When a probe is being removed, it cleans up the event files that correspond
to the probe. But there is a race between writing to one of these files
and deleting the probe. This is especially true for the "enable" file.
CPU 0 CPU 1
----- -----
fd = open("enable",O_WRONLY);
probes_open()
release_all_trace_probes()
unregister_trace_probe()
if (trace_probe_is_enabled(tp))
return -EBUSY
write(fd, "1", 1)
__ftrace_set_clr_event()
call->class->reg()
(kprobe_register)
enable_trace_probe(tp)
__unregister_trace_probe(tp);
list_del(&tp->list)
unregister_probe_event(tp) <-- fails!
free_trace_probe(tp)
write(fd, "0", 1)
__ftrace_set_clr_event()
call->class->unreg
(kprobe_register)
disable_trace_probe(tp) <-- BOOM!
A test program was written that used two threads to simulate the
above scenario adding a nanosleep() interval to change the timings
and after several thousand runs, it was able to trigger this bug
and crash:
BUG: unable to handle kernel paging request at 00000005000000f9
IP: [<ffffffff810dee70>] probes_open+0x3b/0xa7
PGD 7808a067 PUD 0
Oops: 0000 [#1] PREEMPT SMP
Dumping ftrace buffer:
---------------------------------
Modules linked in: ipt_MASQUERADE sunrpc ip6t_REJECT nf_conntrack_ipv6
CPU: 1 PID: 2070 Comm: test-kprobe-rem Not tainted 3.11.0-rc3-test+ #47
Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS SDBLI944.86P 05/08/2007
task: ffff880077756440 ti: ffff880076e52000 task.ti: ffff880076e52000
RIP: 0010:[<ffffffff810dee70>] [<ffffffff810dee70>] probes_open+0x3b/0xa7
RSP: 0018:ffff880076e53c38 EFLAGS: 00010203
RAX: 0000000500000001 RBX: ffff88007844f440 RCX: 0000000000000003
RDX: 0000000000000003 RSI: 0000000000000003 RDI: ffff880076e52000
RBP: ffff880076e53c58 R08: ffff880076e53bd8 R09: 0000000000000000
R10: ffff880077756440 R11: 0000000000000006 R12: ffffffff810dee35
R13: ffff880079250418 R14: 0000000000000000 R15: ffff88007844f450
FS: 00007f87a276f700(0000) GS:ffff88007d480000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00000005000000f9 CR3: 0000000077262000 CR4: 00000000000007e0
Stack:
ffff880076e53c58 ffffffff81219ea0 ffff88007844f440 ffffffff810dee35
ffff880076e53ca8 ffffffff81130f78 ffff8800772986c0 ffff8800796f93a0
ffffffff81d1b5d8 ffff880076e53e04 0000000000000000 ffff88007844f440
Call Trace:
[<ffffffff81219ea0>] ? security_file_open+0x2c/0x30
[<ffffffff810dee35>] ? unregister_trace_probe+0x4b/0x4b
[<ffffffff81130f78>] do_dentry_open+0x162/0x226
[<ffffffff81131186>] finish_open+0x46/0x54
[<ffffffff8113f30b>] do_last+0x7f6/0x996
[<ffffffff8113cc6f>] ? inode_permission+0x42/0x44
[<ffffffff8113f6dd>] path_openat+0x232/0x496
[<ffffffff8113fc30>] do_filp_open+0x3a/0x8a
[<ffffffff8114ab32>] ? __alloc_fd+0x168/0x17a
[<ffffffff81131f4e>] do_sys_open+0x70/0x102
[<ffffffff8108f06e>] ? trace_hardirqs_on_caller+0x160/0x197
[<ffffffff81131ffe>] SyS_open+0x1e/0x20
[<ffffffff81522742>] system_call_fastpath+0x16/0x1b
Code: e5 41 54 53 48 89 f3 48 83 ec 10 48 23 56 78 48 39 c2 75 6c 31 f6 48 c7
RIP [<ffffffff810dee70>] probes_open+0x3b/0xa7
RSP <ffff880076e53c38>
CR2: 00000005000000f9
---[ end trace 35f17d68fc569897 ]---
The unregister_trace_probe() must be done first, and if it fails it must
fail the removal of the kprobe.
Several changes have already been made by Oleg Nesterov and Masami Hiramatsu
to allow moving the unregister_probe_event() before the removal of
the probe and exit the function if it fails. This prevents the tp
structure from being used after it is freed.
Link: http://lkml.kernel.org/r/20130704034038.819592356@goodmis.org
Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
The "break" used in the do_for_each_event_file() is used as an optimization
as the loop is really a double loop. The loop searches all event files
for each trace_array. There's only one matching event file per trace_array
and after we find the event file for the trace_array, the break is used
to jump to the next trace_array and start the search there.
As this is not a standard way of using "break" in C code, it requires
a comment right before the break to let people know what is going on.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Change trace_remove_event_call(call) to return the error if this
call is active. This is what the callers assume but can't verify
outside of the tracing locks. Both trace_kprobe.c/trace_uprobe.c
need the additional changes, unregister_trace_probe() should abort
if trace_remove_event_call() fails.
The caller is going to free this call/file so we must ensure that
nobody can use them after trace_remove_event_call() succeeds.
debugfs should be fine after the previous changes and event_remove()
does TRACE_REG_UNREGISTER, but still there are 2 reasons why we need
the additional checks:
- There could be a perf_event(s) attached to this tp_event, so the
patch checks ->perf_refcount.
- TRACE_REG_UNREGISTER can be suppressed by FTRACE_EVENT_FL_SOFT_MODE,
so we simply check FTRACE_EVENT_FL_ENABLED protected by event_mutex.
Link: http://lkml.kernel.org/r/20130729175033.GB26284@redhat.com
Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
debugfs_remove_recursive() is wrong,
1. it wrongly assumes that !list_empty(d_subdirs) means that this
dir should be removed.
This is not that bad by itself, but:
2. if d_subdirs does not becomes empty after __debugfs_remove()
it gives up and silently fails, it doesn't even try to remove
other entries.
However ->d_subdirs can be non-empty because it still has the
already deleted !debugfs_positive() entries.
3. simple_release_fs() is called even if __debugfs_remove() fails.
Suppose we have
dir1/
dir2/
file2
file1
and someone opens dir1/dir2/file2.
Now, debugfs_remove_recursive(dir1/dir2) succeeds, and dir1/dir2 goes
away.
But debugfs_remove_recursive(dir1) silently fails and doesn't remove
this directory. Because it tries to delete (the already deleted)
dir1/dir2/file2 again and then fails due to "Avoid infinite loop"
logic.
Test-case:
#!/bin/sh
cd /sys/kernel/debug/tracing
echo 'p:probe/sigprocmask sigprocmask' >> kprobe_events
sleep 1000 < events/probe/sigprocmask/id &
echo -n >| kprobe_events
[ -d events/probe ] && echo "ERR!! failed to rm probe"
And after that it is not possible to create another probe entry.
With this patch debugfs_remove_recursive() skips !debugfs_positive()
files although this is not strictly needed. The most important change
is that it does not try to make ->d_subdirs empty, it simply scans
the whole list(s) recursively and removes as much as possible.
