| Age | Commit message (Collapse) | Author |
|---|
|
From Maxime Ripard <maxime.ripard@free-electrons.com>:
ARM: sunxi: dt additions for 3.10, take 2
- Rename the clock compatible introduced in the first pull request for 3.10
- Complete the UART support for A13 and A10
- Adds clock gates support
* tag 'sunxi-dt-for-3.10-2' of git://github.com/mripard/linux:
arm: sunxi: Add clock to pinctrl node
arm: sunxi: use the right clock phandles for UARTs
arm: sunxi: Add clock definitions for AXI, AHB, APB0, APB1 gates
ARM: sunxi: cubieboard: Add UART muxing
ARM: sunxi: hackberry: Add UART muxing
ARM: sunxi: dt: Add A10 UARTs to the dtsi.
ARM: sunxi: dt: Add uart3 dt node
ARM: sunxi: dt: Move uart0 to sun4i-a10.dtsi
ARM: sunxi: Rename uart nodes to serial
ARM: sunxi: dt: Use clocks property instead of clock-frequency for the UARTs
arm: sunxi: rename clock compatible strings
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/swarren/linux-rpi into next/dt
From Stephen Warren <swarren@wwwdotorg.org>:
ARM: bcm2835: device tree updates
This branch adds two devices to the BCM2835 SoC device tree: the SPI
controller and the HW random number generator.
The SPI controller isn't actually instantiated in the Raspberry Pi
device tree, since there are no on-board SPI devices; it's up to the
end-user to modify their own device-tree to describe whatever they
have attached.
* tag 'bcm2835-for-3.10-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/swarren/linux-rpi:
ARM: bcm2835: add Broadcom BCM2835 RNG to the device tree
ARM: bcm2835: add SPI device to DT
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
From Michal Simek <michal.simek@xilinx.com>:
It enables pmu support for zynq.
* 'zynq/core' of git://git.xilinx.com/linux-xlnx:
arm: zynq: Add support for pmu
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
The port controller needs the apb0_pio clock enabled to be able to
work. This commit declares that on the device tree.
Signed-off-by: Emilio López <emilio@elopez.com.ar>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
|
|
All the UARTs are connected to clock gates; now that our clock driver
is able to handle them, make the switch.
Signed-off-by: Emilio López <emilio@elopez.com.ar>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
|
|
This commit adds the corresponding DT bindings for all the AXI,
AHB, APB0 and APB1 gates.
Signed-off-by: Emilio López <emilio@elopez.com.ar>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
|
|
Zynq is standard PMU with 2 interrupt per core.
There is also access via register which is not used right now.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
|
|
This adds a device tree binding for random number generator present on
Broadcom BCM2835 SoC, used in Raspberry Pi and Roku 2 devices.
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Tested-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Stephen Warren <swarren@wwwdotorg.org>
|
|
We previously relied on the bootloader to do the muxing of the UART for
the Cubieboard. Don't rely on it anymore and use pinctrl.
Also remove uart1, as it is not enabled by default and it's not exposed
on the board headers.
Signed-off-by: Emilio López <emilio@elopez.com.ar>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
|
|
We previously relied on the bootloader to do the muxing of the UART for
the Hackberry. Don't rely on it anymore and use pinctrl.
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Acked-by: Emilio López <emilio@elopez.com.ar>
|
|
The Allwinner A10 SoC has 8 available UARTs, which is 6 more than on the
A13, so add the missing UARTs to the sun4i-a10 dtsi.
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Acked-by: Emilio López <emilio@elopez.com.ar>
|
|
Both A10 and A13 Allwinner SoCs have a Synopsys APB uart3 device
available, so add it to the sunxi.dtsi file
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Acked-by: Emilio López <emilio@elopez.com.ar>
|
|
The UART0 is only available on the Allwinner A10 SoCs, and not on the
A13, so move the uart0 node to sun4i-a10.dtsi.
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Acked-by: Emilio López <emilio@elopez.com.ar>
Tested-by: Emilio López <emilio@elopez.com.ar>
|
|
The other architecture use serial@address for their uart nodes, so
rename our uart dt nodes to be consistent
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
|
|
It will be especially useful when we will have the clock definitions in
the device tree.
