1. 10 10月, 2013 1 次提交
    • A
      regmap: Fix regmap_bulk_write single-rw mutex deadlock · 4174a7a4
      Anthony Olech 提交于
      When regmap_bulk_write() is called with the map->use_single_rw flag set
      an immediate mutex deadlock happens because regmap_raw_write() is called
      after obtaining the mutex and regmap_raw_write() itself then tries to
      obtain the mutex as well.
      
      It is obvious that no one other than myself tried it with a real device.
      I did, but only for the purposes of an experiment and demonstration.
      
      But even if this situation will never ever happen with a real device, it
      is a bug and therefore should be fixed.
      Signed-off-by: NAnthony Olech <anthony.olech.opensource@diasemi.com>
      Signed-off-by: NMark Brown <broonie@linaro.org>
      4174a7a4
  2. 27 9月, 2013 1 次提交
    • B
      driver core : Fix use after free of dev->parent in device_shutdown · f123db8e
      Benson Leung 提交于
      The put_device(dev) at the bottom of the loop of device_shutdown
      may result in the dev being cleaned up. In device_create_release,
      the dev is kfreed.
      
      However, device_shutdown attempts to use the dev pointer again after
      put_device by referring to dev->parent.
      
      Copy the parent pointer instead to avoid this condition.
      
      This bug was found on Chromium OS's chromeos-3.8, which is based on v3.8.11.
      See bug report : https://code.google.com/p/chromium/issues/detail?id=297842
      This can easily be reproduced when shutting down with
      hidraw devices that report battery condition.
      Two examples are the HP Bluetooth Mouse X4000b and the Apple Magic Mouse.
      For example, with the magic mouse :
      The dev in question is "hidraw0"
      dev->parent is "magicmouse"
      
      In the course of the shutdown for this device, the input event cleanup calls
      a put on hidraw0, decrementing its reference count.
      When we finally get to put_device(dev) in device_shutdown, kobject_cleanup
      is called and device_create_release does kfree(dev).
      dev->parent is no longer valid, and we may crash in
      put_device(dev->parent).
      
      This change should be applied on any kernel with this change :
      d1c6c030
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NBenson Leung <bleung@chromium.org>
      Reviewed-by: NMing Lei <ming.lei@canonical.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f123db8e
  3. 13 9月, 2013 1 次提交
  4. 10 9月, 2013 2 次提交
  5. 31 8月, 2013 1 次提交
    • M
      firmware loader: fix pending_fw_head list corruption · 1eeeef15
      Maxime Bizon 提交于
      Got the following oops just before reboot:
      
      Unable to handle kernel NULL pointer dereference at virtual address 00000000
      [<8028d300>] (__list_del_entry+0x44/0xac)
      [<802e3320>] (__fw_load_abort.part.13+0x1c/0x50)
      [<802e337c>] (fw_shutdown_notify+0x28/0x50)
      [<80034f80>] (notifier_call_chain.isra.1+0x5c/0x9c)
      [<800350ec>] (__blocking_notifier_call_chain+0x44/0x58)
      [<80035114>] (blocking_notifier_call_chain+0x14/0x18)
      [<80035d64>] (kernel_restart_prepare+0x14/0x38)
      [<80035d94>] (kernel_restart+0xc/0x50)
      
      The following race condition triggers here:
      
        _request_firmware_load()
        device_create_file(...)
        kobject_uevent(...)
        (schedule)
                                             (resume)
                                             firmware_loading_store(1)
                                             firmware_loading_store(0)
                                             list_del_init(&buf->pending_list)
                                             (schedule)
        (resume)
        list_add(&buf->pending_list, &pending_fw_head);
        wait_for_completion(&buf->completion);
      
      causing an oops later when walking pending_list after the firmware has
      been released.
      
      The proposed fix is to move the list_add() before sysfs attribute
      creation.
      Signed-off-by: NMaxime Bizon <mbizon@freebox.fr>
      Acked-by: NMing Lei <ming.lei@canonical.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1eeeef15
  6. 30 8月, 2013 1 次提交
    • R
      driver core / ACPI: Avoid device hot remove locking issues · 5e33bc41
      Rafael J. Wysocki 提交于
      device_hotplug_lock is held around the acpi_bus_trim() call in
      acpi_scan_hot_remove() which generally removes devices (it removes
      ACPI device objects at least, but it may also remove "physical"
      device objects through .detach() callbacks of ACPI scan handlers).
      Thus, potentially, device sysfs attributes are removed under that
      lock and to remove those attributes it is necessary to hold the
      s_active references of their directory entries for writing.
      
      On the other hand, the execution of a .show() or .store() callback
      from a sysfs attribute is carried out with that attribute's s_active
      reference held for reading.  Consequently, if any device sysfs
      attribute that may be removed from within acpi_scan_hot_remove()
      through acpi_bus_trim() has a .store() or .show() callback which
      acquires device_hotplug_lock, the execution of that callback may
      deadlock with the removal of the attribute.  [Unfortunately, the
      "online" device attribute of CPUs and memory blocks is one of them.]
      
