summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-03-12Merge tag 'davinci-for-v3.9-rc/fixes' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci into fixes Via Sekhar Nori <nsekhar@ti.com>: This patch fixes a boot breakage on DA830 that was introduced with EDMA DMA engine conversion. The bug has been there since v3.7 and has been marked for stable update. * tag 'davinci-for-v3.9-rc/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci: ARM: davinci: edma: fix dmaengine induced null pointer dereference on da830 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-03-12ARM: 7670/1: fix the memset fixNicolas Pitre
Commit 455bd4c430b0 ("ARM: 7668/1: fix memset-related crashes caused by recent GCC (4.7.2) optimizations") attempted to fix a compliance issue with the memset return value. However the memset itself became broken by that patch for misaligned pointers. This fixes the above by branching over the entry code from the misaligned fixup code to avoid reloading the original pointer. Also, because the function entry alignment is wrong in the Thumb mode compilation, that fixup code is moved to the end. While at it, the entry instructions are slightly reworked to help dual issue pipelines. Signed-off-by: Nicolas Pitre <nico@linaro.org> Tested-by: Alexander Holler <holler@ahsoftware.de> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2013-03-12ARM: davinci: edma: fix dmaengine induced null pointer dereference on da830Matt Porter
This adds additional error checking to the private edma api implementation to catch the case where the edma_alloc_slot() has an invalid controller parameter. The edma dmaengine wrapper driver relies on this condition being handled in order to avoid setting up a second edma dmaengine instance on DA830. Verfied using a DA850 with the second EDMA controller platform instance removed to simulate a DA830 which only has a single EDMA controller. Reported-by: Tomas Novotny <tomas@novotny.cz> Signed-off-by: Matt Porter <mporter@ti.com> Cc: stable@vger.kernel.org # v3.7.x+ Tested-by: Tomas Novotny <tomas@novotny.cz> Signed-off-by: Sekhar Nori <nsekhar@ti.com>
2013-03-12netconsole: don't call __netpoll_cleanup() while atomicVeaceslav Falico
__netpoll_cleanup() is called in netconsole_netdev_event() while holding a spinlock. Release/acquire the spinlock before/after it and restart the loop. Also, disable the netconsole completely, because we won't have chance after the restart of the loop, and might end up in a situation where nt->enabled == 1 and nt->np.dev == NULL. Signed-off-by: Veaceslav Falico <vfalico@redhat.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-12ARM: spear3xx: Use correct pl080 header fileArnd Bergmann
The definitions have move around recently, causing build errors in spear3xx for all configurations: spear3xx.c:47:5: error: 'PL080_BSIZE_16' undeclared here (not in a function) spear3xx.c:47:23: error: 'PL080_CONTROL_SB_SIZE_SHIFT' undeclared here (not in a function) spear3xx.c:48:22: error: 'PL080_CONTROL_DB_SIZE_SHIFT' undeclared here (not in a function) Signed-off-by: Arnd Bergmann <arnd@arndb.de> Cc: Alessandro Rubini <rubini@gnudd.com> Cc: Viresh Kumar <viresh.kumar@linaro.org>
2013-03-12bridge: reserve space for IFLA_BRPORT_FAST_LEAVEstephen hemminger
The bridge multicast fast leave feature was added sufficient space was not reserved in the netlink message. This means the flag may be lost in netlink events and results of queries. Found by observation while looking up some netlink stuff for discussion with Vlad. Problem introduced by commit c2d3babfafbb9f6629cfb47139758e59a5eb0d80 Author: David S. Miller <davem@davemloft.net> Date: Wed Dec 5 16:24:45 2012 -0500 bridge: implement multicast fast leave Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-12Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-mergeDavid S. Miller
Included changes ares: - fix packet parsing routine to avoid to read beyond the packet boundary Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-12net/ipv4: Ensure that location of timestamp option is storedDavid Ward
This is needed in order to detect if the timestamp option appears more than once in a packet, to remove the option if the packet is fragmented, etc. My previous change neglected to store the option location when the router addresses were prespecified and Pointer > Length. But now the option location is also stored when Flag is an unrecognized value, to ensure these option handling behaviors are still performed. Signed-off-by: David Ward <david.ward@ll.mit.edu> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-12cxgb4: Allow for backward compatibility with new VPD scheme.Santosh Rastapur