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Acked-by: Emilio López <emilio@elopez.com.ar>
Tested-by: Emilio López <emilio@elopez.com.ar>
|
|
During the introduction of the Allwinner SoC platforms, sunxi was
initially meant as a generic name for all the variants of the Allwinner
SoC.
It was ok at the time of the support of only the A10 and A13 that
look pretty much the same; but it's beginning to be troublesome with
the future addition of the Allwinner A31 (sun6i) that is quite
different, and would introduce some weird logic, where sunxi would
actually mean in some case sun4i and sun5i but without sun6i...
Moreover, it makes the compatible strings naming scheme not consistent
with other architectures, where usually for this kind of compability, we
just use the oldest SoC name that has this IP, so let's do just this.
Signed-off-by: Emilio López <emilio@elopez.com.ar>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
|
|
From Maxime Ripard <maxime.ripard@free-electrons.com>:
Allwinner sunxi DT additions for 3.10
* tag 'sunxi-dt-for-3.10' of git://github.com/mripard/linux:
arm: sunxi: Add clock definitions for the new clock driver
ARM: sunxi: dt: Add support for the PineRiver Mini X-plus
sunxi: a10-cubieboard: Add user LEDs to the device tree
sunxi: a13-olinuxino: Add user LED to the device tree
sunxi: dts: Report the pinctrl nodes as gpio-controllers
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
This introduces proper clock definitions on sunxi.dtsi, to be used
with the new clock driver for sunxi.
Signed-off-by: Emilio López <emilio@elopez.com.ar>
Acked-by: Mike Turquette <mturquette@linaro.org>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
|
|
From Nicolas Ferre <nicolas.ferre@atmel.com>:
DT modifications for at91rm9200 and at91sam9x5 SoCs, mainly around
I2C. Also some cleanup of some unneeded properties and conflicting
nodes.
One more DT-only board based on at91rm9200.
* tag 'at91-dt' of git://github.com/at91linux/linux-at91:
ARM: at91/at91sam9x5cm: add 1-wire chip on CM board
ARM: at91/at91sam9x5ek: i2c1 and i2c2 conflict with macb and lcd
ARM: at91/dt: gpio-keys: remove address-cells and size-cells properties
ARM: at91: add MPA 1600 DT board
ARM: at91: add pinctrl nodes to i2c-gpio on RM92000 DT
ARM: at91: add TWI bindings to RM9200 DT
ARM: at91: dt: at91sam9x5: add i2c-gpio pinctrl
ARM: at91: dt: at91sam9x5: add i2c pinctrl
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
This add the 1-wire chip present on the CM board to the DTS.
As the pin is also used by leds, it's disabled by default.
If the board really wants it, it can be enabled in the board DTS.
Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
|
|
On at91sam9x5ek, macb0 is enabled, so it conflicts with i2c2 (PB4)
same for i2c1, (conflicts with LCD).
Moreover, only i2c0 is used on this board.
Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
|
|
Gpio-keys nodes are not using the "reg" property in their sub nodes.
So, there is no need to define #address-cells and #size-cells properties
in gpio-keys nodes: we remove them.
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
|
|
Signed-off-by: Joachim Eastwood <manabian@gmail.com>
[nicolas.ferre@atmel.com: remove unneeded address-cells and size-cells to gpio-keys]
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
|
|
GPIO pins used by i2c-gpio must be set to multi drive
(open drain) to work properly.
Signed-off-by: Joachim Eastwood <manabian@gmail.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
|
|
Signed-off-by: Joachim Eastwood <manabian@gmail.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
|
|
i2c-gpio is sometimes used in place of i2c-at91.
This adds the pin muxes for the gpios.
Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
|
|
This adds the at19 i2c controller pin muxes for at91sam9x5 based boards.
Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
|
|
|
|
Commit 1d9d8639c063 ("perf,x86: fix kernel crash with PEBS/BTS after
suspend/resume") introduces a link failure since
perf_restore_debug_store() is only defined for CONFIG_CPU_SUP_INTEL:
arch/x86/power/built-in.o: In function `restore_processor_state':
(.text+0x45c): undefined reference to `perf_restore_debug_store'
Fix it by defining the dummy function appropriately.
