summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* spi/bfin_spi: namespace local structsMike Frysinger2010-10-181-58/+61
| | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: init earlyMichael Hennerich2010-10-181-1/+1
| | | | | | | | | | Some systems using this bus sometimes have very basic devices on them such as regulators. So we need to be loaded even earlier in case the devices are used by things such as early board init code. Therefore register in subsys_initcall(). Signed-off-by: Michael Hennerich <michael.hennerich@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: check per-transfer bits_per_wordBob Liu2010-10-181-1/+6
| | | | | | | | Currently, if the bits_per_word when doing a transfer is not 8bits, we always treat it as 16bits when we should actually be returning an error. Signed-off-by: Bob Liu <lliubbo@gmail.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: warn when CS is driven by hardware (CPHA=0)Barry Song2010-10-181-2/+7
| | | | | | | | | When the hardware is controlling the CS, there are some SPI options we are unable to support. So issue a warning in the hopes that the user will change to a SPI mode where we can support things sanely. Signed-off-by: Barry Song <barry.song@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: cs should be always low when a new transfer beginsRob Maris2010-10-181-2/+1
| | | | | | Signed-off-by: Rob Maris <maris.rob@vdi.de> Signed-off-by: Barry Song <barry.song@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: fix typo in commentRob Maris2010-10-181-1/+1
| | | | | | Signed-off-by: Rob Maris <maris.rob@vdi.de> Signed-off-by: Barry Song <barry.song@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: reject unsupported SPI modesMike Frysinger2010-10-181-0/+4
| | | | | | Who knows what people will try! Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: use dma_disable_irq_nosync() in irq handlerBarry Song2010-10-181-1/+1
| | | | | | | | Using disable_irq() on the IRQ whose handler we are currently executing in can easily lead to a hang. So use the nosync variant here. Signed-off-by: Barry Song <barry.song@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: combine duplicate SPI_CTL read/write logicMike Frysinger2010-10-182-90/+18
| | | | | | | While combining things, also switch to the proper SPI bit define names. This lets us punt the rarely used SPI defines. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: reset ctl_reg bits when setup is run again on a deviceMike Frysinger2010-10-181-3/+9
| | | | | | | | | | During runtime, the spi setup function may be called multiple times on the same device in order to reconfigure some settings on the fly. When this happens, we need to reset the ctl_reg bits so that changing the mode works as expected. Reported-by: Andy Getzendanner <james.getzendanner@students.olin.edu> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: push all size checks into the transfer functionMike Frysinger2010-10-181-43/+14
| | | | | | | | This reduces duplication between the setup/transfer functions and keeps values cached during setup from overriding values changed on a transfer basis (like bits_per_word). Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: use nosync when disabling the IRQ from the IRQ handlerYi Li2010-10-181-1/+1
| | | | | | | | Using disable_irq() on the IRQ whose handler we are currently executing in can easily lead to a hang. So use the nosync variant here. Signed-off-by: Yi Li <yi.li@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: sync hardware state before reprogramming everythingBarry Song2010-10-181-0/+2
| | | | | | | | | | Sometimes under load, the Blackfin core is able to send SPI register updates out before the controller is actually disabled. So when we go to reprogram the entire state (to switch to a different slave), make sure we sync after disabling the controller. Signed-off-by: Barry Song <barry.song@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: save/restore state when suspending/resumingBarry Song2010-10-181-4/+13
| | | | | | | | We can't rely on the SPI_CTL/SPI_FLG registers retaining their state when suspending, so save/restore their entire values. Signed-off-by: Barry Song <barry.song@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: redo GPIO CS handlingBarry Song2010-10-182-20/+23