Link: http://lkml.kernel.org/r/20130726151256.GC19472@redhat.com
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
There's been a nasty bug that would show up and not give much info.
The bug displayed the following warning:
WARNING: at kernel/trace/ftrace.c:1529 __ftrace_hash_rec_update+0x1e3/0x230()
Pid: 20903, comm: bash Tainted: G O 3.6.11+ #38405.trunk
Call Trace:
[<ffffffff8103e5ff>] warn_slowpath_common+0x7f/0xc0
[<ffffffff8103e65a>] warn_slowpath_null+0x1a/0x20
[<ffffffff810c2ee3>] __ftrace_hash_rec_update+0x1e3/0x230
[<ffffffff810c4f28>] ftrace_hash_move+0x28/0x1d0
[<ffffffff811401cc>] ? kfree+0x2c/0x110
[<ffffffff810c68ee>] ftrace_regex_release+0x8e/0x150
[<ffffffff81149f1e>] __fput+0xae/0x220
[<ffffffff8114a09e>] ____fput+0xe/0x10
[<ffffffff8105fa22>] task_work_run+0x72/0x90
[<ffffffff810028ec>] do_notify_resume+0x6c/0xc0
[<ffffffff8126596e>] ? trace_hardirqs_on_thunk+0x3a/0x3c
[<ffffffff815c0f88>] int_signal+0x12/0x17
---[ end trace 793179526ee09b2c ]---
It was finally narrowed down to unloading a module that was being traced.
It was actually more than that. When functions are being traced, there's
a table of all functions that have a ref count of the number of active
tracers attached to that function. When a function trace callback is
registered to a function, the function's record ref count is incremented.
When it is unregistered, the function's record ref count is decremented.
If an inconsistency is detected (ref count goes below zero) the above
warning is shown and the function tracing is permanently disabled until
reboot.
The ftrace callback ops holds a hash of functions that it filters on
(and/or filters off). If the hash is empty, the default means to filter
all functions (for the filter_hash) or to disable no functions (for the
notrace_hash).
When a module is unloaded, it frees the function records that represent
the module functions. These records exist on their own pages, that is
function records for one module will not exist on the same page as
function records for other modules or even the core kernel.
Now when a module unloads, the records that represents its functions are
freed. When the module is loaded again, the records are recreated with
a default ref count of zero (unless there's a callback that traces all
functions, then they will also be traced, and the ref count will be
incremented).
The problem is that if an ftrace callback hash includes functions of the
module being unloaded, those hash entries will not be removed. If the
module is reloaded in the same location, the hash entries still point
to the functions of the module but the module's ref counts do not reflect
that.
With the help of Steve and Joern, we found a reproducer:
Using uinput module and uinput_release function.
cd /sys/kernel/debug/tracing
modprobe uinput
echo uinput_release > set_ftrace_filter
echo function > current_tracer
rmmod uinput
modprobe uinput
# check /proc/modules to see if loaded in same addr, otherwise try again
echo nop > current_tracer
[BOOM]
The above loads the uinput module, which creates a table of functions that
can be traced within the module.
We add uinput_release to the filter_hash to trace just that function.
Enable function tracincg, which increments the ref count of the record
associated to uinput_release.
Remove uinput, which frees the records including the one that represents
uinput_release.
Load the uinput module again (and make sure it's at the same address).
This recreates the function records all with a ref count of zero,
including uinput_release.
Disable function tracing, which will decrement the ref count for uinput_release
which is now zero because of the module removal and reload, and we have
a mismatch (below zero ref count).
The solution is to check all currently tracing ftrace callbacks to see if any
are tracing any of the module's functions when a module is loaded (it already does
that with callbacks that trace all functions). If a callback happens to have
a module function being traced, it increments that records ref count and starts
tracing that function.
There may be a strange side effect with this, where tracing module functions
on unload and then reloading a new module may have that new module's functions
being traced. This may be something that confuses the user, but it's not
a big deal. Another approach is to disable all callback hashes on module unload,
but this leaves some ftrace callbacks that may not be registered, but can
still have hashes tracing the module's function where ftrace doesn't know about
it. That situation can cause the same bug. This solution solves that case too.
Another benefit of this solution, is it is possible to trace a module's
function on unload and load.
Link: http://lkml.kernel.org/r/20130705142629.GA325@redhat.com
Reported-by: Jörn Engel <joern@logfs.org>
Reported-by: Dave Jones <davej@redhat.com>
Reported-by: Steve Hodgson <steve@purestorage.com>
Tested-by: Steve Hodgson <steve@purestorage.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
When ftrace ops modifies the functions that it will trace, the update
to the function mcount callers may need to be modified. Consolidate
the two places that do the checks to see if an update is required
with a wrapper function for those checks.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Change remove_event_file_dir() to clear ->i_private for every
file we are going to remove.
We need to check file->dir != NULL because event_create_dir()
can fail. debugfs_remove_recursive(NULL) is fine but the patch
moves it under the same check anyway for readability.
spin_lock(d_lock) and "d_inode != NULL" check are not needed
afaics, but I do not understand this code enough.
tracing_open_generic_file() and tracing_release_generic_file()
can go away, ftrace_enable_fops and ftrace_event_filter_fops()
use tracing_open_generic() but only to check tracing_disabled.
This fixes all races with event_remove() or instance_delete().
f_op->read/write/whatever can never use the freed file/call,
all event/* files were changed to check and use ->i_private
under event_mutex.
Note: this doesn't not fix other problems, event_remove() can
destroy the active ftrace_event_call, we need more changes but
those changes are completely orthogonal.
Link: http://lkml.kernel.org/r/20130728183527.GB16723@redhat.com
Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Preparation for the next patch. Extract the common code from
remove_event_from_tracers() and __trace_remove_event_dirs()
into the new helper, remove_event_file_dir().
The patch looks more complicated than it actually is, it also
moves remove_subsystem() up to avoid the forward declaration.
Link: http://lkml.kernel.org/r/20130726172547.GA3629@redhat.com
Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
trace_format_open() and trace_format_seq_ops are racy, nothing
protects ftrace_event_call from trace_remove_event_call().
Change f_start() to take event_mutex and verify i_private != NULL,
change f_stop() to drop this lock.
This fixes nothing, but now we can change debugfs_remove("format")
callers to nullify ->i_private and fix the the problem.
Note: the usage of event_mutex is sub-optimal but simple, we can
change this later.
Link: http://lkml.kernel.org/r/20130726172543.GA3622@redhat.com
Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
event_filter_read/write() are racy, ftrace_event_call can be already
freed by trace_remove_event_call() callers.
1. Shift mutex_lock(event_mutex) from print/apply_event_filter to
the callers.
2. Change the callers, event_filter_read() and event_filter_write()
to read i_private under this mutex and abort if it is NULL.
This fixes nothing, but now we can change debugfs_remove("filter")
callers to nullify ->i_private and fix the the problem.
Link: http://lkml.kernel.org/r/20130726172540.GA3619@redhat.com
Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
tracing_open_generic_file() is racy, ftrace_event_file can be
already freed by rmdir or trace_remove_event_call().
