On 32-bit systems, a large args->num_cliprects from userspace via ioctl
may overflow the allocation size, leading to out-of-bounds access.
This vulnerability was introduced in commit 432e58ed ("drm/i915: Avoid
allocation for execbuffer object list").
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
On 32-bit systems, a large args->buffer_count from userspace via ioctl
may overflow the allocation size, leading to out-of-bounds access.
This vulnerability was introduced in commit 8408c282 ("drm/i915:
First try a normal large kmalloc for the temporary exec buffers").
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
With commit a2ef5c4fd4
"ACPI: Move module parameter gts and bfs to sleep.c" the
wake_sleep_flags is required when calling acpi_enter_sleep_state.
The assembler code in wakeup_*.S did not do that. One solution
is to call it from assembler and stick the wake_sleep_flags on
the stack (for 32-bit) or in %esi (for 64-bit). hpa and rafael
both suggested however to create a wrapper function to call
acpi_enter_sleep_state and call said wrapper function
("acpi_enter_s3") from assembler.
For 32-bit, the acpi_enter_s3 ends up looking as so:
push %ebp
mov %esp,%ebp
sub $0x8,%esp
movzbl 0xc1809314,%eax [wake_sleep_flags]
movl $0x3,(%esp)
mov %eax,0x4(%esp)
call 0xc12d1fa0 <acpi_enter_sleep_state>
leave
ret
And 64-bit:
movzbl 0x9afde1(%rip),%esi [wake_sleep_flags]
push %rbp
mov $0x3,%edi
mov %rsp,%rbp
callq 0xffffffff812e9800 <acpi_enter_sleep_state>
leaveq
retq
Reviewed-by: H. Peter Anvin <hpa@zytor.com>
Suggested-by: H. Peter Anvin <hpa@zytor.com>
[v2: Remove extra assembler operations, per hpa review]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Link: http://lkml.kernel.org/r/1335150198-21899-3-git-send-email-konrad.wilk@oracle.com
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
With commit a2ef5c4fd4
"ACPI: Move module parameter gts and bfs to sleep.c" the wake_sleep_flags
is required when calling acpi_enter_sleep_state, which means
that if there are functions outside the sleep.c code they
can't get the wake_sleep_flags values.
This converts the function in to a exported value and converts
the module config operands to a function.
Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Lin Ming <ming.m.lin@intel.com>
[v2: Parameters can be turned on/off dynamically]
[v3: unsigned char -> u8]
[v4: val -> kp->arg]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Link: http://lkml.kernel.org/r/1335150198-21899-2-git-send-email-konrad.wilk@oracle.com
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Because extcon can also be a switch class for legacy userspace (Android)
and is a superset of switch class in drivers/staging/android/switch,
switch class may be removed.
- Remove switch class
- Remove switch class consideration in extcon class
Signed-off-by: MyungJoo Ham <myungjoo.ham@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The scheduler depends on receiving the CPU_STARTING notification, without
which we end up into a lot of trouble. So add the missing call to
notify_cpu_starting() in the bringup code.
Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Signed-off-by: Richard Kuo <rkuo@codeaurora.org>
Slightly larger than normal - the DAPM fix is a "this should always have
worked" type of thing which is very clear and should have no impact on
systems that don't need it. The WM8994 fix is driver specific but
pretty important for that driver.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAABAgAGBQJPlURUAAoJEBus8iNuMP3dVL4P/1ynNUPmdBhiDeVT6BrJxeyL
dKGBaqYxv8Sfzu8O+TIaqCyls+qp3++vQO26YgeuZNBnE+OtRaJbbpatIBe7Gmyr
7glYowUih+B/lfLbwlPCKCAs2ahk6oUbY3bFVqgOgzX9Zt4M73MEs7oVTPD2TvtQ
ZkudzzopzvEquh1NT/+wLmdJwSgOGfa2fLyt/+OaD6LCxDaZ3RPsO/wFoEqnSjKp
rdqHeOKAg/vFDSfFMwhnqZ5hGUUTqg8HlZ3urYvGrkKsyNUgPkIeNQKy4e0FxeSP
Lqj/EbKvH0gKWNdQkG6AWQpdN5bpqtWZb0h5BIsZhWqmjy7dEOopjnh/Hrmj+nFQ
ac8SGqq2/2HhbE/irN3y4Z3wOJJq9BEiFdUqIntOq95eT3S1Ib00osLR0SMHLwqe
Sk8UfVAspt9tdzqbzy67enAEjDsNo3OalV7qXIjYzL+csCDs7yPEM+JFxKx45ubW
tz3Wr3zjSlShYIeIYxGF8VuiH0QBhcXFMME/hv/QLAmfT6KvB6JlKlyWvHqJhQYE
mKQLz7AvARBfoaPhwn2+wcXO157FTC22Xt6pKo9TLwCotHNP2YO6lLVPE10GF7rf
aecCJe3QAGAWf3TwAiqcv8vOaR6TaO2f3hSAAPkqEWh6uBVC6wib5fJZzuzOafr2
Grt/dZcdfaiN4Rdpok7F
=oz/g
-----END PGP SIGNATURE-----
Merge tag 'asoc-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: updates for 3.4
Slightly larger than normal - the DAPM fix is a "this should always have
worked" type of thing which is very clear and should have no impact on
systems that don't need it. The WM8994 fix is driver specific but
pretty important for that driver.
