Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1224789 > unrolled thread

[PATCH 3.4 000/146] 3.4.109-rc1 review

Back to article view | Back to linux.kernel

Contents

  [PATCH 3.4 000/146] 3.4.109-rc1 review lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 047/146] IB/mlx4: Fix WQE LSO segment calculation lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 051/146] memstick: mspro_block: add missing curly braces lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 022/146] btrfs: don't accept bare namespace as a valid xattr lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 054/146] nfs: fix high load average due to callback thread sleeping lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 030/146] selinux/nlmsg: add XFRM_MSG_GETSPDINFO lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 039/146] selinux/nlmsg: add XFRM_MSG_MAPPING lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 035/146] MIPS: Hibernate: flush TLB entries earlier lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 011/146] drm/radeon: fix doublescan modes (v2) lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 037/146] selinux/nlmsg: add XFRM_MSG_REPORT lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 020/146] Drivers: hv: vmbus: Don't wait after requesting offers lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 014/146] cdc-wdm: fix endianness bug in debug statements lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 043/146] ACPICA: Utilities: split IO address types from data type models. lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 078/146] nilfs2: fix sanity check of btree level in nilfs_btree_root_broken() lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 009/146] pinctrl: remove doc mention of the enable/disable API lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 003/146] Drivers: hv: vmbus: Fix a bug in the error path in vmbus_open() lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 004/146] e1000: add dummy allocator to fix race condition between mtu change and netpoll lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 025/146] ASoC: cs4271: Increase delay time after reset lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 010/146] pinctrl: fix example .get_group_pins implementation signature lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 075/146] xen/console: Update console event channel on resume lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 046/146] IB/core: disallow registering 0-sized memory region lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 065/146] serial: of-serial: Remove device_type = "serial" registration lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 002/146] Bluetooth: ath3k: Add support Atheros AR5B195 combo Mini PCIe card lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 006/146] usb: musb: core: fix TX/RX endpoint order lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 049/146] firmware/ihex2fw.c: restore missing default in switch statement lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 064/146] serial: xilinx: Use platform_get_irq to get irq description structure lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 031/146] selinux/nlmsg: add XFRM_MSG_[NEW|GET]SADINFO lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 062/146] 3w-xxxx: fix command completion race lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 023/146] ARM: 8320/1: fix integer overflow in ELF_ET_DYN_BASE lizf@kernel.org - 2015-09-15 11:10 +0200
    [PATCH 3.4 131/146] ring-buffer-benchmark: Fix the wrong sched_priority of producer lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 141/146] block: fix ext_dev_lock lockdep report lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 083/146] USB: cp210x: add ID for KCF Technologies PRN device lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 111/146] x86/mce: Fix MCE severity messages lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 136/146] x86, kvm: use kernel_fpu_begin/end() in kvm_load/put_guest_fpu() lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 143/146] pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 146/146] ipv6: add check for blackhole or prohibited entry in rt6_redire lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 117/146] USB: serial: ftdi_sio: Add support for a Motion Tracker Development Board lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 088/146] xhci: fix isoc endpoint dequeue from advancing too far on transaction error lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 104/146] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 084/146] USB: pl2303: Remove support for Samsung I330 lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 106/146] sd: Disable support for 256 byte/sector disks lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 127/146] MIPS: Fix enabling of DEBUG_STACKOVERFLOW lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 079/146] ocfs2: dlm: fix race between purge and get lock resource lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 126/146] USB: cp210x: add ID for HubZ dual ZigBee and Z-Wave dongle lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 133/146] udf: Check length of extended attributes and allocation descriptors lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 128/146] bridge: use _bh spinlock variant for br_fdb_update to avoid lockup lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 119/146] ozwpan: divide-by-zero leading to panic lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 129/146] bridge: disable softirqs around br_fdb_update to avoid lockup lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 130/146] bridge: fix multicast router rlist endless loop lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 090/146] xhci: gracefully handle xhci_irq dead device lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 116/146] target/pscsi: Don't leak scsi_host if hba is VIRTUAL_HOST lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 144/146] sched: Queue RT tasks to head when prio drops lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 115/146] d_walk() might skip too much lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 125/146] ALSA: usb-audio: add MAYA44 USB+ mixer control names lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 081/146] libata: Ignore spurious PHY event on LPM policy change lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 100/146] ASoC: wm8960: fix "RINPUT3" audio route error lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 121/146] drm/i915: Don't skip request retirement if the active list is empty lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 092/146] ahci: un-staticize ahci_dev_classify lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 138/146] ipmi: fix timeout calculation when bmc is disconnected lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 132/146] tracing: Have filter check for balanced ops lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 137/146] x86, kvm: fix kvm's usage of kernel_fpu_begin/end() lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 101/146] ASoC: wm8994: correct BCLK DIV 348 to 384 lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 140/146] bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 145/146] udp: fix behavior of wrong checksums lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 097/146] ipvs: fix memory leak in ip_vs_ctl.c lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 135/146] ipv4: Missing sk_nulls_node_init() in ping_unhash(). lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 124/146] ALSA: hda/realtek - Add a fixup for another Acer Aspire 9420 lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 142/146] NET: ROSE: Don't dereference NULL neighbour pointer. lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 096/146] ext4: check for zero length extent explicitly lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 108/146] crypto: s390/ghash - Fix incorrect ghash icv buffer handling. lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 086/146] nfsd: fix the check for confirmed openowner in nfs4_preprocess_stateid_op lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 134/146] md: use kzalloc() when bitmap is disabled lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 099/146] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 112/146] x86: bpf_jit: fix compilation of large bpf programs lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 139/146] net: socket: Fix the wrong returns for recvmsg and sendmsg lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 123/146] Input: elantech - fix detection of touchpads where the revision matches a known rate lizf@kernel.org - 2015-09-15 11:20 +0200
    [PATCH 3.4 110/146] ARM: dts: imx27: only map 4 Kbyte for fec registers lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 102/146] Input: elantech - fix semi-mt protocol for v3 HW lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 107/146] xen/events: don't bind non-percpu VIRQs with percpu chip lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 089/146] xhci: Solve full event ring by increasing TRBS_PER_SEGMENT to 256 lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 122/146] vfs: read file_handle only once in handle_to_path lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 087/146] md/raid5: don't record new size if resize_stripes fails. lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 094/146] ARM: net: delegate filter to kernel interpreter when imm_offset() return value can't fit into 12bits. lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 109/146] bridge: fix parsing of MLDv2 reports lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 093/146] ahci: avoton port-disable reset-quirk lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 091/146] usb-storage: Add NO_WP_DETECT quirk for Lacie 059f:0651 devices lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 113/146] lguest: fix out-by-one error in address checking. lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 114/146] fs, omfs: add NULL terminator in the end up the token list lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 103/146] powerpc: Align TOC to 256 bytes lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 098/146] mac80211: move WEP tailroom size check lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 095/146] drm/radeon: fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 118/146] ozwpan: Use proper check to prevent heap overflow lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 105/146] mmc: atmel-mci: fix bad variable type for clkdiv lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 120/146] ozwpan: unchecked signed subtraction leads to DoS lizf@kernel.org - 2015-09-15 11:30 +0200
    [PATCH 3.4 085/146] USB: visor: Match I330 phone more precisely lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 067/146] ALSA: emu10k1: Emu10k2 32 bit DMA mode lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 082/146] rtlwifi: rtl8192cu: Fix kernel deadlock lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 070/146] ARM: pxa: pxa_cplds: add lubbock and mainstone IO lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 069/146] ext4: move check under lock scope to close a race. lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 073/146] mmc: core: add missing pm event in mmc_pm_notify to fix hib restore lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 071/146] ARM: pxa: mainstone: use new pxa_cplds driver lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 077/146] mm/memory-failure: call shake_page() when error hits thp tail page lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 074/146] RDMA/CMA: Canonize IPv4 on IPV6 sockets properly lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 072/146] ARM: pxa: lubbock: use new pxa_cplds driver lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 080/146] libata: Add helper to determine when PHY events should be ignored lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 076/146] xen/events: Set irq_info->evtchn before binding the channel to CPU in __startup_pirq() lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 066/146] ALSA: emux: Fix mutex deadlock in OSS emulation lizf@kernel.org - 2015-09-15 11:40 +0200
    [PATCH 3.4 053/146] nfs: don't call blocking operations while !TASK_RUNNING lizf@kernel.org - 2015-09-15 11:50 +0200
    [PATCH 3.4 063/146] 3w-9xxx: fix command completion race lizf@kernel.org - 2015-09-15 11:50 +0200
    [PATCH 3.4 061/146] 3w-sas: fix command completion race lizf@kernel.org - 2015-09-15 11:50 +0200
    [PATCH 3.4 042/146] powerpc/perf: Cap 64bit userspace backtraces to PERF_MAX_STACK_DEPTH lizf@kernel.org - 2015-09-15 11:50 +0200
    [PATCH 3.4 044/146] fs/binfmt_elf.c: fix bug in loading of PIE binaries lizf@kernel.org - 2015-09-15 11:50 +0200
    [PATCH 3.4 050/146] ptrace: fix race between ptrace_resume() and wait_task_stopped() lizf@kernel.org - 2015-09-15 11:50 +0200
    [PATCH 3.4 040/146] s390/hibernate: fix save and restore of kernel text section lizf@kernel.org - 2015-09-15 11:50 +0200
    [PATCH 3.4 045/146] dm crypt: fix deadlock when async crypto algorithm returns -EBUSY lizf@kernel.org - 2015-09-15 11:50 +0200
    [PATCH 3.4 055/146] RCU pathwalk breakage when running into a symlink overmounting something lizf@kernel.org - 2015-09-15 11:50 +0200
    [PATCH 3.4 057/146] ALSA: emu10k1: Fix card shortname string buffer overflow lizf@kernel.org - 2015-09-15 11:50 +0200
    [PATCH 3.4 038/146] selinux/nlmsg: add XFRM_MSG_MIGRATE lizf@kernel.org - 2015-09-15 11:50 +0200
    [PATCH 3.4 056/146] ALSA: hda - Fix mute-LED fixed mode lizf@kernel.org - 2015-09-15 11:50 +0200
    [PATCH 3.4 012/146] usb: common: otg-fsm: only signal connect after switching to peripheral lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 028/146] Input: elantech - fix absolute mode setting on some ASUS laptops lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 005/146] KVM: s390: Zero out current VMDB of STSI before including level3 data. lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 029/146] RDS: Documentation: Document AF_RDS, PF_RDS and SOL_RDS correctly. lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 019/146] C6x: time: Ensure consistency in __init lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 033/146] scsi: storvsc: Fix a bug in copy_from_bounce_buffer() lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 036/146] powerpc: Fix missing L2 cache size in /sys/devices/system/cpu lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 026/146] ext4: make fsync to sync parent dir in no-journal for real this time lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 018/146] UBI: fix check for "too many bytes" lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 021/146] Btrfs: fix log tree corruption when fs mounted with -o discard lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 024/146] rtlwifi: rtl8192cu: Add new USB ID lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 015/146] staging: panel: fix lcd type lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 016/146] UBI: fix out of bounds write lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 008/146] compal-laptop: Check return value of power_supply_register lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 007/146] pinctrl: remove maxpin from documentation lizf@kernel.org - 2015-09-15 12:00 +0200
    [PATCH 3.4 001/146] ipv6: add check for blackhole or prohibited entry in rt6_redire lizf@kernel.org - 2015-09-15 12:10 +0200
    Re: [PATCH 3.4 000/146] 3.4.109-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-09-15 16:30 +0200
      Re: [PATCH 3.4 000/146] 3.4.109-rc1 review Zefan Li <lizefan@huawei.com> - 2015-09-18 03:50 +0200
        Re: [PATCH 3.4 000/146] 3.4.109-rc1 review Zefan Li <lizefan@huawei.com> - 2015-09-18 04:50 +0200
        Re: [PATCH 3.4 000/146] 3.4.109-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-09-18 06:10 +0200