Change event_enable_read() and event_disable_read() to read and
verify "file = i_private" under event_mutex.
This fixes nothing, but now we can change debugfs_remove("enable")
callers to nullify ->i_private and fix the the problem.
Link: http://lkml.kernel.org/r/20130726172536.GA3612@redhat.com
Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
event_id_read() is racy, ftrace_event_call can be already freed
by trace_remove_event_call() callers.
Change event_create_dir() to pass "data = call->event.type", this
is all event_id_read() needs. ftrace_event_id_fops no longer needs
tracing_open_generic().
We add the new helper, event_file_data(), to read ->i_private, it
will have more users.
Note: currently ACCESS_ONCE() and "id != 0" check are not needed,
but we are going to change event_remove/rmdir to clear ->i_private.
Link: http://lkml.kernel.org/r/20130726172532.GA3605@redhat.com
Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
- Driver fixes for AM33xx, SIRF and PFC pin controllers.
- Fix a compile warning from the pinctrl single-register
driver.
- Fix a little nasty memory leak.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAABAgAGBQJR9YhoAAoJEEEQszewGV1zfl8P/jk2VjlRE0P4LRLSRn3Rt7yj
Wz7IyZTol+mFnaY0yKQS9rToK+GqtJQHA1zuNP8iQnJbQh+UromAZwBd58dP7cnu
mYSi2QS4osYT5RjvVtB2yYy9sRrc4iTb+qJFekanA4IcHt0zKDZysyN8moU5JxmN
TVr+cauFm7qimkjps2Dns94UhVGpgB7A6Y8yC3SYtPv1GPdWQgSaDabWqMYq0bn1
ARUaz3XcbjMAGbPi8kDEFsP/SkM2OcMXpjX23G6ifgO9pyEKeum5+FWtllVeeAzb
LmymMJYVcTPLFw0yj+9lkRBew2K9JKmPp8rAUBvbDn53vbguMkDJTczM3IUZ279h
lRvR+w9F2M1rqIfwSa0/ZqTYKXbsF/IASYMXL/awNywnss+caPUxiN4EWRuKDssS
Wh6veS9l4roMupaez6GU7gQ8UgNnFTQg2BYzeFYbAg1jJ1b/U+E0MK/9yUzewXQw
phlcFFibYce+1qhJhQ3lIYb6O512vw+2Xk+G6JBZVuwzMVvUUJwJqfGRKCoobxZz
DRBIQJ9U4DRMethjfp5mP0H6nH7/fwKqvftKlsnOb9SXZregpcLV+ymrkkmW/Ey2
XuEHQqUbmD0zoPHvFgoUmAYlzmhxtmHK5uJDSH1aZ4b9IOzr2mV1RSt0xwo3BpTS
gwtDvmutV/JQ8RZMLLvw
=URtB
-----END PGP SIGNATURE-----
Merge tag 'pinctrl-for-v3.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control fixes from Linus Walleij:
- Driver fixes for AM33xx, SIRF and PFC pin controllers
- Fix a compile warning from the pinctrl single-register driver
- Fix a little nasty memory leak
* tag 'pinctrl-for-v3.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
pinctrl: fix a memleak when freeing maps
pinctrl: pinctrl-single: fix compile warning when no CONFIG_PM
pinctrl: sh-pfc: fix SDHI0 VccQ regulator on sh73a0 with DT
arm/dts: sirf: fix the pingroup name mismatch between drivers and dts
pinctrl: sirf: add usp0_uart_nostreamctrl pin group for usp-uart without flowctrl
pinctrl: sirf: fix the pin number and mux bit for usp0
pinctrl: am33xx dt binding: correct include path
and deleting that event at the same time (both must be done as root).
I also found a bug while testing Oleg's patches which has to do with
a race with kprobes using the function tracer.
There's also a deadlock fix that was introduced with the previous fixes.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQEcBAABAgAGBQJR8nMiAAoJEOdOSU1xswtMXMMH/jNuG1vDcTjo7WXu3kYHJNWc
u1Z3YPXunFozz4DofzXPCuSkSgRqSR4cVeGOAv3oEfwQv07jJdTAor8/FuVTNXW9
yiGMUvth0nLVZQEmsh3VvVztqFy8FxhpnQHhIa6pillPUdROKgE/A7/q4wT37lxT
qniM1QJTK9fIf2t6suMwSsBD7fepiDkdHwVbs5NvN7qj62/QSPN+pHLAOBl90AGp
r5eUSj8cDHxmzlV+GAJxeqI7KH+P2PGts9USI+s5EX8mODci620jz1HkKab6XRpz
ggYdNzJ21z1fO9vfnpGCF0d03sKdnbJoIQjkyD4AJHlojmLe3s6l/nxS6jg3wH8=
=VrR4
-----END PGP SIGNATURE-----
Merge tag 'trace-fixes-3.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
Pull tracing fixes from Steven Rostedt:
"Oleg is working on fixing a very tight race between opening a event
file and deleting that event at the same time (both must be done as
root).
I also found a bug while testing Oleg's patches which has to do with a
race with kprobes using the function tracer.
There's also a deadlock fix that was introduced with the previous
fixes"
* tag 'trace-fixes-3.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
tracing: Remove locking trace_types_lock from tracing_reset_all_online_cpus()
ftrace: Add check for NULL regs if ops has SAVE_REGS set
tracing: Kill trace_cpu struct/members
tracing: Change tracing_fops/snapshot_fops to rely on tracing_get_cpu()
tracing: Change tracing_entries_fops to rely on tracing_get_cpu()
tracing: Change tracing_stats_fops to rely on tracing_get_cpu()
tracing: Change tracing_buffers_fops to rely on tracing_get_cpu()
tracing: Change tracing_pipe_fops() to rely on tracing_get_cpu()
tracing: Introduce trace_create_cpu_file() and tracing_get_cpu()
This is five bug fixes, two of which fix long standing problems causing
crashes (sd and mvsas). The remaining three are hung (isci race) or lost
(qla2xxx, isci) devices.
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
iQEcBAABAgAGBQJR8+WtAAoJEDeqqVYsXL0MDIUIAKkm+XVgNPAUhDnPH5IUcHVB
jr0NnKnsmlWVNV/Jc8xYKAjPeyBGr4foMR4W+Qqy2g8tTXI55AkXq4A8lyJfYVj9
1j8HTdbJFcOIwQO3e4gp6yJ9j2AdMoM9eHMYqts9u/G+2ckQm8GyMksgttUatVPu
gShyvU2Er546Di6D+JKNMjLufMucnuyPBHmzAKFc9l0L8A31vE0zkbO1qGozDTEB
tDotPSRuaaHaNQDvP/V0uwEIA1/KTq50ZJQerFp/mhc+gAvC/bQlmiOpWEJ8BxW7
3L0TEBsU+Bq1f+1uIWCHk3NWZEjj7nFLfk2lkhh32UtfXMB8Io46PbQAC9/Nk6U=
=/0W8
-----END PGP SIGNATURE-----
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"This is five bug fixes, two of which fix long standing problems
causing crashes (sd and mvsas). The remaining three are hung (isci
race) or lost (qla2xxx, isci) devices"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
[SCSI] isci: fix breakage caused by >16byte CDB patch
[SCSI] mvsas: Fix kernel panic on tile due to unaligned data access
[SCSI] sd: fix crash when UA received on DIF enabled device
[SCSI] qla2xxx: Properly set the tagging for commands.
