel.org Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2013-12-08Merge tag 'tty-3.13-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty fix from Greg KH: "Here is a single n_tty fix for 3.13-rc3 that resolves a regression in 3.12 that has been reported" * tag 'tty-3.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: n_tty: Fix missing newline echo
2013-12-08Merge tag 'staging-3.13-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some bugfixes for the staging and IIO drivers for 3.13-rc3. The resolve the vm memory issue in the tidspbridge driver, fix a much-reported build failure in an ARM driver, and some other IIO bugfixes that have been reported" * tag 'staging-3.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: Staging: TIDSPBRIDGE: Use vm_iomap_memory for mmap-ing instead of remap_pfn_range Fix build failure for gp2ap020a00f.c iio: hid-sensors: Fix power and report state HID: hid-sensor-hub: Add logical min and max
2013-12-08Merge tag 'char-misc-3.13-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Nothing huge, just a few small bugfixes for problems reported, and a device id update" * tag 'char-misc-3.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: mei: add 9 series PCH mei device ids drivers/char/i8k.c: add Dell XPLS L421X MAINTAINERS: add HSI subsystem misc: mic: Suppress memory space sparse warnings misc: mic: Fix endianness issues. misc: mic: Fix user space namespace pollution from mic_common.h. misc: mic: Bug fix for sysfs poll usage. misc: mic: Minor bug fix in 'retry' loops. misc: mic: Change mic_notify(...) to return true. extcon: remove freed groups caused the panic or warning in unregister flow extcon: arizona: Get pdata from arizona structure not device
2013-12-08Merge tag 'usb-3.13-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a bunch of USB fixes for 3.13-rc3. Nothing major, but we seem to have an argument about a XHCI fix, so I'm not including a revert that Sarah requested, because that breaks a USB network driver, and I can't revert the USB network driver fix without reintroducing other bugs that it fixed. So as it is, everything should now be working. Worse case, I can revert the XHCI fix before 3.13-final is out, but it seems to work well here with my testing, so all should be good. Other than that, some driver updates based on reports" * tag 'usb-3.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (40 commits) usb: hub: Use correct reset for wedged USB3 devices that are NOTATTACHED usb: ohci-pxa27x: include linux/dma-mapping.h USB: cdc-acm: Added support for the Lenovo RD02-D400 USB Modem usb: tools: fix a regression issue that gcc can't link to pthread USB: switch maintainership of chipidea to Peter USB: pl2303: fixed handling of CS5 setting USB: ftdi_sio: fixed handling of unsupported CSIZE setting USB: mos7840: correct handling of CS5 setting USB: spcp8x5: correct handling of CS5 setting usb: wusbcore: fix deadlock in wusbhc_gtk_rekey usb: wusbcore: do device lookup while holding the hc mutex usb: wusbcore: send keepalives to unauthenticated devices USB: option: support new huawei devices USB: serial: option: blacklist interface 1 for Huawei E173s-6 usb: xhci: Link TRB must not occur within a USB payload burst usb: gadget: f_mass_storage: call try_to_freeze only when its safe usb: gadget: tcm_usb_gadget: mark bot_cleanup_old_alt static usb: gadget: ffs: fix sparse warning usb: gadget: zero: module parameters can be static usb: gadget: storage: fix sparse warning ...