Page 2 of 7 — ← Prev page 1 [2] 3 4 5 6 7  Next page →

#1224809 — [PATCH 3.4 046/146] IB/core: disallow registering 0-sized memory region

From: Yann Droneaud <ydroneaud@opteya.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 8abaae62f3fdead8f4ce0ab46b4ab93dee39bab2 upstream.

If ib_umem_get() is called with a size equal to 0 and an
non-page aligned address, one page will be pinned and a
0-sized umem will be returned to the caller.

This should not be allowed: it's not expected for a memory
region to have a size equal to 0.

This patch adds a check to explicitly refuse to register
a 0-sized region.

Link: http://mid.gmane.org/cover.1428929103.git.ydroneaud@opteya.com
Cc: Shachar Raindel <raindel@mellanox.com>
Cc: Jack Morgenstein <jackm@mellanox.com>
Cc: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/infiniband/core/umem.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index d0254be..c1fef27 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -94,6 +94,9 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
 	if (dmasync)
 		dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
 
+	if (!size)
+		return ERR_PTR(-EINVAL);
+
 	/*
 	 * If the combination of the addr and size requested for this memory
 	 * region causes an integer overflow, return error.
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224810 — [PATCH 3.4 065/146] serial: of-serial: Remove device_type = "serial" registration

From: Michal Simek <michal.simek@xilinx.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 6befa9d883385c580369a2cc9e53fbf329771f6d upstream.

Do not probe all serial drivers by of_serial.c which are using
device_type = "serial"; property. Only drivers which have valid
compatible strings listed in the driver should be probed.

When PORT_UNKNOWN is setup probe will fail anyway.