New scheme calls for 3rd party VPD at offset 0x0 and Chelsio VPD at offset 0x400 of the function. If no 3rd party VPD is present, then a copy of Chelsio's VPD will be at offset 0x0 to keep in line with PCI spec which requires the VPD to be present at offset 0x0. Signed-off-by: Santosh Rastapur <santosh@chelsio.com> Signed-off-by: Vipul Pandya <vipul@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-12mfd: ab8500: Kill "reg" property from bindingArnd Bergmann
The ab8500 device is a child of the prcmu device, which is a memory mapped bus device, whose children are addressable using physical memory addresses, not using mailboxes, so a mailbox number in the ab8500 node cannot be parsed by DT. Nothing uses this number, since it was only introduced as part of the failed attempt to clean up prcmu mailbox handling, and we can simply remove it. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-03-12mfd: ab8500-gpadc: Complain if we fail to enable vtvout LDOAxel Lin
Since commit c8801a8e "regulator: core: Mark all get and enable calls as __must_check", we must check return value of regulator_enable() to silence below build warning. CC drivers/mfd/ab8500-gpadc.o drivers/mfd/ab8500-gpadc.c: In function 'ab8500_gpadc_runtime_resume': drivers/mfd/ab8500-gpadc.c:598:18: warning: ignoring return value of 'regulator_enable', declared with attribute warn_unused_result [-Wunused-result] drivers/mfd/ab8500-gpadc.c: In function 'ab8500_gpadc_probe': drivers/mfd/ab8500-gpadc.c:655:18: warning: ignoring return value of 'regulator_enable', declared with attribute warn_unused_result [-Wunused-result] Also convert to devm_regulator_get(), this fixes a missing regulator_put() call in ab8500_gpadc_remove(). Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-03-12mfd: wm831x: Don't forward declare enum wm831x_auxadcMark Brown
We can't forward declare enums. Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-03-12mfd: twl4030-audio: Fix argument type for twl4030_audio_disable_resource()Mark Brown
Looks like the conversion to enum was missed for the definition of this function, the declaration has been updated. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-03-12mfd: tps65912: Declare and use tps65912_irq_exit()Mark Brown
Clean up interrupts on exit, silencing a sparse warning caused by tps65912_irq_exit() being defined but not prototyped as we go. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-03-12mfd: palmas: Provide irq flags through DT/platform dataLaxman Dewangan
Currently driver sets the irq type to IRQF_TRIGGER_LOW which is causing interrupt registration failure in ARM based SoCs as: [ 0.208479] genirq: Setting trigger mode 8 for irq 118 failed (gic_set_type+0x0/0xf0) [ 0.208513] dummy 0-0059: Failed to request IRQ 118: -22 Provide the irq flags through platform data if device is registered through board file or get the irq type from DT node property in place of hardcoding the irq flag in driver to support multiple platforms. Also configure the device to generate the interrupt signal according to flag type. Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-03-12mfd: Make AB8500_CORE select POWER_SUPPLY to fix build errorAxel Lin
This patch fixes below build error when CONFIG_POWER_SUPPLY is not set. drivers/built-in.o: In function `ab8500_power_off': drivers/mfd/ab8500-sysctrl.c:37: undefined reference to `power_supply_get_by_name' drivers/mfd/ab8500-sysctrl.c:53: undefined reference to `power_supply_get_by_name' make: *** [vmlinux] Error 1 Signed-off-by: Axel Lin <axel.lin@ingics.com> Acked-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-03-12mfd: omap-usb-host: Actually update hostconfigRoger Quadros
The helper functions omap_usbhs_rev1_hostconfig() and omap_usbhs_rev2_hostconfig() don't write into the hostconfig register. Make sure that we write the return value into the hostconfig register. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2013-03-12ALSA: usb-audio: add a workaround for the NuForce UDH-100Clemens Ladisch
The NuForce UDH-100 numbers its interfaces incorrectly, which makes the interface associations come out wrong, which results in the driver erroring out with the message "Audio class v2 interfaces need an interface association". Work around this by searching for the interface association descriptor also in some other place where it might have ended up. Reported-and-tested-by: Dave Helstroom <helstroom@google.com> Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-03-12ALSA: asihpi - fix potential NULL pointer dereferenceWei Yongjun
