1. 17 11月, 2012 1 次提交
  2. 16 11月, 2012 20 次提交
  3. 15 11月, 2012 10 次提交
    • H
      s390/3215: fix tty close handling · ae289dc1
      Heiko Carstens 提交于
      The 3215 console always has the RAW3215_FIXED flag set, which causes
      raw3215_shutdown() not to wait for outstanding I/O requests if an attached
      tty gets closed.
      The flag however can be simply removed, so we can guarantee that all requests
      belonging to the tty have been processed when the tty is closed.
      
      However the tasklet that belongs to the 3215 device may be scheduled even if
      there is no tty attached anymore, since we have a race between console and tty
      processing.
      Thefore unconditional tty_wakekup() in raw3215_wakeup() can cause the following
      NULL pointer dereference:
      
      3.465368 Unable to handle kernel pointer dereference at virtual kernel address (null)
      3.465448 Oops: 0004 #1 SMP
      3.465454 Modules linked in:
      3.465459 CPU: 1 Not tainted 3.6.0 #1
      3.465462 Process swapper/1 (pid: 0, task: 000000003ffa4428, ksp: 000000003ffb7ce0)
      3.465466 Krnl PSW : 0404100180000000 0000000000162f86 (__wake_up+0x46/0xb8)
      3.465480            R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:0 CC:1 PM:0 EA:3
               Krnl GPRS: fffffffffffffffe 0000000000000000 0000000000000160 0000000000000001
      3.465492            0000000000000001 0000000000000004 0000000000000004 000000000096b490
      3.465499            0000000000000001 0000000000000100 0000000000000001 0000000000000001
      3.465506            070000003fc87d60 0000000000000160 000000003fc87d68 000000003fc87d00
      3.465526 Krnl Code: 0000000000162f76: e3c0f0a80004      lg      %r12,168(%r15)
                          0000000000162f7c: 58000370          l       %r0,880
                         #0000000000162f80: c007ffffffff00    xilf    %r0,4294967295
                         >0000000000162f86: ba102000          cs      %r1,%r0,0(%r2)
                          0000000000162f8a: 1211              ltr     %r1,%r1
                          0000000000162f8c: a774002f          brc     7,162fea
                          0000000000162f90: b904002d          lgr     %r2,%r13
                          0000000000162f94: b904003a          lgr     %r3,%r10
      3.465597 Call Trace:
      3.465599 (<0400000000000000> 0x400000000000000)
      3.465602  <000000000048c77e> raw3215_wakeup+0x2e/0x40
      3.465607  <0000000000134d66> tasklet_action+0x96/0x168
      3.465612  <000000000013423c> __do_softirq+0xd8/0x21c
      3.465615  <0000000000134678> irq_exit+0xa8/0xac
      3.465617  <000000000046c232> do_IRQ+0x182/0x248
      3.465621  <00000000005c8296> io_return+0x0/0x8
      3.465625  <00000000005c7cac> vtime_stop_cpu+0x4c/0xb8
      3.465629 (<0000000000194e06> tick_nohz_idle_enter+0x4e/0x74)
      3.465633  <0000000000104760> cpu_idle+0x170/0x184
      3.465636  <00000000005b5182> smp_start_secondary+0xd6/0xe0
      3.465641  <00000000005c86be> restart_int_handler+0x56/0x6c
      3.465643  <0000000000000000> 0x0
      3.465645 Last Breaking-Event-Address:
      3.465647  <0000000000403136> tty_wakeup+0x46/0x98
      3.465652
      3.465654 Kernel panic - not syncing: Fatal exception in interrupt
      01: HCPGIR450W CP entered; disabled wait PSW 00020001 80000000 00000000 0010F63C
      
      The easiest solution is simply to check if tty is NULL in the tasklet.
      If it is NULL nothing is to do (no tty attached), otherwise tty_wakeup()
      can be called, since we hold a reference to the tty.
      This is not nice... but it is a small patch and it works.
      Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
      Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
      ae289dc1
    • A
    • C
      pstore: Fix NULL pointer dereference in console writes · 70a6f46d
      Colin Ian King 提交于
      Passing a NULL id causes a NULL pointer deference in writers such as
      erst_writer and efi_pstore_write because they expect to update this id.
      Pass a dummy id instead.
      
