Commit graph

322575 commits

Author SHA1 Message Date
Jonathan Brassow
eb6491236f DM RAID: Move 'rebuild' checking code to its own function
DM RAID:  Move chunk of code to it's own function

The code that checks whether device replacements/rebuilds are possible given
a specific RAID type is moved to it's own function.  It will further expand
when the code to check RAID10 is added.  A separate function makes it easier
to read.

Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: NeilBrown <neilb@suse.de>
2012-10-11 13:40:09 +11:00
Jonathan Brassow
2863b9eb44 MD RAID10: Prep for DM RAID10 device replacement capability
MD RAID10:  Fix a couple potential kernel panics if RAID10 is used by dm-raid

When device-mapper uses the RAID10 personality through dm-raid.c, there is no
'gendisk' structure in mddev and some sysfs information is also not populated.

This patch avoids touching those non-existent structures.

Signed-off-by: Jonathan Brassow <jbrassow@rehdat.com>
Signed-off-by: NeilBrown <neilb@suse.de>
2012-10-11 13:38:58 +11:00
NeilBrown
1ca69c4bc4 md: avoid taking the mutex on some ioctls.
Some ioctls don't need to take the mutex and doing so can cause
a delay as it is held during super-block update.
So move those ioctls out of the mutex and rely on rcu locking
to ensure we don't access stale data.

Signed-off-by: NeilBrown <neilb@suse.de>
2012-10-11 13:37:33 +11:00
Shaohua Li
4ed8731d8e MD: change the parameter of md thread
Change the thread parameter, so the thread can carry extra info. Next patch
will use it.

Signed-off-by: Shaohua Li <shli@fusionio.com>
Signed-off-by: NeilBrown <neilb@suse.de>
2012-10-11 13:34:00 +11:00
NeilBrown
57c67df488 md/raid10: submit IO from originating thread instead of md thread.
queuing writes to the md thread means that all requests go through the
one processor which may not be able to keep up with very high request
rates.

So use the plugging infrastructure to submit all requests on unplug.
If a 'schedule' is needed, we fall back on the old approach of handing
the requests to the thread for it to handle.

This is nearly identical to a recent patch which provided similar
functionality to RAID1.

Signed-off-by: NeilBrown <neilb@suse.de>
2012-10-11 13:32:13 +11:00
Shaohua Li
532a2a3fba md: raid 10 supports TRIM
This makes md raid 10 support TRIM.

If one disk supports discard and another not, or one has
discard_zero_data and another not, there could be inconsistent between
data from such disks. But this should not matter, discarded data is
useless. This will add extra copy in rebuild though.

Signed-off-by: Shaohua Li <shli@fusionio.com>
Signed-off-by: NeilBrown <neilb@suse.de>
2012-10-11 13:30:52 +11:00
Shaohua Li
2ff8cc2c6d md: raid 1 supports TRIM
This makes md raid 1 support TRIM.
If one disk supports discard and another not, or one has discard_zero_data and
another not, there could be inconsistent between data from such disks. But this
should not matter, discarded data is useless. This will add extra copy in rebuild
though.

Signed-off-by: Shaohua Li <shli@fusionio.com>
Signed-off-by: NeilBrown <neilb@suse.de>
2012-10-11 13:28:54 +11:00
Shaohua Li
c83057a1f4 md: raid 0 supports TRIM
This makes md raid 0 support TRIM.

Signed-off-by: Shaohua Li <shli@fusionio.com>
Signed-off-by: NeilBrown <neilb@suse.de>
2012-10-11 13:25:44 +11:00
Shaohua Li
f1cad2b68e md: linear supports TRIM
This makes md linear support TRIM.

Signed-off-by: Shaohua Li <shli@fusionio.com>
Signed-off-by: NeilBrown <neilb@suse.de>
2012-10-11 13:08:44 +11:00
Denis Efremov
bc78c57388 md/linear: rcu_dereference outside read-lock section
According to the comment in linear_stop function
rcu_dereference in linear_start and linear_stop functions
occurs under reconfig_mutex. The patch represents this
agreement in code and prevents lockdep complaint.

Found by Linux Driver Verification project (linuxtesting.org)

Signed-off-by: Denis Efremov <yefremov.denis@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
2012-10-11 13:08:02 +11:00
Shaohua Li
02f3939e1a block: makes bio_split support bio without data
discard bio hasn't data attached. We hit a BUG_ON with such bio. This makes
bio_split works for such bio.

Signed-off-by: Shaohua Li <shli@fusionio.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-28 10:38:48 +02:00
Maxim Levitsky
232f1b5106 scatterlist: refactor the sg_nents
Replace 'while' with 'for' as suggested by Tejun Heo

Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-28 10:38:15 +02:00
Maxim Levitsky
2e48461029 scatterlist: add sg_nents
Useful helper to know the number of entries in scatterlist.

Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
Cc: Alex Dubov <oakad@yahoo.com>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-27 12:45:28 +02:00
Jens Axboe
c2b1ad800b fs: fix include/percpu-rwsem.h export error
We get the following export error on the include file:

usr/include/linux/fs.h:13: included file 'linux/percpu-rwsem.h' is not exported

Move the include inside the __KERNEL__ section.

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-27 09:35:03 +02:00
Mikulas Patocka
e6b5c0822b percpu-rw-semaphore: fix documentation typos
One more patch for this thing, fixing some typos in the documentation.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-26 19:56:15 +02:00
Fengguang Wu
3eab7315c8 fs/block_dev.c:1644:5: sparse: symbol 'blkdev_mmap' was not declared
blkdev_mmap() isn't used outside of fs/block_dev.c, mark it as
static.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-26 09:57:55 +02:00
Mikulas Patocka
62ac665ff9 blockdev: turn a rw semaphore into a percpu rw semaphore
This avoids cache line bouncing when many processes lock the semaphore
for read.

