1. 22 3月, 2013 1 次提交
  2. 21 3月, 2013 3 次提交
    • G
      Merge tag 'fixes-for-v3.9-rc4' of... · d93acbca
      Greg Kroah-Hartman 提交于
      Merge tag 'fixes-for-v3.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
      
      Felipe writes:
      
      	usb: fixes for v3.9-rc4
      
      	udc-core learned that it shouldn't use invalid pointers
      	when unloading a gadget driver.
      
      	net2272 and net2280 got a fix for a regression caused by
      	the udc_start/udc_stop conversion.
      
      	We're defining a static inline no-op for otg_ulpi_create()
      	to prevent build errors when that driver isn't enabled.
      
      	FunctionFS got a fix for an off-by-one error when binding
      	and unbinding instances of FunctionFS.
      
      	MUSB learned that it shouldn't try to unmap buffers which
      	weren't previously mapped.
      
      	f_rndis got a fix for a possible NULL pointer dereference
      	in a debugging message code.
      
      	MUSB's DA8xx glue layer got a build fix due to a typo.
      d93acbca
    • P
      usb: gadget: net2272: finally convert "CONFIG_USB_GADGET_NET2272_DMA" · eda81bea
      Paul Bolle 提交于
      The Kconfig symbol USB_GADGET_NET2272_DMA was renamed to USB_NET2272_DMA
      in commit 193ab2a6 ("usb: gadget: allow
      multiple gadgets to be built"). That commit did not convert the only
      occurrence of the corresponding Kconfig macro. Convert that macro now.
      Signed-off-by: NPaul Bolle <pebolle@tiscali.nl>
      Signed-off-by: NFelipe Balbi <balbi@ti.com>
      eda81bea
    • A
      USB: EHCI: fix regression in QH unlinking · d714aaf6
      Alan Stern 提交于
      This patch (as1670) fixes a regression caused by commit
      6402c796 (USB: EHCI: work around
      silicon bug in Intel's EHCI controllers).  The workaround goes through
      two IAA cycles for each QH being unlinked.  During the first cycle,
      the QH is not added to the async_iaa list (because it isn't fully gone
      from the hardware yet), which means that list will be empty.
      
      Unfortunately, I forgot to update the IAA watchdog timer routine.  It
      thinks that an empty async_iaa list means the timer expiration was an
      error, which isn't true any more.  This problem didn't show up during
      initial testing because the controllers being tested all had working
      IAA interrupts.  But not all controllers do, and when the watchdog
      timer expires, the empty-list check prevents the second IAA cycle from
      starting.  As a result, URB unlinks never complete.  The check needs
      to be removed.
      
      Among the symptoms of the regression are processes stuck in D wait
      states and hangs during system shutdown.
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      Reported-and-tested-by: NStephen Warren <swarren@wwwdotorg.org>
      Reported-and-tested-by: NSven Joachim <svenjoac@gmx.de>
      Reported-by: NAndreas Bombe <aeb@debian.org>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d714aaf6
  3. 20 3月, 2013 6 次提交
  4. 19 3月, 2013 1 次提交
  5. 18 3月, 2013 2 次提交
  6. 16 3月, 2013 4 次提交
  7. 15 3月, 2013 4 次提交
    • M
      mm/fremap.c: fix possible oops on error path · a2362d24
      Michel Lespinasse 提交于
      The vm_flags introduced in 6d7825b1 ("mm/fremap.c: fix oops on error
      path") is supposed to avoid a compiler warning about unitialized
      vm_flags without changing the generated code.
      
      However I am concerned that this is going to be very brittle, and fail
      with some compiler versions. The failure could be either of:
      
      - compiler could actually load vma->vm_flags before checking for the
        !vma condition, thus reintroducing the oops
      
      - compiler could optimize out the !vma check, since the pointer just got
        dereferenced shortly before (so the compiler knows it can't be NULL!)
      
      I propose reversing this part of the change and initializing vm_flags to 0
      just to avoid the bogus uninitialized use warning.
      Signed-off-by: NMichel Lespinasse <walken@google.com>
      Cc: Tommi Rantala <tt.rantala@gmail.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      a2362d24
    • L
      Merge branch 'rcu/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu · f4846e52
      Linus Torvalds 提交于
      Pull fix for hlist_entry_safe() regression from Paul McKenney:
       "This contains a single commit that fixes a regression in
        hlist_entry_safe().  This macro references its argument twice, which
        can cause NULL-pointer errors.  This commit applies a gcc statement
        expression, creating a temporary variable to avoid the double
        reference.  This has been posted to LKML at
      
          https://lkml.org/lkml/2013/3/9/75.
      
        Kudos to CAI Qian, whose testing uncovered this, to Eric Dumazet, who
        spotted root cause, and to Li Zefan, who tested this commit."
      
      * 'rcu/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
        list: Fix double fetch of pointer in hlist_entry_safe()
      f4846e52
    • P
      list: Fix double fetch of pointer in hlist_entry_safe() · f65846a1
      Paul E. McKenney 提交于
      The current version of hlist_entry_safe() fetches the pointer twice,
      once to test for NULL and the other to compute the offset back to the
      enclosing structure.  This is OK for normal lock-based use because in
      that case, the pointer cannot change.  However, when the pointer is
      protected by RCU (as in "rcu_dereference(p)"), then the pointer can
      change at any time.  This use case can result in the following sequence
      of events:
      
      1.	CPU 0 invokes hlist_entry_safe(), fetches the RCU-protected
      	pointer as sees that it is non-NULL.
      
      2.	CPU 1 invokes hlist_del_rcu(), deleting the entry that CPU 0
      	just fetched a pointer to.  Because this is the last entry
      	in the list, the pointer fetched by CPU 0 is now NULL.
      
      3.	CPU 0 refetches the pointer, obtains NULL, and then gets a
      	NULL-pointer crash.
      
      This commit therefore applies gcc's "({ })" statement expression to
      create a temporary variable so that the specified pointer is fetched
      only once, avoiding the above sequence of events.  Please note that
      it is the caller's responsibility to use rcu_dereference() as needed.
      This allows RCU-protected uses to work correctly without imposing
      any additional overhead on the non-RCU case.
      
      Many thanks to Eric Dumazet for spotting root cause!
      Reported-by: NCAI Qian <caiqian@redhat.com>
      Reported-by: NEric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: NPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Tested-by: NLi Zefan <lizefan@huawei.com>
      f65846a1
    • L
      Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · 40e4591d
      Linus Torvalds 提交于
      Pull ext2, ext3, reiserfs, quota fixes from Jan Kara:
       "A fix for regression in ext2, and a format string issue in ext3.  The
        rest isn't too serious."
      
      * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        ext2: Fix BUG_ON in evict() on inode deletion
        reiserfs: Use kstrdup instead of kmalloc/strcpy
        ext3: Fix format string issues
        quota: add missing use of dq_data_lock in __dquot_initialize
      40e4591d
  8. 14 3月, 2013 19 次提交