Commit graph

288764 commits

Author SHA1 Message Date
Malcolm Priestley
4f3b7fed46 [media] lmedm04 ver 1.99 support for m88rs2000 v2
Support for m88rs2000 module.

The driver also attempts to overcome occasional lock problems.

Call backs are now used for read_status, signal level and SNR.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:55:37 -03:00
Mauro Carvalho Chehab
40841e7469 [media] m88rs2000: Don't fill info.type
This field is handled internally by the DVB core, with uses the
selected delivery system to fill it, when a DVBv3 call is
handled. So, drivers should not touch on it.

Cc: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:55:27 -03:00
Malcolm Priestley
ae8dc8ee2b [media] m88rs2000 1.12 v2 DVB-S frontend and tuner module
Support for m88rs2000 chip used in lmedm04 driver.

Note there are still lock problems.

Slow channel change due to the large block of registers sent in set_frontend.

Version 2 differences.
Front end is completely shut down when in sleep mode. This allow user to regain
control of device.
Kaffeine scan problem solved by removing register calls from get_frontend.
Kaffeine seems to call get_frontend when updating signal data. This can happen
in the middle of a tune stalling the driver.
Change calculations to those in the DS3000 driver.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:52:59 -03:00
Malcolm Priestley
77c2402dc6 [media] lmedm04 v1.98 Remove clear halt
These were in the original lme2510 device driver.

Removing them significantly speeds up the driver.

All tuners tested.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:48:33 -03:00
Santosh Nayak
3caaa20121 [media] dvb: negative value assigned to unsigned int in CDRXD()
In CDRXD(), Negative number is assigned to unsigned variable
'state->noise_cal.tdCal2.

Members of 'SNoiseCal' should be 'signed short'.

Signed-off-by: Santosh Nayak <santoshprasadnayak@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:39:14 -03:00
Alexey Khoroshilov
f3033aecf2 [media] dib9000: implement error handling for DibAcquireLock
DibAcquireLock() is implemented as mutex_lock_interruptible()
but the driver does not handle unsuccessful locking.
As a result it may lead to unlock of an unheld mutex.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:36:24 -03:00
Alexey Khoroshilov
9bb24a7e49 [media] dib9000: fix explicit lock mismatches
There are several error paths, where &state->platform.risc.mem_mbx_lock
is not unlocked. The patch fixes it.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:36:17 -03:00
Justin P. Mattock
b47acf2a16 [media] staging: Fix comments and some typos in staging/media/*
linux-next:
I like to spend some time reading code, in doing so I have found some
typos in some of the comments.

Signed-off-by: Justin P. Mattock <justinmattock@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:26:16 -03:00
Gianluca Gennari
abfac0b648 [media] as102: set optimal eLNA config values for each device
Ryley and me tested several eLNA configuration values with both a rooftop
and a portable antenna.

Ryley fuond out that the best value for his Elgato stick is indeed the current
default value 0xC0.

Instead, my stick is not capable of tuning VHF channels with 0xC0. With 0x80,
VHF works but the tuner sensitivity with the portable antenna is poor.
Instead, the value 0xA0 works with VHF and also gives good performance with
both the rooftop and the portable antenna.

So we concluded that devices built on the reference design work best with 0xA0,
while custom designs (Elgato, PCTV) seem to require 0xC0.

I also removed the unused parameter "minor" in struct as102_dev_t.

Signed-off-by: Gianluca Gennari <gennarone@gmail.com>
Signed-off-by: Ryley Angus <rangus@student.unimelb.edu.au>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:26:03 -03:00
Gianluca Gennari
abf9d00537 [media] as102: add __packed attribute to structs defined inside packed structs
This patch fixes a regression in kernel 3.3 due to this patch:

http://patchwork.linuxtv.org/patch/8332/

That patch changes "#pragma pack(1)" with "__packed" attributes, but it is not
complete. In fact, in the as102 driver there are a lot of structs/unions
defined inside other structs/unions.
When the "__packed" attribute is applied only on the external struct, it will
not affect the internal struct definitions.
So the regression is fixed by specifiying the "__packed" attribute also on the
internal structs.