Signed-off-by: David Rientjes <rientjes@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Commit 1d9d8639c063 ("perf,x86: fix kernel crash with PEBS/BTS after
suspend/resume") fixed a crash when doing PEBS performance profiling
after resuming, but in using init_debug_store_on_cpu() to restore the
DS_AREA mtrr it also resulted in a new WARN_ON() triggering.
init_debug_store_on_cpu() uses "wrmsr_on_cpu()", which in turn uses CPU
cross-calls to do the MSR update. Which is not really valid at the
early resume stage, and the warning is quite reasonable. Now, it all
happens to _work_, for the simple reason that smp_call_function_single()
ends up just doing the call directly on the CPU when the CPU number
matches, but we really should just do the wrmsr() directly instead.
This duplicates the wrmsr() logic, but hopefully we can just remove the
wrmsr_on_cpu() version eventually.
Reported-and-tested-by: Parag Warudkar <parag.lkml@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs
Pull btrfs fixes from Chris Mason:
"Eric's rcu barrier patch fixes a long standing problem with our
unmount code hanging on to devices in workqueue helpers. Liu Bo
nailed down a difficult assertion for in-memory extent mappings."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
Btrfs: fix warning of free_extent_map
Btrfs: fix warning when creating snapshots
Btrfs: return as soon as possible when edquot happens
Btrfs: return EIO if we have extent tree corruption
btrfs: use rcu_barrier() to wait for bdev puts at unmount
Btrfs: remove btrfs_try_spin_lock
Btrfs: get better concurrency for snapshot-aware defrag work
|
|
Users report that an extent map's list is still linked when it's actually
going to be freed from cache.
The story is that
a) when we're going to drop an extent map and may split this large one into
smaller ems, and if this large one is flagged as EXTENT_FLAG_LOGGING which means
that it's on the list to be logged, then the smaller ems split from it will also
be flagged as EXTENT_FLAG_LOGGING, and this is _not_ expected.
b) we'll keep ems from unlinking the list and freeing when they are flagged with
EXTENT_FLAG_LOGGING, because the log code holds one reference.
The end result is the warning, but the truth is that we set the flag
EXTENT_FLAG_LOGGING only during fsync.
So clear flag EXTENT_FLAG_LOGGING for extent maps split from a large one.
Reported-by: Johannes Hirte <johannes.hirte@fem.tu-ilmenau.de>
Reported-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: Chris Mason <chris.mason@fusionio.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild
Pull kbuild fix from Michal Marek:
"One fix for for make headers_install/headers_check to not require make
3.81. The requirement has been accidentally introduced in 3.7."
* 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
kbuild: fix make headers_check with make 3.80
|
|
Pull OpenRISC bug fixes from Jonas Bonn:
- The GPIO descriptor work has exposed how broken the non-GPIOLIB bits
for OpenRISC were. We now require GPIOLIB as this is the preferred
way forward.
- The system.h split introduced a bug in llist.h for arches using
asm-generic/cmpxchg.h directly, which is currently only OpenRISC.
The patch here moves two defines from asm-generic/atomic.h to
asm-generic/cmpxchg.h to make things work as they should.
- The VIRT_TO_BUS selector was added for OpenRISC, but OpenRISC does
not have the virt_to_bus methods, so there's a patch to remove it
again.
* tag 'for-3.9-rc3' of git://openrisc.net/jonas/linux:
openrisc: remove HAVE_VIRT_TO_BUS
asm-generic: move cmpxchg*_local defs to cmpxchg.h
openrisc: require gpiolib
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc fixes from Greg Kroah-Hartman:
"Here are some tiny fixes for the w1 drivers and the final removal
patch for getting rid of CONFIG_EXPERIMENTAL (all users of it are now
gone from your tree, this just drops the Kconfig item itself.)
All have been in the linux-next tree for a while"
* tag 'char-misc-3.9-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
final removal of CONFIG_EXPERIMENTAL
w1: fix oops when w1_search is called from netlink connector
w1-gpio: fix unused variable warning
w1-gpio: remove erroneous __exit and __exit_p()
ARM: w1-gpio: fix erroneous gpio requests
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of small fixes, as expected for the middle rc:
- A couple of fixes for potential NULL dereferences and out-of-range
array accesses revealed by static code parsers
- A fix for the wrong error handling detected by trinity
- A regression fix for missing audio on some MacBooks
- CA0132 DSP loader fixes
- Fix for EAPD control of IDT codecs on machines w/o speaker
- Fix a regression in the HD-audio widget list parser code
- Workaround for the NuForce UDH-100 USB audio"
* tag 'sound-3.9' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hda - Fix missing EAPD/GPIO setup for Cirrus codecs
sound: sequencer: cap array index in seq_chn_common_event()
ALSA: hda/ca0132 - Remove extra setting of dsp_state.