Arnd quotation about driver historical background:
"when I wrote that driver initially, the idea was that it would
get used as a stub to hook up all other serial drivers but after
that, the common code learned to create platform devices from DT"

This patch fix the problem with on the system with xilinx_uartps and
16550a where of_serial failed to register for xilinx_uartps and because
of irq_dispose_mapping() removed irq_desc. Then when xilinx_uartps was asking
for irq with request_irq() EINVAL is returned.

Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/tty/serial/of_serial.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
index 6563cad..746e771 100644
--- a/drivers/tty/serial/of_serial.c
+++ b/drivers/tty/serial/of_serial.c
@@ -192,7 +192,6 @@ static struct of_device_id __devinitdata of_platform_serial_table[] = {
 	{ .compatible = "ibm,qpace-nwp-serial",
 		.data = (void *)PORT_NWPSERIAL, },
 #endif
-	{ .type = "serial",         .data = (void *)PORT_UNKNOWN, },
 	{ /* end of list */ },
 };
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224811 — [PATCH 3.4 002/146] Bluetooth: ath3k: Add support Atheros AR5B195 combo Mini PCIe card

From: Alexander Ploumistos <alex.ploumistos@gmail.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 2eeff0b4317a02f0e281df891d990194f0737aae upstream.

Add 04f2:aff1 to ath3k.c supported devices list and btusb.c blacklist, so
that the device can load the ath3k firmware and re-enumerate itself as an
AR3011 device.

T:  Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=04f2 ProdID=aff1 Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Alexander Ploumistos <alexpl@fedoraproject.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/bluetooth/ath3k.c | 1 +
 drivers/bluetooth/btusb.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 8a084bf..52be498 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -64,6 +64,7 @@ static struct usb_device_id ath3k_table[] = {
 	/* Atheros AR3011 with sflash firmware*/
 	{ USB_DEVICE(0x0489, 0xE027) },
 	{ USB_DEVICE(0x0489, 0xE03D) },
+	{ USB_DEVICE(0x04F2, 0xAFF1) },
 	{ USB_DEVICE(0x0930, 0x0215) },
 	{ USB_DEVICE(0x0CF3, 0x3002) },
 	{ USB_DEVICE(0x0CF3, 0xE019) },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 7c0b21e..f8a58db 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -142,6 +142,7 @@ static struct usb_device_id blacklist_table[] = {
 	/* Atheros 3011 with sflash firmware */
 	{ USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
 	{ USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
+	{ USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
 	{ USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
 	{ USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
 	{ USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224812 — [PATCH 3.4 006/146] usb: musb: core: fix TX/RX endpoint order

From: Felipe Balbi <balbi@ti.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit e3c93e1a3f35be4cf1493d3ccfb0c6d9209e4922 upstream.

As per Mentor Graphics' documentation, we should
always handle TX endpoints before RX endpoints.

This patch fixes that error while also updating
some hard-to-read comments which were scattered
around musb_interrupt().

This patch should be backported as far back as
possible since this error has been in the driver
since it's conception.

Signed-off-by: Felipe Balbi <balbi@ti.com>
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/usb/musb/musb_core.c | 44 ++++++++++++++++++++++++++------------------
 1 file changed, 26 insertions(+), 18 deletions(-)

diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index a2b4008..d3481c4 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1544,16 +1544,30 @@ irqreturn_t musb_interrupt(struct musb *musb)
 		(devctl & MUSB_DEVCTL_HM) ? "host" : "peripheral",
 		musb->int_usb, musb->int_tx, musb->int_rx);
 
-	/* the core can interrupt us for multiple reasons; docs have
-	 * a generic interrupt flowchart to follow
+	/**
+	 * According to Mentor Graphics' documentation, flowchart on page 98,
+	 * IRQ should be handled as follows:
+	 *
+	 * . Resume IRQ
+	 * . Session Request IRQ
+	 * . VBUS Error IRQ
+	 * . Suspend IRQ
+	 * . Connect IRQ
+	 * . Disconnect IRQ
+	 * . Reset/Babble IRQ
+	 * . SOF IRQ (we're not using this one)
+	 * . Endpoint 0 IRQ
+	 * . TX Endpoints
+	 * . RX Endpoints
+	 *
+	 * We will be following that flowchart in order to avoid any problems
+	 * that might arise with internal Finite State Machine.
 	 */
+
 	if (musb->int_usb)
 		retval |= musb_stage0_irq(musb, musb->int_usb,
 				devctl, power);
 
-	/* "stage 1" is handling endpoint irqs */
-
-	/* handle endpoint 0 first */
 	if (musb->int_tx & 1) {
 		if (devctl & MUSB_DEVCTL_HM)
 			retval |= musb_h_ep0_irq(musb);
@@ -1561,43 +1575,37 @@ irqreturn_t musb_interrupt(struct musb *musb)
 			retval |= musb_g_ep0_irq(musb);
 	}
 
-	/* RX on endpoints 1-15 */
-	reg = musb->int_rx >> 1;
+	reg = musb->int_tx >> 1;
 	ep_num = 1;
 	while (reg) {
 		if (reg & 1) {
-			/* musb_ep_select(musb->mregs, ep_num); */
-			/* REVISIT just retval = ep->rx_irq(...) */
 			retval = IRQ_HANDLED;
 			if (devctl & MUSB_DEVCTL_HM) {
 				if (is_host_capable())
-					musb_host_rx(musb, ep_num);
+					musb_host_tx(musb, ep_num);
 			} else {
 				if (is_peripheral_capable())
-					musb_g_rx(musb, ep_num);
+					musb_g_tx(musb, ep_num);
 			}
 		}
-
 		reg >>= 1;
 		ep_num++;
 	}
 
-	/* TX on endpoints 1-15 */
-	reg = musb->int_tx >> 1;
+	reg = musb->int_rx >> 1;
 	ep_num = 1;
 	while (reg) {
 		if (reg & 1) {
-			/* musb_ep_select(musb->mregs, ep_num); */
-			/* REVISIT just retval |= ep->tx_irq(...) */
 			retval = IRQ_HANDLED;
 			if (devctl & MUSB_DEVCTL_HM) {
 				if (is_host_capable())
-					musb_host_tx(musb, ep_num);
+					musb_host_rx(musb, ep_num);
 			} else {
 				if (is_peripheral_capable())
-					musb_g_tx(musb, ep_num);
+					musb_g_rx(musb, ep_num);
 			}
 		}
+
 		reg >>= 1;
 		ep_num++;
 	}
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224813 — [PATCH 3.4 049/146] firmware/ihex2fw.c: restore missing default in switch statement

From: Nicolas Iooss <nicolas.iooss_linux@m4x.org>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit d43698e8abb58a6ac47d16e0f47bb55f452e4fc4 upstream.

Commit 2473238eac95 ("ihex: add support for CS:IP/EIP records") removes
the "default:" statement in the switch block, making the "return
usage();" line dead code and ihex2fw silently ignoring unknown options.
Restore this statement.

This bug was found by building with HOSTCC=clang and adding
-Wunreachable-code-return to HOSTCFLAGS.