      To avoid such deadlocks, make all of the sysfs attribute callbacks
      that need to lock device hotplug, for example store_online(), use
      a special function, lock_device_hotplug_sysfs(), to lock device
      hotplug and return the result of that function immediately if it is
      not zero.  This will cause the s_active reference of the directory
      entry in question to be released and the syscall to be restarted
      if device_hotplug_lock cannot be acquired.
      
      [show_online() actually doesn't need to lock device hotplug, but
      it is useful to serialize it with respect to device_offline() and
      device_online() for the same device (in case user space attempts to
      run them concurrently) which can be done with the help of
      device_lock().]
      Reported-by: NYasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
      Reported-and-tested-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
      Suggested-by: NTejun Heo <tj@kernel.org>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Acked-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Acked-by: NToshi Kani <toshi.kani@hp.com>
      5e33bc41
  7. 29 8月, 2013 6 次提交
    • L
      regmap: rbtree: Make cache_present bitmap per node · 3f4ff561
      Lars-Peter Clausen 提交于
      With devices which have a dense and small register map but placed at a large
      offset the global cache_present bitmap imposes a huge memory overhead. Making
      the cache_present per rbtree node avoids the issue and easily reduces the memory
      footprint by a factor of ten. For devices with a more sparse map or without a
      large base register offset the memory usage might increase slightly by a few
      bytes, but not significantly. E.g. for a device which has ~50 registers at
      offset 0x4000 the memory footprint of the register cache goes down form 2496
      bytes to 175 bytes.
      
      Moving the bitmap to a per node basis means that the handling of the bitmap is
      now cache implementation specific and can no longer be managed by the core. The
      regcache_sync_block() function is extended by a additional parameter so that the
      cache implementation can tell the core which registers in the block are set and
      which are not. The parameter is optional and if NULL the core assumes that all
      registers are set. The rbtree cache also needs to implement its own drop
      callback instead of relying on the core to handle this.
      Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
      Signed-off-by: NMark Brown <broonie@linaro.org>
      3f4ff561
    • L
      regmap: rbtree: Reduce number of nodes, take 2 · 472fdec7
      Lars-Peter Clausen 提交于
      Support for reducing the number of nodes and memory consumption of the rbtree
      cache by allowing for small unused holes in the node's register cache block was
      initially added in commit 0c7ed856 ("regmap: Cut down on the average # of nodes
      in the rbtree cache"). But the commit had problems and so its effect was
      reverted again in commit 4e67fb5f ("regmap: rbtree: Fix overlapping rbnodes.").
      This patch brings the feature back of reducing the average number of nodes,
      which will speedup node look-up, while at the same time also reducing the memory
      usage of the rbtree cache. This patch takes a slightly different approach than
      the original patch though. It modifies the adjacent node look-up to not only
      consider nodes that are just one to the left or the right of the register but
      any node that falls in a certain range around the register. The range is
      calculated based on how much memory it would take to allocate a new node
      compared to how much memory it takes adding a set of unused registers to an
      existing node. E.g. if a node takes up 24 bytes and each register in a block
      uses 1 byte the range will be from the register address - 24 to the register
      address + 24. If we find a node that falls within this range it is cheaper or as
      expensive to add the register to the existing node and have a couple of unused
      registers in the node's cache compared to allocating a new node.
      Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
      Signed-off-by: NMark Brown <broonie@linaro.org>
      472fdec7
    • L
      regmap: rbtree: Simplify adjacent node look-up · 194c753a
      Lars-Peter Clausen 提交于
      A register which is adjacent to a node will either be left to the first
      register or right to the last register. It will not be within the node's range,
      so there is no point in checking for each register cached by the node whether
      the new register is next to it. It is sufficient to check whether the register
      comes before the first register or after the last register of the node.
      Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
      Signed-off-by: NMark Brown <broonie@linaro.org>
      194c753a
    • R
      drivers/base/memory.c: fix show_mem_removable() to handle missing sections · 21ea9f5a
      Russ Anderson 提交于
      "cat /sys/devices/system/memory/memory*/removable" crashed the system.
      
      The problem is that show_mem_removable() is passing a
      bad pfn to is_mem_section_removable(), which causes
      
          if (!node_online(page_to_nid(page)))
      
      to blow up.  Why is it passing in a bad pfn?
      
      The reason is that show_mem_removable() will loop sections_per_block
      times.  sections_per_block is 16, but mem->section_count is 8,
      indicating holes in this memory block.  Checking that the memory section
      is present before checking to see if the memory section is removable
      fixes the problem.
      