The dereference should be moved below the NULL test. Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-03-12keys: fix race with concurrent install_user_keyrings()David Howells
This fixes CVE-2013-1792. There is a race in install_user_keyrings() that can cause a NULL pointer dereference when called concurrently for the same user if the uid and uid-session keyrings are not yet created. It might be possible for an unprivileged user to trigger this by calling keyctl() from userspace in parallel immediately after logging in. Assume that we have two threads both executing lookup_user_key(), both looking for KEY_SPEC_USER_SESSION_KEYRING. THREAD A THREAD B =============================== =============================== ==>call install_user_keyrings(); if (!cred->user->session_keyring) ==>call install_user_keyrings() ... user->uid_keyring = uid_keyring; if (user->uid_keyring) return 0; <== key = cred->user->session_keyring [== NULL] user->session_keyring = session_keyring; atomic_inc(&key->usage); [oops] At the point thread A dereferences cred->user->session_keyring, thread B hasn't updated user->session_keyring yet, but thread A assumes it is populated because install_user_keyrings() returned ok. The race window is really small but can be exploited if, for example, thread B is interrupted or preempted after initializing uid_keyring, but before doing setting session_keyring. This couldn't be reproduced on a stock kernel. However, after placing systemtap probe on 'user->session_keyring = session_keyring;' that introduced some delay, the kernel could be crashed reliably. Fix this by checking both pointers before deciding whether to return. Alternatively, the test could be done away with entirely as it is checked inside the mutex - but since the mutex is global, that may not be the best way. Signed-off-by: David Howells <dhowells@redhat.com> Reported-by: Mateusz Guzik <mguzik@redhat.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: James Morris <james.l.morris@oracle.com>
2013-03-11ext4: use atomic64_t for the per-flexbg free_clusters countTheodore Ts'o
A user who was using a 8TB+ file system and with a very large flexbg size (> 65536) could cause the atomic_t used in the struct flex_groups to overflow. This was detected by PaX security patchset: http://forums.grsecurity.net/viewtopic.php?f=3&t=3289&p=12551#p12551 This bug was introduced in commit 9f24e4208f7e, so it's been around since 2.6.30. :-( Fix this by using an atomic64_t for struct orlav_stats's free_clusters. Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Reviewed-by: Lukas Czerner <lczerner@redhat.com> Cc: stable@vger.kernel.org
2013-03-11batman-adv: verify tt len does not exceed packet lenMarek Lindner
batadv_iv_ogm_process() accesses the packet using the tt_num_changes attribute regardless of the real packet len (assuming the length check was done before). Therefore a length check is needed to avoid reading random memory. Signed-off-by: Marek Lindner <lindner_marek@yahoo.de> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
2013-03-11libceph: fix decoding of pgidsSage Weil
In 4f6a7e5ee1393ec4b243b39dac9f36992d161540 we effectively dropped support for the legacy encoding for the OSDMap and incremental. However, we didn't fix the decoding for the pgid. Signed-off-by: Sage Weil <sage@inktank.com> Reviewed-by: Yehuda Sadeh <yehuda@inktank.com>
2013-03-11reiserfs: Use kstrdup instead of kmalloc/strcpyIonut-Gabriel Radu
Signed-off-by: Ionut-Gabriel Radu <ihonius@gmail.com> Signed-off-by: Jan Kara <jack@suse.cz>
2013-03-11ext3: Fix format string issuesLars-Peter Clausen
ext3_msg() takes the printk prefix as the second parameter and the format string as the third parameter. Two callers of ext3_msg omit the prefix and pass the format string as the second parameter and the first parameter to the format string as the third parameter. In both cases this string comes from an arbitrary source. Which means the string may contain format string characters, which will lead to undefined and potentially harmful behavior. The issue was introduced in commit 4cf46b67eb("ext3: Unify log messages in ext3") and is fixed by this patch. CC: stable@vger.kernel.org Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Jan Kara <jack@suse.cz>
2013-03-11quota: add missing use of dq_data_lock in __dquot_initializeJeff Mahoney
The bulk of __dquot_initialize runs under the dqptr_sem which protects the inode->i_dquot pointers. It doesn't protect the dereferenced contents, though. Those are protected by the dq_data_lock, which is missing around the dquot_resv_space call. Signed-off-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: Jan Kara <jack@suse.cz>
2013-03-11Bluetooth: Device 0cf3:3008 should map AR 3012Sunguk Lee
T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0cf3 ProdID=3008 Rev= 0.01 S: Manufacturer=Atheros Communications S: Product=Bluetooth USB Host Controller S: SerialNumber=Alaska Day 2006 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Sunguk Lee <d3m3vilurr@gmail.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-03-11Arm: socfpga: pl330: Add #dma-cells for generic dma binding supportPadmavathi Venna
This patch adds #dma-cells property to PL330 DMA controller nodes for supporting generic dma dt bindings on SOCFPGA platform. #dma-channels and #dma-requests are not required now but added in advance. Signed-off-by: Padmavathi Venna <padma.v@samsung.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-03-11Merge tag 'mvebu_fixes_for_v3.9' of ↵Arnd Bergmann
git://git.infradead.org/users/jcooper/linux into fixes mvebu fixes for v3.9 from Jason Cooper <jason@lakedaemon.net>: The first four patches: 89c58c1 rtc: rtc-mv: Add support for clk to avoid lockups de88747 gpio: mvebu: Add clk support to prevent lockup 7bf5b40 ARM: kirkwood: fix to retain gbe MAC addresses for DT kernels 93fff4c ARM: kirkwood: of_serial: fix clock gating by removing clock-frequency are Cc'd to stable since they were held over from the previous merge window. The rest are a small collection of fixes and a couple of devicetree conversion catchups. * tag 'mvebu_fixes_for_v3.9' of git://git.infradead.org/users/jcooper/linux: arm: mach-orion5x: fix typo in compatible string of a .dts file arm: mvebu: fix address-cells in mpic DT node arm: plat-orion: fix address decoding when > 4GB is used arm: mvebu: Reduce reg-io-width with UARTs ARM: Dove: add RTC device node arm: mvebu: enable the USB ports on Armada 370 Reference Design board ARM: dove: drop "select COMMON_CLK_DOVE" rtc: rtc-mv: Add support for clk to avoid lockups gpio: mvebu: Add clk support to prevent lockup ARM: kirkwood: fix to retain gbe MAC addresses for DT kernels ARM: kirkwood: of_serial: fix clock gating by removing clock-frequency Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-03-11Merge tag 'imx-fixes-3.9-2' of ↵Arnd Bergmann
git://git.linaro.org/people/shawnguo/linux-2.6 into fixes From Shawn Guo <shawn.guo@linaro.org>: The 2nd take of imx fixes for 3.9: - Fix pll1_sys clk initial status - Fix a typo in imx DEBUG_LL Kconfig * tag 'imx-fixes-3.9-2' of git://git.linaro.org/people/shawnguo/linux-2.6: ARM: imx: fix typo "DEBUG_IMX50_IMX53_UART" ARM: imx: pll1_sys should be an initial on clk Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-03-11Merge tag 'mxs-fixes-3.9-2' of ↵Arnd Bergmann
git://git.linaro.org/people/shawnguo/linux-2.6 into fixes From Shawn Guo <shawn.guo@linaro.org>: The 2nd mxs fixes for 3.9: - Fix an error caused by incorrect conflict resolution when applying the patch * tag 'mxs-fixes-3.9-2' of git://git.linaro.org/people/shawnguo/linux-2.6: ARM: mxs: cfa10049: Fix fb initialisation function Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-03-11ARM: multiplatform: Sort the max gpio numbers.Maxime Ripard
When building a multiplatform kernel, we could end up with a smaller number of GPIOs than the one required by the platform the kernel was running on. Sort the max GPIO number by descending order so that we always take the highest number required. Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-03-11qcaux: add Franklin U600Dan Williams
4 ports; AT/PPP is standard CDC-ACM. The other three (added by this patch) are QCDM/DIAG, possibly GPS, and unknown. Signed-off-by: Dan Williams <dcbw@redhat.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-11usb: musb: core: fix possible build error with randconfigFelipe Balbi
when making commit e574d57 (usb: musb: fix compile warning) I forgot to git add this part of the patch which ended up introducing a possible build error. Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-11Merge tag 'nfc-fixes-3.9-1' of ↵John W. Linville