[SCSI] isci: Fix a race condition in the SSP task management path
Pull drm fixes from Dave Airlie:
"This is just a regular fixes pull apart from the qxl one, it has
radeon and intel bits in it,
The intel fixes are for a regression with the RC6 fix and a 3.10 hdmi
regression, whereas radeon is more DPM fixes, a few lockup fixes and
some rn50/r100 DAC fixes"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/radeon/dpm: fix r600_enable_sclk_control()
drm/radeon/dpm: implement force performance levels for rv6xx
drm/radeon/dpm: fix displaygap programming on rv6xx
drm/radeon/dpm: fix a typo in the rv6xx mclk setup
drm/i915: initialize gt_lock early with other spin locks
drm/i915: fix hdmi portclock limits
drm/radeon: fix combios tables on older cards
drm/radeon: improve dac adjust heuristics for legacy pdac
drm/radeon: Another card with wrong primary dac adj
drm/radeon: fix endian issues with DP handling (v3)
drm/radeon/vm: only align the pt base to 32k
drm/radeon: wait for 3D idle before using CP DMA
Pull qxl drm fixes from Dave Airlie:
"Okay as I warned, the qxl driver was running a bit free and loose with
its ttm object reservations and the new lockdep enabled reservation
tracking shone a bright light into it, it also with the new
reservations mutexes hits a possible deadlock during boot.
The first patch is a real fix to render the console correctly as the
driver used to just drop irq renderering as too hard, this also fixes
a sleeping while atomic warning.
The other two patches are the big ugly ones that redo how the driver
allocates objects and reserves them and makes things all work
properly, I've tested this in a VM, and compared to the current code
which hits a lockdep warning and the sleep while atomic warning before
failing.
So sorry this is coming in late, I should have tested qxl before
merging the mutex code, but I'd rather just fix qxl with this than
revert the reservations code at this point"
* 'qxl-fixes' of git://people.freedesktop.org/~airlied/linux:
qxl: convert qxl driver to proper use for reservations
qxl: allow creation of pre-pinned objects and use for releases.
drm/qxl: add delayed fb operations
- Revert of the ACPI video commit that I hoped would help fix
backlight problems related to Windows 8 compatibility on some
systems. Unfortunately, it turned out to cause problems to happen
too.
- Fix for two problems in intel_pstate, a possible failure to respond
to a load change on a quiet system and a possible failure to select
the highest available P-state on some systems. From Dirk Brandewie.
/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
iQIcBAABAgAGBQJR8ub/AAoJEKhOf7ml8uNsgeQP+QFcSyDmkVCPTiLg5UYwFAIj
nptNB108tFH3ac9eZKNNdkYUeO3aeQooACMG3OqDEMzM88EUlQY33/yWJf9LXaq9
CYh6wNhGIFLWbIm2NcdP7akbXfz9dnoty2ELvD6kfVkRfVUgdo5LJlTn+sBcKwcu
kKUWODj4776dbFvg1Qv5Q6SrFNFWvpWZpsedpAQZWZE88sLy0pwpfq2H88naH551
9PxHqJ3trihq8i2cPSgKAipcIotqubPSHKm0HGYOKo8+C+V64TcJxWIaFwYawnvB
LrnsdjC3l+0DyQIy7OztEzWr/gTi6fdeiWuTU6+6IVbJ7P1waTdVy+B/wy/25PLL
zCJ+DXfqVTiaeSh4nriQVny30XTdZL/jpeFHRdL707FbuK1LLoFSlhH+uDx9EQUc
yIabX+roV6WX2ohNc+cu+pRPuG45vs7/gPUPa167UvqR0rxNc2Qf/kWWwVH7fwFz
g5FMMWqdNRxa7XKo0VbazG9mTk023CB37CVNEHWNe9g1a3XHe6zcgq2Ea8+i4QRi
WALLCSzV8+1eA/upS1wQs8M2o3Mh+Okdu7WEN89OANQHMgyTVjHGHWIyV820XXWc
MrhvB2DeqjyREl1ks2qiuUhrGO5nipCIlgKLvI2qD0jumasLob+9e3ozMSpSrtvi
J8qR46N4/fB9eLNdPCZt
=mGfr
-----END PGP SIGNATURE-----
Merge tag 'pm+acpi-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI and power management fixes from Rafael Wysocki:
"These are just two fixes, a revert of the would-be backlight fix that
didn't work and an intel_pstate fix for two problems related to
maximum P-state selection.
Specifics:
- Revert of the ACPI video commit that I hoped would help fix
backlight problems related to Windows 8 compatibility on some
systems. Unfortunately, it turned out to cause problems to happen
too.
- Fix for two problems in intel_pstate, a possible failure to respond
to a load change on a quiet system and a possible failure to select
the highest available P-state on some systems. From Dirk
Brandewie"
* tag 'pm+acpi-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
Revert "ACPI / video / i915: No ACPI backlight if firmware expects Windows 8"
cpufreq / intel_pstate: Change to scale off of max P-state
This is a largeish batch of fixes, mostly because I missed -rc2 due to
travel/vacation. So in number these are a bit more than ideal unless
you amortize them over two -rcs.
Quick breakdown:
- Defconfig updates
- Making multi_v7_defconfig useful on more hardware to encourage
single-image usage
- Davinci and nomadik updates due to new code merged this merge window
- Fixes for UART on Samsung platforms, both PM and clock-related
- A handful of warning fixes from defconfig builds, including for
max8925 backlight and pxamci (both with appropriate acks)
- Exynos5440 fixes for LPAE configuration, PM
- ...plus a bunch of other smaller changes all over the place
I expect to switch to regressions-or-severe-bugs-only fixes from here
on out.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAABAgAGBQJR8cSDAAoJEIwa5zzehBx3dgsQAIRYV0xKDWYUgzvLGx1Gn/eC
tUw5JeT13eSyEzPL8vAHyMFkI/N7yUzExMjzULPsDXiKHCkRDosLqwxNRFCSVBEv
vp6ipoa75t+l7sys4lOoTVZGY+Pt0SJDIs1jpkTzWPt+BtFanKpaOFJN0hCMZh1j
x0ls+TX4UUsl7MhxtTSEHSMIjt+8bz4rxE6shQOSRePGHkQKrsS1VrFAIC+u1x5b
bkAU3KdLCu5i4qNSU5Niqg2VgRWzxrkR1lQiY8e0BtGqmret9itYFsRWwdZ0qrLQ
Q6aYnR6O/uWH1i2g+Fcl+R4FJo96hy7KqbI0wJmgKlpG5nRQWhCXyYWo86xjw97G
JOA4EHyV+wcmQIo7ZwjYRae7fJYQeRBdUT6/rVnlW++Hi7ZeHI2DLyNLkwG7iXat
iD3OPgzsQ2beK5QTB6fL8iTv+q4o4hXHFDmFukjPYdR3NPHNaJ+uuaI78rUAblmc
RoQ38UzSL82kiseaFP8b7sU9P1JF2hopPDLA7rdSyKBCLczEhzXvgXG1XJVwOdmA
FTBf1g9taawLAxzaJOC82wYrTCLWX2dzv3DeCbaEpzYq1nblJrqYLerQ6Rb0c5xy
V7a+h4aQhLsZvA2Qu7NGBD0wv47d7r5UAPUS1i4Em1Yi+syrBNY4XCiJhBH0fZc5
k4PXz5wVMhpyVLrX6bVd
=XOG3
-----END PGP SIGNATURE-----
Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc
Pull ARM SoC fixes from Olof Johansson:
"This is a largeish batch of fixes, mostly because I missed -rc2 due to
travel/vacation. So in number these are a bit more than ideal unless
you amortize them over two -rcs.