The QUECVT flag should not prevent conversions from
being granted immediately when the convert queue is
empty.
Signed-off-by: David Teigland <teigland@redhat.com>
The file kernel/irq/debug.h temporarily defines P, PS, PD
and then undefines them. However these names aren't really
"internal" enough, and collide with other more legit users
such as the ones in the xtensa arch, causing:
In file included from kernel/irq/internals.h:58:0,
from kernel/irq/irqdesc.c:18:
kernel/irq/debug.h:8:0: warning: "PS" redefined [enabled by default]
arch/xtensa/include/asm/regs.h:59:0: note: this is the location of the previous definition
Add a handful of underscores to do a better job of hiding these
temporary macros.
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Caused by commit 6c03438ede
kernel.h: doesn't explicitly use bug.h, so don't include it.
This header uses bug.h so explicitly include it now that the
implicit presence was removed by 6c03438ed.
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Caused by commit 3785006ac3
"xtensa: don't mask signals if we fail to setup signal stack"
It assigns a return value to "ret", but there is no such variable
anywhere in scope. Create one.
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Chris Zankel <chris@zankel.net>
Acked-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
A small fallout from Vinod's conversions to dma_transfer_direction,
this small comparison was done with a dma_data_direction instead.
Fix it by comparing against the correct enum.
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
The patch "ARM: amba: Remove AMBA level regulator support" breaks
the DMA40 driver since the <linux/amba/bus.h> header implicitly
included the regulator consumer header. So include it explicitly
and fix the build error.
Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
can be directly stopped by issuing a SUSPEND_REQ on the EE
bits. There is no need to suspend the physical channel and
restart it.
Also, the support for pre-V2 hw is discontinued.
EE bits for writing:
00: disable only if AS=11 or AS=00
01: enable
10: suspend_req only if AS=01 & EE=01 or EE=11
11: round / no change for writing
Signed-off-by: Narayanan G <narayanan.gopalakrishnan@stericsson.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
This ensures a clean startup of the channels, without this change some
use cases could result in issues in a small proportion of cases.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: stable@vger.kernel.org
with this patch, if the memory region is physically non-continuous
then VM_MIXEDMAP is set to vm->vm_flags otherwise VM_PFNMAP.
we had missed this flag setting.
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
this patch fixes the problem that the physical memory region to be mapped
to user space could be exceeded. if page fault address was placed at between
buffer start and end then memory region to be mapped would be exceeded.
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
the gem was already allocated at gem allocation time but is allocated
at page fault handler so this patch fixes the problem that gem was
allocated one more time.
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Remove max_data_size sysfs entry. Otherwise is possible
to have a buffer overrun if its value is increased after
the device is open.
Signed-off-by: Carlos Chinea <carlos.chinea@nokia.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Remove custom hack and make use of the notifier chain interfaces for
delivering events from the ports to their associated clients.
Clients that want to receive port events need to register their callbacks
using hsi_register_port_event(). The callbacks can be called in interrupt
context. Use hsi_unregestier_port_event() to undo the registration.
Signed-off-by: Carlos Chinea <carlos.chinea@nokia.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
HSI controllers and ports do not belong to the HSI bus.
Those devices are not supposed to have a driver attached to them.
Signed-off-by: Carlos Chinea <carlos.chinea@nokia.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
HSI client structure should be freed on error path after
calling device_registration by dropping a reference to it.
