linux-stable.git/drivers, branch v3.7.9

PCI/PM: Clean up PME state when removing a device

2013-02-17T18:53:13+00:00

commit 249bfb83cf8ba658955f0245ac3981d941f746ee upstream.

Devices are added to pci_pme_list when drivers use pci_enable_wake()
or pci_wake_from_d3(), but they aren't removed from the list unless
the driver explicitly disables wakeup.  Many drivers never disable
wakeup, so their devices remain on the list even after they are
removed, e.g., via hotplug.  A subsequent PME poll will oops when
it tries to touch the device.

This patch disables PME# on a device before removing it, which removes
the device from pci_pme_list.  This is safe even if the device never
had PME# enabled.

This oops can be triggered by unplugging a Thunderbolt ethernet adapter
on a Macbook Pro, as reported by Daniel below.

[bhelgaas: changelog]
Reference: http://lkml.kernel.org/r/CAMVG2svG21yiM1wkH4_2pen2n+cr2-Zv7TbH3Gj+8MwevZjDbw@mail.gmail.com
Reported-and-tested-by: Daniel J Blueman 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Bjorn Helgaas 
Signed-off-by: Greg Kroah-Hartman

drivers/rtc/rtc-pl031.c: restore ST variant functionality

2013-02-17T18:53:12+00:00

commit 3399cfb5df9594495b876d1843a7165f77366b2b upstream.

Commit e7e034e18a0a ("drivers/rtc/rtc-pl031.c: fix the missing operation
on enable") accidentally broke the ST variants of PL031.

The bit that is being poked as "clockwatch" enable bit for the ST
variants does the work of bit 0 on this variant.  Bit 0 is used for a
clock divider on the ST variants, and setting it to 1 will affect
timekeeping in a very bad way.

Signed-off-by: Linus Walleij 
Acked-by: Haojian Zhuang 
Cc: Mian Yousaf KAUKAB 
Cc: Srinidhi Kasagar 
Cc: Alessandro Zummo 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

drm/nouveau: add lockdep annotations

2013-02-14T18:48:37+00:00

commit 5f97ab913cf0fbc378ea8ffc3ee66f4890d11c55 upstream.

1) Lockdep thinks all nouveau subdevs belong to the same class and can be
locked in arbitrary order, which is not true (at least in general case).
Tell it to distinguish subdevs by (o)class type.
2) DRM client can be locked under user client lock - tell lockdep to put
DRM client lock in a separate class.

Reported-by: Arend van Spriel 
Reported-by: Peter Hurley 
Reported-by: Maarten Lankhorst 
Reported-by: Daniel J Blueman 
Signed-off-by: Marcin Slusarz 
Signed-off-by: Ben Skeggs 
Signed-off-by: Greg Kroah-Hartman

netback: correct netbk_tx_err to handle wrap around.

2013-02-14T18:48:29+00:00

[ Upstream commit b9149729ebdcfce63f853aa54a404c6a8f6ebbf3 ]

Signed-off-by: Ian Campbell 
Acked-by: Jan Beulich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xen/netback: free already allocated memory on failure in xen_netbk_get_requests

2013-02-14T18:48:28+00:00

[ Upstream commit 4cc7c1cb7b11b6f3515bd9075527576a1eecc4aa ]

Signed-off-by: Ian Campbell 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xen/netback: don't leak pages on failure in xen_netbk_tx_check_gop.

2013-02-14T18:48:25+00:00

[ Upstream commit 7d5145d8eb2b9791533ffe4dc003b129b9696c48 ]

Signed-off-by: Matthew Daley 
Reviewed-by: Konrad Rzeszutek Wilk 
Acked-by: Ian Campbell 
Acked-by: Jan Beulich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xen/netback: shutdown the ring if it contains garbage.

2013-02-14T18:48:19+00:00

[ Upstream commit 48856286b64e4b66ec62b94e504d0b29c1ade664 ]

A buggy or malicious frontend should not be able to confuse netback.
If we spot anything which is not as it should be then shutdown the
device and don't try to continue with the ring in a potentially
hostile state. Well behaved and non-hostile frontends will not be
penalised.

As well as making the existing checks for such errors fatal also add a
new check that ensures that there isn't an insane number of requests
on the ring (i.e. more than would fit in the ring). If the ring
contains garbage then previously is was possible to loop over this
insane number, getting an error each time and therefore not generating
any more pending requests and therefore not exiting the loop in
xen_netbk_tx_build_gops for an externded period.

Also turn various netdev_dbg calls which no precipitate a fatal error
into netdev_err, they are rate limited because the device is shutdown
afterwards.

This fixes at least one known DoS/softlockup of the backend domain.