git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-fixes Samuel Ortiz <sameo@linux.intel.com> says: This is the first NFC pull request for 3.9 fixes With this one we have: - A fix for properly decreasing socket ack log. - A timer and works cleanup upon NFC device removal. - A monitoroing socket cleanup round from llcp_socket_release. - A proper error report to pending sockets upon NFC device removal. Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-03-11xen/acpi: remove redundant acpi/acpi_drivers.h includeLiu Jinsong
It's redundant since linux/acpi.h has include it when CONFIG_ACPI enabled, and when CONFIG_ACPI disabled it will trigger compiling warning In file included from drivers/xen/xen-stub.c:28:0: include/acpi/acpi_drivers.h:103:31: warning: 'struct acpi_device' declared inside parameter list [enabled by default] include/acpi/acpi_drivers.h:103:31: warning: its scope is only this definition or declaration, which is probably not what you want [enabled by default] include/acpi/acpi_drivers.h:107:43: warning: 'struct acpi_pci_root' declared inside parameter list [enabled by default] Reported-by: Wu Fengguang <fengguang.wu@intel.com> Signed-off-by: Liu Jinsong <jinsong.liu@intel.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2013-03-11xen: arm: mandate EABI and use generic atomic operations.Ian Campbell
Rob Herring has observed that c81611c4e96f "xen: event channel arrays are xen_ulong_t and not unsigned long" introduced a compile failure when building without CONFIG_AEABI: /tmp/ccJaIZOW.s: Assembler messages: /tmp/ccJaIZOW.s:831: Error: even register required -- `ldrexd r5,r6,[r4]' Will Deacon pointed out that this is because OABI does not require even base registers for 64-bit values. We can avoid this by simply using the existing atomic64_xchg operation and the same containerof trick as used by the cmpxchg macros. However since this code is used on memory which is shared with the hypervisor we require proper atomic instructions and cannot use the generic atomic64 callbacks (which are based on spinlocks), therefore add a dependency on !GENERIC_ATOMIC64. Since we already depend on !CPU_V6 there isn't much downside to this. While thinking about this we also observed that OABI has different struct alignment requirements to EABI, which is a problem for hypercall argument structs which are shared with the hypervisor and which must be in EABI layout. Since I don't expect people to want to run OABI kernels on Xen depend on CONFIG_AEABI explicitly too (although it also happens to be enforced by the !GENERIC_ATOMIC64 requirement too). Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Rob Herring <robherring2@gmail.com> Acked-by: Stefano Stabellini <Stefano.Stabellini@eu.citrix.com> Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
2013-03-11jbd2: fix use after free in jbd2_journal_dirty_metadata()Jan Kara
jbd2_journal_dirty_metadata() didn't get a reference to journal_head it was working with. This is OK in most of the cases since the journal head should be attached to a transaction but in rare occasions when we are journalling data, __ext4_journalled_writepage() can race with jbd2_journal_invalidatepage() stripping buffers from a page and thus journal head can be freed under hands of jbd2_journal_dirty_metadata(). Fix the problem by getting own journal head reference in jbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers() which can possibly have the same issue). Reported-by: Zheng Liu <gnehzuil.liu@gmail.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Cc: stable@vger.kernel.org
2013-03-11staging: comedi: dt9812: use CR_CHAN() for channel numberIan Abbott
As pointed out by Dan Carpenper in <http://driverdev.linuxdriverproject.org/pipermail/devel/2013-February/036025.html>, the dt9812 comedi driver's use of the `chanspec` member of `struct comedi_insn` as a channel number is incorrect. Change it to use `CR_CHAN(insn->chanspec)` as the channel number (where `insn` is a pointer to the `struct comedi_insn` being processed). Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable <stable@vger.kernel.org> # 3.8 onwards Cc: Anders Blomdell <anders.blomdell@control.lth.se> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-11staging/vt6656: Fix too large integer constant warning on 32-bitGeert Uytterhoeven
drivers/staging/vt6656/card.c: In function ‘CARDqGetNextTBTT’: drivers/staging/vt6656/card.c:793: warning: integer constant is too large for ‘unsigned long’ type Commit c7b7cad0d8df823ea063c86a54316bbcbfa04a7c ("staging/vt6656: Fix sparse warning constant 0xffffffff00000000U is so big it is unsigned long") changed the constant to "0xffffffff00000000UL", but that only works on 64-bit. Change it "0xffffffff00000000ULL" to fix it for 32-bit, too. Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Reviewed-by: Peter Huewe <peterhuewe@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-11staging: comedi: drivers: usbduxsigma.c: fix DMA buffers on stackKumar Amit Mehta