Signed-off-by: Carlos Chinea <carlos.chinea@nokia.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Use the proper release mechanism for hsi_controller and
hsi_ports structures. Free the structures through their
associated device release callbacks.
Signed-off-by: Carlos Chinea <carlos.chinea@nokia.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Pull ARM fixes from Russell King:
"Here's my usual Sunday push, just for one revert which PeterZ hollered
about after last weeks push. Other than that, all seems strangely
quiet as far as fixes go in non-platform ARM land at the moment."
* 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
Revert "ARM: 7359/2: smp_twd: Only wait for reprogramming on active cpus"
Pull powerpc fixes from Benjamin Herrenschmidt:
"Here are a few fixes for powerpc. Note the addition to the generic
irq.h. This is part of a 3-patches regression fix for mpic due to
changes in how IRQ_TYPE_NONE is being handled. Thomas agreed to the
addition of the new IRQ_TYPE_DEFAULT contant, however he hasn't
replied with an Ack to the actual patch yet. I don't to wait much
longer with these patches tho."
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc/mpic: Properly set default triggers
irq: Add IRQ_TYPE_DEFAULT for use by PIC drivers
powerpc/mpic: Fix confusion between hw_irq and virq
powerpc/pmac: Don't add_timer() twice
powerpc/eeh: Fix crash caused by null eeh_dev
powerpc/mpc85xx: add MPIC message dts node
powerpc/mpic_msgr: fix offset error when setting mer register
powerpc/mpic_msgr: add lock for MPIC message global variable
powerpc/mpic_msgr: fix compile error when SMP disabled
powerpc: fix build when CONFIG_BOOKE_WDT is enabled
powerpc/85xx: don't call of_platform_bus_probe() twice
Pull networking fixes from David Miller:
1) Fix namespace init and cleanup in phonet to fix some oopses, from
Eric W. Biederman.
2) Missing kfree_skb() in AF_KEY, from Julia Lawall.
3) Refcount leak and source address handling fix in l2tp from James
Chapman.
4) Memory leak fix in CAIF from Tomasz Gregorek.
5) When routes are cloned from ipv6 addrconf routes, we don't process
expirations properly. Fix from Gao Feng.
6) Fix panic on DMA errors in atl1 driver, from Tony Zelenoff.
7) Only enable interrupts in 8139cp driver after we've registered the
IRQ handler. From Jason Wang.
8) Fix too many reads of KS_CIDER register in ks8851 during probe,
fixing crashes on spurious interrupts. From Matt Renzelmann.
9) Missing include in ath5k driver and missing iounmap on probe
failure, from Jonathan Bither.
10) Fix RX packet handling in smsc911x driver, from Will Deacon.
11) Fix ixgbe WoL on fiber by leaving the laser on during shutdown.
12) ks8851 needs MAX_RECV_FRAMES increased otherwise the internal MAC
buffers are easily overflown. Fix from Davide Cimingahi.
13) Fix memory leaks in peak_usb CAN driver, from Jesper Juhl.
14) gred packet scheduler can dump in WRED more when doing a netlink
dump. Fix from David Ward.
15) Fix MTU in USB smsc75xx driver, from Stephane Fillod.
16) Dummy device needs ->ndo_uninit handler to properly handle
->ndo_init failures. From Hiroaki SHIMODA.
17) Fix TX fragmentation in ath9k driver, from Sujith Manoharan.
18) Missing RTNL lock in ixgbe PM resume, from Benjamin Poirier.
19) Missing iounmap in farsync WAN driver, from Julia Lawall.
20) With LRO/GRO, tcp_grow_window() is easily tricked into not growing
the receive window properly, and this hurts performance. Fix from
Eric Dumazet.
21) Network namespace init failure can leak net_generic data, fix from
Julian Anastasov.
22) Fix skb_over_panic due to mis-accounting in TCP for partially ACK'd
SKBs. From Eric Dumazet.
23) New IDs for qmi_wwan driver, from Bjørn Mork.
24) Fix races in ax25_exit(), from Eric W. Biederman.
