linux-stable.git/drivers/char, branch v3.7.8 Linux kernel stable tree virtio_console: Don't access uninitialized data. 2013-02-14T18:48:00+00:00 Sjur Brændeland sjur.brandeland@stericsson.com 2013-01-21T23:20:26+00:00 cbadbcec8966fe7efa16786a5080013398a5d332 commit aded024a12b32fc1ed9a80639681daae2d07ec25 upstream. Don't access uninitialized work-queue when removing device. The work queue is initialized only if the device multi-queue. So don't call cancel_work unless this is a multi-queue device. This fixes the following panic: Kernel panic - not syncing: BUG! Call Trace: 62031b28: [<6026085d>] panic+0x16b/0x2d3 62031b30: [<6004ef5e>] flush_work+0x0/0x1d7 62031b60: [<602606f2>] panic+0x0/0x2d3 62031b68: [<600333b0>] memcpy+0x0/0x140 62031b80: [<6002d58a>] unblock_signals+0x0/0x84 62031ba0: [<602609c5>] printk+0x0/0xa0 62031bd8: [<60264e51>] __mutex_unlock_slowpath+0x13d/0x148 62031c10: [<6004ef5e>] flush_work+0x0/0x1d7 62031c18: [<60050234>] try_to_grab_pending+0x0/0x17e 62031c38: [<6004e984>] get_work_gcwq+0x71/0x8f 62031c48: [<60050539>] __cancel_work_timer+0x5b/0x115 62031c78: [<628acc85>] unplug_port+0x0/0x191 [virtio_console] 62031c98: [<6005061c>] cancel_work_sync+0x12/0x14 62031ca8: [<628ace96>] virtcons_remove+0x80/0x15c [virtio_console] 62031ce8: [<628191de>] virtio_dev_remove+0x1e/0x7e [virtio] 62031d08: [<601cf242>] __device_release_driver+0x75/0xe4 62031d28: [<601cf2dd>] device_release_driver+0x2c/0x40 62031d48: [<601ce0dd>] driver_unbind+0x7d/0xc6 62031d88: [<601cd5d9>] drv_attr_store+0x27/0x29 62031d98: [<60115f61>] sysfs_write_file+0x100/0x14d 62031df8: [<600b737d>] vfs_write+0xcb/0x184 62031e08: [<600b58b8>] filp_close+0x88/0x94 62031e38: [<600b7686>] sys_write+0x59/0x88 62031e88: [<6001ced1>] handle_syscall+0x5d/0x80 62031ea8: [<60030a74>] userspace+0x405/0x531 62031f08: [<600d32cc>] sys_dup+0x0/0x5e 62031f28: [<601b11d6>] strcpy+0x0/0x18 62031f38: [<600be46c>] do_execve+0x10/0x12 62031f48: [<600184c7>] run_init_process+0x43/0x45 62031fd8: [<60019a91>] new_thread_handler+0xba/0xbc Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit aded024a12b32fc1ed9a80639681daae2d07ec25 upstream.

Don't access uninitialized work-queue when removing device.
The work queue is initialized only if the device multi-queue.
So don't call cancel_work unless this is a multi-queue device.

This fixes the following panic:

Kernel panic - not syncing: BUG!
Call Trace:
62031b28:  [<6026085d>] panic+0x16b/0x2d3
62031b30:  [<6004ef5e>] flush_work+0x0/0x1d7
62031b60:  [<602606f2>] panic+0x0/0x2d3
62031b68:  [<600333b0>] memcpy+0x0/0x140
62031b80:  [<6002d58a>] unblock_signals+0x0/0x84
62031ba0:  [<602609c5>] printk+0x0/0xa0
62031bd8:  [<60264e51>] __mutex_unlock_slowpath+0x13d/0x148
62031c10:  [<6004ef5e>] flush_work+0x0/0x1d7
62031c18:  [<60050234>] try_to_grab_pending+0x0/0x17e
62031c38:  [<6004e984>] get_work_gcwq+0x71/0x8f
62031c48:  [<60050539>] __cancel_work_timer+0x5b/0x115
62031c78:  [<628acc85>] unplug_port+0x0/0x191 [virtio_console]
62031c98:  [<6005061c>] cancel_work_sync+0x12/0x14
62031ca8:  [<628ace96>] virtcons_remove+0x80/0x15c [virtio_console]
62031ce8:  [<628191de>] virtio_dev_remove+0x1e/0x7e [virtio]
62031d08:  [<601cf242>] __device_release_driver+0x75/0xe4
62031d28:  [<601cf2dd>] device_release_driver+0x2c/0x40
62031d48:  [<601ce0dd>] driver_unbind+0x7d/0xc6
62031d88:  [<601cd5d9>] drv_attr_store+0x27/0x29
62031d98:  [<60115f61>] sysfs_write_file+0x100/0x14d
62031df8:  [<600b737d>] vfs_write+0xcb/0x184
62031e08:  [<600b58b8>] filp_close+0x88/0x94
62031e38:  [<600b7686>] sys_write+0x59/0x88
62031e88:  [<6001ced1>] handle_syscall+0x5d/0x80
62031ea8:  [<60030a74>] userspace+0x405/0x531
62031f08:  [<600d32cc>] sys_dup+0x0/0x5e
62031f28:  [<601b11d6>] strcpy+0x0/0x18
62031f38:  [<600be46c>] do_execve+0x10/0x12
62031f48:  [<600184c7>] run_init_process+0x43/0x45
62031fd8:  [<60019a91>] new_thread_handler+0xba/0xbc

Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge branch 'block-dev' 2012-12-03T18:53:25+00:00 Linus Torvalds torvalds@linux-foundation.org 2012-12-03T18:53:25+00:00 d3594ea2b343fbbabaaebeb4ce4e1f29e88ab6b3 Merge 'block-dev' branch. I was going to just mark everything here for stable and leave it to the 3.8 merge window, but having decided on doing another -rc, I migth as well merge it now. This removes the bd_block_size_semaphore semaphore that was added in this release to fix a race condition between block size changes and block IO, and replaces it with atomicity guaratees in fs/buffer.c instead, along with simplifying fs/block-dev.c. This removes more lines than it adds, makes the code generally simpler, and avoids the latency/rt issues that the block size semaphore introduced for mount. I'm not happy with the timing, but it wouldn't be much better doing this during the merge window and then having some delayed back-port of it into stable. * block-dev: blkdev_max_block: make private to fs/buffer.c direct-io: don't read inode->i_blkbits multiple times blockdev: remove bd_block_size_semaphore again fs/buffer.c: make block-size be per-page and protected by the page lock 
Merge 'block-dev' branch.

I was going to just mark everything here for stable and leave it to the
3.8 merge window, but having decided on doing another -rc, I migth as
well merge it now.

This removes the bd_block_size_semaphore semaphore that was added in
this release to fix a race condition between block size changes and
block IO, and replaces it with atomicity guaratees in fs/buffer.c
instead, along with simplifying fs/block-dev.c.

This removes more lines than it adds, makes the code generally simpler,
and avoids the latency/rt issues that the block size semaphore
introduced for mount.

I'm not happy with the timing, but it wouldn't be much better doing this
during the merge window and then having some delayed back-port of it
into stable.

* block-dev:
  blkdev_max_block: make private to fs/buffer.c
  direct-io: don't read inode->i_blkbits multiple times
  blockdev: remove bd_block_size_semaphore again
  fs/buffer.c: make block-size be per-page and protected by the page lock
blockdev: remove bd_block_size_semaphore again 2012-11-29T18:52:19+00:00 Linus Torvalds torvalds@linux-foundation.org 2012-11-29T18:49:50+00:00 1e8b33328a5407b447ff80953655a47014a6dcb9 This reverts the block-device direct access code to the previous unlocked code, now that fs/buffer.c no longer needs external locking. With this, fs/block_dev.c is back to the original version, apart from a whitespace cleanup that I didn't want to revert. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
This reverts the block-device direct access code to the previous
unlocked code, now that fs/buffer.c no longer needs external locking.