Fixes: 2473238eac95 ("ihex: add support for CS:IP/EIP records")
Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 firmware/ihex2fw.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/firmware/ihex2fw.c b/firmware/ihex2fw.c
index cf38e15..08d90e2 100644
--- a/firmware/ihex2fw.c
+++ b/firmware/ihex2fw.c
@@ -86,6 +86,7 @@ int main(int argc, char **argv)
 		case 'j':
 			include_jump = 1;
 			break;
+		default:
 			return usage();
 		}
 	}
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224814 — [PATCH 3.4 064/146] serial: xilinx: Use platform_get_irq to get irq description structure

From: Michal Simek <michal.simek@xilinx.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 5c90c07b98c02198d9777a7c4f3047b0a94bf7ed upstream.

For systems with CONFIG_SERIAL_OF_PLATFORM=y and device_type =
"serial"; property in DT of_serial.c driver maps and unmaps IRQ (because
driver probe fails). Then a driver is called but irq mapping is not
created that's why driver is failing again in again on request_irq().
Based on this use platform_get_irq() instead of platform_get_resource()
which is doing irq_desc allocation and driver itself can request IRQ.

Fix both xilinx serial drivers in the tree.

Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/tty/serial/uartlite.c      | 11 ++++++-----
 drivers/tty/serial/xilinx_uartps.c | 12 ++++++------
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c
index 6cd4143..d9706e7 100644
--- a/drivers/tty/serial/uartlite.c
+++ b/drivers/tty/serial/uartlite.c
@@ -573,7 +573,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match);
 
 static int __devinit ulite_probe(struct platform_device *pdev)
 {
-	struct resource *res, *res2;
+	struct resource *res;
+	int irq;
 	int id = pdev->id;
 #ifdef CONFIG_OF
 	const __be32 *prop;
@@ -587,11 +588,11 @@ static int __devinit ulite_probe(struct platform_device *pdev)
 	if (!res)
 		return -ENODEV;
 
-	res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-	if (!res2)
-		return -ENODEV;
+	irq = platform_get_irq(pdev, 0);
+	if (irq <= 0)
+		return -ENXIO;
 
-	return ulite_assign(&pdev->dev, id, res->start, res2->start);
+	return ulite_assign(&pdev->dev, id, res->start, irq);
 }
 
 static int __devexit ulite_remove(struct platform_device *pdev)
diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
index b627363..778c39a 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -941,9 +941,9 @@ static struct uart_driver xuartps_uart_driver = {
  **/
 static int __devinit xuartps_probe(struct platform_device *pdev)
 {
-	int rc;
+	int rc, irq;
 	struct uart_port *port;
-	struct resource *res, *res2;
+	struct resource *res;
 	int clk = 0;
 
 #ifdef CONFIG_OF
@@ -964,9 +964,9 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
 	if (!res)
 		return -ENODEV;
 
-	res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-	if (!res2)
-		return -ENODEV;
+	irq = platform_get_irq(pdev, 0);
+	if (irq <= 0)
+		return -ENXIO;
 
 	/* Initialize the port structure */
 	port = xuartps_get_port();
@@ -980,7 +980,7 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
 		 * and triggers invocation of the config_port() entry point.
 		 */
 		port->mapbase = res->start;
-		port->irq = res2->start;
+		port->irq = irq;
 		port->dev = &pdev->dev;
 		port->uartclk = clk;
 		dev_set_drvdata(&pdev->dev, port);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224816 — [PATCH 3.4 031/146] selinux/nlmsg: add XFRM_MSG_[NEW|GET]SADINFO

From: Nicolas Dichtel <nicolas.dichtel@6wind.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 5b5800fad072133e4a9c2efbf735baaac83dec86 upstream.

These commands are missing.

Fixes: 28d8909bc790 ("[XFRM]: Export SAD info.")
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 security/selinux/nlmsgtab.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index 4e14a28..375faa2 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -100,6 +100,8 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] =
 	{ XFRM_MSG_FLUSHPOLICY,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
 	{ XFRM_MSG_NEWAE,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
 	{ XFRM_MSG_GETAE,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
+	{ XFRM_MSG_NEWSADINFO,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
+	{ XFRM_MSG_GETSADINFO,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
 	{ XFRM_MSG_GETSPDINFO,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
 };
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224817 — [PATCH 3.4 062/146] 3w-xxxx: fix command completion race

From: Christoph Hellwig <hch@lst.de>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 9cd9554615cba14f0877cc9972a6537ad2bdde61 upstream.

The 3w-xxxx driver needs to tear down the dma mappings before returning
the command to the midlayer, as there is no guarantee the sglist and
count are valid after that point.  Also remove the dma mapping helpers
which have another inherent race due to the request_id index.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/scsi/3w-xxxx.c | 42 ++++++------------------------------------
 drivers/scsi/3w-xxxx.h |  5 -----
 2 files changed, 6 insertions(+), 41 deletions(-)

diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index 7fe96ff..86bc5f9 100644
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -1283,32 +1283,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev)
 	return 0;
 } /* End tw_initialize_device_extension() */
 
-static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
-{
-	int use_sg;
-
-	dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n");
-
-	use_sg = scsi_dma_map(cmd);
-	if (use_sg < 0) {
-		printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n");
-		return 0;
-	}
-
-	cmd->SCp.phase = TW_PHASE_SGLIST;
-	cmd->SCp.have_data_in = use_sg;
-
-	return use_sg;
-} /* End tw_map_scsi_sg_data() */
-
-static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
-{
-	dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n");
-
-	if (cmd->SCp.phase == TW_PHASE_SGLIST)
-		scsi_dma_unmap(cmd);
-} /* End tw_unmap_scsi_data() */
-
 /* This function will reset a device extension */
 static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
 {
@@ -1331,8 +1305,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
 			srb = tw_dev->srb[i];
 			if (srb != NULL) {
 				srb->result = (DID_RESET << 16);
-				tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
-				tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]);
+				scsi_dma_unmap(srb);
+				srb->scsi_done(srb);
 			}
 		}
 	}
@@ -1779,8 +1753,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id)
 	command_packet->byte8.io.lba = lba;
 	command_packet->byte6.block_count = num_sectors;
 
-	use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
-	if (!use_sg)
+	use_sg = scsi_dma_map(srb);
+	if (use_sg <= 0)
 		return 1;
 
 	scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) {
@@ -1967,9 +1941,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c
 	/* Save the scsi command for use by the ISR */
 	tw_dev->srb[request_id] = SCpnt;
 
-	/* Initialize phase to zero */
-	SCpnt->SCp.phase = TW_PHASE_INITIAL;
-
 	switch (*command) {
 		case READ_10:
 		case READ_6:
@@ -2196,12 +2167,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance)
 