25) IPV6 TCP doesn't handle TCP_MAXSEG socket option properly, copy over
logic from the IPV4 side. From Neal Cardwell.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (59 commits)
tcp: fix TCP_MAXSEG for established IPv6 passive sockets
drivers/net: Do not free an IRQ if its request failed
drop_monitor: allow more events per second
ks8851: Fix request_irq/free_irq mismatch
net/hyperv: Adding cancellation to ensure rndis filter is closed
ks8851: Fix mutex deadlock in ks8851_net_stop()
net ax25: Reorder ax25_exit to remove races.
icplus: fix interrupt for IC+ 101A/G and 1001LF
net: qmi_wwan: support Sierra Wireless MC77xx devices in QMI mode
bnx2x: off by one in bnx2x_ets_e3b0_sp_pri_to_cos_set()
ksz884x: don't copy too much in netdev_set_mac_address()
tcp: fix retransmit of partially acked frames
netns: do not leak net_generic data on failed init
net/sock.h: fix sk_peek_off kernel-doc warning
tcp: fix tcp_grow_window() for large incoming frames
drivers/net/wan/farsync.c: add missing iounmap
davinci_mdio: Fix MDIO timeout check
ipv6: clean up rt6_clean_expires
ipv6: fix rt6_update_expires
arcnet: rimi: Fix device name in debug output
...
The following build warning is seen in some configurations.
drivers/hwmon/ad7314.c: In function 'ad7314_show_temperature':
drivers/hwmon/ad7314.c:70: warning: 'data' may be used uninitialized in this function
Fix by overloading the return value from ad7314_spi_read with both data and
error code (the returned data is really u16 and needs to be converted into a
signed value anyway).
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Cameron <jic23@cam.ac.uk>
Acked-by: Jean Delvare <khali@linux-fr.org>
This gets rid of the unused default senses array, and replaces the
incorrect use of IRQ_TYPE_NONE with the new IRQ_TYPE_DEFAULT for
the initial set_trigger() call when mapping an interrupt.
This in turn makes us read the HW state and update the irq desc
accordingly.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
This is meant typically to allow a PIC driver's irq domain map() callback
to establish sane defaults for the interrupt (and make sure that the HW
and the irq_desc are in sync as far as the trigger is concerned).
The irq core may not call the set_trigger callback if it thinks the
trigger is already set to the right setting, so we need to ensure new
descriptors are properly synchronized with the hardware.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
mpic_is_ipi() takes a virq and immediately converts it to a hw_irq.
However, one of the two call sites calls it with a ... hw_irq. The
other call site also happens to have the hw_irq at hand, so let's
change it to just take that as an argument. Also change mpic_is_tm()
for consistency.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
If the interrupt and the timeout happen roughly at the same
time, we can get into a situation where the timer function
is run while the interrupt has already been processed. In
this case, the timer function might end up doing an add_timer
on an already pending timer, causing a BUG_ON() to trigger.
Instead, just skip the whole timeout operation if we see that
the timer is pending. The spinlock ensures that the only way
that happens is if we already started a new operation and thus
the timeout can be ignored.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
The problem was reported by Anton Blanchard. While EEH error
happened to the PCI device without the corresponding device
driver, kernel crash was seen. Eventually, I successfully
reproduced the problem on Firebird-L machine with utility
"errinjct". Initially, the device driver for Emulex ethernet
MAC has been disabled from .config and force data parity on
the Emulex ethernet MAC with help of "errinjct". Eventually,
I saw the kernel crash after issueing couple of "lspci -v"
command.
The root cause behind is that the PCI device, including the
reference to the corresponding eeh device, will be removed
from the system while EEH does recovery. Afterwards, the
PCI device will be probed again and added into the system
accordingly. So it's not safe to retrieve the eeh device from
the corresponding PCI device after the PCI device has been removed
and not added again.
The patch fixes the issue and retrieve the eeh device from OF node
instead of PCI device after the PCI device has been removed.
Signed-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>
Tested-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Commit f5fff5d forgot to fix TCP_MAXSEG behavior IPv6 sockets, so IPv6
TCP server sockets that used TCP_MAXSEG would find that the advmss of
child sockets would be incorrect. This commit mirrors the advmss logic
from tcp_v4_syn_recv_sock in tcp_v6_syn_recv_sock. Eventually this
logic should probably be shared between IPv4 and IPv6, but this at
least fixes this issue.
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Somehow we have a fast-path that tries to avoid going through
the load-detect code when the encode already has a crtc associated.
But this fails horribly when the crtc is off. The load detect pipe
itself manages this case well (and also does not forget to restore the
dpms state), so just rip out this special case.