New percpu lock implementation

The lock consists of an array of percpu unsigned integers, a boolean
variable and a mutex.

When we take the lock for read, we enter rcu read section, check for a
"locked" variable. If it is false, we increase a percpu counter on the
current cpu and exit the rcu section. If "locked" is true, we exit the
rcu section, take the mutex and drop it (this waits until a writer
finished) and retry.

Unlocking for read just decreases percpu variable. Note that we can
unlock on a difference cpu than where we locked, in this case the
counter underflows. The sum of all percpu counters represents the number
of processes that hold the lock for read.

When we need to lock for write, we take the mutex, set "locked" variable
to true and synchronize rcu. Since RCU has been synchronized, no
processes can create new read locks. We wait until the sum of percpu
counters is zero - when it is, there are no readers in the critical
section.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-26 07:46:43 +02:00
Mikulas Patocka
b87570f5d3 Fix a crash when block device is read and block size is changed at the same time
The kernel may crash when block size is changed and I/O is issued
simultaneously.

Because some subsystems (udev or lvm) may read any block device anytime,
the bug actually puts any code that changes a block device size in
jeopardy.

The crash can be reproduced if you place "msleep(1000)" to
blkdev_get_blocks just before "bh->b_size = max_blocks <<
inode->i_blkbits;".
Then, run "dd if=/dev/ram0 of=/dev/null bs=4k count=1 iflag=direct"
While it is waiting in msleep, run "blockdev --setbsz 2048 /dev/ram0"
You get a BUG.

The direct and non-direct I/O is written with the assumption that block
size does not change. It doesn't seem practical to fix these crashes
one-by-one there may be many crash possibilities when block size changes
at a certain place and it is impossible to find them all and verify the
code.

This patch introduces a new rw-lock bd_block_size_semaphore. The lock is
taken for read during I/O. It is taken for write when changing block
size. Consequently, block size can't be changed while I/O is being
submitted.

For asynchronous I/O, the patch only prevents block size change while
the I/O is being submitted. The block size can change when the I/O is in
progress or when the I/O is being finished. This is acceptable because
there are no accesses to block size when asynchronous I/O is being
finished.

The patch prevents block size changing while the device is mapped with
mmap.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-26 07:46:40 +02:00
Tejun Heo
60ea8226cb block: fix request_queue->flags initialization
A queue newly allocated with blk_alloc_queue_node() has only
QUEUE_FLAG_BYPASS set.  For request-based drivers,
blk_init_allocated_queue() is called and q->queue_flags is overwritten
with QUEUE_FLAG_DEFAULT which doesn't include BYPASS even though the
initial bypass is still in effect.

In blk_init_allocated_queue(), or QUEUE_FLAG_DEFAULT to q->queue_flags
instead of overwriting.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
Acked-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-21 15:33:12 +02:00
Tejun Heo
749fefe677 block: lift the initial queue bypass mode on blk_register_queue() instead of blk_init_allocated_queue()
b82d4b197c ("blkcg: make request_queue bypassing on allocation") made
request_queues bypassed on allocation to avoid switching on and off
bypass mode on a queue being initialized.  Some drivers allocate and
then destroy a lot of queues without fully initializing them and
incurring bypass latency overhead on each of them could add upto
significant overhead.

Unfortunately, blk_init_allocated_queue() is never used by queues of
bio-based drivers, which means that all bio-based driver queues are in
bypass mode even after initialization and registration complete
successfully.

Due to the limited way request_queues are used by bio drivers, this
problem is hidden pretty well but it shows up when blk-throttle is
used in combination with a bio-based driver.  Trying to configure
(echoing to cgroupfs file) blk-throttle for a bio-based driver hangs
indefinitely in blkg_conf_prep() waiting for bypass mode to end.

This patch moves the initial blk_queue_bypass_end() call from
blk_init_allocated_queue() to blk_register_queue() which is called for
any userland-visible queues regardless of its type.

I believe this is correct because I don't think there is any block
driver which needs or wants working elevator and blk-cgroup on a queue
which isn't visible to userland.  If there are such users, we need a
different solution.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Joseph Glanville <joseph.glanville@orionvm.com.au>
Cc: stable@vger.kernel.org
Acked-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-21 15:32:57 +02:00
Martin K. Petersen
66ba32dc16 block: ioctl to zero block ranges
Introduce a BLKZEROOUT ioctl which can be used to clear block ranges by
way of blkdev_issue_zeroout().

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-20 14:31:53 +02:00
Martin K. Petersen
579e8f3c7b block: Make blkdev_issue_zeroout use WRITE SAME
If the device supports WRITE SAME, use that to optimize zeroing of
blocks. If the device does not support WRITE SAME or if the operation
fails, fall back to writing zeroes the old-fashioned way.

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-20 14:31:49 +02:00
Martin K. Petersen
4363ac7c13 block: Implement support for WRITE SAME
The WRITE SAME command supported on some SCSI devices allows the same
block to be efficiently replicated throughout a block range. Only a
single logical block is transferred from the host and the storage device
writes the same data to all blocks described by the I/O.

This patch implements support for WRITE SAME in the block layer. The
blkdev_issue_write_same() function can be used by filesystems and block
drivers to replicate a buffer across a block range. This can be used to
efficiently initialize software RAID devices, etc.

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-20 14:31:45 +02:00
Martin K. Petersen
f31dc1cd49 block: Consolidate command flag and queue limit checks for merges
- blk_check_merge_flags() verifies that cmd_flags / bi_rw are
   compatible. This function is called for both req-req and req-bio
   merging.

 - blk_rq_get_max_sectors() and blk_queue_get_max_sectors() can be used
   to query the maximum sector count for a given request or queue. The
   calls will return the right value from the queue limits given the
   type of command (RW, discard, write same, etc.)