| | | | | | | | | | | | | | | | | The common SPI layers take care of detecting CS conflicts and preventing two devices from claiming the same CS. This causes problems for the GPIO CS support we currently have as we are using CS0 to mean "GPIO CS". But if we have multiple devices using a GPIO CS, the common SPI layers see multiple devices using the virtual "CS0" and reject any such attempts. To make both work, we introduce an offset define. This represents the max number of hardware CS values that the SPI peripheral supports. If the CS is below this limit, we know we can use the hardware CS. If it's above, we treat it as a GPIO CS. This keeps the CS unique as seen by the common code and prevents conflicts. Signed-off-by: Barry Song <barry.song@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* Blackfin: SPI: expand SPI bitmasksMike Frysinger2010-10-181-4/+7
| | | | | | | Expand the BIT_CTL defines to use the naming convention of the hardware, and expand the masks to cover all documented bits. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: use the SPI namespaced bit namesMike Frysinger2010-10-181-10/+11
| | | | | | This lets us push the short SPI MMR bit names out of the global namespace. Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: drop extra memory we don't needMike Frysinger2010-10-181-2/+2
| | | | | | | | The driver that we based ours on uses a little extra memory behind the normal driver state, but we don't. So drop this useless bit of memory. Reported-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: convert struct names to something more logicalMike Frysinger2010-10-181-50/+50
| | | | | | | | The current structure names are a bit confusing as to what they represent, so use better names. Reported-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: convert read/write/duplex funcs to a dedicated ops structureMike Frysinger2010-10-181-26/+32
| | | | | | | | Rather than having to look up the same 3 sets of functions at the same time, just use an ops structure so we only need to set one pointer. Reported-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: convert queue run state to true/falseMike Frysinger2010-10-181-10/+8
| | | | | | | | No point in creating our own version of true/false defines when there is already a standard stdbool available to us. Reported-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: fix up some unused/misleading commentsMike Frysinger2010-10-181-6/+2
| | | | | Reported-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: punt useless null read/write funcsMike Frysinger2010-10-181-42/+5
| | | | | | | | The chip ops should always be initialized, so having null fallback functions are useless. Reported-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: drop custom cs_change_per_word supportMike Frysinger2010-10-182-137/+12
| | | | | | | | | As David points out, the cs_change_per_word option isn't standard, nor is anyone actually using it. So punt all of the dead code considering it makes up ~10% of the code size. Reported-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: fix CS handlingBarry Song2010-10-181-6/+27
| | | | | | | | | | | | | | The CS helper functions were toggling both the Flag Enable and the Flag Value bits, but the Flag Value bit is ignored if the corresponding Flag Enable bit is cleared. So under high speed transactions, the CS sometimes would not toggle properly. Since it makes no sense to toggle the Flag Enable bit dynamically when we actually want to control the Flag Value, do this when setting up the device and then only handle toggling of the CS value during runtime. Signed-off-by: Barry Song <barry.song@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: utilize the SPI interrupt in PIO modeYi Li2010-10-181-50/+185
| | | | | | | | | | The current behavior in PIO mode is to poll the SPI status registers which can obviously lead to higher latencies when doing a lot of SPI traffic. There is a SPI interrupt which can be used instead to signal individual completion of transactions. Signed-off-by: Yi Li <yi.li@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: force sane master-mode state at bootWolfgang Muees2010-10-181-0/+6