      This avoids a cascade of oopses caused when the initial
      pstore_console_write passes a null which in turn causes writes to the
      console causing further oopses in subsequent pstore_console_write calls.
      Signed-off-by: NColin Ian King <colin.king@canonical.com>
      Acked-by: NKees Cook <keescook@chromium.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: NAnton Vorontsov <anton.vorontsov@linaro.org>
      70a6f46d
    • M
      Merge remote-tracking branches 'regulator/fix/gpio', 'regulator/fix/put' and... · ecb48c33
      Mark Brown 提交于
      Merge remote-tracking branches 'regulator/fix/gpio', 'regulator/fix/put' and 'regulator/fix/supp-volt' into tmp
      ecb48c33
    • M
      regulator: fix voltage check in regulator_is_supported_voltage() · f0f98b19
      Marek Szyprowski 提交于
      regulator_is_supported_voltage() should return true only if the voltage
      of fixed/constant regulator is between min_uV and max_uV.
      Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
      Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>
      Cc: stable@vger.kernel.org
      f0f98b19
    • A
      tty: serial: max310x: Add terminating entry for spi_device_id table · 1838b8c4
      Axel Lin 提交于
      The spi_device_id table is supposed to be zero-terminated.
      Signed-off-by: NAxel Lin <axel.lin@ingics.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1838b8c4
    • L
      Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux · 79e979ea
      Linus Torvalds 提交于
      Pull power tools fixes from Len Brown:
       "A pair of power tools patches -- a 3.7 regression fix plus a bug fix."
      
      * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux:
        tools/power turbostat: graceful fail on garbage input
        tools/power turbostat: Repair Segmentation fault when using -i option
      79e979ea
    • L
      Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus · f0c39113
      Linus Torvalds 提交于
      Pull MIPS update from Ralf Baechle:
       "To avoid unnecessary risk and work the preemption fixes are combined
        with some preparatory work that isn't strictly required.  So it's
        really just 3 fixes:
      
         - Get is_compat_task() to do the right thing while simplifying it.
           The unnecessary complexity hid a rarely striking bug which could be
           triggered by ext3/ext4 under certain circumstances.
         - Resolve a preemption issue in the irqflags.h functions for kernels
           built to support pre-MIPS32 / pre-MIPS64 Release 2 processors.
         - Fix the interrupt number of the MIPS Malta's CBUS UART."
      
      * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
        MIPS: Malta: Fix interupt number of CBUS UART.
        MIPS: Make irqflags.h functions preempt-safe for non-mipsr2 cpus
        MIPS: Remove irqflags.h dependency from bitops.h
        MIPS: bitops.h: Change use of 'unsigned short' to 'int'
        MIPS: compat: Delete now unused TIF_32BIT.
        MIPS: compat: Implement is_compat_task() by testing for 32-bit address space.
        MIPS: compat: Fix use of TIF_32BIT_ADDR vs _TIF_32BIT_ADDR
      f0c39113
    • L
      Merge branch 'for-3.7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup · 1e096209
      Linus Torvalds 提交于
      Pull cgroup fixes from Tejun Heo:
       "This contains two fix patches for device_cgroup.  One fixes a
        regression introduced earlier in 3.7 cycle where device_cgroup could
        try to dereference the NULL parent of the root cgroup.  The other one
        is RCU usage fix."
      
      * 'for-3.7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
        device_cgroup: fix RCU usage
        device_cgroup: fix unchecked cgroup parent usage
      1e096209
    • P
      TTY: hvc_console, fix port reference count going to zero prematurely · c019bc11
      Paul Mackerras 提交于
      Commit bdb498c2 "TTY: hvc_console, add tty install" took the port
      refcounting out of hvc_open()/hvc_close(), but failed to remove the
      kref_put() and tty_kref_put() calls in hvc_hangup() that were there to
      remove the extra references that hvc_open() had taken.
      
      The result was that doing a vhangup() when the current terminal was
      a hvc_console, then closing the current terminal, would end up calling
      destroy_hvc_struct() and making the port disappear entirely.  This
      meant that Fedora 17 systems would boot up but then not display the
      login prompt on the console, and attempts to open /dev/hvc0 would
      give a "No such device" error.
      
      This fixes it by removing the extra kref_put() and tty_kref_put() calls.
      Signed-off-by: NPaul Mackerras <paulus@samba.org>
      Acked-by: NJiri Slaby <jslaby@suse.cz>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c019bc11
  4. 14 11月, 2012 9 次提交