With this, fs/block_dev.c is back to the original version, apart from a
whitespace cleanup that I didn't want to revert.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
IXP4xx: HW pseudo-random generator is available on IXP45x/46x only. 2012-11-22T03:35:39+00:00 Krzysztof Hałasa khc@pm.waw.pl 2010-03-23T19:22:13+00:00 553da857b1b917e27817b923ea2c786313620845 Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl> 
Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl>
sonypi: suspend/resume callbacks should be conditionally compiled on CONFIG_PM_SLEEP 2012-10-25T19:05:50+00:00 Yuanhan Liu yuanhan.liu@linux.intel.com 2012-10-16T14:59:04+00:00 2cb55a2f47a3c695a0105b7fc04a3b70c3bc4e4f This will fix warnings like following when CONFIG_PM_SLEEP is not set: warning: 'xxx_suspend' defined but not used [-Wunused-function] warning: 'xxx_resume' defined but not used [-Wunused-function] Because SET_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) Only references the callbacks on CONFIG_PM_SLEEP (instead of CONFIG_PM). Cc: Mattia Dongili <malattia@linux.it> Cc: Arnd Bergmann <arnd@arndb.de> Cc: platform-driver-x86@vger.kernel.org Signed-off-by: Yuanhan Liu <yuanhan.liu@linux.intel.com> Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
This will fix warnings like following when CONFIG_PM_SLEEP is not set:

        warning: 'xxx_suspend' defined but not used [-Wunused-function]
        warning: 'xxx_resume' defined but not used [-Wunused-function]

Because
	SET_SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn)

Only references the callbacks on CONFIG_PM_SLEEP (instead of CONFIG_PM).

Cc: Mattia Dongili <malattia@linux.it>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: platform-driver-x86@vger.kernel.org
Signed-off-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux 2012-10-17T01:14:31+00:00 Linus Torvalds torvalds@linux-foundation.org 2012-10-17T01:14:31+00:00 75fa29c7000924060677e0591368045576daad93 Pull drm fixes from Dave Airlie: "Fixes for i915, nouveau and radeon: - i915: haswell stability, modeset rework fallout, ums fix - nouveau: misc fixes from code rework - radeon: pll rework fixes, more 2 level PTE cleanups. - core: warning fixes on 32-bit." * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (31 commits) nouveau: fix warning on 32-bit build. drm/nouveau/bios: fix typo in error message drm/nouveau: only call ttm_agp_tt_create when __OS_HAS_AGP drm/nv50/fb: fix double free of vram mm drm/nouveau/pm: do not stop reclocking if failing to set the fan speed drm/nouveau/pm: fix a typo related to the move to the therm subdev drm/nouveau/hwmon: fix the initialization condition drm: fix warning on 32-bit. drm: radeon: fix printk format warning drm/radeon: fix spelling typos in debugging output drm/radeon: Don't destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy(). drm/radeon: check if pcie gen 2 is already enabled (v2) drm/radeon/cayman: set VM max pfn at MC init drm/radeon: separate pt alloc from lru add drm/radeon: don't add the IB pool to all VMs v2 drm/radeon: allocate page tables on demand v4 drm/radeon: update comments to clarify VM setup (v2) drm/radeon: allocate PPLLs from low to high drm/radeon: fix compilation with backlight disabled drm/radeon: use %zu for formatting size_t ... 
Pull drm fixes from Dave Airlie:
 "Fixes for i915, nouveau and radeon:

   - i915: haswell stability, modeset rework fallout, ums fix
   - nouveau: misc fixes from code rework
   - radeon: pll rework fixes, more 2 level PTE cleanups.
   - core: warning fixes on 32-bit."

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (31 commits)
  nouveau: fix warning on 32-bit build.
  drm/nouveau/bios: fix typo in error message
  drm/nouveau: only call ttm_agp_tt_create when __OS_HAS_AGP
  drm/nv50/fb: fix double free of vram mm
  drm/nouveau/pm: do not stop reclocking if failing to set the fan speed
  drm/nouveau/pm: fix a typo related to the move to the therm subdev
  drm/nouveau/hwmon: fix the initialization condition
  drm: fix warning on 32-bit.
  drm: radeon: fix printk format warning
  drm/radeon: fix spelling typos in debugging output
  drm/radeon: Don't destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy().
  drm/radeon: check if pcie gen 2 is already enabled (v2)
  drm/radeon/cayman: set VM max pfn at MC init
  drm/radeon: separate pt alloc from lru add
  drm/radeon: don't add the IB pool to all VMs v2
  drm/radeon: allocate page tables on demand v4
  drm/radeon: update comments to clarify VM setup (v2)
  drm/radeon: allocate PPLLs from low to high
  drm/radeon: fix compilation with backlight disabled
  drm/radeon: use %zu for formatting size_t
  ...
IPMI: Detect register spacing on PCI interfaces 2012-10-17T01:07:12+00:00 Corey Minyard cminyard@mvista.com 2012-10-16T20:53:40+00:00 a6c16c2803089f032f86fe15e952176c0713d6e3 The IPMI spec defines a way to detect register spacing for PCI interfaces, so implement it. Signed-off-by: Steven Hsieh <sshsieh@broadcom.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
The IPMI spec defines a way to detect register spacing for PCI interfaces,
so implement it.