 				/* Now complete the io */
 				if ((error != TW_ISR_DONT_COMPLETE)) {
+					scsi_dma_unmap(tw_dev->srb[request_id]);
+					tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
 					tw_dev->state[request_id] = TW_S_COMPLETED;
 					tw_state_request_finish(tw_dev, request_id);
 					tw_dev->posted_request_count--;
-					tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
-					
-					tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
 				}
 			}
 				
diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h
index 49dcf03..1d31858 100644
--- a/drivers/scsi/3w-xxxx.h
+++ b/drivers/scsi/3w-xxxx.h
@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] =
 #define TW_AEN_SMART_FAIL        0x000F
 #define TW_AEN_SBUF_FAIL         0x0024
 
-/* Phase defines */
-#define TW_PHASE_INITIAL 0
-#define TW_PHASE_SINGLE 1
-#define TW_PHASE_SGLIST 2
-
 /* Misc defines */
 #define TW_ALIGNMENT_6000		      64 /* 64 bytes */
 #define TW_ALIGNMENT_7000                     4  /* 4 bytes */
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224818 — [PATCH 3.4 023/146] ARM: 8320/1: fix integer overflow in ELF_ET_DYN_BASE

From: Andrey Ryabinin <a.ryabinin@samsung.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 8defb3367fcd19d1af64c07792aade0747b54e0f upstream.

Usually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel
split this is not so, because 2*TASK_SIZE overflows 32 bits,
so the actual value of ELF_ET_DYN_BASE is:
	(2 * TASK_SIZE / 3) = 0x2a000000

When ASLR is disabled PIE binaries will load at ELF_ET_DYN_BASE address.
On 32bit platforms AddressSanitzer uses addresses [0x20000000 - 0x40000000]
for shadow memory [1]. So ASan doesn't work for PIE binaries when ASLR disabled
as it fails to map shadow memory.
Also after Kees's 'split ET_DYN ASLR from mmap ASLR' patchset PIE binaries
has a high chance of loading somewhere in between [0x2a000000 - 0x40000000]
even if ASLR enabled. This makes ASan with PIE absolutely incompatible.

Fix overflow by dividing TASK_SIZE prior to multiplying.
After this patch ELF_ET_DYN_BASE equals to (for CONFIG_VMSPLIT_3G=y):
	(TASK_SIZE / 3 * 2) = 0x7f555554

[1] https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm#Mapping

Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
Reported-by: Maria Guseva <m.guseva@samsung.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 arch/arm/include/asm/elf.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index 38050b1..dfc980b 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
    the loader.  We need to make sure that it is out of the way of the program
    that it will "exec", and that there is sufficient room for the brk.  */
 
-#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
+#define ELF_ET_DYN_BASE	(TASK_SIZE / 3 * 2)
 
 /* When the program starts, a1 contains a pointer to a function to be 
    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224819 — [PATCH 3.4 131/146] ring-buffer-benchmark: Fix the wrong sched_priority of producer

From: Wang Long <long.wanglong@huawei.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 108029323910c5dd1ef8fa2d10da1ce5fbce6e12 upstream.

The producer should be used producer_fifo as its sched_priority,
so correct it.

Link: http://lkml.kernel.org/r/1433923957-67842-1-git-send-email-long.wanglong@huawei.com

Signed-off-by: Wang Long <long.wanglong@huawei.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 kernel/trace/ring_buffer_benchmark.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c
index a5457d5..6ad2e2d 100644
--- a/kernel/trace/ring_buffer_benchmark.c
+++ b/kernel/trace/ring_buffer_benchmark.c
@@ -455,7 +455,7 @@ static int __init ring_buffer_benchmark_init(void)
 
 	if (producer_fifo >= 0) {
 		struct sched_param param = {
-			.sched_priority = consumer_fifo
+			.sched_priority = producer_fifo
 		};
 		sched_setscheduler(producer, SCHED_FIFO, &param);
 	} else
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224820 — [PATCH 3.4 141/146] block: fix ext_dev_lock lockdep report

From: Dan Williams <dan.j.williams@intel.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 4d66e5e9b6d720d8463e11d027bd4ad91c8b1318 upstream.

 =================================
 [ INFO: inconsistent lock state ]
 4.1.0-rc7+ #217 Tainted: G           O
 ---------------------------------
 inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
 swapper/6/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
  (ext_devt_lock){+.?...}, at: [<ffffffff8143a60c>] blk_free_devt+0x3c/0x70
 {SOFTIRQ-ON-W} state was registered at:
   [<ffffffff810bf6b1>] __lock_acquire+0x461/0x1e70
   [<ffffffff810c1947>] lock_acquire+0xb7/0x290
   [<ffffffff818ac3a8>] _raw_spin_lock+0x38/0x50
   [<ffffffff8143a07d>] blk_alloc_devt+0x6d/0xd0  <-- take the lock in process context
[..]
  [<ffffffff810bf64e>] __lock_acquire+0x3fe/0x1e70
  [<ffffffff810c00ad>] ? __lock_acquire+0xe5d/0x1e70
  [<ffffffff810c1947>] lock_acquire+0xb7/0x290
  [<ffffffff8143a60c>] ? blk_free_devt+0x3c/0x70
  [<ffffffff818ac3a8>] _raw_spin_lock+0x38/0x50
  [<ffffffff8143a60c>] ? blk_free_devt+0x3c/0x70
  [<ffffffff8143a60c>] blk_free_devt+0x3c/0x70    <-- take the lock in softirq
  [<ffffffff8143bfec>] part_release+0x1c/0x50
  [<ffffffff8158edf6>] device_release+0x36/0xb0
  [<ffffffff8145ac2b>] kobject_cleanup+0x7b/0x1a0
  [<ffffffff8145aad0>] kobject_put+0x30/0x70
  [<ffffffff8158f147>] put_device+0x17/0x20
  [<ffffffff8143c29c>] delete_partition_rcu_cb+0x16c/0x180
  [<ffffffff8143c130>] ? read_dev_sector+0xa0/0xa0
  [<ffffffff810e0e0f>] rcu_process_callbacks+0x2ff/0xa90
  [<ffffffff810e0dcf>] ? rcu_process_callbacks+0x2bf/0xa90
  [<ffffffff81067e2e>] __do_softirq+0xde/0x600

Neil sees this in his tests and it also triggers on pmem driver unbind
for the libnvdimm tests.  This fix is on top of an initial fix by Keith
for incorrect usage of mutex_lock() in this path: 2da78092dda1 "block:
Fix dev_t minor allocation lifetime".  Both this and 2da78092dda1 are
candidates for -stable.