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-20 14:31:41 +02:00
Martin K. Petersen
e2a60da74f block: Clean up special command handling logic
Remove special-casing of non-rw fs style requests (discard). The nomerge
flags are consolidated in blk_types.h, and rq_mergeable() and
bio_mergeable() have been modified to use them.

bio_is_rw() is used in place of bio_has_data() a few places. This is
done to to distinguish true reads and writes from other fs type requests
that carry a payload (e.g. write same).

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-20 14:31:38 +02:00
Peter Senna Tschudin
d41570b746 block/blk-tag.c: Remove useless kfree
Remove useless kfree() and clean up code related to the removal.

The semantic patch that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@r exists@
position p1,p2;
expression x;
@@

if (x@p1 == NULL) { ... kfree@p2(x); ... return ...; }

@unchanged exists@
position r.p1,r.p2;
expression e <= r.x,x,e1;
iterator I;
statement S;
@@

if (x@p1 == NULL) { ... when != I(x,...) S
                        when != e = e1
                        when != e += e1
                        when != e -= e1
                        when != ++e
                        when != --e
                        when != e++
                        when != e--
                        when != &e
   kfree@p2(x); ... return ...; }

@ok depends on unchanged exists@
position any r.p1;
position r.p2;
expression x;
@@

... when != true x@p1 == NULL
kfree@p2(x);

@depends on !ok && unchanged@
position r.p2;
expression x;
@@

*kfree@p2(x);
// </smpl>

Signed-off-by: Peter Senna Tschudin <peter.senna@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-12 22:25:12 +02:00
Jaehoon Chung
e32463b2f7 block: remove the duplicated setting for congestion_threshold
Before call the blk_queue_congestion_threshold(),
the blk_queue_congestion_threshold() is already called at blk_queue_make_rquest().
Because this code is the duplicated, it has removed.

Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-09 12:44:10 +02:00
Dave Reisner
b1f3b64d76 block: reject invalid queue attribute values
Instead of using simple_strtoul which "converts" invalid numbers to 0,
use strict_strtoul and perform error checking to ensure that userspace
passes us a valid unsigned long. This addresses problems with functions
such as writev, which might want to write a trailing newline -- the
newline should rightfully be rejected, but the value preceeding it
should be preserved.

Fixes BZ#46981.

Signed-off-by: Dave Reisner <dreisner@archlinux.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-09 10:39:18 +02:00
Kent Overstreet
bf800ef181 block: Add bio_clone_bioset(), bio_clone_kmalloc()
Previously, there was bio_clone() but it only allocated from the fs bio
set; as a result various users were open coding it and using
__bio_clone().

This changes bio_clone() to become bio_clone_bioset(), and then we add
bio_clone() and bio_clone_kmalloc() as wrappers around it, making use of
the functionality the last patch adedd.

This will also help in a later patch changing how bio cloning works.

Signed-off-by: Kent Overstreet <koverstreet@google.com>
CC: Jens Axboe <axboe@kernel.dk>
CC: NeilBrown <neilb@suse.de>
CC: Alasdair Kergon <agk@redhat.com>
CC: Boaz Harrosh <bharrosh@panasas.com>
CC: Jeff Garzik <jeff@garzik.org>
Acked-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-09 10:35:39 +02:00
Kent Overstreet
3f86a82aeb block: Consolidate bio_alloc_bioset(), bio_kmalloc()
Previously, bio_kmalloc() and bio_alloc_bioset() behaved slightly
different because there was some almost-duplicated code - this fixes
some of that.

The important change is that previously bio_kmalloc() always set
bi_io_vec = bi_inline_vecs, even if nr_iovecs == 0 - unlike
bio_alloc_bioset(). This would cause bio_has_data() to return true; I
don't know if this resulted in any actual bugs but it was certainly
wrong.

bio_kmalloc() and bio_alloc_bioset() also have different arbitrary
limits on nr_iovecs - 1024 (UIO_MAXIOV) for bio_kmalloc(), 256
(BIO_MAX_PAGES) for bio_alloc_bioset(). This patch doesn't fix that, but
at least they're enforced closer together and hopefully they will be
fixed in a later patch.

This'll also help with some future cleanups - there are a fair number of
functions that allocate bios (e.g. bio_clone()), and now they don't have
to be duplicated for bio_alloc(), bio_alloc_bioset(), and bio_kmalloc().

Signed-off-by: Kent Overstreet <koverstreet@google.com>
CC: Jens Axboe <axboe@kernel.dk>
v7: Re-add dropped comments, improv patch description
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-09 10:35:39 +02:00
Kent Overstreet
4254bba17d block: Kill bi_destructor
Now that we've got generic code for freeing bios allocated from bio
pools, this isn't needed anymore.

This patch also makes bio_free() static, since without bi_destructor
there should be no need for it to be called anywhere else.

bio_free() is now only called from bio_put, so we can refactor those a
bit - move some code from bio_put() to bio_free() and kill the redundant
bio->bi_next = NULL.

v5: Switch to BIO_KMALLOC_POOL ((void *)~0), per Boaz
v6: BIO_KMALLOC_POOL now NULL, drop bio_free's EXPORT_SYMBOL
v7: No #define BIO_KMALLOC_POOL anymore

Signed-off-by: Kent Overstreet <koverstreet@google.com>
CC: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-09 10:35:39 +02:00
Kent Overstreet
ccc5c9ca6a pktcdvd: Switch to bio_kmalloc()
This is prep work for killing bi_destructor - previously, pktcdvd had
its own pkt_bio_alloc which was basically duplication bio_kmalloc(),
necessitating its own bi_destructor implementation.

v5: Un-reorder some functions, to make the patch easier to review

Signed-off-by: Kent Overstreet <koverstreet@google.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-09 10:35:39 +02:00
Kent Overstreet
f44b48c769 block: Add bio_reset()
Reusing bios is something that's been highly frowned upon in the past,
but driver code keeps doing it anyways. If it's going to happen anyways,
we should provide a generic method.