Quick breakdown:
- Defconfig updates
- Making multi_v7_defconfig useful on more hardware to encourage
single-image usage
- Davinci and nomadik updates due to new code merged this merge
window
- Fixes for UART on Samsung platforms, both PM and clock-related
- A handful of warning fixes from defconfig builds, including for
max8925 backlight and pxamci (both with appropriate acks)
- Exynos5440 fixes for LPAE configuration, PM
- ...plus a bunch of other smaller changes all over the place
I expect to switch to regressions-or-severe-bugs-only fixes from here
on out"
* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (37 commits)
mfd: max8925: fix dt code for backlight
ARM: omap5: Only select errata 798181 if SMP
ARM: EXYNOS: Update CONFIG_ARCH_NR_GPIO for Exynos
ARM: EXYNOS: Fix low level debug support
ARM: SAMSUNG: Save/restore only selected uart's registers
ARM: SAMSUNG: Add SAMSUNG_PM config option to select pm
ARM: S3C24XX: Add missing clkdev entries for s3c2440 UART
ARM: multi_v7_defconfig: Select USB chipidea driver
ARM: pxa: propagate errors from regulator_enable() to pxamci
ARM: zynq: fix compilation warning
ARM: keystone: fix compilation warning
ARM: highbank: Only touch common coherency control register fields
ARM: footbridge: fix overlapping PCI mappings
dmaengine: shdma: fix a build failure on platforms with no DMA support
ARM: STi: Set correct ARM ERRATAs.
ARM: dts: STi: Fix pinconf setup for STiH416 serial2
ARM: nomadik: configure for NO_HZ and HRTIMERS
ARM: nomadik: update defconfig base
ARM: nomadik: Update MMC defconfigs
ARM: davinci: defconfig: enable EDMA driver
...
Here are a number of USB fixes for 3.11-rc3.
Lots of little things, nothing major. A number of new device ids, build
fixes for DMA, and a bunch of other minor things. All of these have
been in the linux-next tree.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
iEYEABECAAYFAlHyp6cACgkQMUfUDdst+ynfQACfb+akG9GYjNpdjkiun0dh2DG2
hDYAoKuhkL1L63vDcIjfFOdZpVKetjPi
=71aA
-----END PGP SIGNATURE-----
Merge tag 'usb-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here are a number of USB fixes for 3.11-rc3.
Lots of little things, nothing major. A number of new device ids,
build fixes for DMA, and a bunch of other minor things. All of these
have been in the linux-next tree"
* tag 'usb-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (40 commits)
usb: Clear both buffers when clearing a control transfer TT buffer.
usb/gadget: free opts struct on error recovery
USB: mos7840: fix memory leak in open
usb: serial: option.c: remove ONDA MT825UP product ID fromdriver
usb: serial: option: add Olivetti Olicard 200
usb: serial: option: blacklist ONDA MT689DC QMI interface
xhci: fix null pointer dereference on ring_doorbell_for_active_rings
usb: host: xhci: Enable XHCI_SPURIOUS_SUCCESS for all controllers with xhci 1.0
usb: fix build warning in pci-quirks.h when CONFIG_PCI is not enabled
usb: xhci: Mark two functions __maybe_unused
xhci: Avoid NULL pointer deref when host dies.
usb: serial: option: Add ONYX 3G device support
USB: ti_usb_3410_5052: fix dynamic-id matching
usb: option: add TP-LINK MA260
USB: option: add D-Link DWM-152/C1 and DWM-156/C1
USB: EHCI: Fix resume signalling on remote wakeup
USB: cp210x: add MMB and PI ZigBee USB Device Support
usb: cp210x support SEL C662 Vendor/Device
USB: option: append Petatel NP10T device to GSM modems list
USB: misc: Add Manhattan Hi-Speed USB DVI Converter to sisusbvga
...
Here are 3 fixes for TTY and serial issues that have been reported.
Nothing huge, but nice to get fixed.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
iEYEABECAAYFAlHyqbQACgkQMUfUDdst+ylRnACgxsIFAvjVszn4nIjPtrsP+SUD
dooAnjL/xGoi6MdJ92mrjTZ4rjUQgw2Z
=bJyY
-----END PGP SIGNATURE-----
Merge tag 'tty-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty/serial fixes from Greg KH:
"Here are 3 fixes for TTY and serial issues that have been reported.
Nothing huge, but nice to get fixed"
* tag 'tty-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
serial: tegra: correct help message in Kconfig from 'ttyHS' to 'ttyTHS'
tty/8250_early: Don't truncate last character of options
TTY: snyclinkmp: calculating wrong addresses
Here are some tiny drivers/staging/ fixes for 3.11-rc3
A number of bugfixes, all pretty tiny, but resolve issues that have been
reported (the kstrtos32 change fixes a data corruption problem that Dan
found.) And a MAINTAINERS file update for the comedi drivers.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
iEYEABECAAYFAlHyqLIACgkQMUfUDdst+ylR1gCglBMx4nQjWc7Bp5653TQFqveg
F6cAnRnDxVutdUv1WJwhLH7JJT+HQniN
=/dxc
-----END PGP SIGNATURE-----
Merge tag 'staging-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging fixes from Greg KH:
"Here are some tiny drivers/staging/ fixes for 3.11-rc3
A number of bugfixes, all pretty tiny, but resolve issues that have
been reported (the kstrtos32 change fixes a data corruption problem
that Dan found). And a MAINTAINERS file update for the comedi
drivers"
* tag 'staging-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
MAINTAINERS: Update the list of maintainers for staging/comedi driver.
staging: tidspbridge: replace strict_strtol() with kstrtos32()
staging: android: logger: Correct write offset reset on error
staging: zram: protect zram_reset_device() call
staging: gdm72xx: potential use after free in send_qos_list()
staging: drm/imx: drop "select OF_VIDEOMODE"
staging: frontier: use after free in disconnect()
staging: comedi: fix a race between do_cmd_ioctl() and read/write
staging: comedi: COMEDI_CANCEL ioctl should wake up read/write
Here are some char/misc patches for 3.11-rc3. It's pretty much just:
- mei fixes
- hyperv fixes
- new ja_JP translation update
all tiny stuff, but fixes for issues people have reported.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
iEYEABECAAYFAlHyqBcACgkQMUfUDdst+ylMswCgoppo0tfChc0KfyAcsgWwJr2o
iTsAoLEJ2sg8GIGYI765UMXWAkzJyCxR
=oHJj
-----END PGP SIGNATURE-----
Merge tag 'char-misc-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc patches from Greg KH:
"Here are some char/misc patches for 3.11-rc3. It's pretty much just:
- mei fixes
- hyperv fixes
- new ja_JP translation update
all tiny stuff, but fixes for issues people have reported."
