1. 09 1月, 2014 3 次提交
    • B
      firmware_class: Fix the file size check · 08da2012
      Ben Hutchings 提交于
      We expect to read firmware blobs with a single call to kernel_read(),
      which returns int.  Therefore the size must be within the range of
      int, not long.
      Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      08da2012
    • B
      driver-core: Fix use-after-free triggered by bus_unregister() · 174be70b
      Bart Van Assche 提交于
      Avoid that bus_unregister() triggers a use-after-free with
      CONFIG_DEBUG_KOBJECT_RELEASE=y. This patch avoids that the
      following sequence triggers a kernel crash with memory poisoning
      enabled:
      * bus_register()
      * driver_register()
      * driver_unregister()
      * bus_unregister()
      
      The above sequence causes the bus private data to be freed from
      inside the bus_unregister() call although it is not guaranteed in
      that function that the reference count on the bus private data has
      dropped to zero. As an example, with CONFIG_DEBUG_KOBJECT_RELEASE=y
      the ${bus}/drivers kobject is still holding a reference on
      bus->p->subsys.kobj via its parent pointer at the time the bus
      private data is freed. Fix this by deferring freeing the bus private
      data until the last kobject_put() call on bus->p->subsys.kobj.
      
      The kernel oops triggered by the above sequence and with memory
      poisoning enabled and that is fixed by this patch is as follows:
      
      general protection fault: 0000 [#1] PREEMPT SMP
      CPU: 3 PID: 2711 Comm: kworker/3:32 Tainted: G        W  O 3.13.0-rc4-debug+ #1
      Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
      Workqueue: events kobject_delayed_cleanup
      task: ffff880037f866d0 ti: ffff88003b638000 task.ti: ffff88003b638000
      Call Trace:
       [<ffffffff81263105>] ? kobject_get_path+0x25/0x100
       [<ffffffff81264354>] kobject_uevent_env+0x134/0x600
       [<ffffffff8126482b>] kobject_uevent+0xb/0x10
       [<ffffffff81262fa2>] kobject_delayed_cleanup+0xc2/0x1b0
       [<ffffffff8106c047>] process_one_work+0x217/0x700
       [<ffffffff8106bfdb>] ? process_one_work+0x1ab/0x700
       [<ffffffff8106c64b>] worker_thread+0x11b/0x3a0
       [<ffffffff8106c530>] ? process_one_work+0x700/0x700
       [<ffffffff81074b70>] kthread+0xf0/0x110
       [<ffffffff81074a80>] ? insert_kthread_work+0x80/0x80
       [<ffffffff815673bc>] ret_from_fork+0x7c/0xb0
       [<ffffffff81074a80>] ? insert_kthread_work+0x80/0x80
      Code: 89 f8 48 89 e5 f6 82 c0 27 63 81 20 74 15 0f 1f 44 00 00 48 83 c0 01 0f b6 10 f6 82 c0 27 63 81 20 75 f0 5d c3 66 0f 1f 44 00 00 <80> 3f 00 55 48 89 e5 74 15 48 89 f8 0f 1f 40 00 48 83 c0 01 80
      RIP  [<ffffffff81267ed0>] strlen+0x0/0x30
       RSP <ffff88003b639c70>
      ---[ end trace 210f883ef80376aa ]---
      Signed-off-by: NBart Van Assche <bvanassche@acm.org>
      Acked-by: NMing Lei <ming.lei@canonical.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      174be70b
    • B
      firmware loader: Add sparse annotation · 98233b21
      Bart Van Assche 提交于
      Avoid that sparse reports the following warning on __fw_free_buf():
      
      drivers/base/firmware_class.c:230:9: warning: context imbalance in '__fw_free_buf' - unexpected unlock
      Signed-off-by: NBart Van Assche <bvanassche@acm.org>
      Acked-by: NMing Lei <ming.lei@canonical.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      98233b21
  2. 20 12月, 2013 1 次提交
  3. 19 12月, 2013 1 次提交
  4. 09 12月, 2013 4 次提交
  5. 08 12月, 2013 1 次提交
  6. 28 11月, 2013 1 次提交
  7. 26 11月, 2013 1 次提交
  8. 21 11月, 2013 1 次提交
  9. 15 11月, 2013 2 次提交
    • W
      tree-wide: use reinit_completion instead of INIT_COMPLETION · 16735d02
      Wolfram Sang 提交于
      Use this new function to make code more comprehensible, since we are
      reinitialzing the completion, not initializing.
      