This'll help with getting rid of bi_destructor - drivers/block/pktcdvd.c
was open coding it, by doing a bio_init() and resetting bi_destructor.

This required reordering struct bio, but the block layer is not yet
nearly fast enough for any cacheline effects to matter here.

v5: Add a define BIO_RESET_BITS, to be very explicit about what parts of
bio->bi_flags are saved.
v6: Further commenting verbosity, per Tejun
v9: Add a function comment

Signed-off-by: Kent Overstreet <koverstreet@google.com>
CC: Jens Axboe <axboe@kernel.dk>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-09 10:35:39 +02:00
Kent Overstreet
9481874231 dm: Use bioset's front_pad for dm_rq_clone_bio_info
Previously, dm_rq_clone_bio_info needed to be freed by the bio's
destructor to avoid a memory leak in the blk_rq_prep_clone() error path.
This gets rid of a memory allocation and means we can kill
dm_rq_bio_destructor.

The _rq_bio_info_cache kmem cache is unused now and needs to be deleted,
but due to the way io_pool is used and overloaded this looks not quite
trivial so I'm leaving it for a later patch.

v6: Fix comment on struct dm_rq_clone_bio_info, per Tejun

Signed-off-by: Kent Overstreet <koverstreet@google.com>
CC: Alasdair Kergon <agk@redhat.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-09 10:35:38 +02:00
Kent Overstreet
1e2a410ff7 block: Ues bi_pool for bio_integrity_alloc()
Now that bios keep track of where they were allocated from,
bio_integrity_alloc_bioset() becomes redundant.

Remove bio_integrity_alloc_bioset() and drop bio_set argument from the
related functions and make them use bio->bi_pool.

Signed-off-by: Kent Overstreet <koverstreet@google.com>
CC: Jens Axboe <axboe@kernel.dk>
CC: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-09 10:35:38 +02:00
Kent Overstreet
395c72a707 block: Generalized bio pool freeing
With the old code, when you allocate a bio from a bio pool you have to
implement your own destructor that knows how to find the bio pool the
bio was originally allocated from.

This adds a new field to struct bio (bi_pool) and changes
bio_alloc_bioset() to use it. This makes various bio destructors
unnecessary, so they're then deleted.

v6: Explain the temporary if statement in bio_put

Signed-off-by: Kent Overstreet <koverstreet@google.com>
CC: Jens Axboe <axboe@kernel.dk>
CC: NeilBrown <neilb@suse.de>
CC: Alasdair Kergon <agk@redhat.com>
CC: Nicholas Bellinger <nab@linux-iscsi.org>
CC: Lars Ellenberg <lars.ellenberg@linbit.com>
Acked-by: Tejun Heo <tj@kernel.org>
Acked-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-09-09 10:35:38 +02:00
Linus Torvalds
eeea3ac912 arm-soc: bug fixes for v3.6-rc5
Mostly Renesas and Atmel bugfixes this time, targeting boot and build
 problems. A couple of patches for gemini and kirkwood as well. On a
 whole nothing very controversial.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJQR+5tAAoJEIwa5zzehBx37ucQAIoOkQN6RqzXDkM4o6uhgtrS
 Fqt231762msmrrMpFwH/o0slgtyNIogHZfykoy2H8EXxJC93ZLYyVaqii+D2/H9O
 hRn7F6JGZ2R/h0+bYWAf3skX1ecRikxOF+knPmD4aolsnkddBeP6Rb0KIDgRqwRb
 pJxmlD8M68Dq7oKCMIT3EWP8pzXjJlVeS5Zli/X3XIxE5iTELQltK4St8oZWE2S1
 O2uOj/GuGgERiq39lIbf1YggEQZrZVf0a3a4koVFMCQ/kmT7LE1bzVp2lqsUNKpB
 2KG2GllTac2excjeg8Oyd4apy2mmGQimnIdKf1W3RfpVlnXUySw1XaPbjU1L6IcO
 xgZoLsxLgpeohK1T1mUsKEBtHWPKTBOTqGvquuvf8h7CAqRVPzX0nNmIt+JcfaTN
 lcdflHEks55eZfEad794DjwZdCG6/RXY5wDFeZKOzUTWK2//hlsRVlYHumpiRXIe
 UaVdFB//N2bzZiz+HYVBpd4TgEDhGm6WM3REYhMNVtnie/ubg/CiMW1cLuA3Xouk
 STvZ6EM/G0bwAM3PZOnBWxKlv7jAN0Zwhw0meK7W1Go1FrQsdroVmOMDL7PzPIWI
 kgtDzxLa6VV77EvBVJAPs2JZqdsRTa7r/AZLaBne/VvhikUVOdo2aOROPyn/vJqy
 /8Atzs6hU2BqDYStyK/z
 =hMrY
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC bug fixes from Olof Johansson:
 "Mostly Renesas and Atmel bugfixes this time, targeting boot and build
  problems.  A couple of patches for gemini and kirkwood as well.  On a
  whole nothing very controversial."