This patch should go into 3.3, as it fixes a regression introduced in the new
kernel version.

Signed-off-by: Gianluca Gennari <gennarone@gmail.com>
Signed-off-by: Ryley Angus <rangus@student.unimelb.edu.au>
Cc: stable@kernel.org # for v3.3
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:26:02 -03:00
Jose Alberto Reguero
962f8f67e4 [media] Add CI support to az6007 driver
This patch add CI support to az6007 driver.

Signed-off-by: Jose Alberto Reguero <jareguero@telefonica.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:15:16 -03:00
Jesper Juhl
266e8ae37d [media] media, cx231xx: Fix double free on close
In cx231xx_v4l2_close() there are two calls to
cx231xx_release_resources(dev) followed by kfree(dev). That is a
problem since cx231xx_release_resources() already kfree()'s its
argument, so we end up doing a double free.

Easily resolved by just removing the redundant kfree() calls after the
calls to cx231xx_release_resources().

I also changed the 'dev = NULL' assignments (which are rather
pointless since 'dev' is about to go out of scope), to 'fh->dev = NULL'
since it looks to me that that is what was actually intended.
And I removed the 'dev = NULL' assignment at the end of
cx231xx_release_resources() since it is pointless.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:13:51 -03:00
Malcolm Priestley
1a611d8cd0 [media] lmedm04 ver 1.97 Remove delays required for STV0288
Remove delays added for STV0288 frontend.

This patch significantly speeds up channel change and scan.

It requires patch 10161-STV0288 increase delay between carrier search.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:12:53 -03:00
Malcolm Priestley
77768e4b75 [media] STV0288 increase delay between carrier search
The current delay of 30uS is too short to recover any carrier.

In the lmedm04 driver delays were added to overcome carrier lock
problems. The typical delay was 30mS (2 x 15ms register write
0x2c and read 0x24).

Other drivers that use STV0288 don't appear to have any delay are
likely to have also suffered this problem.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:12:32 -03:00
Andrew Morton
66ede038aa [media] uvcvideo: uvc_driver.c: use linux/atomic.h
There's no known problem here, but this is one of only two non-arch files
in the kernel which use asm/atomic.h instead of linux/atomic.h.

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:08:34 -03:00
Laurent Pinchart
3efe2f1b12 [media] uvcvideo: Add support for Dell XPS m1530 integrated webcam
The camera requires the PROBE_DEF quirk. Add a corresponding entry in
the device IDs list.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:07:41 -03:00
Javier Martin
ab86e9e03d [media] uvcvideo: Allow userptr IO mode
Userptr can be very useful if a UVC camera is requested to use video
buffers allocated by another processing device. So that buffers don't
need to be copied.

Signed-off-by: Javier Martin <javier.martin@vista-silicon.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:07:13 -03:00
Laurent Pinchart
1a5e4c867c [media] uvcvideo: Implement compat_ioctl32 for custom ioctls
Support 32-bit/64-bit compatibility for the the UVCIOC_ ioctls.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:07:01 -03:00
Laurent Pinchart
a3ec69b707 [media] uvcvideo: Return -ENOTTY in case of unknown ioctl
-EINVAL is the wrong error code in that case, replace it with -ENOTTY.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:06:27 -03:00
Laurent Pinchart
b9d0aa6e21 [media] v4l: Add custom compat_ioctl32 operation
Drivers implementing custom ioctls need to handle 32-bit/64-bit
compatibility themselves. Provide them with a way to do so.

To avoid circular module dependencies, merge the v4l2-compat-ioctl32
module into videodev. There is no point in keeping them separate, as the
v4l2_compat_ioctl32() function is required by videodev if CONFIG_COMPAT
is set anyway.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:06:12 -03:00
Hans Verkuil
f769c26085 [media] Two small string fixes in v4l2-ctrls.c
Fix one typo and use 'Microseconds' instead of 'useconds' in the pre-emphasis
descriptions.