| | | | | | | | | | | | | | | | | | | We should make sure the SPI controller is in a sane state in case the boot loader left it in a crappy state. Such as DMA pending which causes interrupts to fire on us. When setting a sane initial state, do not default to slave mode. If we do, then the SPI peripheral may implicitly take over the SPISS pin which other things might be using. For example, the BF533-STAMP uses this pin as a GPIO to control switching between ethernet and flash. If the SPI peripheral controls the output state instead, the ethernet is no longer accessible. URL: http://blackfin.uclinux.org/gf/tracker/5630 Signed-off-by: Wolfgang Muees <wolfgang.mues@auerswald.de> Signed-off-by: Michael Hennerich <michael.hennerich@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: work around anomaly 05000119Sonic Zhang2010-10-181-4/+0
| | | | | | | | | Anomaly 05000119 states that the DMA_RUN bit with peripherals isn't reliable. However, the way the driver is currently written (DMA IRQ callback), we don't need the polling in the first place, so drop it. Signed-off-by: Sonic Zhang <sonic.zhang@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* spi/bfin_spi: fix resources leakageDaniel Mack2010-10-181-45/+75
| | | | | | | | | | Re-order setup() a bit so we don't leak memory/dma/gpio resources upon errors. Also make sure we don't call kfree() twice on the same object. Signed-off-by: Daniel Mack <daniel@caiaq.de> Signed-off-by: Bryan Wu <cooloney@kernel.org> Signed-off-by: Yi Li <yi.li@analog.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* Merge branch 'fix/misc' of ↵Linus Torvalds2010-10-171-1/+3
|\ | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: rawmidi: fix oops (use after free) when unloading a driver module
| * ALSA: rawmidi: fix oops (use after free) when unloading a driver moduleClemens Ladisch2010-10-171-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When a driver module is unloaded and the last still open file is a raw MIDI device, the card and its devices will be actually freed in the snd_card_file_remove() call when that file is closed. Afterwards, rmidi and rmidi->card point into freed memory, so the module pointer is likely to be garbage. (This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.) Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Reported-by: Krzysztof Foltman <wdev@foltman.com> Cc: 2.6.30-2.6.35 <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | m32r: test __LITTLE_ENDIAN__ instead of __LITTLE_ENDIANKyle McMartin2010-10-151-2/+2
| | | | | | | | | | | | | | Fixes build for me... these are what's tested in byteorder.h... Signed-off-by: Kyle McMartin <kyle@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | m32r: add kernel/.gitignore and ignore vmlinux.ldsKyle McMartin2010-10-151-0/+1
| | | | | | | | | | Signed-off-by: Kyle McMartin <kyle@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | m32r: get_user takes an lvalue, not a pointerKyle McMartin2010-10-151-1/+1
| | | | | | | | | | | | Signed-off-by: Kyle McMartin <kyle@redhat.com> Acked-by: Al "my fuckup" Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | m32r: restore _BLOCKABLEKyle McMartin2010-10-151-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit a7f8388e accidentally removed it... Al explains: "Sorry, reordering breakage. In the signals tree here I have static inline void sig_set_blocked(struct sigset_t *set) ... and it's used all over the place (including quite a few places where we currently have sigprocmask(SIG_SETMASK, set, NULL), which is what it's equivalent to). With that done, m32r doesn't use _BLOCKABLE anywhere, so it got removed. And that chunk got picked when I'd been reordering the queue to pull the arch-specific fixes in front. Sorry." Signed-off-by: Kyle McMartin <kyle@redhat.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | types.h: define __aligned_u64 and expose to userspaceEric Paris2010-10-151-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We currently have a kernel internal type called aligned_u64 which aligns __u64's on 8 bytes boundaries even on systems which would normally align them on 4 byte boundaries. This patch creates a new type __aligned_u64 which does the same thing but which is exposed to userspace rather than being kernel internal. [akpm: merge early as both the net and audit trees want this] [akpm@linux-foundation.org: enhance the comment describing the reasons for using aligned_u64. Via Andreas and Andi.] Based-on-patch-by: Andreas Gruenbacher <agruen@suse.de> Signed-off-by: Eric Paris <eparis@redhat.com> Cc: Jan Engelhardt <jengelh@medozas.de> Cc: David Miller <davem@davemloft.net> Cc: Andi Kleen <andi@firstfloor.org> Cc: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | uml: fix buildFUJITA Tomonori2010-10-151-9/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix a build error introduced by d6d1b650ae6acce73d55dd024 ("param: simple locking for sysfs-writable charp parameters"). CC arch/um/kernel/trap.o arch/um/drivers/hostaudio_kern.c: In function 'hostaudio_open': arch/um/drivers/hostaudio_kern.c:204: error: '__param_dsp' undeclared (first use in this function) arch/um/drivers/hostaudio_kern.c:204: error: (Each undeclared identifier is reported only once arch/um/drivers/hostaudio_kern.c:204: error: for each function it appears in.) arch/um/drivers/hostaudio_kern.c: In function 'hostmixer_open_mixdev': arch/um/drivers/hostaudio_kern.c:265: error: '__param_mixer' undeclared (first use in this function) arch/um/drivers/hostaudio_kern.c:272: error: '__param_dsp' undeclared (first use in this function) Reported-by: Toralf Förster <toralf.foerster@gmx.de> Tested-by: Toralf Förster <toralf.foerster@gmx.de> Cc: Rusty Russell <rusty@rustcorp.com.au> Cc: Takashi Iwai <tiwai@suse.de> Cc: Jeff Dike <jdike@addtoit.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | sysctl: min/max bounds are optionalEric Dumazet2010-10-151-9/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | sysctl check complains with a WARN() when proc_doulongvec_minmax() or proc_doulongvec_ms_jiffies_minmax() are used by a vector of longs (with more than one element), with no min or max value specified. This is unexpected, given we had a bug on this min/max handling :) Reported-by: Jiri Slaby <jirislaby@gmail.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: David Miller <davem@davemloft.net> Acked-by: WANG Cong <xiyou.wangcong@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | Merge branch 'for-linus' of ↵Linus Torvalds2010-10-151-0/+13
|\ \ | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: mmc: sdio: fix SDIO suspend/resume regression
| * | mmc: sdio: fix SDIO suspend/resume regressionOhad Ben-Cohen2010-10-151-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix SDIO suspend/resume regression introduced by 4c2ef25fe0b "mmc: fix all hangs related to mmc/sd card insert/removal during suspend/resume": PM: Syncing filesystems ... done. Freezing user space processes ... (elapsed 0.01 seconds) done. Freezing remaining freezable tasks ... (elapsed 0.01 seconds) done. Suspending console(s) (use no_console_suspend to debug) pm_op(): platform_pm_suspend+0x0/0x5c returns -38 PM: Device pxa2xx-mci.0 failed to suspend: error -38 PM: Some devices failed to suspend 4c2ef25fe0b moved the card removal/insertion mechanism out of MMC's suspend/resume path and into pm notifiers (mmc_pm_notify), and that broke SDIO's expectation that mmc_suspend_host() will remove the card, and squash the error, in case -ENOSYS is returned from the bus suspend handler (mmc_sdio_suspend() in this case). mmc_sdio_suspend() is using this whenever at least one of the card's SDIO function drivers does not have suspend/resume handlers - in that case it is agreed to force removal of the entire card. This patch fixes this regression by trivially bringing back that part of mmc_suspend_host(), which was removed by 4c2ef25fe0b. Reported-and-tested-by: Sven Neumann <s.neumann@raumfeld.com> Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com> Cc: Maxim Levitsky <maximlevitsky@gmail.com> Cc: <stable@kernel.org> Acked-by: Nicolas Pitre <nico@fluxnic.net> Signed-off-by: Chris Ball <cjb@laptop.org>
* | | Merge branch 'timers-for-linus-urgent' of ↵Linus Torvalds2010-10-151-2/+11
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-for-linus-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: hrtimer: Preserve timer state in remove_hrtimer()
| * | | hrtimer: Preserve timer state in remove_hrtimer()Salman Qazi2010-10-141-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The race is described as follows: CPU X CPU Y remove_hrtimer // state & QUEUED == 0 timer->state = CALLBACK unlock timer base timer->f(n) //very long hrtimer_start lock timer base remove_hrtimer // no effect hrtimer_enqueue timer->state = CALLBACK | QUEUED unlock timer base hrtimer_start lock timer base remove_hrtimer mode = INACTIVE // CALLBACK bit lost! switch_hrtimer_base CALLBACK bit not set: timer->base changes to a different CPU. lock this CPU's timer base The bug was introduced with commit ca109491f (hrtimer: removing all ur callback modes) in 2.6.29 [ tglx: Feed new state via local variable and add a comment. ] Signed-off-by: Salman Qazi <sqazi@google.com> Cc: akpm@linux-foundation.org Cc: Peter Zijlstra <peterz@infradead.org> LKML-Reference: <20101012142351.8485.21823.stgit@dungbeetle.mtv.corp.google.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@kernel.org