Fixes: 2da78092dda1 ("block: Fix dev_t minor allocation lifetime")
Cc: Keith Busch <keith.busch@intel.com>
Reported-by: NeilBrown <neilb@suse.de>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 block/genhd.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/block/genhd.c b/block/genhd.c
index 7a2a8dc..618ca1a 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -420,13 +420,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
 	do {
 		if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL))
 			return -ENOMEM;
-		spin_lock(&ext_devt_lock);
+		spin_lock_bh(&ext_devt_lock);
 		rc = idr_get_new(&ext_devt_idr, part, &idx);
 		if (!rc && idx >= NR_EXT_DEVT) {
 			idr_remove(&ext_devt_idr, idx);
 			rc = -EBUSY;
 		}
-		spin_unlock(&ext_devt_lock);
+		spin_unlock_bh(&ext_devt_lock);
 	} while (rc == -EAGAIN);
 
 	if (rc)
@@ -451,9 +451,9 @@ void blk_free_devt(dev_t devt)
 		return;
 
 	if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
-		spin_lock(&ext_devt_lock);
+		spin_lock_bh(&ext_devt_lock);
 		idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
-		spin_unlock(&ext_devt_lock);
+		spin_unlock_bh(&ext_devt_lock);
 	}
 }
 
@@ -684,13 +684,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno)
 	} else {
 		struct hd_struct *part;
 
-		spin_lock(&ext_devt_lock);
+		spin_lock_bh(&ext_devt_lock);
 		part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
 		if (part && get_disk(part_to_disk(part))) {
 			*partno = part->partno;
 			disk = part_to_disk(part);
 		}
-		spin_unlock(&ext_devt_lock);
+		spin_unlock_bh(&ext_devt_lock);
 	}
 
 	return disk;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224821 — [PATCH 3.4 083/146] USB: cp210x: add ID for KCF Technologies PRN device

From: Mark Edwards <sonofaforester@gmail.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit c735ed74d83f8ecb45c4c4c95a16853c9c3c8157 upstream.

Added the USB serial console device ID for KCF Technologies PRN device
which has a USB port for its serial console.

Signed-off-by: Mark Edwards <sonofaforester@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/usb/serial/cp210x.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 5c289fc..bf69088 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -133,6 +133,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
 	{ USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
 	{ USB_DEVICE(0x10C4, 0x8977) },	/* CEL MeshWorks DevKit Device */
+	{ USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
 	{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224822 — [PATCH 3.4 111/146] x86/mce: Fix MCE severity messages

From: Borislav Petkov <bp@suse.de>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 17fea54bf0ab34fa09a06bbde2f58ed7bbdf9299 upstream.

Derek noticed that a critical MCE gets reported with the wrong
error type description:

  [Hardware Error]: CPU 34: Machine Check Exception: 5 Bank 9: f200003f000100b0
  [Hardware Error]: RIP !INEXACT! 10:<ffffffff812e14c1> {intel_idle+0xb1/0x170}
  [Hardware Error]: TSC 49587b8e321cb
  [Hardware Error]: PROCESSOR 0:306e4 TIME 1431561296 SOCKET 1 APIC 29
  [Hardware Error]: Some CPUs didn't answer in synchronization
  [Hardware Error]: Machine check: Invalid
				   ^^^^^^^

The last line with 'Invalid' should have printed the high level
MCE error type description we get from mce_severity, i.e.
something like:

  [Hardware Error]: Machine check: Action required: data load error in a user process

this happens due to the fact that mce_no_way_out() iterates over
all MCA banks and possibly overwrites the @msg argument which is
used in the panic printing later.

Change behavior to take the message of only and the (last)
critical MCE it detects.

Reported-by: Derek <denc716@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Tony Luck <tony.luck@intel.com>
Link: http://lkml.kernel.org/r/1431936437-25286-3-git-send-email-bp@alien8.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 arch/x86/kernel/cpu/mcheck/mce.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 0d2db0e..9eeaed4 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -652,11 +652,14 @@ EXPORT_SYMBOL_GPL(machine_check_poll);
 static int mce_no_way_out(struct mce *m, char **msg)
 {
 	int i;
+	char *tmp;
 
 	for (i = 0; i < banks; i++) {
 		m->status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i));
-		if (mce_severity(m, tolerant, msg) >= MCE_PANIC_SEVERITY)
+		if (mce_severity(m, tolerant, &tmp) >= MCE_PANIC_SEVERITY) {
+			*msg = tmp;
 			return 1;
+		}
 	}
 	return 0;
 }
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224823 — [PATCH 3.4 136/146] x86, kvm: use kernel_fpu_begin/end() in kvm_load/put_guest_fpu()

From: Suresh Siddha <suresh.b.siddha@intel.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 9c1c3fac53378c9782c18f80107965578d7b7167 upstream.

kvm's guest fpu save/restore should be wrapped around
kernel_fpu_begin/end(). This will avoid for example taking a DNA
in kvm_load_guest_fpu() when it tries to load the fpu immediately
after doing unlazy_fpu() on the host side.

More importantly this will prevent the host process fpu from being
corrupted.

Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Link: http://lkml.kernel.org/r/1345842782-24175-4-git-send-email-suresh.b.siddha@intel.com
Cc: Avi Kivity <avi@redhat.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: Rui Xiang <rui.xiang@huawei.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 arch/x86/kvm/x86.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 318a245..55ee4ca 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5907,7 +5907,7 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
 	 */
 	kvm_put_guest_xcr0(vcpu);
 	vcpu->guest_fpu_loaded = 1;
-	unlazy_fpu(current);
+	kernel_fpu_begin();
 	fpu_restore_checking(&vcpu->arch.guest_fpu);
 	trace_kvm_fpu(1);
 }
@@ -5921,6 +5921,7 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
 
 	vcpu->guest_fpu_loaded = 0;
 	fpu_save_init(&vcpu->arch.guest_fpu);
+	kernel_fpu_end();
 	++vcpu->stat.fpu_reload;
 	kvm_make_request(KVM_REQ_DEACTIVATE_FPU, vcpu);
 	trace_kvm_fpu(0);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224824 — [PATCH 3.4 143/146] pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic

From: Ben Hutchings <ben@decadent.org.uk>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


pipe_iov_copy_{from,to}_user() may be tried twice with the same iovec,
the first time atomically and the second time not.  The second attempt
needs to continue from the iovec position, pipe buffer offset and
remaining length where the first attempt failed, but currently the
pipe buffer offset and remaining length are reset.  This will corrupt
the piped data (possibly also leading to an information leak between
processes) and may also corrupt kernel memory.

This was fixed upstream by commits f0d1bec9d58d ("new helper:
copy_page_from_iter()") and 637b58c2887e ("switch pipe_read() to
copy_page_to_iter()"), but those aren't suitable for stable.  This fix
for older kernel versions was made by Seth Jennings for RHEL and I
have extracted it from their update.