         harp5-sys:~ # cat /sys/devices/system/memory/memory*/removable
         0
         1
         1
         1
         1
         1
         1
         1
         1
         1
         1
         1
         1
         1
         BUG: unable to handle kernel paging request at ffffea00c3200000
         IP: [<ffffffff81117ed1>] is_pageblock_removable_nolock+0x1/0x90
         PGD 83ffd4067 PUD 37bdfce067 PMD 0
         Oops: 0000 [#1] SMP
         Modules linked in: autofs4 binfmt_misc rdma_ucm rdma_cm iw_cm ib_addr ib_srp scsi_transport_srp scsi_tgt ib_ipoib ib_cm ib_uverbs ib_umad iw_cxgb3 cxgb3 mdio mlx4_en mlx4_ib ib_sa mlx4_core ib_mthca ib_mad ib_core fuse nls_iso8859_1 nls_cp437 vfat fat joydev loop hid_generic usbhid hid hwperf(O) numatools(O) dm_mod iTCO_wdt ipv6 iTCO_vendor_support igb i2c_i801 ioatdma i2c_algo_bit ehci_pci pcspkr lpc_ich i2c_core ehci_hcd ptp sg mfd_core dca rtc_cmos pps_core mperf button xhci_hcd sd_mod crc_t10dif usbcore usb_common scsi_dh_emc scsi_dh_hp_sw scsi_dh_alua scsi_dh_rdac scsi_dh gru(O) xvma(O) xfs crc32c libcrc32c thermal sata_nv processor piix mptsas mptscsih scsi_transport_sas mptbase megaraid_sas fan thermal_sys hwmon ext3 jbd ata_piix ahci libahci libata scsi_mod
         CPU: 4 PID: 5991 Comm: cat Tainted: G           O 3.11.0-rc5-rja-uv+ #10
         Hardware name: SGI UV2000/ROMLEY, BIOS SGI UV 2000/3000 series BIOS 01/15/2013
         task: ffff88081f034580 ti: ffff880820022000 task.ti: ffff880820022000
         RIP: 0010:[<ffffffff81117ed1>]  [<ffffffff81117ed1>] is_pageblock_removable_nolock+0x1/0x90
         RSP: 0018:ffff880820023df8  EFLAGS: 00010287
         RAX: 0000000000040000 RBX: ffffea00c3200000 RCX: 0000000000000004
         RDX: ffffea00c30b0000 RSI: 00000000001c0000 RDI: ffffea00c3200000
         RBP: ffff880820023e38 R08: 0000000000000000 R09: 0000000000000001
         R10: 0000000000000000 R11: 0000000000000001 R12: ffffea00c33c0000
         R13: 0000160000000000 R14: 6db6db6db6db6db7 R15: 0000000000000001
         FS:  00007ffff7fb2700(0000) GS:ffff88083fc80000(0000) knlGS:0000000000000000
         CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
         CR2: ffffea00c3200000 CR3: 000000081b954000 CR4: 00000000000407e0
         Call Trace:
           show_mem_removable+0x41/0x70
           dev_attr_show+0x2a/0x60
           sysfs_read_file+0xf7/0x1c0
           vfs_read+0xc8/0x130
           SyS_read+0x5d/0xa0
           system_call_fastpath+0x16/0x1b
      Signed-off-by: NRuss Anderson <rja@sgi.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
      Cc: Yinghai Lu <yinghai@kernel.org>
      Reviewed-by: NYasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      21ea9f5a
    • G
      drivers/base/memory.c: introduce help macro to_memory_block · 7315f0cc
      Gu Zheng 提交于
      Introduce help macro to_memory_block to hide the conversion(device-->memory_block),
      just clean up.
      Reviewed-by: NYasuaki Ishimatsu  <isimatu.yasuaki@jp.fujitsu.com>
      Signed-off-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7315f0cc
    • L
      regmap: debugfs: Fix continued read from registers file · 26ee4741
      Lars-Peter Clausen 提交于
      The regmap_debugfs_get_dump_start() function maps from a file offset to the
      register that can be found at that position in the file. This is done using a
      look-up table. Commit d6814a7d ("regmap: debugfs: Suppress cache for partial
      register files") added a check to bypass the look-up table for partial register
      files, since the offsets in that table are only correct for the full register
      file. The check incorrectly uses the file offset instead of the register base
      address and returns it. This will cause the file offset to be interpreted as a
      register address which will result in a incorrect output from the registers file
      for all reads except at position 0.
      
      The issue can easily be reproduced by doing small reads the registers file, e.g.
      `dd if=registers bs=10 count=5`.
      Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
      Signed-off-by: NMark Brown <broonie@linaro.org>
      Cc: stable@vger.kernel.org
      26ee4741
  8. 28 8月, 2013 1 次提交
  9. 27 8月, 2013 2 次提交
  10. 24 8月, 2013 4 次提交
  11. 23 8月, 2013 1 次提交
    • G
      sysfs.h: remove attr_name() macro · 3e1026b3
      Greg Kroah-Hartman 提交于
      Gotta love a macro that doesn't reduce the typing you have to do.
      
      Also, only the driver core, and one network driver uses this.  The
      driver core functions will be going away soon, and I'll convert the
      network driver soon to not need this as well, so delete it for now
      before anyone else gets some bright ideas and wants to use it.
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      3e1026b3
  12. 22 8月, 2013 10 次提交
  13. 21 8月, 2013 1 次提交
  14. 20 8月, 2013 3 次提交
  15. 17 8月, 2013 1 次提交
  16. 13 8月, 2013 4 次提交