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 14:03:35 -03:00
Mauro Carvalho Chehab
9ce28d827f Merge tag 'v3.3' into staging/for_v3.4
* tag 'v3.3': (1646 commits)
  Linux 3.3
  Don't limit non-nested epoll paths
  netfilter: ctnetlink: fix race between delete and timeout expiration
  ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu.
  nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
  nilfs2: clamp ns_r_segments_percentage to [1, 99]
  afs: Remote abort can cause BUG in rxrpc code
  afs: Read of file returns EBADMSG
  C6X: remove dead code from entry.S
  wimax/i2400m: fix erroneous NETDEV_TX_BUSY use
  net/hyperv: fix erroneous NETDEV_TX_BUSY use
  net/usbnet: reserve headroom on rx skbs
  bnx2x: fix memory leak in bnx2x_init_firmware()
  bnx2x: fix a crash on corrupt firmware file
  sch_sfq: revert dont put new flow at the end of flows
  ipv6: fix icmp6_dst_alloc()
  MAINTAINERS: Add Serge as maintainer of capabilities
  drivers/video/backlight/s6e63m0.c: fix corruption storing gamma mode
  MAINTAINERS: add entry for exynos mipi display drivers
  MAINTAINERS: fix link to Gustavo Padovans tree
  ...
2012-03-19 13:41:24 -03:00
Mauro Carvalho Chehab
f074ff92b5 [media] radio-sf16fmr2: fix session mismatches
WARNING: drivers/media/radio/built-in.o(.data+0x284): Section mismatch in reference from the variable fmr2_driver to the function .init.text:fmr2_probe()
The variable fmr2_driver references
the function __init fmr2_probe()
If the reference is valid then annotate the
variable with __init* or __refdata (see linux/init.h) or name the variable:
*_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console

WARNING: drivers/media/built-in.o(.data+0x48200): Section mismatch in reference from the variable fmr2_driver to the function .init.text:fmr2_probe()
The variable fmr2_driver references
the function __init fmr2_probe()
If the reference is valid then annotate the
variable with __init* or __refdata (see linux/init.h) or name the variable:
*_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console

Cc: Hans Verkuil <hans.verkuil@cisco.com>
Cc: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 13:32:37 -03:00
Hans Verkuil
9d17217330 [media] V4L2 Spec: return -EINVAL on unsupported wrap_around value
This is a small extension to the S_HW_FREQ_SEEK ioctl: if the wrap_around
value is not support by the hardware, then -EINVAL is returned.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 11:29:28 -03:00
Hans Verkuil
cfb19b0ab1 [media] radio-maxiradio: use the tea575x framework
This card is based on the tea575x receiver. Use the tea575x-tuner framework
instead of reinventing the wheel.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 11:29:09 -03:00
Hans Verkuil
bc2b395c03 [media] tea575x: fix HW seek
Fix HW seek in TEA575x to work properly:
- a delay must be present after search start and before first register read
  or the seek does weird things
- when the search stops, the new frequency is not available immediately, we
  must wait until it appears in the register (fortunately, we can clear the
  frequency bits when starting the search as it starts at the frequency
  currently set, not from the value written)
- sometimes, seek remains on the current frequency (or moves only a little),
  so repeat it until it moves by at least 50 kHz

Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 11:28:52 -03:00
Hans Verkuil
d4ecc83b79 [media] tea575x-tuner: update to latest V4L2 framework requirements
The tea575x-tuner module has been updated to use the latest V4L2 framework
functionality. This also required changes in the drivers that rely on it.

The tea575x changes are:

- The drivers must provide a v4l2_device struct to the tea module.
- The radio_nr module parameter must be part of the actual radio driver,
  and not of the tea module.
- Changed the frequency range to the normal 76-108 MHz range instead of
  50-150.
- Add hardware frequency seek support.
- Fix broken rxsubchans/audmode handling.
- The application can now select between stereo and mono.
- Support polling for control events.
- Add V4L2 priority handling.

And radio-sf16fmr2.c now uses the isa bus kernel framework.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Thanks-to: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 11:27:21 -03:00
Hans Verkuil
9f1dfccf66 [media] Add missing slab.h to fix linux-next compile errors
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reported-by: Randy Dunlap <rdunlap@xenotime.net>
Acked-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 11:25:12 -03:00
Andreas Regel
ef3d23de05 [media] stb0899: fixed reading of IF_AGC_GAIN register
When reading IF_AGC_GAIN register a wrong value for the base address
register was used (STB0899_DEMOD instead of STB0899_S2DEMOD). That
lead to a wrong signal strength value on DVB-S2 transponders.

Signed-off-by: Andreas Regel <andreas.regel@gmx.de>
Acked-by: Klaus Schmidinger <Klaus.Schmidinger@tvdr.de>
Cc: Manu Abraham <abraham.manu@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 11:22:52 -03:00
Andreas Regel
91caad3195 [media] stb0899: set FE_HAS_SIGNAL flag in read_status
In stb0899_read_status the FE_HAS_SIGNAL flag was not set in case of a
successful carrier lock. This change fixes that.

Signed-off-by: Andreas Regel <andreas.regel@gmx.de>
Acked-by: Klaus Schmidinger <Klaus.Schmidinger@tvdr.de>
Cc: Manu Abraham <abraham.manu@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 11:22:19 -03:00
Antti Palosaari
2b49fad595 [media] tda10071: fix the delivery system
Commit b2a29b578d sets accidentally
supported delivery systems as DVB-T/T2 whilst it should be
DVB-S/S2. Due to that frontend cannot be used at all.

Reported-by: Jiří Zelenka <klacek@bubakov.net>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Cc: stable@kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-03-19 10:47:50 -03:00
Linus Torvalds
c16fa4f2ad Linux 3.3 2012-03-18 16:15:34 -07:00
Jason Baron
93dc6107a7 Don't limit non-nested epoll paths
Commit 28d82dc1c4 ("epoll: limit paths") that I did to limit the
number of possible wakeup paths in epoll is causing a few applications
to longer work (dovecot for one).

The original patch is really about limiting the amount of epoll nesting
(since epoll fds can be attached to other fds). Thus, we probably can
allow an unlimited number of paths of depth 1. My current patch limits
it at 1000. And enforce the limits on paths that have a greater depth.

This is captured in: https://bugzilla.redhat.com/show_bug.cgi?id=681578

Signed-off-by: Jason Baron <jbaron@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-03-18 12:25:04 -07:00
Linus Torvalds
c579bc7e31 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking changes from David Miller:
 "1) icmp6_dst_alloc() returns NULL instead of ERR_PTR() leading to
     crashes, particularly during shutdown.  Reported by Dave Jones and
     fixed by Eric Dumazet.

  2) hyperv and wimax/i2400m return NETDEV_TX_BUSY when they have
     already freed the SKB, which causes crashes as to the caller this
     means requeue the packet.  Fixes from Eric Dumazet.

  3) usbnet driver doesn't allocate the right amount of headroom on
     fresh RX SKBs, fix from Eric Dumazet.

  4) Fix regression in ip6_mc_find_dev_rcu(), as an RCU lookup it
     abolutely should not take a reference to 'dev', this leads to
     leaks.  Fix from RonQing Li.

  5) Fix netfilter ctnetlink race between delete and timeout expiration.
     From Pablo Neira Ayuso.

  6) Revert SFQ change which causes regressions, specifically queueing
     to tail can lead to unavoidable flow starvation.  From Eric
     Dumazet.

  7) Fix a memory leak and a crash on corrupt firmware files in bnx2x,
     from Michal Schmidt."

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  netfilter: ctnetlink: fix race between delete and timeout expiration
  ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu.
  wimax/i2400m: fix erroneous NETDEV_TX_BUSY use
  net/hyperv: fix erroneous NETDEV_TX_BUSY use
  net/usbnet: reserve headroom on rx skbs
  bnx2x: fix memory leak in bnx2x_init_firmware()
  bnx2x: fix a crash on corrupt firmware file
  sch_sfq: revert dont put new flow at the end of flows
  ipv6: fix icmp6_dst_alloc()
2012-03-17 19:22:24 -07:00
Linus Torvalds
96ee0499c5 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf fixes from Ingo Molnar.

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf tools, x86: Build perf on older user-space as well
  perf tools: Use scnprintf where applicable
  perf tools: Incorrect use of snprintf results in SEGV
2012-03-17 09:54:16 -07:00
Pablo Neira Ayuso
a16a1647fa netfilter: ctnetlink: fix race between delete and timeout expiration
Kerin Millar reported hardlockups while running `conntrackd -c'
in a busy firewall. That system (with several processors) was
acting as backup in a primary-backup setup.

After several tries, I found a race condition between the deletion
operation of ctnetlink and timeout expiration. This patch fixes
this problem.

Tested-by: Kerin Millar <kerframil@gmail.com>
Reported-by: Kerin Millar <kerframil@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-17 01:47:08 -07:00
RongQing.Li
c577923756 ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu.
ip6_mc_find_dev_rcu() is called with rcu_read_lock(), so don't
need to dev_hold().
With dev_hold(), not corresponding dev_put(), will lead to leak.

[ bug introduced in 96b52e61be (ipv6: mcast: RCU conversions) ]

Signed-off-by: RongQing.Li <roy.qing.li@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-16 21:56:42 -07:00
Linus Torvalds
cb1ecf25a8 Merge branch 'akpm' (more patches from Andrew)
Merge some more email patches from Andrew Morton:
 "A couple of nilfs fixes"

* emailed from Andrew Morton <akpm@linux-foundation.org>:
  nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
  nilfs2: clamp ns_r_segments_percentage to [1, 99]
2012-03-16 17:14:55 -07:00
Ryusuke Konishi
d7178c79d9 nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
According to the report from Slicky Devil, nilfs caused kernel oops at
nilfs_load_super_block function during mount after he shrank the
partition without resizing the filesystem:

 BUG: unable to handle kernel NULL pointer dereference at 00000048
 IP: [<d0d7a08e>] nilfs_load_super_block+0x17e/0x280 [nilfs2]
 *pde = 00000000
 Oops: 0000 [#1] PREEMPT SMP
 ...
 Call Trace:
  [<d0d7a87b>] init_nilfs+0x4b/0x2e0 [nilfs2]
  [<d0d6f707>] nilfs_mount+0x447/0x5b0 [nilfs2]
  [<c0226636>] mount_fs+0x36/0x180
  [<c023d961>] vfs_kern_mount+0x51/0xa0
  [<c023ddae>] do_kern_mount+0x3e/0xe0
  [<c023f189>] do_mount+0x169/0x700
  [<c023fa9b>] sys_mount+0x6b/0xa0
  [<c04abd1f>] sysenter_do_call+0x12/0x28
 Code: 53 18 8b 43 20 89 4b 18 8b 4b 24 89 53 1c 89 43 24 89 4b 20 8b 43
 20 c7 43 2c 00 00 00 00 23 75 e8 8b 50 68 89 53 28 8b 54 b3 20 <8b> 72
 48 8b 7a 4c 8b 55 08 89 b3 84 00 00 00 89 bb 88 00 00 00
 EIP: [<d0d7a08e>] nilfs_load_super_block+0x17e/0x280 [nilfs2] SS:ESP 0068:ca9bbdcc
 CR2: 0000000000000048

This turned out due to a defect in an error path which runs if the
calculated location of the secondary super block was invalid.

This patch fixes it and eliminates the reported oops.

Reported-by: Slicky Devil <slicky.dvl@gmail.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: Slicky Devil <slicky.dvl@gmail.com>
Cc: <stable@vger.kernel.org>	[2.6.30+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-03-16 17:14:44 -07:00
Haogang Chen
3d777a6406 nilfs2: clamp ns_r_segments_percentage to [1, 99]
ns_r_segments_percentage is read from the disk.  Bogus or malicious
value could cause integer overflow and malfunction due to meaningless
disk usage calculation.  This patch reports error when mounting such
bogus volumes.