CVE-2015-1805

References: https://bugzilla.redhat.com/show_bug.cgi?id=1202855
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 fs/pipe.c | 55 ++++++++++++++++++++++++++++++++-----------------------
 1 file changed, 32 insertions(+), 23 deletions(-)

diff --git a/fs/pipe.c b/fs/pipe.c
index 1667e6f..abfb935 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -104,25 +104,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
 }
 
 static int
-pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
-			int atomic)
+pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
+			size_t *remaining, int atomic)
 {
 	unsigned long copy;
 
-	while (len > 0) {
+	while (*remaining > 0) {
 		while (!iov->iov_len)
 			iov++;
-		copy = min_t(unsigned long, len, iov->iov_len);
+		copy = min_t(unsigned long, *remaining, iov->iov_len);
 
 		if (atomic) {
-			if (__copy_from_user_inatomic(to, iov->iov_base, copy))
+			if (__copy_from_user_inatomic(addr + *offset,
+						      iov->iov_base, copy))
 				return -EFAULT;
 		} else {
-			if (copy_from_user(to, iov->iov_base, copy))
+			if (copy_from_user(addr + *offset,
+					   iov->iov_base, copy))
 				return -EFAULT;
 		}
-		to += copy;
-		len -= copy;
+		*offset += copy;
+		*remaining -= copy;
 		iov->iov_base += copy;
 		iov->iov_len -= copy;
 	}
@@ -130,25 +132,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
 }
 
 static int
-pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
-		      int atomic)
+pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
+		      size_t *remaining, int atomic)
 {
 	unsigned long copy;
 
-	while (len > 0) {
+	while (*remaining > 0) {
 		while (!iov->iov_len)
 			iov++;
-		copy = min_t(unsigned long, len, iov->iov_len);
+		copy = min_t(unsigned long, *remaining, iov->iov_len);
 
 		if (atomic) {
-			if (__copy_to_user_inatomic(iov->iov_base, from, copy))
+			if (__copy_to_user_inatomic(iov->iov_base,
+						    addr + *offset, copy))
 				return -EFAULT;
 		} else {
-			if (copy_to_user(iov->iov_base, from, copy))
+			if (copy_to_user(iov->iov_base,
+					 addr + *offset, copy))
 				return -EFAULT;
 		}
-		from += copy;
-		len -= copy;
+		*offset += copy;
+		*remaining -= copy;
 		iov->iov_base += copy;
 		iov->iov_len -= copy;
 	}
@@ -384,7 +388,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
 			struct pipe_buffer *buf = pipe->bufs + curbuf;
 			const struct pipe_buf_operations *ops = buf->ops;
 			void *addr;
-			size_t chars = buf->len;
+			size_t chars = buf->len, remaining;
 			int error, atomic;
 
 			if (chars > total_len)
@@ -398,9 +402,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
 			}
 
 			atomic = !iov_fault_in_pages_write(iov, chars);
+			remaining = chars;
 redo:
 			addr = ops->map(pipe, buf, atomic);
-			error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
+			error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
+						      &remaining, atomic);
 			ops->unmap(pipe, buf, addr);
 			if (unlikely(error)) {
 				/*
@@ -415,7 +421,6 @@ redo:
 				break;
 			}
 			ret += chars;
-			buf->offset += chars;
 			buf->len -= chars;
 
 			/* Was it a packet buffer? Clean up and exit */
@@ -522,6 +527,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
 		if (ops->can_merge && offset + chars <= PAGE_SIZE) {
 			int error, atomic = 1;
 			void *addr;
+			size_t remaining = chars;
 
 			error = ops->confirm(pipe, buf);
 			if (error)
@@ -530,8 +536,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
 			iov_fault_in_pages_read(iov, chars);
 redo1:
 			addr = ops->map(pipe, buf, atomic);
-			error = pipe_iov_copy_from_user(offset + addr, iov,
-							chars, atomic);
+			error = pipe_iov_copy_from_user(addr, &offset, iov,
+							&remaining, atomic);
 			ops->unmap(pipe, buf, addr);
 			ret = error;
 			do_wakeup = 1;
@@ -566,6 +572,8 @@ redo1:
 			struct page *page = pipe->tmp_page;
 			char *src;
 			int error, atomic = 1;
+			int offset = 0;
+			size_t remaining;
 
 			if (!page) {
 				page = alloc_page(GFP_HIGHUSER);
@@ -586,14 +594,15 @@ redo1:
 				chars = total_len;
 
 			iov_fault_in_pages_read(iov, chars);
+			remaining = chars;
 redo2:
 			if (atomic)
 				src = kmap_atomic(page);
 			else
 				src = kmap(page);
 
-			error = pipe_iov_copy_from_user(src, iov, chars,
-							atomic);
+			error = pipe_iov_copy_from_user(src, &offset, iov,
+							&remaining, atomic);
 			if (atomic)
 				kunmap_atomic(src);
 			else
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224825 — [PATCH 3.4 146/146] ipv6: add check for blackhole or prohibited entry in rt6_redire

From: Weilong Chen <chenweilong@huawei.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


There's a check for ip6_null_entry, but it's not enough if the config
CONFIG_IPV6_MULTIPLE_TABLES is selected. Blackhole or prohibited entries
should also be ignored.

This path is for kernel before v3.6, as there's a commit b94f1c0
use icmpv6_notify() instead of rt6_redirect() and rt6_redirect has
been deleted.

The oops as follow:
    [exception RIP: do_raw_write_lock+12]
    RIP: ffffffff8122c42c  RSP: ffff880666e45820  RFLAGS: 00010282
    RAX: ffff8801207bffd8  RBX: 0000000000000018  RCX: 0000000000000000
    RDX: 0000000000000000  RSI: ffff880666e45898  RDI: 0000000000000018
    RBP: ffff880666e45830   R8: 000000000000001e   R9: 0000000006000000
    R10: ffff88011796b8a0  R11: 0000000000000004  R12: ffff88010391ed00
    R13: 0000000000000000  R14: ffff880666e45898  R15: ffff88011796b890
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
    [ffff880666e45838] _raw_write_lock_bh at ffffffff81450b39
    [ffff880666e45858] __ip6_ins_rt at ffffffff813ed8c1
    [ffff880666e45888] ip6_ins_rt at ffffffff813eef58
    [ffff880666e458b8] rt6_redirect at ffffffff813f0b84
    [ffff880666e45958] ndisc_rcv at ffffffff813f95d8
    [ffff880666e45a08] icmpv6_rcv at ffffffff814000e8
    [ffff880666e45ae8] ip6_input_finish at ffffffff813e43bb
    [ffff880666e45b38] ip6_input at ffffffff813e4b08
    [ffff880666e45b68] ipv6_rcv at ffffffff813e4969
    [ffff880666e45bc8] __netif_receive_skb at ffffffff8135158a
    [ffff880666e45c38] dev_gro_receive at ffffffff81351cb0
    [ffff880666e45c78] napi_gro_receive at ffffffff81351fc5
    [ffff880666e45cb8] tg3_rx at ffffffffa0bfb354 [tg]
    [ffff880666e45d88] tg3_poll_work at ffffffffa0c07857 [tg]
    [ffff880666e45e18] tg3_poll_msix at ffffffffa0c07d1b [tg]
    [ffff880666e45e68] net_rx_action at ffffffff81352219
    [ffff880666e45ec8] __do_softirq at ffffffff8103e5a1
    [ffff880666e45f38] call_softirq at ffffffff81459c4c
    [ffff880666e45f50] do_softirq at ffffffff8100413d
    [ffff880666e45f80] do_IRQ at ffffffff81003cce
This happened when ip6_route_redirect found a rt which was set
blackhole, the rt had a NULL rt6i_table argument which is accessed by
__ip6_ins_rt() when trying to lock rt6i_table->tb6_lock caused a BUG:
"BUG: unable to handle kernel NULL pointer"