* tag 'char-misc-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
HOWTO ja_JP sync
mei: me: fix waiting for hw ready
mei: don't have to clean the state on power up
mei: me: fix reset state machine
mei: hbm: fix typo in error message
Tools: hv: KVP: Fix a bug in IPV6 subnet enumeration
Drivers: hv: balloon: Do not post pressure status if interrupted
Drivers: hv: balloon: Fix a bug in the hot-add code
Drivers: hv: vmbus: incorrect device name is printed when child device is unregistered
Just a handfull of regression and small fixes in ASoC, HD-audio
and USB-audio drivers.
- Sigmetal HD-audio codec regression fixes
- A copule of XRUN indication fixes for usb-audio devices
- ASoC: ep93xx build fix, sgtl5000 fix for probe order changes,
max98088 register access fix, etc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
iQIcBAABAgAGBQJR8mGLAAoJEGwxgFQ9KSmkQ4MP/2B4QCf3j6/H+RHceYOXmvOs
rD+5KmbvWcq7NlcZGpevciEo5YIAsqLAVjN9tglMQGdaNWi6jWRMoKhYif7Gp/hB
ijxMeiwpwWsB9k84o3TIWRwenJjYAfH2kn64BO9jGNFYHbAACNXADlz6IvE6sKPT
2tBp9NnNZT4Q/1/tbN7o7+IJnZFeXJZ/t420pMiPGa+kKJ3ormsiMY2FYDStMRkx
6pz/Bd0ehYMwrVTOj7FVTGZPikcSk+dC6gMX4xgdsL07BeeSrbJkv1ZN+lgjGPQk
Hm+scnIFPyTyzPpfNtkAOkpCq5T56CNIEF7OfSm2Vebut1UrH180oj4/XoUY8VnZ
s9MKdM1uIv2rS9BsZeMQ4s6CaZEQ1LXsUWbOq+DqFOP94dJCPoYCd0lvS0wP/+Rp
95HwyiMTMsVrOjVzh1jwmTIUixw3JpAbDFDwYc+8ulzG4TPm3ZKzFDNVB8z0/Wce
bUs5TsYSzciBcKrzTYirB2SoxvculJbCIterxIgJVH0xaUMlYRU0aShhKfksxHCh
7GMzf9AdmlSMJIKg7N8aUhaYwEnCTbqx2nhUUFC9yEDQL+b0E0D1e67CSBzQDh8E
SsJFZJrWqV8zGlE6FBeB0JPNd0yz+7XTxIEVtkU3mtWLE/M6jbOyQHCTDX8EtTbJ
GYWvmcafqYn8hUxgoFfF
=7CQ7
-----END PGP SIGNATURE-----
Merge tag 'sound-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"Just a handful of regression and small fixes in ASoC, HD-audio and
USB-audio drivers.
- Sigmetal HD-audio codec regression fixes
- A copule of XRUN indication fixes for usb-audio devices
- ASoC: ep93xx build fix, sgtl5000 fix for probe order changes,
max98088 register access fix, etc"
* tag 'sound-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hiface: return correct XRUN indication
ASoC: tegra: correct playback_dma_data setup
ASoC: core: double free in snd_soc_add_platform()
ALSA: usb-audio: 6fire: return correct XRUN indication
ASoC: ep93xx: fix build of ep93xx-ac97.c
ALSA: hda - Remove NO_PRESENCE bit override for Dell 1420n Laptop
ALSA: hda - Fix EAPD GPIO control for Sigmatel codecs
ASoC: atmel-ssc: remove clk_disable_unprepare call from critical section
ASoC: sgtl5000: defer the probe if clock is not found
ASoC: max98088 - fix element type of the register cache.
- fix for regression in commit cca9f93a52d2, recovery causing filesystem
corruption after a crash
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQIcBAABAgAGBQJR8ZWnAAoJENaLyazVq6ZOb7cP/iLwa59qX5sHAoYRGterE4Li
34xPkihJEjcbvNCtK+rznXT9ohSvwTahnrdlLy/bQ6d0K1gBX3j1DD4cpTvGRWJR
hEBbQU0PXhXjRL6ixgxfeNPfbEfNMYhiTFfjPhBjKVgzYN3NnJZ1lv8zTHaeQ8JP
m7dEKrrg/J8LsW18fq2E0p/SjKi7cT1mEf8jkcYu0UGYd7yDtQSukMbEjfsIJq9L
DpB3QXHQkUf1UlVdUvLncGmcDUPAEt+8/ae9uUpY2nxHv+7jmzAoCyRUCTDYsIh2
gznQjsns56B2FWfnkyzXC3nMaoyIZpT8Fy3FRBsQRKGboOeOPS+/Yyzf/FcLQ8Jl
yMXA0oR+3Ft7wJ62+aSuP3/dug8TbBk09bI+RqV4D+GwM7n7kLE/Fo3kQLva5Aqf
rZIhwzfBDl51vxRzm4I29wOkfvQRXndy4c0hYtfeVy0lBA2yCFLSlzGha5EX+CxM
s1kbpOkuOOE5k5Mgjve/iIKbwG3OKEuPCrESJPG+sTREAkkXkycnVQft2ihJYgg8
yIgPG4fxpIIpwTdC016YAa/raOm/unIG6ko+ec3m2rB2lmo8j3vQOjoIFuV0KYV1
enzhK5F+sQJl9evQOgfJc+uOMgjs1DrE38hnlQ8rc3LXa5Dtb7ReMRAT7z2FxicF
keAPwJNrMlwgIyYi+3B+
=hrYY
-----END PGP SIGNATURE-----
Merge tag 'for-linus-v3.11-rc3' of git://oss.sgi.com/xfs/xfs
Pull xfs fix from Ben Myers:
"Fix for regression in commit cca9f93a52d2 ("xfs: don't do IO when
creating an new inode"), recovery causing filesystem corruption after
a crash"
* tag 'for-linus-v3.11-rc3' of git://oss.sgi.com/xfs/xfs:
xfs: di_flushiter considered harmful
Pull nfsd fix from Bruce Fields:
"One more nfsd bugfix for 3.11"
* 'for-3.11' of git://linux-nfs.org/~bfields/linux:
nfsd: nfsd_open: when dentry_open returns an error do not propagate as struct file
Both marked for -stable, both since 3.3. I guess I should spend more
time testing...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
iQIVAwUAUfDTjDnsnt1WYoG5AQKMkw//dbNZsOt1M1LvXUcGiDwBrcewltbXMmju
7rNkDP6YhOng+p4IRNsvjbA3NplBHbKDPnhzabT8MT+fT7039XYaAFkpI++Q5ylm
9owub1Ym1eZTrSjCYmp5sK+5OXoUX5kaVsQcPqpb9Pk42mSYepnjpZrj2/EMGHlM
ud6Ih9OicONM967DGRo5MP2bp82eJVe2yJ5Tg4I9gWVPkDoPYLjTAutahPQ0vXr9
SS3o+L1Ewsb0CicllirnjcroFFfeEO2b7kIXWC8PUzoR1XEa2wRxeNIo1M9vXKuV
9YMfLXBUTbzGBx/dA9rW709Lr9UG8rOXRbJcv/I1moidpeEWipsSRg3HeEV7TYq0
5oY+JW4/gzyepDv7sgm1Mc1wMf4C4/B+WUcgDp5e2EurKWYGx2HzHYWaovyLU6s3
OsaOUwpivIvQglbW+dEhRbUGXXi9J762H8DT2JmPliA0ylfPwqyAvks+nIIC7TPF
RUpgYHyBYRxUcYad5Df0eX1pd1KVATR3F7UIWzYTB/aG3+lsprY3jB+oWlAFmIg8
ExVCuaUNZdW8MQUU4xLFgJjUv+gZ2UJAjCv49Wj+nvJD/W/LgbLCZ1Xosk9CwfVy
mc9SnLdfUsseM3PE6fBWVNcSO1hddIo1w1hL+xZix36kY7E9Pi8TLiJwB8q2/WRl
4Yo+g5LQV0w=
=68H7
-----END PGP SIGNATURE-----
Merge tag 'md/3.11-fixes' of git://neil.brown.name/md
Pull md fixes from Neil Brown:
"Two more bugfixes for md in 3.11
Both marked for -stable, both since 3.3. I guess I should spend more
time testing..."