ALSA: hda/ca0132 - Check download state of DSP.
ALSA: hda/ca0132 - Check if dspload_image succeeded.
ALSA: hda - Disable IDT eapd_switch if there are no internal speakers
ALSA: hda - Fix snd_hda_get_num_raw_conns() to return a correct value
ALSA: usb-audio: add a workaround for the NuForce UDH-100
ALSA: asihpi - fix potential NULL pointer dereference
ALSA: seq: Fix missing error handling in snd_seq_timer_open()
|
|
git://git.linaro.org/people/mszyprowski/linux-dma-mapping
Pull DMA-mapping fix from Marek Szyprowski:
"An important fix for all ARM architectures which use ZONE_DMA.
Without it dma_alloc_* calls with GFP_ATOMIC flag might have allocated
buffers outsize DMA zone."
* 'fixes-for-3.9' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping:
ARM: DMA-mapping: add missing GFP_DMA flag for atomic buffer allocation
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-fixes
Pull MFD fixes from Samuel Ortiz:
"This is the first batch of MFD fixes for 3.9.
With this one we have:
- An ab8500 build failure fix.
- An ab8500 device tree parsing fix.
- A fix for twl4030_madc remove routine to work properly (when
built-in).
- A fix for properly registering palmas interrupt handler.
- A fix for omap-usb init routine to actually write into the
hostconfig register.
- A couple of warning fixes for ab8500-gpadc and tps65912"
* tag 'mfd-fixes-3.9-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-fixes:
mfd: twl4030-madc: Remove __exit_p annotation
mfd: ab8500: Kill "reg" property from binding
mfd: ab8500-gpadc: Complain if we fail to enable vtvout LDO
mfd: wm831x: Don't forward declare enum wm831x_auxadc
mfd: twl4030-audio: Fix argument type for twl4030_audio_disable_resource()
mfd: tps65912: Declare and use tps65912_irq_exit()
mfd: palmas: Provide irq flags through DT/platform data
mfd: Make AB8500_CORE select POWER_SUPPLY to fix build error
mfd: omap-usb-host: Actually update hostconfig
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck:
"Bug fixes for pmbus, ltc2978, and lineage-pem drivers
Added specific maintainer for some hwmon drivers"
* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
hwmon: (pmbus/ltc2978) Fix temperature reporting
hwmon: (pmbus) Fix krealloc() misuse in pmbus_add_attribute()
hwmon: (lineage-pem) Add missing terminating entry for pem_[input|fan]_attributes
MAINTAINERS: Add maintainer for MAX6697, INA209, and INA2XX drivers
|
|
git://git.infradead.org/users/jcooper/linux into next/dt
From Jason Cooper <jason@lakedaemon.net>:
mvebu DT changes for v3.10
- mvebu: gpio expander for the Mirabox
- kirkwood: thermal sensor
- dove: thermal sensor
* tag 'mvebu_dt_for_v3.10' of git://git.infradead.org/users/jcooper/linux:
Dove: Thermal: Add DT node and enable in defconfig
ARM: Kirkwood: Add support thermal sensor for 88F6282 and 88F6283
arm: mvebu: enable gpio expander over i2c on Mirabox platform
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
|
|
This patch fixes a kernel crash when using precise sampling (PEBS)
after a suspend/resume. Turns out the CPU notifier code is not invoked
on CPU0 (BP). Therefore, the DS_AREA (used by PEBS) is not restored properly
by the kernel and keeps it power-on/resume value of 0 causing any PEBS
measurement to crash when running on CPU0.
The workaround is to add a hook in the actual resume code to restore
the DS Area MSR value. It is invoked for all CPUS. So for all but CPU0,
the DS_AREA will be restored twice but this is harmless.