Signed-off-by: Weilong Chen <chenweilong@huawei.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 net/ipv6/route.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 23b3304..6a80567 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1672,6 +1672,17 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
 	}
 #endif
 
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+	if (rt == net->ipv6.ip6_blk_hole_entry ||
+	    rt == net->ipv6.ip6_prohibit_entry) {
+		if (net_ratelimit())
+			printk(KERN_DEBUG "rt6_redirect: source isn't a valid" \
+			       " nexthop for redirect target " \
+			       "(blackhole or prohibited)\n");
+		goto out;
+	}
+#endif
+
 	/*
 	 *	We have finally decided to accept it.
 	 */
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224826 — [PATCH 3.4 117/146] USB: serial: ftdi_sio: Add support for a Motion Tracker Development Board

From: Patrick Riphagen <patrick.riphagen@xsens.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 1df5b888f54070a373a73b34488cc78c2365b7b4 upstream.

This adds support for new Xsens device, Motion Tracker Development Board,
using Xsens' own Vendor ID

Signed-off-by: Patrick Riphagen <patrick.riphagen@xsens.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/usb/serial/ftdi_sio.c     | 1 +
 drivers/usb/serial/ftdi_sio_ids.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 06abee6..1e4899c 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -723,6 +723,7 @@ static struct usb_device_id id_table_combined [] = {
 	{ USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
 	{ USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
 	{ USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
+	{ USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) },
 	{ USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
 	{ USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 105b982..1fee973 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -155,6 +155,7 @@
 #define XSENS_AWINDA_STATION_PID 0x0101
 #define XSENS_AWINDA_DONGLE_PID 0x0102
 #define XSENS_MTW_PID		0x0200	/* Xsens MTw */
+#define XSENS_MTDEVBOARD_PID	0x0300	/* Motion Tracker Development Board */
 #define XSENS_CONVERTER_PID	0xD00D	/* Xsens USB-serial converter */
 
 /* Xsens devices using FTDI VID */
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224827 — [PATCH 3.4 088/146] xhci: fix isoc endpoint dequeue from advancing too far on transaction error

From: Mathias Nyman <mathias.nyman@linux.intel.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit d104d0152a97fade389f47635b73a9ccc7295d0b upstream.

Isoc TDs usually consist of one TRB, sometimes two. When all goes well we
receive only one success event for a TD, and move the dequeue pointer to
the next TD.

This fails if the TD consists of two TRBs and we get a transfer error
on the first TRB, we will then see two events for that TD.

Fix this by making sure the event we get is for the last TRB in that TD
before moving the dequeue pointer to the next TD. This will resolve some
of the uvc and dvb issues with the
"ERROR Transfer event TRB DMA ptr not part of current TD" error message

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/usb/host/xhci-ring.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index e47a4e1..744e97e 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2129,8 +2129,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
 		break;
 	case COMP_DEV_ERR:
 	case COMP_STALL:
+		frame->status = -EPROTO;
+		skip_td = true;
+		break;
 	case COMP_TX_ERR:
 		frame->status = -EPROTO;
+		if (event_trb != td->last_trb)
+			return 0;
 		skip_td = true;
 		break;
 	case COMP_STOP:
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224829 — [PATCH 3.4 104/146] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724

From: David Henningsson <david.henningsson@canonical.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 6ffc0898b29a2811a6c0569c5dd9b581980110df upstream.

This patch adds support for Conexant HD Audio codecs
CX20721, CX20722, CX20723 and CX20724.

BugLink: https://bugs.launchpad.net/bugs/1454656
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 sound/pci/hda/patch_conexant.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 20cfc5b..ba80c2f 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -4606,6 +4606,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
 	  .patch = patch_conexant_auto },
 	{ .id = 0x14f150b9, .name = "CX20665",
 	  .patch = patch_conexant_auto },
+	{ .id = 0x14f150f1, .name = "CX20721",
+	  .patch = patch_conexant_auto },
+	{ .id = 0x14f150f2, .name = "CX20722",
+	  .patch = patch_conexant_auto },
+	{ .id = 0x14f150f3, .name = "CX20723",
+	  .patch = patch_conexant_auto },
+	{ .id = 0x14f150f4, .name = "CX20724",
+	  .patch = patch_conexant_auto },
 	{ .id = 0x14f1510f, .name = "CX20751/2",
 	  .patch = patch_conexant_auto },
 	{ .id = 0x14f15110, .name = "CX20751/2",
@@ -4640,6 +4648,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab");
 MODULE_ALIAS("snd-hda-codec-id:14f150ac");
 MODULE_ALIAS("snd-hda-codec-id:14f150b8");
 MODULE_ALIAS("snd-hda-codec-id:14f150b9");
+MODULE_ALIAS("snd-hda-codec-id:14f150f1");
+MODULE_ALIAS("snd-hda-codec-id:14f150f2");
+MODULE_ALIAS("snd-hda-codec-id:14f150f3");
+MODULE_ALIAS("snd-hda-codec-id:14f150f4");
 MODULE_ALIAS("snd-hda-codec-id:14f1510f");
 MODULE_ALIAS("snd-hda-codec-id:14f15110");
 MODULE_ALIAS("snd-hda-codec-id:14f15111");
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1224830 — [PATCH 3.4 084/146] USB: pl2303: Remove support for Samsung I330

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

3.4.109-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 48ef23a4f686b1e4519d4193c20d26834ff810ff upstream.

This phone is already supported by the visor driver.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/usb/serial/pl2303.c | 1 -
 drivers/usb/serial/pl2303.h | 4 ----
 2 files changed, 5 deletions(-)

diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 3e450b4..723ed87 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -67,7 +67,6 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) },
 	{ USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) },
 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) },
-	{ USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) },
 	{ USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) },
 	{ USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) },
 	{ USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 71fd9da..e3b7af8 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -62,10 +62,6 @@
 #define ALCATEL_VENDOR_ID	0x11f7
 #define ALCATEL_PRODUCT_ID	0x02df
 
-/* Samsung I330 phone cradle */
-#define SAMSUNG_VENDOR_ID	0x04e8
-#define SAMSUNG_PRODUCT_ID	0x8001
-
 #define SIEMENS_VENDOR_ID	0x11f5
 #define SIEMENS_PRODUCT_ID_SX1	0x0001
 #define SIEMENS_PRODUCT_ID_X65	0x0003
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

Page 2 of 7 — ← Prev page 1 [2] 3 4 5 6 7  Next page →

Back to top | Article view | linux.kernel

csiph-web