Signed-off-by: Steven Hsieh <sshsieh@broadcom.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
IPMI: Fix some uninitialized warning 2012-10-17T01:07:12+00:00 Corey Minyard cminyard@mvista.com 2012-10-16T20:53:39+00:00 9ebca93bf3b350910c66516cbec68899eeddfd8e There was a spot where the compiler couldn't tell some variables would be set. So initialize them to make the warning go away. Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
There was a spot where the compiler couldn't tell some variables
would be set.  So initialize them to make the warning go away.

Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
IPMI: Change link order 2012-10-17T01:07:12+00:00 Matthew Garrett mjg@redhat.com 2012-10-16T20:53:38+00:00 061475b65c126454aaaaddcbd40e7118424fc860 IPMI must be initialised before ACPI in order to ensure that any IPMI services are available before ACPI driver initialisation attempts to use any IPMI operation regions. Signed-off-by: Matthew Garrett <mjg@redhat.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
IPMI must be initialised before ACPI in order to ensure that any IPMI
services are available before ACPI driver initialisation attempts to use
any IPMI operation regions.

Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel into drm-fixes 2012-10-16T00:11:59+00:00 Dave Airlie airlied@redhat.com 2012-10-16T00:11:29+00:00 3459f6204730fc3c0e44059296f6daa592e8c8d6 Daniel writes: "- some register magic to fix hsw crw (Paulo&Ben) - fix backlight destruction for cpu edp (Jani) - fix gen ch7xxx dvo ->get_hw_state - fixup the plane->pipe fixup code, the broken version massively angers the modeset sanity checks - kill pipe A quirk for i855gm, otherwise I get a black screen with the above patch - fixup for gem_get_page helper (Chris) - fixup guardband clipping w/a (Ken), without this mesa master can erronously drop vertices on snb, mesa 9.0 has the optimization reverted - another pageflip vs. modeset fix - kill bogus BUG_ON which broke ums+gem from Willy Tarreau (gasp, people are still using this!)" * 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel: drm/i915: fix non-DP-D eDP backlight cleanup and module reload drm/i915: HSW CRW stability magic drm/i915/dvo-ch7xxx: fix get_hw_state drm/i915: fixup the plane->pipe fixup code drm/i915: rip out the pipe A quirk for i855gm drm/i915: disable wc gtt pte mappings on gen2 drm/i915: fixup i915_gem_object_get_page inline helper drm/i915: Disallow preallocation of requests drm/i915: Set guardband clipping workaround bit in the right register. drm/i915: paper over a pipe-enable vs pageflip race drm/i915: remove useless BUG_ON which caused a regression in 3.5. 
Daniel writes:
"- some register magic to fix hsw crw (Paulo&Ben)
- fix backlight destruction for cpu edp (Jani)
- fix gen ch7xxx dvo ->get_hw_state
- fixup the plane->pipe fixup code, the broken version massively angers
  the modeset sanity checks
- kill pipe A quirk for i855gm, otherwise I get a black screen with the
  above patch
- fixup for gem_get_page helper (Chris)
- fixup guardband clipping w/a (Ken), without this mesa master can erronously
  drop vertices on snb, mesa 9.0 has the optimization reverted
- another pageflip vs. modeset fix
- kill bogus BUG_ON which broke ums+gem from Willy Tarreau (gasp, people
  are still using this!)"

* 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel:
  drm/i915: fix non-DP-D eDP backlight cleanup and module reload
  drm/i915: HSW CRW stability magic
  drm/i915/dvo-ch7xxx: fix get_hw_state
  drm/i915: fixup the plane->pipe fixup code
  drm/i915: rip out the pipe A quirk for i855gm
  drm/i915: disable wc gtt pte mappings on gen2
  drm/i915: fixup i915_gem_object_get_page inline helper
  drm/i915: Disallow preallocation of requests
  drm/i915: Set guardband clipping workaround bit in the right register.
  drm/i915: paper over a pipe-enable vs pageflip race
  drm/i915: remove useless BUG_ON which caused a regression in 3.5.