      [akpm@linux-foundation.org: linux-next resyncs]
      Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
      Acked-by: Linus Walleij <linus.walleij@linaro.org> (personally at LCE13)
      Cc: Ingo Molnar <mingo@kernel.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      16735d02
    • R
      ACPI / driver core: Store an ACPI device pointer in struct acpi_dev_node · 7b199811
      Rafael J. Wysocki 提交于
      Modify struct acpi_dev_node to contain a pointer to struct acpi_device
      associated with the given device object (that is, its ACPI companion
      device) instead of an ACPI handle corresponding to it.  Introduce two
      new macros for manipulating that pointer in a CONFIG_ACPI-safe way,
      ACPI_COMPANION() and ACPI_COMPANION_SET(), and rework the
      ACPI_HANDLE() macro to take the above changes into account.
      Drop the ACPI_HANDLE_SET() macro entirely and rework its users to
      use ACPI_COMPANION_SET() instead.  For some of them who used to
      pass the result of acpi_get_child() directly to ACPI_HANDLE_SET()
      introduce a helper routine acpi_preset_companion() doing an
      equivalent thing.
      
      The main motivation for doing this is that there are things
      represented by struct acpi_device objects that don't have valid
      ACPI handles (so called fixed ACPI hardware features, such as
      power and sleep buttons) and we would like to create platform
      device objects for them and "glue" them to their ACPI companions
      in the usual way (which currently is impossible due to the
      lack of valid ACPI handles).  However, there are more reasons
      why it may be useful.
      
      First, struct acpi_device pointers allow of much better type checking
      than void pointers which are ACPI handles, so it should be more
      difficult to write buggy code using modified struct acpi_dev_node
      and the new macros.  Second, the change should help to reduce (over
      time) the number of places in which the result of ACPI_HANDLE() is
      passed to acpi_bus_get_device() in order to obtain a pointer to the
      struct acpi_device associated with the given "physical" device,
      because now that pointer is returned by ACPI_COMPANION() directly.
      Finally, the change should make it easier to write generic code that
      will build both for CONFIG_ACPI set and unset without adding explicit
      compiler directives to it.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Acked-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com> # on Haswell
      Reviewed-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Reviewed-by: Aaron Lu <aaron.lu@intel.com> # for ATA and SDIO part
      7b199811
  10. 14 11月, 2013 1 次提交
  11. 12 11月, 2013 1 次提交
  12. 09 11月, 2013 2 次提交
    • J
      locks: break delegations on any attribute modification · 27ac0ffe
      J. Bruce Fields 提交于
      NFSv4 uses leases to guarantee that clients can cache metadata as well
      as data.
      
      Cc: Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
      Cc: David Howells <dhowells@redhat.com>
      Cc: Tyler Hicks <tyhicks@canonical.com>
      Cc: Dustin Kirkland <dustin.kirkland@gazzang.com>
      Acked-by: NJeff Layton <jlayton@redhat.com>
      Signed-off-by: NJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      27ac0ffe
    • J
      locks: break delegations on unlink · b21996e3
      J. Bruce Fields 提交于
      We need to break delegations on any operation that changes the set of
      links pointing to an inode.  Start with unlink.
      
      Such operations also hold the i_mutex on a parent directory.  Breaking a
      delegation may require waiting for a timeout (by default 90 seconds) in
      the case of a unresponsive NFS client.  To avoid blocking all directory
      operations, we therefore drop locks before waiting for the delegation.
      The logic then looks like:
      
      	acquire locks
      	...
      	test for delegation; if found:
      		take reference on inode
      		release locks
      		wait for delegation break
      		drop reference on inode
      		retry
      
      It is possible this could never terminate.  (Even if we take precautions
      to prevent another delegation being acquired on the same inode, we could
      get a different inode on each retry.)  But this seems very unlikely.
      