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Stephane Eranian <eranian@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
During the transition to the generic parser, the hook to the codec
specific automute function was forgotten. This resulted in the silent
output on some MacBooks.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
"chn" here is a number between 0 and 255, but ->chn_info[] only has
16 elements so there is a potential write beyond the end of the
array.
If the seq_mode isn't SEQ_2 then we let the individual drivers
(either opl3.c or midi_synth.c) handle it. Those functions all
do a bounds check on "chn" so I haven't changed anything here.
The opl3.c driver has up to 18 channels and not 16.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
4740f73fe5 "mfd: remove use of __devexit" removed the __devexit annotation
on the twl4030_madc_remove function, but left an __exit_p() present on the
pointer to this function. Using __exit_p was as wrong with the devexit in
place as it is now, but now we get a gcc warning about an unused function.
In order for the twl4030_madc_remove to work correctly in built-in code, we
have to remove the __exit_p.
Cc: Bill Pemberton <wfp5p@virginia.edu>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
|
|
spec->dsp_state is initialized to DSP_DOWNLOAD_INIT, no need to reset
and check it in ca0132_download_dsp().
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
Instead of using the dspload_is_loaded() function, check the dsp_state
that is kept in the spec. The dspload_is_loaded() function returns
true if the DSP transfer was never started. This false-positive leads
to multiple second delays when ca0132_setup_efaults() times out on
each write.
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
If dspload_image() fails, it was ignored and dspload_wait_loaded() was
still called. dsp_loaded should never be set to true in this case,
skip it. The check in dspload_wait_loaded() return true if the DSP is
loaded or if it never started.
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
The vm_flags introduced in 6d7825b10dbe ("mm/fremap.c: fix oops on error
path") is supposed to avoid a compiler warning about unitialized
vm_flags without changing the generated code.
However I am concerned that this is going to be very brittle, and fail
with some compiler versions. The failure could be either of:
- compiler could actually load vma->vm_flags before checking for the
!vma condition, thus reintroducing the oops
- compiler could optimize out the !vma check, since the pointer just got
dereferenced shortly before (so the compiler knows it can't be NULL!)
I propose reversing this part of the change and initializing vm_flags to 0
just to avoid the bogus uninitialized use warning.
Signed-off-by: Michel Lespinasse <walken@google.com>
Cc: Tommi Rantala <tt.rantala@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu
Pull fix for hlist_entry_safe() regression from Paul McKenney:
"This contains a single commit that fixes a regression in
hlist_entry_safe(). This macro references its argument twice, which
can cause NULL-pointer errors. This commit applies a gcc statement
expression, creating a temporary variable to avoid the double
reference. This has been posted to LKML at
https://lkml.org/lkml/2013/3/9/75.
Kudos to CAI Qian, whose testing uncovered this, to Eric Dumazet, who
spotted root cause, and to Li Zefan, who tested this commit."
* 'rcu/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
list: Fix double fetch of pointer in hlist_entry_safe()
|
|
The current version of hlist_entry_safe() fetches the pointer twice,
once to test for NULL and the other to compute the offset back to the
enclosing structure. This is OK for normal lock-based use because in
that case, the pointer cannot change. However, when the pointer is
protected by RCU (as in "rcu_dereference(p)"), then the pointer can
change at any time. This use case can result in the following sequence
of events:
1. CPU 0 invokes hlist_entry_safe(), fetches the RCU-protected
pointer as sees that it is non-NULL.
2. CPU 1 invokes hlist_del_rcu(), deleting the entry that CPU 0
just fetched a pointer to. Because this is the last entry
in the list, the pointer fetched by CPU 0 is now NULL.
3. CPU 0 refetches the pointer, obtains NULL, and then gets a
NULL-pointer crash.
This commit therefore applies gcc's "({ })" statement expression to
create a temporary variable so that the specified pointer is fetched
only once, avoiding the above sequence of events. Please note that
it is the caller's responsibility to use rcu_dereference() as needed.
This allows RCU-protected uses to work correctly without imposing
any additional overhead on the non-RCU case.
Many thanks to Eric Dumazet for spotting root cause!
Reported-by: CAI Qian <caiqian@redhat.com>
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Tested-by: Li Zefan <lizefan@huawei.com>
|