* tag 'md/3.11-fixes' of git://neil.brown.name/md:
md/raid5: fix interaction of 'replace' and 'recovery'.
md/raid10: remove use-after-free bug.
Pull libata fixes from Tejun Heo:
"Assorted libata updates.
The most critical one is a fix for ahci oops during boot. Also, a new
smallish platform ahci driver is added and sata_inic162x is marked
clearly as experimental (it whines during boot too) as data corruption
seems rather common on the device and it's unlikely to get any love in
the foreseeable future. If the whining doesn't draw any attention, I
think we'd probably be better of making the driver depend on BROKEN in
a couple releases"
This is v2 of this pull request with fixed dependencies for ahci_imx.
* 'for-3.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
ahci_imx: depend on CONFIG_MFD_SYSCON
ahci_imx: add ahci sata support on imx platforms
ARM: imx6q: update the sata bits definitions of gpr13
ahci: fix Null pointer dereference in achi_host_active()
libata: make it clear that sata_inic162x is experimental
libata: replace strict_strtol() with kstrtol()
ata: Fix DVD not dectected at some platform with Wellsburg PCH
We attempted to address a regression introduced by commit a57f7f9
(ACPICA: Add Windows8/Server2012 string for _OSI method.) after which
ACPI video backlight support doesn't work on a number of systems,
because the relevant AML methods in the ACPI tables in their BIOSes
become useless after the BIOS has been told that the OS is compatible
with Windows 8. That problem is tracked by the bug entry at:
https://bugzilla.kernel.org/show_bug.cgi?id=51231
Commit 8c5bd7a (ACPI / video / i915: No ACPI backlight if firmware
expects Windows 8) introduced for this purpose essentially prevented
the ACPI backlight support from being used if the BIOS had been told
that the OS was compatible with Windows 8 and the i915 driver was
loaded, in which case the backlight would always be handled by i915.
Unfortunately, however, that turned out to cause problems with
backlight to appear on multiple systems with symptoms indicating that
i915 was unable to control the backlight on those systems as
expected.
For this reason, revert commit 8c5bd7a, but leave the function
acpi_video_backlight_quirks() introduced by it, because another
commit on top of it uses that function.
References: https://lkml.org/lkml/2013/7/21/119
References: https://lkml.org/lkml/2013/7/22/261
References: https://lkml.org/lkml/2013/7/23/429
References: https://lkml.org/lkml/2013/7/23/459
References: https://lkml.org/lkml/2013/7/23/81
References: https://lkml.org/lkml/2013/7/24/27
Reported-and-tested-by: James Hogan <james@albanarts.com>
Reported-and-tested-by: Kamal Mostafa <kamal@canonical.com>
Reported-and-tested-by: Jörg Otte <jrg.otte@gmail.com>
Reported-and-tested-by: Steven Newbury <steve@snewbury.org.uk>
Reported-by: Martin Steigerwald <Martin@lichtvoll.de>
Reported-by: Kalle Valo <kvalo@adurom.com>
Tested-by: Joerg Platte <jplatte@naasa.net>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ahci_imx makes use of regmap but the dependency wasn't specified in
Kconfig leading build failures if CONFIG_AHCI_IMX is enabled but
CONFIG_MFD_SYSCON is not. Add the Kconfig dependency.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Commit a82274151af "tracing: Protect ftrace_trace_arrays list in trace_events.c"
added taking the trace_types_lock mutex in trace_events.c as there were
several locations that needed it for protection. Unfortunately, it also
encapsulated a call to tracing_reset_all_online_cpus() which also takes
the trace_types_lock, causing a deadlock.
This happens when a module has tracepoints and has been traced. When the
module is removed, the trace events module notifier will grab the
trace_types_lock, do a bunch of clean ups, and also clears the buffer
by calling tracing_reset_all_online_cpus. This doesn't happen often
which explains why it wasn't caught right away.
Commit a82274151af was marked for stable, which means this must be
sent to stable too.
Link: http://lkml.kernel.org/r/51EEC646.7070306@broadcom.com
Reported-by: Arend van Spril <arend@broadcom.com>
Tested-by: Arend van Spriel <arend@broadcom.com>
Cc: Alexander Z Lam <azl@google.com>
Cc: Vaibhav Nagarnaik <vnagarnaik@google.com>
Cc: David Sharp <dhsharp@google.com>
Cc: stable@vger.kernel.org # 3.10
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Written by Catalin Marinas, tested by APM on storm platform. This is needed
because of the failures encountered when running SpecWeb benchmark test.
Signed-off-by: Feng Kan <fkan@apm.com>
Acked-by: Kumar Sankaran <ksankaran@apm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Brown-paper-bag pull request here. The snb rc6 fix from the last pull
broke forcewake BIOS dirt cleanup, which with fixed. But that fix broke
the spinlock init sequence, which results in an ugly BUG when spinlock
debugging is enabled :( So I get to throw another patch at cc: stable to
fix up the mess ...
* tag 'drm-intel-fixes-2013-07-25' of git://people.freedesktop.org/~danvet/drm-intel:
drm/i915: initialize gt_lock early with other spin locks
drm/i915: fix hdmi portclock limits
r600 dpm fixes, old school card dac fixes, lockup fixes
endian fixes
* 'drm-fixes-3.11' of git://people.freedesktop.org/~agd5f/linux:
drm/radeon/dpm: fix r600_enable_sclk_control()
drm/radeon/dpm: implement force performance levels for rv6xx
drm/radeon/dpm: fix displaygap programming on rv6xx
drm/radeon/dpm: fix a typo in the rv6xx mclk setup
drm/radeon: fix combios tables on older cards
drm/radeon: improve dac adjust heuristics for legacy pdac
drm/radeon: Another card with wrong primary dac adj
drm/radeon: fix endian issues with DP handling (v3)
drm/radeon/vm: only align the pt base to 32k
drm/radeon: wait for 3D idle before using CP DMA
The device-tree enablement for max8925 has several problems, but besides
the bindings being wrong (and not having seen review) there's also some
bad coding practices on how to fill in the platform_data from device tree.