Signed-off-by: Ian Campbell 
Reviewed-by: Konrad Rzeszutek Wilk 
Acked-by: Jan Beulich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

atm/iphase: rename fregt_t -> ffreg_t

2013-02-14T18:48:19+00:00

[ Upstream commit ab54ee80aa7585f9666ff4dd665441d7ce41f1e8 ]

We have conflicting type qualifiers for "freg_t" in s390's ptrace.h and the
iphase atm device driver, which causes the compile error below.
Unfortunately the s390 typedef can't be renamed, since it's a user visible api,
nor can I change the include order in s390 code to avoid the conflict.

So simply rename the iphase typedef to a new name. Fixes this compile error:

In file included from drivers/atm/iphase.c:66:0:
drivers/atm/iphase.h:639:25: error: conflicting type qualifiers for 'freg_t'
In file included from next/arch/s390/include/asm/ptrace.h:9:0,
                 from next/arch/s390/include/asm/lowcore.h:12,
                 from next/arch/s390/include/asm/thread_info.h:30,
                 from include/linux/thread_info.h:54,
                 from include/linux/preempt.h:9,
                 from include/linux/spinlock.h:50,
                 from include/linux/seqlock.h:29,
                 from include/linux/time.h:5,
                 from include/linux/stat.h:18,
                 from include/linux/module.h:10,
                 from drivers/atm/iphase.c:43:
next/arch/s390/include/uapi/asm/ptrace.h:197:3: note: previous declaration of 'freg_t' was here

Signed-off-by: Heiko Carstens 
Acked-by: chas williams - CONTRACTOR 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

via-rhine: Fix bugs in NAPI support.

2013-02-14T18:48:18+00:00

[ Upstream commit 559bcac35facfed49ab4f408e162971612dcfdf3 ]

1) rhine_tx() should use dev_kfree_skb() not dev_kfree_skb_irq()

2) rhine_slow_event_task's NAPI triggering logic is racey, it
   should just hit the interrupt mask register.  This is the
   same as commit 7dbb491878a2c51d372a8890fa45a8ff80358af1
   ("r8169: avoid NAPI scheduling delay.") made to fix the same
   problem in the r8169 driver.  From Francois Romieu.

Reported-by: Jamie Gloudon 
Tested-by: Jamie Gloudon 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: loopback: fix a dst refcounting issue

2013-02-14T18:48:15+00:00

[ Upstream commit 794ed393b707f01858f5ebe2ae5eabaf89d00022 ]

Ben Greear reported crashes in ip_rcv_finish() on a stress
test involving many macvlans.

We tracked the bug to a dst use after free. ip_rcv_finish()
was calling dst->input() and got garbage for dst->input value.

It appears the bug is in loopback driver, lacking
a skb_dst_force() before calling netif_rx().

As a result, a non refcounted dst, normally protected by a
RCU read_lock section, was escaping this section and could
be freed before the packet being processed.

  [] loopback_xmit+0x64/0x83
  [] dev_hard_start_xmit+0x26c/0x35e
  [] dev_queue_xmit+0x2c4/0x37c
  [] ? dev_hard_start_xmit+0x35e/0x35e
  [] ? eth_header+0x28/0xb6
  [] neigh_resolve_output+0x176/0x1a7
  [] ip_finish_output2+0x297/0x30d
  [] ? ip_finish_output2+0x137/0x30d
  [] ip_finish_output+0x63/0x68
  [] ip_output+0x61/0x67
  [] dst_output+0x17/0x1b
  [] ip_local_out+0x1e/0x23
  [] ip_queue_xmit+0x315/0x353
  [] ? ip_send_unicast_reply+0x2cc/0x2cc
  [] tcp_transmit_skb+0x7ca/0x80b
  [] tcp_connect+0x53c/0x587
  [] ? getnstimeofday+0x44/0x7d
  [] ? ktime_get_real+0x11/0x3e
  [] tcp_v4_connect+0x3c2/0x431
  [] __inet_stream_connect+0x84/0x287
  [] ? inet_stream_connect+0x22/0x49
  [] ? _local_bh_enable_ip+0x84/0x9f
  [] ? local_bh_enable+0xd/0x11
  [] ? lock_sock_nested+0x6e/0x79
  [] ? inet_stream_connect+0x22/0x49
  [] inet_stream_connect+0x33/0x49
  [] sys_connect+0x75/0x98

This bug was introduced in linux-2.6.35, in commit
7fee226ad2397b (net: add a noref bit on skb dst)

skb_dst_force() is enforced in dev_queue_xmit() for devices having a
qdisc.

Reported-by: Ben Greear 
Signed-off-by: Eric Dumazet 
Tested-by: Ben Greear 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman