summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-03-21USB: quatech2: fix use-after-free in TIOCMIWAITJohan Hovold
Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: pl2303: fix use-after-free in TIOCMIWAITJohan Hovold
Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: oti6858: fix use-after-free in TIOCMIWAITJohan Hovold
Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: mos7840: fix use-after-free in TIOCMIWAITJohan Hovold
Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: mos7840: fix broken TIOCMIWAITJohan Hovold
Make sure waiting processes are woken on modem-status changes. Currently processes are only woken on termios changes regardless of whether the modem status has changed. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: mct_u232: fix use-after-free in TIOCMIWAITJohan Hovold
Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: io_ti: fix use-after-free in TIOCMIWAITJohan Hovold
Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: io_edgeport: fix use-after-free in TIOCMIWAITJohan Hovold
Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: ftdi_sio: fix use-after-free in TIOCMIWAITJohan Hovold
Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. When switching to tty ports, some lifetime assumptions were changed. Specifically, close can now be called before the final tty reference is dropped as part of hangup at device disconnect. Even with the ftdi private-data refcounting this means that the port private data can be freed while a process is sleeping on modem-status changes and thus cannot be relied on to detect disconnects when woken up. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: f81232: fix use-after-free in TIOCMIWAITJohan Hovold
Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: cypress_m8: fix use-after-free in TIOCMIWAITJohan Hovold
Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Also remove bogus test for private data pointer being NULL as it is never assigned in the loop. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: ch341: fix use-after-free in TIOCMIWAITJohan Hovold
Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: ark3116: fix use-after-free in TIOCMIWAITJohan Hovold
Use the port wait queue and make sure to check the serial disconnected flag before accessing private port data after waking up. This is is needed as the private port data (including the wait queue itself) can be gone when waking up after a disconnect. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: serial: add modem-status-change wait queueJohan Hovold
Add modem-status-change wait queue to struct usb_serial_port that subdrivers can use to implement TIOCMIWAIT. Currently subdrivers use a private wait queue which may have been released when waking up after device disconnected. Note that we're adding a new wait queue rather than reusing the tty-port one as we do not want to get woken up at hangup (yet). Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: serial: fix interface refcountingJohan Hovold
Make sure the interface is not released before our serial device. Note that drivers are still not allowed to access the interface in any way that may interfere with another driver that may have gotten bound to the same interface after disconnect returns. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: io_ti: fix get_icount for two port adaptersJohan Hovold
Add missing get_icount field to two-port driver. The two-port driver was not updated when switching to the new icount interface in commit 0bca1b913aff ("tty: Convert the USB drivers to the new icount interface"). Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: garmin_gps: fix memory leak on disconnectJohan Hovold
Remove bogus disconnect test introduced by 95bef012e ("USB: more serial drivers writing after disconnect") which prevented queued data from being freed on disconnect. The possible IO it was supposed to prevent is long gone. Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21USB: cdc-acm: fix device unregistrationJohan Hovold
Unregister tty device in disconnect as is required by the USB stack. By deferring unregistration to when the last tty reference is dropped, the parent interface device can get unregistered before the child resulting in broken hotplug events being generated when the tty is finally closed: KERNEL[2290.798128] remove /devices/pci0000:00/0000:00:1d.7/usb2/2-1/2-1:3.1 (usb) KERNEL[2290.804589] remove /devices/pci0000:00/0000:00:1d.7/usb2/2-1 (usb) KERNEL[2294.554799] remove /2-1:3.1/tty/ttyACM0 (tty) The driver must deal with tty callbacks after disconnect by checking the disconnected flag. Specifically, further opens must be prevented and this is already implemented. Cc: stable <stable@vger.kernel.org> Cc: Oliver Neukum <oneukum@suse.de> Acked-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21usb: cdc-acm: fix error handling in acm_probe()Alexey Khoroshilov
acm_probe() ignores errors in tty_port_register_device() and leaves intfdata pointing to freed memory on alloc_fail7 error path. The patch fixes the both issues. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Acked-by: Oliver Neukum <oliver@neukum.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-03-21[media] m5mols: Fix bug in stream on handlerAndrzej Hajda
Due to improper condition check streaming start for some pixel formats was prevent and the s_stream just reatuned -EINVAL. This fixes regression introduced in commit 5565a2ad47cdd8e697 [media] m5mols: Protect driver data with a mutex. Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21[media] s5p-fimc: Do not attempt to disable not enabled media pipelineSylwester Nawrocki
This fixes following warnings when all links are being disconnected: [ 20.080000] WARNING: at drivers/media/platform/s5p-fimc/fimc-mdevice.c:1269 __fimc_md_set_camclk+0x208/0x20c() [ 20.090000] Modules linked in: [ 20.095000] [<c001603c>] (unwind_backtrace+0x0/0x13c) from [<c00246dc>] (warn_slowpath_common+0x54/0x64) [ 20.105000] [<c00246dc>] (warn_slowpath_common+0x54/0x64) from [<c0024708>] (warn_slowpath_null+0x1c/0x24) [ 20.115000] [<c0024708>] (warn_slowpath_null+0x1c/0x24) from [<c0323fe8>] (__fimc_md_set_camclk+0x208/0x20c) [ 20.125000] [<c0323fe8>] (__fimc_md_set_camclk+0x208/0x20c) from [<c0324368>] (__fimc_pipeline_close+0x38/0x48) [ 20.135000] [<c0324368>] (__fimc_pipeline_close+0x38/0x48) from [<c0325848>] (fimc_md_link_notify+0x10c/0x198) [ 20.145000] [<c0325848>] (fimc_md_link_notify+0x10c/0x198) from [<c02f9dd4>] (__media_entity_setup_link+0x1c0/0x1e8) [ 20.155000] [<c02f9dd4>] (__media_entity_setup_link+0x1c0/0x1e8) from [<c02f9710>] (media_device_ioctl+0x2c0/0x41c) [ 20.165000] [<c02f9710>] (media_device_ioctl+0x2c0/0x41c) from [<c02f9938>] (media_ioctl+0x30/0x34) [ 20.175000] [<c02f9938>] (media_ioctl+0x30/0x34) from [<c00cf0bc>] (do_vfs_ioctl+0x84/0x5e8) [ 20.185000] [<c00cf0bc>] (do_vfs_ioctl+0x84/0x5e8) from [<c00cf65c>] (sys_ioctl+0x3c/0x60) [ 20.190000] [<c00cf65c>] (sys_ioctl+0x3c/0x60) from [<c000f040>] (ret_fast_syscall+0x0/0x30) Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21[media] s5p-mfc: Fix encoder control 15 issueArun Kumar K
mfc-encoder is not working in the latest kernel giving the erorr "Adding control (15) failed". Adding the missing step parameter in this control to fix the issue. Signed-off-by: Arun Kumar K <arun.kk@samsung.com> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21[media] s5p-mfc: Fix frame skip bugArun Kumar K
The issue was seen in VP8 decoding where the last frame was skipped by the driver. This patch gets the correct frame_type value to fix this bug. Signed-off-by: Arun Kumar K <arun.kk@samsung.com> Signed-off-by: Arun Mankuzhi <arun.m@samsung.com> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21[media] s5p-fimc: send valid m2m ctx to fimc_m2m_job_finishShaik Ameer Basha
fimc_m2m_job_finish() has to be called with the m2m context for the necessary cleanup while resume. But currently fimc_m2m_job_finish() always passes m2m context as NULL. This patch preserves the context before making it null, for necessary cleanup. Signed-off-by: Shaik Ameer Basha <shaik.ameer@samsung.com> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21[media] exynos-gsc: send valid m2m ctx to gsc_m2m_job_finishShaik Ameer Basha
gsc_m2m_job_finish() has to be called with the m2m context for the necessary cleanup while resume. But currently gsc_m2m_job_finish() always passes m2m context as NULL. This patch preserves the context before making it null, for necessary cleanup. Use gsc_m2m_opened() instead gsc_m2m_active() in gsc_resume(). Signed-off-by: Shaik Ameer Basha <shaik.ameer@samsung.com> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21[media] fimc-lite: Fix the variable type to avoid possible crashShaik Ameer Basha
Changing the variable type to 'int' from 'unsigned int'. Driver logic expects the variable type to be 'int'. Signed-off-by: Shaik Ameer Basha <shaik.ameer@samsung.com> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21[media] fimc-lite: Initialize 'step' field in fimc_lite_ctrl structureShaik Ameer Basha
v4l2_ctrl_new() uses check_range() for control range checking. This function expects 'step' value for V4L2_CTRL_TYPE_BOOLEAN type control. If 'step' value doesn't match to '1', it returns -ERANGE error. This patch adds the default .step value to 1. Signed-off-by: Shaik Ameer Basha <shaik.ameer@samsung.com> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2013-03-21pinmux: forbid mux_usecount to be set at UINT_MAXRichard Genoud
If pin_free is called on a pin already freed, mux_usecount is set to UINT_MAX which is really a bad idea. This will issue a warning, so that we can correct the code responsible for the double free. Signed-off-by: Richard Genoud <richard.genoud@gmail.com> Reviewed-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2013-03-21pinctrl: mvebu: fix checking for SoC specific controlsSimon Guinot
This patch fixes a minor bug (probably due to a typo) while checking the SoC specific controls in mvebu_pinctrl_probe(). Acked-by: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com> Signed-off-by: Simon Guinot <simon.guinot@sequanux.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2013-03-21cifs: ignore everything in SPNEGO blob after mechTypesJeff Layton
We've had several reports of people attempting to mount Windows 8 shares and getting failures with a return code of -EINVAL. The default sec= mode changed recently to sec=ntlmssp. With that, we expect and parse a SPNEGO blob from the server in the NEGOTIATE reply. The current decode_negTokenInit function first parses all of the mechTypes and then tries to parse the rest of the negTokenInit reply. The parser however currently expects a mechListMIC or nothing to follow the mechTypes, but Windows 8 puts a mechToken field there instead to carry some info for the new NegoEx stuff. In practice, we don't do anything with the fields after the mechTypes anyway so I don't see any real benefit in continuing to parse them. This patch just has the kernel ignore the fields after the mechTypes. We'll probably need to reinstate some of this if we ever want to support NegoEx. Reported-by: Jason Burgess <jason@jacknife2.dns2go.com> Reported-by: Yan Li <elliot.li.tech@gmail.com> Signed-off-by: Jeff Layton <jlayton@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Steve French <sfrench@us.ibm.com>
2013-03-21Don't bother with redoing rw_verify_area() from default_file_splice_from()Al Viro
default_file_splice_from() ends up calling vfs_write() (via very convoluted callchain). It's an overkill, since we already have done rw_verify_area() in the caller by the time we call vfs_write() we are under set_fs(KERNEL_DS), so access_ok() is also pointless. Add a new helper (__kernel_write()), use it instead of kernel_write() in there. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-03-21Merge tag 'imx-fixes-3.9-3' of ↵Arnd Bergmann
git://git.linaro.org/people/shawnguo/linux-2.6 into fixes From Shawn Guo <shawn.guo@linaro.org>: The imx fixes for 3.9, take 3: - Add the lost dependency check for DEBUG_IMX_UART_PORT back * tag 'imx-fixes-3.9-3' of git://git.linaro.org/people/shawnguo/linux-2.6: ARM: imx: add dependency check for DEBUG_IMX_UART_PORT Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-03-21Merge tag 'mxs-fixes-3.9-3' of ↵Arnd Bergmann
git://git.linaro.org/people/shawnguo/linux-2.6 into fixes From Shawn Guo <shawn.guo@linaro.org>: The mxs fixes for 3.9, take 3: - Fix the shifted framebuffer with X11 system * tag 'mxs-fixes-3.9-3' of git://git.linaro.org/people/shawnguo/linux-2.6: ARM: video: mxs: Fix mxsfb misconfiguring VDCTRL0 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2013-03-21net: fix *_DIAG_MAX constantsAndrey Vagin