I came across this since it causes a warning when compiling
mmp2_defconfig, and instead of doing the minimal fix to silence the
warning, I restructured the code a bit.
This silences the warning:
drivers/video/backlight/max8925_bl.c: In function 'max8925_backlight_probe':
drivers/video/backlight/max8925_bl.c:177:3: warning: statement with no effect [-Wunused-value]
Note that the bindings themselves need to be revisited too, but that will
affect more than just the backlight driver and is best done separately;
this just fixes the bad code for the backlight driver.
Acked-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Olof Johansson <olof@lixom.net>
Need to use the driver state rather than the register
state since the displays may not be enabled when the
power state is programmed.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Control transfers have both IN and OUT (or SETUP) packets, so when
clearing TT buffers for a control transfer it's necessary to send
two HUB_CLEAR_TT_BUFFER requests to the hub.
Signed-off-by: William Gulland <wgulland@google.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix memory leaks introduced in commits:
40d133d7f542616cf9538508a372306e626a16e9
usb: gadget: f_ncm: convert to new function interface with backward compatibility
fee562a6450b7806f1fbbe1469a67b5395b5c10a
usb: gadget: f_ecm: convert to new function interface with backward compatibility
fcbdf12ebef73a6069e2a1aada1e546fb578a4aa
usb: gadget: f_phonet: convert to new function interface with backward compatibility
b29002a157940752dfed2c488b2011f63f007d71
usb: gadget: f_eem: convert to new function interface with backward compatibility
8cedba7c73af1369599b1111639cfeb66fe13aaa
usb: gadget: f_subset: convert to new function interface with backward compatibility
f466c6353819326873fa48a02c6f2d7c903240d6
usb: gadget: f_rndis: convert to new function interface with backward compatibility
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Allocated urbs and buffers were never freed on errors in open.
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Some (very few) early devices like mine, where not exposting a proper CDC
descriptor. This was fixed with an immediate firmware update from the vendor,
and pre-installed on newer devices.
So actual devices can be driven by cdc_acm.c + cdc_ether.c.
Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Speaks AT on interfaces 5 (command & PPP) and 3 (secondary), other
interface protocols are unknown.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Prevent the option driver from binding itself to the QMI/WWAN interface, making
it unusable by the proper driver.
Signed-off-by: enrico Mioso <mrkiko.rs@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Hi Greg,
Here's five bug fixes for 3.12.
The three patches are marked for stable. Two fix NULL pointer dereferences.
The third marked for stable suppresses some serious log spam from unnecessary
xHCI driver warnings, whenever an isochronous short packet happens on an xHCI
1.0 host.
The other two patches fix build warnings.
Sarah Sharp
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAABAgAGBQJR8UAgAAoJEBMGWMLi1Gc5bP8P/jqHycOH8vJTIY/oEO+e12kv
G8XEaKdssN5ob8+VvQU7ngkC/tMTsLiZu63n5nOQOSsmF6Qhw+0Zvp4v0mp+T77T
Z7ZrmMYA6h0YcJN2rEQMJwIn5RiUbGSs0rwhvodGMuVV4q9l2Kqy8E0OOL8bDwvI
6gRamRASFJeMkjNxjgWm7e5Ke+OnvS7AsmIYxVLUMPwDLsDZQQ9UcxbJuAOcfjq/
qi4HLmDVT/+Bea584j0TE26VG7RJPyo1/IkkLmfhZcH+usX39+0nh70iqPHhES1H
I2CtX23m1YdsMakRMMq8RBBOyri3ngLb35SDoDYNgG/i6S1/hxTMTBHC1015QRax
4aNx872gm5gUG+bVfSbpNvut31ox4kKMEzqqFz01AjKvq/w5W/UBSHkfDSjNF3C7
DWmUgFAAUbWHpXo3k4WvAwYWapZbTPlk0t+dfQqtbKil41mz5WZOfpg0DVZhcvzQ
FcP2kWuGvXYvQ5FukeHHeoAEBfvGUvdpU8CebcWBM4y7h8yrMxpQ3+7dGYm9koBj
MYOuXP9gon6FRdz4uo0HvaM8Bq9rszkm8AH2OwxJQthrG6kK8OZALgz5iU3C6rLw
/R3XgAzp9T6CzqKkg8o1vFcCeb1jI+1kXaGtrF1Aso3hRfLgf1G3+KNkv8uVasq+
JNR+6yUtM+LsWyNXWuMz
=BrdB
-----END PGP SIGNATURE-----
Merge tag 'for-usb-linus-2013-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/sarah/xhci into usb-linus
Sarah writes:
xhci: Bug fixes, now with more tags!
Hi Greg,
Here's five bug fixes for 3.12.
The three patches are marked for stable. Two fix NULL pointer dereferences.
The third marked for stable suppresses some serious log spam from unnecessary
xHCI driver warnings, whenever an isochronous short packet happens on an xHCI
1.0 host.
The other two patches fix build warnings.
Sarah Sharp
When we made all inode updates transactional, we no longer needed
the log recovery detection for inodes being newer on disk than the
transaction being replayed - it was redundant as replay of the log
would always result in the latest version of the inode would be on
disk. It was redundant, but left in place because it wasn't
considered to be a problem.
However, with the new "don't read inodes on create" optimisation,
flushiter has come back to bite us. Essentially, the optimisation
made always initialises flushiter to zero in the create transaction,
and so if we then crash and run recovery and the inode already on
disk has a non-zero flushiter it will skip recovery of that inode.
As a result, log recovery does the wrong thing and we end up with a
corrupt filesystem.
Because we have to support old kernel to new kernel upgrades, we
can't just get rid of the flushiter support in log recovery as we
might be upgrading from a kernel that doesn't have fully transactional
inode updates. Unfortunately, for v4 superblocks there is no way to
guarantee that log recovery knows about this fact.
We cannot add a new inode format flag to say it's a "special inode
create" because it won't be understood by older kernels and so
recovery could do the wrong thing on downgrade. We cannot specially
detect the combination of zero mode/non-zero flushiter on disk to
non-zero mode, zero flushiter in the log item during recovery
because wrapping of the flushiter can result in false detection.
Hence that makes this "don't use flushiter" optimisation limited to
a disk format that guarantees that we don't need it. And that means
the only fix here is to limit the "no read IO on create"
optimisation to version 5 superblocks....
Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>
Signed-off-by: Ben Myers <bpm@sgi.com>
(cherry picked from commit e60896d8f2b81412421953e14d3feb14177edb56)
We forgot to free the node itself when free:ing a map.
Reported-by: xulinuxkernel <xulinuxkernel@gmail.com>
Reviewed-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