* | | | Merge branch 'upstream-fixes' of ↵Linus Torvalds2010-10-155-0/+17
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid * 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: Add Cando touch screen 15.6-inch product id HID: Add MULTI_INPUT quirk for turbox/mosart touchscreen HID: hidraw, fix a NULL pointer dereference in hidraw_write HID: hidraw, fix a NULL pointer dereference in hidraw_ioctl
| * | | | HID: Add Cando touch screen 15.6-inch product idFrançois Jaouen2010-10-133-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This add the product id of the touch screen found on ACER Aspire 5738PZ. Works with hid-cando driver. Signed-off-by: Francois Jaouen<francois.jaouen@laposte.net> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | HID: Add MULTI_INPUT quirk for turbox/mosart touchscreenPierre BAILLY2010-10-122-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This device generates ABS_Z and ABS_RX events, while it should be generating ABS_X and ABS_Y instead. Using the MULTI_INPUT quirk solves this issue. Reference: https://bugs.launchpad.net/ubuntu/+bug/620609/ Signed-off-by: Pierre BAILLY <pierre@substantiel.fr> Signed-off-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | HID: hidraw, fix a NULL pointer dereference in hidraw_writeAntonio Ospite2010-10-061-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 IP: [<ffffffffa0f0a625>] hidraw_write+0x3b/0x116 [hid] [...] This is reproducible by disconnecting the device while userspace writes to dev node in a loop and doesn't check return values in order to exit the loop. Signed-off-by: Antonio Ospite <ospite@studenti.unina.it> Cc: stable@kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
| * | | | HID: hidraw, fix a NULL pointer dereference in hidraw_ioctlAntonio Ospite2010-10-061-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 IP: [<ffffffffa02c66b4>] hidraw_ioctl+0xfc/0x32c [hid] [...] This is reproducible by disconnecting the device while userspace does ioctl in a loop and doesn't check return values in order to exit the loop. Signed-off-by: Antonio Ospite <ospite@studenti.unina.it> Cc: stable@kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* | | | | Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-blockLinus Torvalds2010-10-152-5/+6
|\ \ \ \ \ | |_|_|/ / |/| | | | | | | | | | | | | | | | | | | * 'for-linus' of git://git.kernel.dk/linux-2.6-block: ubd: fix incorrect sector handling during request restart ps3disk: passing wrong variable to bvec_kunmap_irq()
| * | | | ubd: fix incorrect sector handling during request restartTejun Heo2010-10-151-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit f81f2f7c (ubd: drop unnecessary rq->sector manipulation) dropped request->sector manipulation in preparation for global request handling cleanup; unfortunately, it incorrectly assumed that the updated sector wasn't being used. ubd tries to issue as many requests as possible to io_thread. When issuing fails due to memory pressure or other reasons, the device is put on the restart list and issuing stops. On IO completion, devices on the restart list are scanned and IO issuing is restarted. ubd issues IOs sg-by-sg and issuing can be stopped in the middle of a request, so each device on the restart queue needs to remember where to restart in its current request. ubd needs to keep track of the issue position itself because, * blk_rq_pos(req) is now updated by the block layer to keep track of _completion_ position. * Multiple io_req's for the current request may be in flight, so it's difficult to tell where blk_rq_pos(req) currently is. Add ubd->rq_pos to keep track of the issue position and use it to correctly restart io_req issue. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Richard Weinberger <richard@nod.at> Tested-by: Richard Weinberger <richard@nod.at> Tested-by: Chris Frey <cdfrey@foursquare.net> Cc: stable@kernel.org Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
| * | | | ps3disk: passing wrong variable to bvec_kunmap_irq()Dan Carpenter2010-10-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This should pass "buf" to bvec_kunmap_irq() instead of "bv". The api is like kmap_atomic() instead of kmap(). Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
OpenPOWER on IntegriCloud