      The initial test for a delegation happens after the lock on the target
      inode is acquired, but the directory inode may have been acquired
      further up the call stack.  We therefore add a "struct inode **"
      argument to any intervening functions, which we use to pass the inode
      back up to the caller in the case it needs a delegation synchronously
      broken.
      
      Cc: David Howells <dhowells@redhat.com>
      Cc: Tyler Hicks <tyhicks@canonical.com>
      Cc: Dustin Kirkland <dustin.kirkland@gazzang.com>
      Acked-by: NJeff Layton <jlayton@redhat.com>
      Signed-off-by: NJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      b21996e3
  13. 08 11月, 2013 1 次提交
  14. 29 10月, 2013 1 次提交
  15. 26 10月, 2013 3 次提交
  16. 25 10月, 2013 1 次提交
  17. 24 10月, 2013 1 次提交
  18. 22 10月, 2013 1 次提交
    • Y
      regmap: irq: clear status when disable irq · 4bd7145b
      Yi Zhang 提交于
      clear the status bit if the mask register doesn't prevent
      the chip level irq from being asserted
      
      OR in the following sequence, there will be irq storm happens:
      1) interrupt is triggered;
      2) another thread disables it(the mask bit is set);
      3) _Then_ the interrupt thread is not ACKed(the status bit is not cleared),
         and it's ignored;
      4) if the irq is still asserted because of the uncleared status bit,
         the irq storm happens;
      Signed-off-by: NYi Zhang <yizhang@marvell.com>
      Signed-off-by: NMark Brown <broonie@linaro.org>
      4bd7145b
  19. 18 10月, 2013 1 次提交
    • B
      PM / Sleep: Detect device suspend/resume lockup and log event · 70fea60d
      Benoit Goby 提交于
      Rather than hard-lock the kernel, dump the suspend/resume thread stack
      and panic() to capture a message in pstore when a driver takes too long
      to suspend/resume. Default suspend/resume watchdog timeout is set to 12
      seconds to be longer than the usbhid 10 second timeout, but could be
      changed at compile time.
      
      Exclude from the watchdog the time spent waiting for children that
      are resumed asynchronously and time every device, whether or not they
      resumed synchronously.
      
      This patch is targeted for mobile devices where a suspend/resume lockup
      could cause a system reboot. Information about failing device can be
      retrieved in subsequent boot session by mounting pstore and inspecting
      the log. Laptops with EFI-enabled pstore could also benefit from
      this feature.
      
      The hardware watchdog timer is likely suspended during this time and
      couldn't be relied upon. The soft-lockup detector would eventually tell
      that tasks are not scheduled, but would provide little context as to why.
      The patch hence uses system timer and assumes it is still active while the
      devices are suspended/resumed.
      
      This feature can be enabled/disabled during kernel configuration.
      
      This change is based on earlier work by San Mehat.
      Signed-off-by: NBenoit Goby <benoit@android.com>
      Signed-off-by: NZoran Markovic <zoran.markovic@linaro.org>
      Acked-by: NUlf Hansson <ulf.hansson@linaro.org>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      70fea60d
  20. 17 10月, 2013 3 次提交
  21. 16 10月, 2013 1 次提交
  22. 15 10月, 2013 2 次提交
  23. 14 10月, 2013 2 次提交
  24. 11 10月, 2013 2 次提交
  25. 10 10月, 2013 1 次提交
    • A
      regmap: Fix regmap_bulk_write single-rw mutex deadlock · 4174a7a4
      Anthony Olech 提交于
      When regmap_bulk_write() is called with the map->use_single_rw flag set
      an immediate mutex deadlock happens because regmap_raw_write() is called
      after obtaining the mutex and regmap_raw_write() itself then tries to
      obtain the mutex as well.
      
      It is obvious that no one other than myself tried it with a real device.
      I did, but only for the purposes of an experiment and demonstration.
      
      But even if this situation will never ever happen with a real device, it
      is a bug and therefore should be fixed.
      Signed-off-by: NAnthony Olech <anthony.olech.opensource@diasemi.com>
      Signed-off-by: NMark Brown <broonie@linaro.org>
      4174a7a4
  26. 09 10月, 2013 1 次提交