The issue seems to go back all the way to the commit that originally
introduced load-detection on the vga output:
commit e4a5d54f92
Author: Ma Ling <ling.ma@intel.com>
Date: Tue May 26 11:31:00 2009 +0800
drm/i915: Add support for VGA load detection (pre-945).
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=43020
Reported-by: Jean Delvare <khali@linux-fr.org>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Refrain from attempting to free an interrupt line if the request
fails and hence, there is no IRQ to free.
CC: netdev@vger.kernel.org
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Otherwise cpu_active_mask will not set, which lead to other issue.
Signed-off-by: Yong Zhang <yong.zhang0@gmail.com>
Signed-off-by: Konrad Eisele <konrad@gaisler.com>
Reviewed-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
It seems there is a logic error in trace_drop_common(), since we store
only 64 drops, even if they are from same location.
This fix is a one liner, but we probably need more work to avoid useless
atomic dec/inc
Now I can watch 1 Mpps drops through dropwatch...
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
The dev_id parameter passed to free_irq needs to match the one passed
to the corresponding request_irq.
Signed-off-by: Matt Renzelmann <mjr@cs.wisc.edu>
Acked-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
The major fixes here are:
* Build fix for omap_hsmmc with OF against 3.4-rc1.
* Fix CONFIG_MMC_UNSAFE_RESUME semantics regression against 3.3,
which broke hotplug card detection when UNSAFE_RESUME is set.
* Fix a race condition in omap_hsmmc with runtime PM.
* Fix two libertas SDIO-powered-resume regressions.
Also small fixes for discard/sanitize, dw_mmc, cd-gpio and esdhc-imx.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAABAgAGBQJPkh1jAAoJEHNBYZ7TNxYMe0EQAIpvPan5J3eT9rQU2R0Fsgbd
hd10NVOPQAQaBDc59r/jmTj5iqDQQ1PGkrHti94IECCPWr3dbeTamhmUfYt6+XXZ
Ae9dlYQ8llKa6ZLSVPmNsMLmFnsqDek3LIsxk/viJIKqSGee/yOHeM6W7v6d2T+z
GCLFtV3xADU4F9PrZxdfWOJ3kDsV9WCTYnn5/WR78maSURo8iAfck5u+isitO0rn
NaXfgO29WIHlYmRHRpXMGk2pCmv8cMX8i89mBExeIWdfn40yGCZRi+kUb0VquR1W
7lqdeKEF0NY1EU9ejuPZK2VepvxEhC1ibOlPkGfgHBd52YLrDaSl3WcqKdzKILIm
wYKEls8AU5ZnWiuRpJq7QpPemTsbFQpI72O6OgntYhwiKE2TkJ0BY3KtjvFpVCxi
s+zqZsQwIt6rjJZyQzg1Y5yGA42JF75rkzWnRtRfWcSma83MFiZawAVAV/qGZsrn
EddUdOodvvO3owC9dD4wI0Q2eCRSZog3sVO9uSQg8zVHvfRGD61GBvqguyR8mbiH
+CUAMMD9mpKiApu3gvHbjn3OjZuKQ9AGDz0SYj+PbQEwsEBF+qXs5BeytBC8S1Yh
cNNdpvzjZl7EM/lJWywZ1XQ741Tg1Qgdgtx8njsoilfE51UTlR9TUd04V0bg0Fk2
fS3P+BRKf+4WR+iGyXJ1
=Zl8K
-----END PGP SIGNATURE-----
Merge tag 'mmc-fixes-for-3.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc
Pull MMC fixes from Chris Ball:
- Build fix for omap_hsmmc with OF against 3.4-rc1.
- Fix CONFIG_MMC_UNSAFE_RESUME semantics regression against 3.3, which
broke hotplug card detection when UNSAFE_RESUME is set.
- Fix a race condition in omap_hsmmc with runtime PM.
- Fix two libertas SDIO-powered-resume regressions.
- Small fixes for discard/sanitize, dw_mmc, cd-gpio and esdhc-imx.