This patch fixes an instance of DMA buffer on stack(being passed to usb_control_msg)for the USB-DUXsigma Board driver. Found using smatch. Signed-off-by: Kumar Amit Mehta <gmate.amit@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-11staging: imx/drm: request irq only after adding the crtcPhilipp Zabel
If the bootloader already enabled the display, the interrupt handler will be called as soon as it is registered. If the CRTC is not already added at this time, the call to imx_drm_handle_vblank will result in a NULL pointer dereference. The patch fixes a kernel panic [1], which has been on linux-next since Jan 8 [2]. [1] http://thread.gmane.org/gmane.linux.ports.arm.kernel/218858 [2] http://thread.gmane.org/gmane.linux.ports.arm.kernel/208192 Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Tested-by: Shawn Guo <shawn.guo@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-11staging: comedi: drivers: usbduxfast.c: fix for DMA buffers on stackKumar Amit Mehta
fix for instances of DMA buffer on stack(being passed to usb_control_msg) for the USB-DUXfast Board driver. Signed-off-by: Kumar Amit Mehta <gmate.amit@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-11staging: comedi: drivers: usbdux.c: fix DMA buffers on stackKumar Amit Mehta
fix for instances of DMA buffer on stack(being passed to usb_control_msg) for the USB-DUX-D Board driver. Signed-off-by: Kumar Amit Mehta <gmate.amit@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-11staging: vt6656: Fix oops on resume from suspend.Malcolm Priestley
Remove usb_put_dev from vt6656_suspend and usb_get_dev from vt6566_resume. These are not normally in suspend/resume functions. Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Cc: stable@vger.kernel.org # 3.0+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-11usb: cp210x new Vendor/Device IDsMatwey V. Kornilov
This patch adds support for the Lake Shore Cryotronics devices to the CP210x driver. These lines are ported from cp210x driver distributed by Lake Shore web site: http://www.lakeshore.com/Documents/Lake%20Shore%20cp210x-3.0.0.tar.gz and licensed under the terms of GPLv2. Moreover, I've tested this changes with Lake Shore 335 in my labs. Signed-off-by: Matwey V. Kornilov <matwey@sai.msu.ru> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-11Merge tag 'fixes-for-v3.9-rc3' of ↵Greg Kroah-Hartman
git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: usb: fixes for v3.9-rc3 Most fixes are on 'musb' driver. There's a sparse warning fix which marks omap2430_glue as static, a build warning fix which was found with randconfig, a fix for omap_musb_mailbox check and removal of 'select' from musb's Kconfig to prevent Kconfig warnings. Other than that, pxa25x got a fix which was introduced by the latest conversion to udc_start/udc_stop patchset, kernel-doc warnings for composite layer and dwc3 got a build fix on sparc64. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-11thermal: exynos_thermal: return a proper error code while ↵Devendra Naga
thermal_zone_device_register fail. we are returning EINVAL while the thermal_zone_device_register function fail. instead we can use the return value from the thermal_zone_device_register by using PTR_ERR. Signed-off-by: Devendra Naga <devendra.aaru@gmail.com> Signed-off-by: Zhang Rui <rui.zhang@intel.com>
2013-03-11thermal: rcar_thermal: propagate return value of thermal_zone_device_registerDevendra Naga
thermal_zone_device_register returns a value contained in the pointer itself use PTR_ERR to obtain the address and return it at the end. Signed-off-by: Devendra Naga <devendra.aaru@gmail.com> Signed-off-by: Zhang Rui <rui.zhang@intel.com>
2013-03-11Thermal: kirkwood: Convert to devm_ioremap_resource()Sachin Kamat
Use the newly introduced devm_ioremap_resource() instead of devm_request_and_ioremap() which provides more consistent error handling. devm_ioremap_resource() provides its own error messages; so all explicit error messages can be removed from the failure code paths. Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Cc: Nobuhiro Iwamatsu <iwamatsu@nigauri.org> Reviewed-by: Thierry Reding <thierry.reding@avionic-design.de> Acked-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org> Signed-off-by: Zhang Rui <rui.zhang@intel.com>