Follow the common pattern and define *_DIAG_MAX like: [...] __XXX_DIAG_MAX, }; Because everyone is used to do: struct nlattr *attrs[XXX_DIAG_MAX+1]; nla_parse([...], XXX_DIAG_MAX, [...] Reported-by: Thomas Graf <tgraf@suug.ch> Cc: "David S. Miller" <davem@davemloft.net> Cc: Pavel Emelyanov <xemul@parallels.com> Cc: Eric Dumazet <edumazet@google.com> Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com> Cc: David Howells <dhowells@redhat.com> Signed-off-by: Andrey Vagin <avagin@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-21ALSA: hda - Fix DAC assignment for independent HPTakashi Iwai
The generic parser should evaluate the availability of the independent HP when specified. Otherwise a DAC without the direct connection to the corresponding pin may be assigned for the HP, but the driver doesn't check it at all. The problem was actually seen on some machines with VT1708s or equivalent codec, where DAC0 is assigned to HP although it can be connected only via aamix. This patch adds the badness evaluation for the independent HP to make it working properly. Reported-by: Lydia Wang <LydiaWang@viatech.com.cn> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-03-21Merge branch 'mlx4'David S. Miller
Or Gerlitz says: ==================== Here's a batch of mlx4 driver fixes for 3.9, mostly SRIOV/Flow-steering related. Series done against the net tree as of commit 5a3da1f "inet: limit length of fragment queue hash table bucket lists ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-21net/mlx4_core: Disallow releasing VF QPs which have steering rulesHadar Hen Zion
VF QPs must not be released when they have steering rules attached to them. For that end, introduce a reference count field to the QP object in the SRIOV resource tracker which is incremented/decremented when steering rules are attached/detached to it. QPs can be released by VF only when their ref count is zero. Signed-off-by: Hadar Hen Zion <hadarh@mellanox.com> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-21net/mlx4_core: Always use 64 bit resource ID when doing lookupHadar Hen Zion
One of the resource tracker code paths was wrongly using int and not u64 for resource tracking IDs, fix it. Signed-off-by: Hadar Hen Zion <hadarh@mellanox.com> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-21net/mlx4_en: Remove ethtool flow steering rules before releasing QPsHadar Hen Zion
Fix the ethtool flow steering rules cleanup to be carried out before releasing the RX QPs. Signed-off-by: Hadar Hen Zion <hadarh@mellanox.com> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-21net/mlx4_core: Fix wrong order of flow steering resources removalHadar Hen Zion
On the resource tracker cleanup flow, the DMFS rules must be deleted before we destroy the QPs, else the HW may attempt doing packet steering to non existent QPs. Signed-off-by: Hadar Hen Zion <hadarh@mellanox.com> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-21net/mlx4_core: Fix wrong mask applied on EQ numbers in the wrapperMoshe Lazer
Currently the mask is wrongly set in the MAP_EQ wrapper, fix that. Without the fix any EQ number above 511 is mapped to one below 511. Signed-off-by: Moshe Lazer <moshel@mellanox.com> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-21net: ethernet: cpsw: fix erroneous condition in error checkLothar Waßmann
The error check in cpsw_probe_dt() has an '&&' where an '||' is meant to be. This causes a NULL pointer dereference when incomplet DT data is passed to the driver ('phy_id' property for cpsw_emac1 missing). Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-21lantiq_etop: use free_netdev(netdev) instead of kfree()Wei Yongjun
Freeing netdev without free_netdev() leads to net, tx leaks. And it may lead to dereferencing freed pointer. Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn> Signed-off-by: David S. Miller <davem@davemloft.net>
2013-03-21Merge tag 'fixes-for-v3.9-rc4' of ↵Greg Kroah-Hartman
git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: usb: fixes for v3.9-rc4 udc-core learned that it shouldn't use invalid pointers when unloading a gadget driver. net2272 and net2280 got a fix for a regression caused by the udc_start/udc_stop conversion. We're defining a static inline no-op for otg_ulpi_create() to prevent build errors when that driver isn't enabled. FunctionFS got a fix for an off-by-one error when binding and unbinding instances of FunctionFS. MUSB learned that it shouldn't try to unmap buffers which weren't previously mapped. f_rndis got a fix for a possible NULL pointer dereference in a debugging message code. MUSB's DA8xx glue layer got a build fix due to a typo.
2013-03-21Merge branch 'next' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux Pull thermal management fixes from Zhang Rui. * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux: thermal: exynos_thermal: return a proper error code while thermal_zone_device_register fail. thermal: rcar_thermal: propagate return value of thermal_zone_device_register Thermal: kirkwood: Convert to devm_ioremap_resource() Thermal: rcar: Convert to devm_ioremap_resource() Thermal: dove: Convert to devm_ioremap_resource() thermal: rcar: fix missing unlock on error in rcar_thermal_update_temp()
2013-03-21Merge branch 'perf-urgent-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "A fair chunk of the linecount comes from a fix for a tracing bug that corrupts latency tracing buffers when the overwrite mode is changed on the fly - the rest is mostly assorted fewliner fixlets." * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86: Add SNB/SNB-EP scheduling constraints for cycle_activity event kprobes/x86: Check Interrupt Flag modifier when registering probe kprobes: Make hash_64() as always inlined perf: Generate EXIT event only once per task context perf: Reset hwc->last_period on sw clock events tracing: Prevent buffer overwrite disabled for latency tracers tracing: Keep overwrite in sync between regular and snapshot buffers tracing: Protect tracer flags with trace_types_lock perf tools: Fix LIBNUMA build with glibc 2.12 and older. tracing: Fix free of probe entry by calling call_rcu_sched() perf/POWER7: Create a sysfs format entry for Power7 events perf probe: Fix segfault libtraceevent: Remove hard coded include to /usr/local/include in Makefile perf record: Fix -C option perf tools: check if -DFORTIFY_SOURCE=2 is allowed perf report: Fix build with NO_NEWT=1 perf annotate: Fix build with NO_NEWT=1 tracing: Fix race in snapshot swapping
2013-03-21Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds
Pull drm fixes from Dave Airlie: "Radeon, intel and nouveau, along with one mgag200 fix - intel fix for an ioctl overflow, along with a regression fix for some phantom irqs on Ironlake. - nouveau has a lockdep warning and a bunch of thermal fixes - radeon has new pci ids and some minor fixes." * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (26 commits) drm/mgag200: Bug fix: Modified pll algorithm for EH project drm/i915: stop using GMBUS IRQs on Gen4 chips drm/nv50/kms: prevent lockdep false-positive in page flipping path drm/nouveau/core: fix return value of nouveau_object_del() MAINTAINERS: intel-gfx is no longer subscribers-only drm/i915: Use the fixed pixel clock for eDP in intel_dp_set_m_n() drm/nouveau/hwmon: do not expose a buggy temperature if it is unavailable drm/nouveau/therm: display the availability of the internal sensor drm/nouveau/therm: disable temperature management if the sensor isn't readable drm/nouveau/therm: disable auto fan management if temperature is not available drm/nv40/therm: reserve negative temperatures for errors drm/nv40/therm: disable temperature reading if the bios misses some parameters drm/nouveau/therm-ic: the temperature is off by sensor_constant, warn the user drm/nouveau/therm: remove some confusion introduced by therm_mode drm/nouveau/therm: do not make assumptions on temperature drm/nv40/therm: increase the sensor's settling delay to 20ms drm/nv40/therm: improve selection between the old and the new style Revert "drm/i915: try to train DP even harder" drm/radeon: add Richland pci ids drm/radeon: add support for Richland APUs ...
2013-03-21Merge tag 'dm-3.9-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-dm Pull device-mapper fixes from Alasdair G Kergon: "Fix reported data loss with discards and thin snapshots; avoid a deadlock observed in dm verity; fix a race in the new dm cache code along with some other minor bugs; store the cache policy version on disk to make the stored hints format future-proof." * tag 'dm-3.9-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-dm: dm cache: policy ignore hints if generated by different version dm cache: policy change version from string to integer set dm cache: fix race in writethrough implementation dm cache: metadata clear dirty bits on clean shutdown dm cache: avoid calling policy destructor twice on error dm cache: detect cache_create failure dm cache: avoid 64 bit division on 32 bit dm verity: avoid deadlock dm thin: fix non power of two discard granularity calc dm thin: fix discard corruption
2013-03-21NFSv4.1: Add a helper pnfs_commit_and_return_layoutTrond Myklebust
In order to be able to safely return the layout in nfs4_proc_setattr, we need to block new uses of the layout, wait for all outstanding users of the layout to complete, commit the layout and then return it. This patch adds a helper in order to do all this safely. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Cc: Boaz Harrosh <bharrosh@panasas.com>
2013-03-21NFSv4.1: Always clear the NFS_INO_LAYOUTCOMMIT in layoutreturnTrond Myklebust
Note that clearing NFS_INO_LAYOUTCOMMIT is tricky, since it requires you to also clear the NFS_LSEG_LAYOUTCOMMIT bits from the layout segments. The only two sites that need to do this are the ones that call pnfs_return_layout() without first doing a layout commit. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Acked-by: Benny Halevy <bhalevy@tonian.com> Cc: stable@vger.kernel.org