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: gemini: fix the gemini build
  ARM: shmobile: armadillo800eva: enable rw rootfs mount
  ARM: Kirkwood: Fix 'SZ_1M' undeclared here for db88f6281-bp-setup.c
  ARM: shmobile: mackerel: fixup usb module order
  ARM: shmobile: armadillo800eva: fixup: sound card detection order
  ARM: shmobile: marzen: fixup smsc911x id for regulator
  ARM: at91/feature-removal-schedule: delay at91_mci removal
  ARM: mach-shmobile: armadillo800eva: Enable power button as wakeup source
  ARM: mach-shmobile: armadillo800eva: Fix GPIO buttons descriptions
  ARM: at91/dts: remove partial parameter in at91sam9g25ek.dts
  ARM: at91/clock: fix PLLA overclock warning
  ARM: at91: fix rtc-at91sam9 irq issue due to sparse irq support
  ARM: at91: fix system timer irq issue due to sparse irq support
  ARM: shmobile: sh73a0: fixup RELOC_BASE of intca_irq_pins_desc
2012-09-06 10:23:58 -07:00
Linus Torvalds
c7c6bf1e8c One patch, fixing DIV_ROUND_CLOSEST to support negative dividends.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.11 (GNU/Linux)
 
 iQIcBAABAgAGBQJQSCWfAAoJEMsfJm/On5mBvicP/0CmzUgasB1MVpBpxZeaLrcf
 buGw5GZpH/Kh7h+4mdfY5egzvn0J9lFt9gWB58lw1xaQhHgihaus/h63K9nDQpyb
 NhsuGDY628st9cJWBFU18KcnSjVKNSEdVOZLtSkqzpbtAiy6zH0pQGfNPCSZaJuo
 XngjHAyIHZaAyORgwudGm9hrTqTGNUdaLPp1NbXO1N7+/Upnm5f237XUWqgboTgK
 4BGVOG6Prjm6ytJqc+eXg/iUACPgdG8Fe8rQMhRm0HjIEdX58+xfjrOZ3IPqxqcX
 F+ri3W615PazVi27wC6Afk9NqssvJagImEzRh7DbbMAeTesh0vAPMb8UihhhX4M6
 BsWU8zE1UVBEHJmi0ZT/Q+5v3heLbBd2kbmyorSBvHZyH+zFaAgvWVSqMCWguKO+
 CBptQnFhFY209Pi3S79tZFe7g5T6xMFddGW+0Wpp7pdT+BgC9EL7UBJGctCzO7Yq
 ipfCtRzZmJO7HnQic9T7XQhQvmCNjZEXHIooFZgZ6uF3GJL0Ipetc3t/uHwZ2C+E
 TwX4eNJH/IxgyRJszjCyKWs6iu7RaRQu7lq4a6ZpROmQJIW64pEF/ZWQ2+QULwnN
 pX2j2mLPltidjUiJ6uAIyzZr8FL97uLSLDkWhc4fZTsDC+2NOLwaK7nPErO1M6Rc
 C9fde4G5GOhkCaGrZX83
 =eZQ4
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull a hwmon fix from Guenter Roeck:
 "One patch, fixing DIV_ROUND_CLOSEST to support negative dividends.

  While the changes are not in the drivers/hwmon directory, the problem
  primarily affects hwmon drivers, and it makes sense to push the patch
  through the hwmon tree."

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  linux/kernel.h: Fix DIV_ROUND_CLOSEST to support negative dividends
2012-09-06 09:39:47 -07:00
Linus Torvalds
bd12ce8cc2 Merge branch 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild
Pull kbuild fixes from Michal Marek:
 "These are two fixes that should go into 3.6.  The link-vmlinux.sh one
  is obvious.

  The other one fixes make firmware_install with certain configurations,
  where a file in the toplevel firmware tree gets installed first, and
  $(INSTALL_FW_PATH)/$$(dir <file>) results in /lib/firmware/./, which
  confuses make 3.82 for some reason."

* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  firmware: fix directory creation rule matching with make 3.82
  link-vmlinux.sh: Fix stray "echo" in error message
2012-09-06 09:38:25 -07:00
Dave Jones
80de7c3138 Remove user-triggerable BUG from mpol_to_str
Trivially triggerable, found by trinity:

  kernel BUG at mm/mempolicy.c:2546!
  Process trinity-child2 (pid: 23988, threadinfo ffff88010197e000, task ffff88007821a670)
  Call Trace:
    show_numa_map+0xd5/0x450
    show_pid_numa_map+0x13/0x20
    traverse+0xf2/0x230
    seq_read+0x34b/0x3e0
    vfs_read+0xac/0x180
    sys_pread64+0xa2/0xc0
    system_call_fastpath+0x1a/0x1f
  RIP: mpol_to_str+0x156/0x360

Cc: stable@vger.kernel.org
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-09-06 09:37:58 -07:00
Linus Torvalds
0809095036 MMC fixes for 3.6-rc5:
- a firmware bug on several Samsung MoviNAND eMMC models causes
    permanent corruption on the device when secure erase and secure trim
    requests are made, so we disable those requests on these eMMC devices.
  - atmel-mci: fix a hang with some SD cards by waiting for not-busy flag.
  - dw_mmc: low-power mode breaks SDIO interrupts; fix PIO error handling;
    fix handling of error interrupts.
  - mxs-mmc: fix deadlocks; fix compile error due to dma.h arch change.
  - omap: fix broken PIO mode causing memory corruption.
  - sdhci-esdhc: fix card detection.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJQR/7BAAoJEHNBYZ7TNxYMT3gQANQDdD/wvYFgUvssIAgdQJdl
 KORu7ke5ks2Gvx0Ef0Ch+GXIFFDoqH0zMkQMXc+c0BdhR4BF/vNBbBYZoVYyvmgK
 GUHK740nznwp9edIVbGbRm+FSxDG7ZpjUlFq+SInBOehIw7tQAep3Tbv1rYZzu6M
 SUBGc31Nif9eCvTKzGU195qbutAhvcGmqEvi/ALP9bUCYR7QaTt/oD3YYuUD/ZjV
 O/mf3R30vrV+R1lrQRqzXIi8vCojPMzkVU8x+C8PdOTjewvYviM0huW9+Lv6WsxK
 DzhCgoNvrB1Q/rYtiNZ1gyWd5cTZWns308slREEwywD5IBQJMo5T68Q/D+h2PkS9
 JCvtiZ+ryycvINyUn2JxEZuygseUiT/nMS0ijSidQY7vrZlNR8JrrK3qf0vRDkWo
 0mXhQG5DvxDN6Dx9K15OgTAuABek1CEdKFD0R/a3X41H/KUvKQwWPWmdTybBriAo
 8jkUl64YMpFt+LZqrmeQ1oOcwc8BvMvcM4dnMbkXrHvBb926fENBIMGNeI7O10o8
 597dEpLlKNZj8e8YxJjbqaCuFhOp/pHRQy+rxdjP28V4mfHASQGgsnFAO4qV7B24
 1wqtSu5ZCor4K616wfDvMYgL88pMg7fVEV3nN9Cc/WpsBaBPZv7vOQbp/f40rKWa
 GRb9+9NC0WU0CP28GlCq
 =n1hi
 -----END PGP SIGNATURE-----