* tag 'mmc-fixes-for-3.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc:
mmc: core: Do not pre-claim host in suspend
mmc: dw_mmc: prevent NULL dereference for dma_ops
mmc: unbreak sdhci-esdhc-imx on i.MX25
mmc: cd-gpio: Include header to pickup exported symbol prototypes
mmc: sdhci: refine non-removable card checking for card detection
mmc: dw_mmc: Fix switch from DMA to PIO
mmc: remove MMC bus legacy suspend/resume method
mmc: omap_hsmmc: Get rid of of_have_populated_dt() usage
mmc: omap_hsmmc: build fix for CONFIG_OF=y and CONFIG_MMC_OMAP_HS=m
mmc: fixes for eMMC v4.5 sanitize operation
mmc: fixes for eMMC v4.5 discard operation
Pull media fixes from Mauro Carvalho Chehab:
- Fixes a regression at DVB core when switching from DVB-S2 to DVB-S on
Kaffeine (Fedora 16 Bugzilla #812895);
- Fixes a mutex unlock at an error condition at drx-k;
- Fix winbond-cir set mode;
- mt9m032: Fix a compilation breakage with some random Kconfig;
- mt9m032: fix two dead locks;
- xc5000: don't require an special firmware (that won't be provided by
the vendor) just because the xtal frequency is different;
- V4L DocBook: fix some typos at multi-plane formats description.
* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
[media] xc5000: support 32MHz & 31.875MHz xtal using the 41.024.5 firmware
[media] V4L: mt9m032: fix compilation breakage
[media] V4L: DocBook: Fix typos in the multi-plane formats description
[media] V4L: mt9m032: fix two dead-locks
[media] rc-core: set mode for winbond-cir
[media] drxk: Does not unlock mutex if sanity check failed in scu_command()
[media] dvb_frontend: Fix a regression when switching back to DVB-S
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAABAgAGBQJPkXdoAAoJEIqAPN1PVmxKOuMP/3K87kcpwUUI/vA0pSPYf58T
Q+Sxsd85C6c0SOvE3MOI+1stibLAXeeT+MsmMKYIhmAXbTtKsmMW5TC1aTapJHQx
kDGuhqiw5Zyk5tPrZ333cLBdgiDDr8qWUBRzcNCK5O1xuDET76JtQwqtehSoDXDh
Afcg3BLzYA3HIz0nm+Wlll1yeyKrAg20dESOCvl1ptNbb2BVBSfaBpOqTjw6R88J
BRtua//L9HGHQIRntYnrH6/nzwDAhkrw2m3p1ZGWG+y5j88cQy4s0/dtZ7FJ8ZAE
qoUx2YqH6dPYGZa2A6XaOkF4hvDC6iAXawWllvsDxcQSYRWR4qxmHYm5KkxyT6y9
UACk+c7qdRmZgHfPcNNaq5CPDAEFvSFRKfDBpXUJdO6O/bVzBsA/P4fCjYFZ1FOC
NQtouAbz2BpH1iwCMRWtTsCSwiVXSHQL/jR4vQrtXU6KwX1ArKF5W1zTvnbaK13c
Bc9E4Se4Hn5Bs+FkJIbBnViAW/9gv7KUe9AtDjhcrUWkxZLswDnXhUd1k2x1Gxfp
WQf29FZmoLiITA4ffsizqR6wC98lzIrHW29FdoSyTnz9SSoqo6J10l82w8ED45lJ
wGanen7Txjsc2ub9GYqzCUYHGBitLfaQSkSvBIRSWc43Ju3b0l/esH12ioajjSEu
sAvMHCkaR7l7NZVEt6rS
=gHlK
-----END PGP SIGNATURE-----
Merge tag 'mfd-for-linus-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6
Pull MFD fixes from Samuel Ortiz:
"We have 3 build fixes, a OMAP USB host PHY reset fix and the twl6040
conversion to an i2c driver. The latter may not sound like a fix but
the twl6040 MFD driver won't probe without it, triggering an OMAP4
audio regression."
* tag 'mfd-for-linus-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6:
mfd: Fix modular builds of rc5t583 regulator support
mfd: Fix asic3_gpio_to_irq
ARM: OMAP3: USB: Fix the EHCI ULPI PHY reset issue
mfd: Convert twl6040 to i2c driver, and separate it from twl core
mfd : Fix dbx500 compilation error
Although the network interface is down, the RX packets number which
could be observed by ifconfig may keep on increasing.
This is because the WORK scheduled in netvsc_set_multicast_list()
may be executed after netvsc_close(). That means the rndis filter
may be re-enabled by do_set_multicast() even if it was closed by
netvsc_close().
By canceling possible WORK before close the rndis filter, the issue
could be never happened.
Signed-off-by: Wenqi Ma <wenqi_ma@trendmicro.com.cn>
Reviewed-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