Signed-off-by: Haogang Chen <haogangchen@gmail.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-03-16 17:14:44 -07:00
Linus Torvalds
33e9ee8dbd Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
Pull maintainer update from James Morris:
 "Please pull this patch which adds Serge as maintainer of the
  capabilities code, as discussed on lwn and the lsm list.

  New capabilities must be signed off by the maintainer, and new uses of
  any capabilities should at be cc'd to the maintainer."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  MAINTAINERS: Add Serge as maintainer of capabilities
2012-03-16 17:04:02 -07:00
Linus Torvalds
9fc005c017 Remove dead code from entry.S which causes a build failure when using
a newer assembler (v2.22 complains about it, v2.20 ignores it).
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJPY0NTAAoJEOiN4VijXeFPpGcQAJ/tk1n7nlgVkmxvVpiqGj3s
 IFrdJJ8SQkj9VTSWQ9FVgxIpJIJ7J57FHoLJtVmz7HbDs6/LgSY/jSX40SzYlrgt
 84Wh8HD8Ycqi26YSr1+yLMfPsUhbp5d1065fl6E0XNSDkd5m9qH2Qmf4RenVLWcG
 P01jDnNAmz/NXHKLVlCZMdZlrUnFYZn5W5K8RidAc19Hv2nsDTa1p7OLpRhy05ST
 ZTXF5fioQoPwcCpsFkjDjANtltw1x4TvCxFG1ubttwBkIOZ0OUr3yTfd3AtShazV
 VC2etsiAcmKasUsIvCzh6EYd2t+i6GG+V7tM+i1ATlznGFE6PbGUHIWEWBVeo2XC
 7nq8S40d9Z9uExuFo3AtYSZhylwbU6v0ah+eGljhozQ8XBDLiCvTRX7ZpFq5AX4C
 F5nigoCrdvpw9mL06e9x4aVl1UgXlk+lkyjNE+EUhXf/0RtVf+2qDC2Is9enwdxR
 NDO6lSi1+pTgmDCgs6WhKaAQhijbAsi48JfGUj6C5ahMTBGTF5SbhjNzYZQU68A/
 2QsuuR0s9hwlXVldOcx1yxBVFuijX6L8CpWJSJPgvWI52f+9ZXNMPbj9Ty7efGKJ
 /xjvNjw48LHqDrzqzpGaZ1M8/JriuOTUOZV3khSpsk9tSSxXQ6LXsPjdoxziU/ed
 56umOZgs6HHe6ND1mwNe
 =dMe3
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming

Pull c6x bugfix from Mark Salter:
 "Remove dead code from entry.S which causes a build failure when using
  a newer assembler (v2.22 complains about it, v2.20 ignores it)."

* tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
  C6X: remove dead code from entry.S
2012-03-16 17:03:15 -07:00
Anton Blanchard
c017386352 afs: Remote abort can cause BUG in rxrpc code
When writing files to afs I sometimes hit a BUG:

kernel BUG at fs/afs/rxrpc.c:179!

With a backtrace of:

	afs_free_call
	afs_make_call
	afs_fs_store_data
	afs_vnode_store_data
	afs_write_back_from_locked_page
	afs_writepages_region
	afs_writepages

The cause is:

	ASSERT(skb_queue_empty(&call->rx_queue));

Looking at a tcpdump of the session the abort happens because we
are exceeding our disk quota:

	rx abort fs reply store-data error diskquota exceeded (32)

So the abort error is valid. We hit the BUG because we haven't
freed all the resources for the call.

By freeing any skbs in call->rx_queue before calling afs_free_call
we avoid hitting leaking memory and avoid hitting the BUG.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-03-16 17:01:41 -07:00
Anton Blanchard
2c724fb927 afs: Read of file returns EBADMSG
A read of a large file on an afs mount failed:

# cat junk.file > /dev/null
cat: junk.file: Bad message

Looking at the trace, call->offset wrapped since it is only an
unsigned short. In afs_extract_data:

        _enter("{%u},{%zu},%d,,%zu", call->offset, len, last, count);
...

        if (call->offset < count) {
                if (last) {
                        _leave(" = -EBADMSG [%d < %zu]", call->offset, count);
                        return -EBADMSG;
                }

Which matches the trace:

[cat   ] ==> afs_extract_data({65132},{524},1,,65536)
[cat   ] <== afs_extract_data() = -EBADMSG [0 < 65536]

call->offset went from 65132 to 0. Fix this by making call->offset an
unsigned int.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-03-16 17:01:41 -07:00
Mark Salter
6e780cf5c0 C6X: remove dead code from entry.S
The ENDPROC() on sys_fadvise64_c6x() in arch/c6x/kernel/entry.S is
outside of the conditional block with the matching ENTRY() macro. This
leads a newer (v2.22 vs. v2.20) assembler to complain:

  /tmp/ccGZBaPT.s: Assembler messages:
  /tmp/ccGZBaPT.s: Error: .size expression for sys_fadvise64_c6x does not evaluate to a constant

The conditional block became dead code when c6x switched to generic
unistd.h and should be removed along with the offending ENDPROC().

Signed-off-by: Mark Salter <msalter@redhat.com>
Acked-by: David Howells <dhowells@redhat.com>
2012-03-16 09:27:57 -04:00
Eric Dumazet
b8fbaef586 wimax/i2400m: fix erroneous NETDEV_TX_BUSY use
A driver start_xmit() method cannot free skb and return NETDEV_TX_BUSY,
since caller is going to reuse freed skb.

In fact netif_tx_stop_queue() / netif_stop_queue() is needed before
returning NETDEV_TX_BUSY or you can trigger a ksoftirqd fatal loop.

In case of memory allocation error, only safe way is to drop the packet
and return NETDEV_TX_OK

Also increments tx_dropped counter

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-16 02:01:41 -07:00
Eric Dumazet
bb6d5e76fb net/hyperv: fix erroneous NETDEV_TX_BUSY use
A driver start_xmit() method cannot free skb and return NETDEV_TX_BUSY,
since caller is going to reuse freed skb.

This is mostly a revert of commit bf769375c (staging: hv: fix the return
status of netvsc_start_xmit())

In fact netif_tx_stop_queue() / netif_stop_queue() is needed before
returning NETDEV_TX_BUSY or you can trigger a ksoftirqd fatal loop.

In case of memory allocation error, only safe way is to drop the packet
and return NETDEV_TX_OK

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: "K. Y. Srinivasan" <kys@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-16 02:01:17 -07:00
Eric Dumazet
7bdd402706 net/usbnet: reserve headroom on rx skbs
network drivers should reserve some headroom on incoming skbs so that we
dont need expensive reallocations, eg forwarding packets in tunnels.

This NET_SKB_PAD padding is done in various helpers, like
__netdev_alloc_skb_ip_align() in this patch, combining NET_SKB_PAD and
NET_IP_ALIGN magic.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Oliver Neukum <oneukum@suse.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-16 02:01:05 -07:00
Michal Schmidt
c0ea452e42 bnx2x: fix memory leak in bnx2x_init_firmware()
When cycling the interface down and up, bnx2x_init_firmware() knows that
the firmware is already loaded, but nevertheless it allocates certain
arrays anew (init_data, init_ops, init_ops_offsets, iro_arr). The old
arrays are leaked.

Fix the leaks by returning early if the firmware was already loaded.
Because if the firmware is loaded, so are the arrays.

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Acked-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-16 01:57:26 -07:00
Michal Schmidt
127d0a198a bnx2x: fix a crash on corrupt firmware file
If the requested firmware is deemed corrupt and then released, reset the
pointer to NULL in order to avoid double-freeing it in
bnx2x_release_firmware() or dereferencing it in bnx2x_init_firmware().

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Acked-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-03-16 01:57:26 -07:00