Merge tag 'mmc-fixes-for-3.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc

Pull MMC fixes from Chris Ball:
 - a firmware bug on several Samsung MoviNAND eMMC models causes
   permanent corruption on the device when secure erase and secure trim
   requests are made, so we disable those requests on these eMMC devices.
 - atmel-mci: fix a hang with some SD cards by waiting for not-busy flag.
 - dw_mmc: low-power mode breaks SDIO interrupts; fix PIO error handling;
   fix handling of error interrupts.
 - mxs-mmc: fix deadlocks; fix compile error due to dma.h arch change.
 - omap: fix broken PIO mode causing memory corruption.
 - sdhci-esdhc: fix card detection.

* tag 'mmc-fixes-for-3.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc:
  mmc: omap: fix broken PIO mode
  mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption.
  mmc: dw_mmc: Disable low power mode if SDIO interrupts are used
  mmc: dw_mmc: fix error handling in PIO mode
  mmc: dw_mmc: correct mishandling error interrupt
  mmc: dw_mmc: amend using error interrupt status
  mmc: atmel-mci: not busy flag has also to be used for read operations
  mmc: sdhci-esdhc: break out early if clock is 0
  mmc: mxs-mmc: fix deadlock caused by recursion loop
  mmc: mxs-mmc: fix deadlock in SDIO IRQ case
  mmc: bfin_sdh: fix dma_desc_array build error
2012-09-05 19:41:58 -07:00
Miklos Szeredi
bc6c83641e uml: fix compile error in deliver_alarm()
Fix the following compile error on UML.

  arch/um/os-Linux/time.c: In function 'deliver_alarm':
  arch/um/os-Linux/time.c:117:3: error: too few arguments to function 'alarm_handler'
  arch/um/os-Linux/internal.h:1:6: note: declared here

The error was introduced by commit d3c1cfcd ("um: pass siginfo to guest
process") in 3.6-rc1.

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: Martin Pärtel <martin.partel@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-09-05 19:40:59 -07:00
Alan Cox
8a55ade765 dj: memory scribble in logi_dj
Allocate a structure not a pointer to it !

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-09-05 19:37:08 -07:00
Linus Torvalds
cb4f9a2964 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
Pull powerpc fixes from Benjamin Herrenschmidt:
 "Here are a few fixes for 3.6 that were piling up while I was away or
  busy (I was mostly MIA a week or two before San Diego).

  Some fixes from Anton fixing up issues with our relatively new DSCR
  control feature, and a few other fixes that are either regressions or
  bugs nasty enough to warrant not waiting."

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc: Don't use __put_user() in patch_instruction
  powerpc: Make sure IPI handlers see data written by IPI senders
  powerpc: Restore correct DSCR in context switch
  powerpc: Fix DSCR inheritance in copy_thread()
  powerpc: Keep thread.dscr and thread.dscr_inherit in sync
  powerpc: Update DSCR on all CPUs when writing sysfs dscr_default
  powerpc/powernv: Always go into nap mode when CPU is offline
  powerpc: Give hypervisor decrementer interrupts their own handler
  powerpc/vphn: Fix arch_update_cpu_topology() return value
2012-09-05 18:41:32 -07:00
Linus Torvalds
813e64382a These are some GPIO regression fixes for v3.6:
- Erroneous debug message from of_get_named_gpio_flags()
 - Make sure the MC9S08DZ60 GPIO driver depend on I2C being
   compiled in (not module) or allmodconfig breaks.
 - Check return value from irq_alloc_descs() in the Emma
   Mobile GPIO driver.
 - Assign the owner field for the rdc321x driver so the
   module won't be removed if it has active GPIOs.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJQRuO5AAoJEEEQszewGV1zxw0QAMvCidLRwqdoHfWOIPx3YI7x
 lp44BteGZagQrELvVo/16+P5/eRumOo4Pyd/KFIZjmwhKAtHjbl0j01fAijTy0XN
 bAYPHoIhekwXr1PPVRFCcqqQFxa8JkY6lPVx3fRoCAiyBeoj3RXTElaE6NmqE81I
 ZGSAul2WOKzHjSn2aKGc5ciwiC5sbsI/KxxnZZxv4Mrqz32l71dn8AmqazTXVSBA
 Mr7hrr8N2sO1O5SIMcdH1VjLsN73XPDuwSKHJw55uAA4TqxZ5Z0T1HYERxh97Nql
 p//x4wMDV5orBIkQQROFu2FjxHiPDcnEp8bFq5oU/QnC9jJSH3qiTvJhK3OkdN4r
 W+hhs26iD31fJG/nK3NVWd0JIe8dJm6gh/dDo6sQXQKnaUospZayoz5M8DkFiyo8
 Ba6nrSAssIdwoY+cYwo4q+VN63qAEKFC/PolehKayUoB0RWdV178DX6v4Dl9TwHs
 UeGIGzR2ymiAZJsMBZYP/simRgdljNgcr7EuhAecpI9CYnV7fsuOBEQydcmOsIHq
 t2YTtzRkX/RUiKcFieXOoGv0ixnrYam4VLGBHQuDRikvyyS6mlh6KDrnWlrko4al
 atObhaEgOJ+NUz1izIZvg8J4t/AMybNYRdZl8xW9s3YgUFne1wBCdmxxL9Cyax/3
 jHL99DkmoYVISU0uOyPG
 =QDOR
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio

Pull GPIO fixes from Linus Walleij:
 "These are some GPIO regression fixes for v3.6:
   - Erroneous debug message from of_get_named_gpio_flags()
   - Make sure the MC9S08DZ60 GPIO driver depend on I2C being compiled
     in (not module) or allmodconfig breaks.
   - Check return value from irq_alloc_descs() in the Emma Mobile GPIO
     driver.
   - Assign the owner field for the rdc321x driver so the module won't
     be removed if it has active GPIOs."

* tag 'gpio-fixes-for-v3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  gpio: rdc321x: Prevent removal of modules exporting active GPIOs
  gpio: em: Fix checking return value of irq_alloc_descs
  gpio: mc9s08dz60: Fix build error if I2C=m
  gpio: Fix debug message in of_get_named_gpio_flags()
2012-09-05 18:40:12 -07:00
Linus Torvalds
5e682c0e54 Sound fixes for 3.6-rc5
There are nothing scaring, contains only small fixes for HD-audio and
 USB-audio:
 - EPSS regression fix and GPIO fix for HD-audio IDT codecs
 - A series of USB-audio regression fixes that are found since 3.5 kernel
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.19 (GNU/Linux)
 
 iQIcBAABAgAGBQJQRZeCAAoJEGwxgFQ9KSmkPikP/2ZpK3xvf1WnEJT+K+2ErsI+
 KEChW70QNRcghvbOa0viUx6v3B8tkPhDuo6YgTIjiP+yde0BjVujSXYAOvznvHxy
 ea8xX7hR0j0G9y0FVb0oYlj+CIZWupChz9V2uSB7EudMvYPUBUzkkDtrpsb4+t3z
 0e/4VEEkWIVhVyuPEnaL8fdzYPLs7UA6/QotC/SLxnFSmbaGvUuryssEmb99vl0h
 xQHr8FuIF12DTS1ZwdCYcL9VTFriXcYeIWf+ThaoY3evSeStCUuboHf69RUy1WR9
 JAn0hArI358m/Xicmr6pG6y0VqIPqfFLgsjXgt8/Fe0ljTcYbXoWL09MXVSL40wA
 2jFWAizPe8/OAASHpgzWNb/8WWDFL/XWoeefSwL1lOIArlZhe07b61bA69s2GG0k
 /rwZn058ZgQCgqC5Dph7RD7squ0ANg6WIq8obdJevLgekw/MCkKUPNA6N2lXjboT
 KaKEouLUff72A2WKiE7W6ykNATWjqteDe7+11HhDC543lAKBnq/Zyv8zjsqhzPuU
 TnxA0W1pcfc4GLRBaedIH2AeEzQc/aT0RE79sGGzPSB4SG0MLTRWT3yUXMiVTeWB
 vBb4ZuEvGeo6i81QovIN/y1m/kEljaSu7uSi0Kzopq663HsUEvJ1BvLAviZsJZ01
 pSNAne3Ze7kWQwyWkVDQ
 =AbfN
 -----END PGP SIGNATURE-----

Merge tag 'sound-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "There are nothing scaring, contains only small fixes for HD-audio and
  USB-audio:
   - EPSS regression fix and GPIO fix for HD-audio IDT codecs
   - A series of USB-audio regression fixes that are found since 3.5
     kernel"

* tag 'sound-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: snd-usb: fix cross-interface streaming devices
  ALSA: snd-usb: fix calls to next_packet_size
  ALSA: snd-usb: restore delay information
  ALSA: snd-usb: use list_for_each_safe for endpoint resources
  ALSA: snd-usb: Fix URB cancellation at stream start
  ALSA: hda - Don't trust codec EPSS bit for IDT 92HD83xx & co
  ALSA: hda - Avoid unnecessary parameter read for EPSS
  ALSA: hda - Do not set GPIOs for speakers on IDT if there are no speakers
2012-09-05 18:38:52 -07:00
Linus Torvalds
6d1a05033b fbdev fixes for 3.6
- a fix by Paul Cercueil to prevent a possible buffer overflow
 - a fix by Bruno Prémont to prevent a rare sleep in invalid context
 - a fix by Julia Lawall for a double free in auo_k190x
 - a fix by Dan Carpenter to prevent a division by zero in mb862xxfb
 - a regression fix by Tomi Valkeinen for the SDI output in OMAP
 - a fix by Grazvydas Ignotas to fix the console colors in OMAP
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJQRdW3AAoJECSVL5KnPj1PKpcQAJn9tS3BeTi9zcV5sk31U1Jy
 kc72y318bg5jpJPDgWOfM+9CY3yhezVi2q9odiTUtuhx5WzWbOJh7/TuUGoWGKaY
 dUvTqen83hFGKfTs+eujTbAgAH3+PGIGo5VmTyx1TVj5Vnb1m3wsU6jwDzalfox8
 MChhoOyrCpn6wxiqSuF6eoqZ01jASsNDW1rQaxi6AdaKKxJXrG22phMpwmfZz9Mt
 naIx1aI8aowkZ5gEBlOsnX6O0kjPVyQWlXqljGuZxRJZD+x9MKj/8nU1PITi0Pz2
 DNAQz3ZU/apAooLCFsBF7oGtMUJ6e/v61LdIcMZZzw569tCtnmidwdU0ss2JJhAP
 aDhdtWESbxFbpggOEWD36Wq6Z5ekCW5xfTR+ZASiknSMAT6rmqfX4NPJ3750jjVb
 Aa9Ds37KQgfUrQIEhKCoZPyPTtCK98fQUHhxlf2I0TbuCGBvbZEAnRpuc1eelNo9
 G9IJKG1vnea2x+DmsR1OEqFpHU3fn82T7RYm3SYc6ZDJwU58GxEvTzytGBs5YxLe
 bTTM2mTT3m23l8BBp6UPZjESJoBv2bd+cY70MCxhVIKHXbQYdzet0DDEDA6t2UQK
 isIOLXMGqxTXNZq7bM+q9UuYUuAkTUv1VmwGy5YJOD1JtOhFGQtxBe59OMmrC1H5
 aU+GP6btV/biv8cTs/JG
 =8eFG
 -----END PGP SIGNATURE-----

Merge tag 'fbdev-fixes-for-3.6-1' of git://github.com/schandinat/linux-2.6

Pull fbdev fixes from Florian Tobias Schandinat:
 - a fix by Paul Cercueil to prevent a possible buffer overflow
 - a fix by Bruno Prémont to prevent a rare sleep in invalid context
 - a fix by Julia Lawall for a double free in auo_k190x
 - a fix by Dan Carpenter to prevent a division by zero in mb862xxfb
 - a regression fix by Tomi Valkeinen for the SDI output in OMAP
 - a fix by Grazvydas Ignotas to fix the console colors in OMAP

* tag 'fbdev-fixes-for-3.6-1' of git://github.com/schandinat/linux-2.6:
  OMAPFB: fix framebuffer console colors
  OMAPDSS: Fix SDI PLL locking
  video: mb862xxfb: prevent divide by zero bug
  drivers/video/auo_k190x.c: drop kfree of devm_kzalloc's data
  fbcon: Fix bit_putcs() call to kmalloc(s, GFP_KERNEL)
  fbcon: prevent possible buffer overflow.
2012-09-05 18:38:02 -07:00
Linus Torvalds
50234c58d3 A single small fix for memory deallocation: we allocated memory using
'kmem_cache_alloc()' but were freeing it using 'kfree()' in some cases.
 Now we fix this by using 'kmem_cache_free()' instead.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJQRaL3AAoJECmIfjd9wqK01AMP+wazg4SPSPoyj8HJFOHy/ZWu
 Y18TNMtiSQDL2i9cH34rj6sxdNZYy+tHYt64VGQ+jBDTXIOJyZ9HhmPVcAuK5/CJ
 ol7YzFRsKCF7dLps3MmUejgf15nnTVgQAMzXTbJ5Cv9FB+pex87XaObOK8phUk4r
 k0o5ORwViZRXm9KPqIv65iviAw6fnzJDVaFy8WGGk3WX+gBUZq+pz78gB96N2LKE
 rHjD2SyzAIam9Mv8kcJRvJ4TjWAJrPMxAAF9uGzxx/D9UbpiArmu233qCeGTXO+p
 3v94lyLcWPsMA+ugwT3taHH0HgpXM1DFQb6ln/SRtMwiITi5mFY+O1MORQlb8llB
 gyOUKKHeTBhD8myoStZH3lwN0lelyhcKO/s9WRZ6pPaV9992UVau+dWBTNCswckw
 N+qKQHJNQEw47OaqOhYKY7lIjxRQIVZZTffJuTJWz3Ck+d63b2U46pke91G7pqrI
 YiJ8MukunurXyK4ItwJ1XKvpjgrayABGhHAR8tzFQAlIy7a74T9J1qKlXSfIoB0T
 L0DA30Txwb5wbfjX6unoGsVLv8Uo7oh5JltZJ2GCrL3eNS4iIW6nitGX5juWZFBl
 GcarWW6lIeg9qYlz1jG5+Iqckb+IGCJqBrHrFNP9E6jpigw3K6pVxch81N3tBBld
 2aq3PcZ0e0TAGokunElP
 =Bin1
 -----END PGP SIGNATURE-----

Merge tag 'upstream-3.6-rc5' of git://git.infradead.org/linux-ubi

Pull ubi fix from Artem Bityutskiy:
 "A single small fix for memory deallocation: we allocated memory using
  'kmem_cache_alloc()' but were freeing it using 'kfree()' in some
  cases.  Now we fix this by using 'kmem_cache_free()' instead."

* tag 'upstream-3.6-rc5' of git://git.infradead.org/linux-ubi:
  UBI: fix a horrible memory deallocation bug
2012-09-05 18:37:16 -07:00
Mikulas Patocka
ed6fe9d614 Fix order of arguments to compat_put_time[spec|val]
Commit 644595f896 ("compat: Handle COMPAT_USE_64BIT_TIME in
net/socket.c") introduced a bug where the helper functions to take
either a 64-bit or compat time[spec|val] got the arguments in the wrong
order, passing the kernel stack pointer off as a user pointer (and vice
versa).

Because of the user address range check, that in turn then causes an
EFAULT due to the user pointer range checking failing for the kernel
address.  Incorrectly resuling in a failed system call for 32-bit
processes with a 64-bit kernel.

On odder architectures like HP-PA (with separate user/kernel address
spaces), it can be used read kernel memory.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-09-05 18:34:13 -07:00
Benjamin Herrenschmidt
636802ef96 powerpc: Don't use __put_user() in patch_instruction
patch_instruction() can be called very early on ppc32, when the kernel
isn't yet running at it's linked address. That can cause the !
is_kernel_addr() test in __put_user() to trip and call might_sleep()
which is very bad at that point during boot.

Use a lower level function instead for now, at least until we get to
rework ppc32 boot process to do the code patching later, like ppc64
does.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-09-05 16:05:23 +10:00