aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
Commit message (Collapse)AuthorAge
...
* iwlwifi: range checking issueDan Carpenter2010-04-26
| | | | | | | | | | | | | | | | | | | commit 8e1a53c615e8efe0fac670f2973da64758748a8a upstream. IWL_RATE_COUNT is 13 and IWL_RATE_COUNT_LEGACY is 12. IWL_RATE_COUNT_LEGACY is the right one here because iwl3945_rates doesn't support 60M and also that's how "rates" is defined in iwlcore_init_geos() from drivers/net/wireless/iwlwifi/iwl-core.c. rates = kzalloc((sizeof(struct ieee80211_rate) * IWL_RATE_COUNT_LEGACY), GFP_KERNEL); Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* iwlwifi: counting number of tfds can be free for 4965Wey-Yi Guy2010-04-26
| | | | | | | | | | | | | commit be6b38bcb175613f239e0b302607db346472c6b6 upstream. Forget one hunk in 4965 during "iwlwifi: error checking for number of tfds in queue" patch. Reported-by: Shanyu Zhao <shanyu.zhao@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* iwlwifi: fix regulatoryReinette Chatre2010-04-26
| | | | | | | | | | | | | commit f6c8f1523a2de3b84340e45913cbcee8bee74570 upstream. Commit "cfg80211: convert bools into flags" mistakenly modified iwlwifi's regulatory settings instead of just converting it. Fix this. This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2172 Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* libiscsi: Fix recovery slowdown regressionMike Christie2010-04-26
| | | | | | | | | | | | | | | | | | | | | | | commit 4ae0a6c15efcc37e94e3f30e3533bdec03c53126 upstream. We could be failing/stopping a connection due to libiscsi starting recovery/cleanup, but the xmit path or scsi eh thread path could be dropping the connection at the same time. As a result the session->state gets set to failed instead of in recovery. We end up not blocking the session and so the replacement timeout never gets started and we only end up failing the IO when scsi_softirq_done sees that the cmd has been running for (cmd->allowed + 1) * rq->timeout secs. We used to fail the IO right away so users are seeing a long delay when using dm-multipath. This problem was added in 2.6.28. Signed-off-by: Mike Christie <michaelc@cs.wisc.edu> Signed-off-by: James Bottomley <James.Bottomley@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* drm: Return ENODEV if the inode mapping changesChris Wilson2010-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit da58405860b992d2bb21ebae5d685fe3204dd3f0 upstream. Replace a BUG_ON with an error code in the event that the inode mapping changes between calls to drm_open. This may happen for instance if udev is loaded subsequent to the original opening of the device: [ 644.291870] kernel BUG at drivers/gpu/drm/drm_fops.c:146! [ 644.291876] invalid opcode: 0000 [#1] SMP [ 644.291882] last sysfs file: /sys/kernel/uevent_seqnum [ 644.291888] [ 644.291895] Pid: 7276, comm: lt-cairo-test-s Not tainted 2.6.34-rc1 #2 N150/N210/N220 /N150/N210/N220 [ 644.291903] EIP: 0060:[<c11c70e3>] EFLAGS: 00210283 CPU: 0 [ 644.291912] EIP is at drm_open+0x4b1/0x4e2 [ 644.291918] EAX: f72d8d18 EBX: f790a400 ECX: f73176b8 EDX: 00000000 [ 644.291923] ESI: f790a414 EDI: f790a414 EBP: f647ae20 ESP: f647adfc [ 644.291929] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 [ 644.291937] Process lt-cairo-test-s (pid: 7276, ti=f647a000 task=f73f5c80 task.ti=f647a000) [ 644.291941] Stack: [ 644.291945] 00000000 f7bb7400 00000080 f6451100 f73176b8 f6479214 f6451100 f73176b8 [ 644.291957] <0> c1297ce0 f647ae34 c11c6c04 f73176b8 f7949800 00000000 f647ae54 c1080ac5 [ 644.291969] <0> f7949800 f6451100 00000000 f6451100 f73176b8 f6452780 f647ae70 c107d1e6 [ 644.291982] Call Trace: [ 644.291991] [<c11c6c04>] ? drm_stub_open+0x8a/0xb8 [ 644.292000] [<c1080ac5>] ? chrdev_open+0xef/0x106 [ 644.292008] [<c107d1e6>] ? __dentry_open+0xd4/0x1a6 [ 644.292015] [<c107d35b>] ? nameidata_to_filp+0x31/0x45 [ 644.292022] [<c10809d6>] ? chrdev_open+0x0/0x106 [ 644.292030] [<c10864e2>] ? do_last+0x346/0x423 [ 644.292037] [<c108789f>] ? do_filp_open+0x190/0x415 [ 644.292046] [<c1071eb5>] ? handle_mm_fault+0x214/0x710 [ 644.292053] [<c107d008>] ? do_sys_open+0x4d/0xe9 [ 644.292061] [<c1016462>] ? do_page_fault+0x211/0x23f [ 644.292068] [<c107d0f0>] ? sys_open+0x23/0x2b [ 644.292075] [<c1002650>] ? sysenter_do_call+0x12/0x26 [ 644.292079] Code: 89 f0 89 55 dc e8 8d 96 0a 00 8b 45 e0 8b 55 dc 83 78 04 01 75 28 8b 83 18 02 00 00 85 c0 74 0f 8b 4d ec 3b 81 ac 00 00 00 74 13 <0f> 0b eb fe 8b 4d ec 8b 81 ac 00 00 00 89 83 18 02 00 00 89 f0 [ 644.292143] EIP: [<c11c70e3>] drm_open+0x4b1/0x4e2 SS:ESP 0068:f647adfc [ 644.292175] ---[ end trace 2ddd476af89a60fa ]--- Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* drm/radeon/kms: fix pal tv-out support on legacy IGP chipsAlex Deucher2010-04-26
| | | | | | | | | | | commit 15f7207761cfcf8f53fb6e5cacffe060478782c3 upstream. Based on ddx patch by Andrzej Hajda. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* drm/radeon/kms: don't print error on -ERESTARTSYS.Dave Airlie2010-04-26
| | | | | | | | | | | commit 97f23b3d85a4d734a8584dade3a34579931c8f8d upstream. We can get this if the user moves the mouse when we are waiting to move some stuff around in the validate. Don't fail. Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* drm/radeon/kms: Fix NULL pointer dereference if memory allocation failed in ↵Stefan Lippers-Hollmann2010-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | a simple way > From: Pauli Nieminen <suokkos@gmail.com> > Date: Fri, 19 Mar 2010 07:44:33 +0000 > Subject: drm/radeon/kms: Fix NULL pointer dereference if memory allocation failed. > > From: Pauli Nieminen <suokkos@gmail.com> > > commit fcbc451ba1948fba967198bd150ecbd10bbb7075 upstream. > > When there is allocation failure in radeon_cs_parser_relocs parser->nrelocs > is not cleaned. This causes NULL pointer defeference in radeon_cs_parser_fini > when clean up code is trying to loop over the relocation array and free the > objects. > > Fix adds a check for a possible NULL pointer in clean up code. [...] This patch breaks compiling kernel 2.6.33 + the current stable queue: CC [M] drivers/gpu/drm/radeon/radeon_cs.o /tmp/buildd/linux-sidux-2.6-2.6.33/debian/build/source_amd64_none/drivers/gpu/drm/radeon/radeon_cs.c: In function 'radeon_cs_parser_fini': /tmp/buildd/linux-sidux-2.6-2.6.33/debian/build/source_amd64_none/drivers/gpu/drm/radeon/radeon_cs.c:200: error: implicit declaration of function 'drm_gem_object_unreference_unlocked' make[6]: *** [drivers/gpu/drm/radeon/radeon_cs.o] Error 1 as it depends on the introduction of drm_gem_object_unreference_unlocked() in: Commit: c3ae90c099bb62387507e86da7cf799850444b08 Author: Luca Barbieri <luca@luca-barbieri.com> AuthorDate: Tue Feb 9 05:49:11 2010 +0000 drm: introduce drm_gem_object_[handle_]unreference_unlocked This patch introduces the drm_gem_object_unreference_unlocked and drm_gem_object_handle_unreference_unlocked functions that do not require holding struct_mutex. drm_gem_object_unreference_unlocked calls the new ->gem_free_object_unlocked entry point if available, and otherwise just takes struct_mutex and just calls ->gem_free_object which in turn suggests: Commit: bc9025bdc4e2b591734cca17697093845007b63d Author: Luca Barbieri <luca@luca-barbieri.com> AuthorDate: Tue Feb 9 05:49:12 2010 +0000 Use drm_gem_object_[handle_]unreference_unlocked where possible Mostly obvious simplifications. The i915 pread/pwrite ioctls, intel_overlay_put_image and nouveau_gem_new were incorrectly using the locked versions without locking: this is also fixed in this patch. which don't really look like candidates for 2.6.33-stable. > --- a/drivers/gpu/drm/radeon/radeon_cs.c > +++ b/drivers/gpu/drm/radeon/radeon_cs.c > @@ -193,11 +193,13 @@ static void radeon_cs_parser_fini(struct > radeon_bo_list_fence(&parser->validated, parser->ib->fence); > } > radeon_bo_list_unreserve(&parser->validated); > - for (i = 0; i < parser->nrelocs; i++) { > - if (parser->relocs[i].gobj) { > - mutex_lock(&parser->rdev->ddev->struct_mutex); > - drm_gem_object_unreference(parser->relocs[i].gobj); > - mutex_unlock(&parser->rdev->ddev->struct_mutex); > + if (parser->relocs != NULL) { ^ the only important part, the rest merely covers the new indentation level > + for (i = 0; i < parser->nrelocs; i++) { > + if (parser->relocs[i].gobj) { > + mutex_lock(&parser->rdev->ddev->struct_mutex); > + drm_gem_object_unreference_unlocked(parser->relocs[i].gobj); ^ drm_gem_object_unreference_unlocked() doesn't exist in 2.6.33, yet we can use drm_gem_object_unreference() instead. > + mutex_unlock(&parser->rdev->ddev->struct_mutex); > + } > } > } > kfree(parser->track); As a consequence, I'd suggest to merely backport the NULL pointer check, while ignoring the simplification of using the newly introduced drm_gem_object_unreference_unlocked() from 2.6.34: Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> Cc: Pauli Nieminen <suokkos@gmail.com> Cc: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* drm/radeon/kms: never treat rs4xx as AGPAlex Deucher2010-04-26
| | | | | | | | | | | | | | | | commit f95df9ca6896978108201a77422a1ae2cdc595ec upstream. RS4xx+ IGP chips use an internal gart, however, some of them have the agp cap bits set in their pci configs. Make sure to clear the AGP flag as AGP will not work with them. Should fix fdo bug 27225 Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* drm: remove the EDID blob stored in the EDID property when it is disconnectedZhao Yakui2010-04-26
| | | | | | | | | | | | | | | | | | commit 725398322d05486109375fbb85c3404108881e17 upstream. Now the EDID property will be updated when the corresponding EDID can be obtained from the external display device. But after the external device is plugged-out, the EDID property is not updated. In such case we still get the corresponding EDID property although it is already detected as disconnected. https://bugs.freedesktop.org/show_bug.cgi?id=26743 Signed-off-by: Zhao Yakui <yakui.zhao@intel.com> Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* drm/edid: allow certain bogus edids to hit a fixup path rather than failBen Skeggs2010-04-26
| | | | | | | | | commit 44fef22416886a04d432043f741a6faf2c6ffefd upstream. Signed-off-by: Ben Skeggs <bskeggs@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* pata_via: fix VT6410/6415/6330 detection issueJosephChan@via.com.tw2010-04-01
| | | | | | | | | | | | | | | commit bc8a67386fd462914269fa93446e1891955a8bb3 upstream. When using VT6410/6415/6330 chips on some VIA's platforms, the HDD connection to VT6410/6415/6330 cannot be detected. It is because the driver detects wrong via_isa_bridge ID, and then causes this issue to happen. Signed-off-by: Joseph Chan <josephchan@via.com.tw> Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* classmate-laptop: use a single MODULE_DEVICE_TABLE to get correct aliasesThadeu Lima de Souza Cascardo2010-04-01
| | | | | | | | | | | | | | | | commit 02e77a55f7b7e36888e39c62439fedb90ae4e808 upstream. Instead of a MODULE_DEVICE_TABLE for every acpi_driver ids table, we create a table containing all ids to export to get a module alias for each one. This will fix automatic loading of the driver when one of the ACPI devices is not present (like the accelerometer, which is not present in some models). Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* b43: Workaround circular locking in hw-tkip key update callbackMichael Buesch2010-04-01
| | | | | | | | | | | | | | | | | | | | commit 96869a39399269a776a94812e9fff3d38b47d838 upstream The TKIP key update callback is called from the RX path, where the driver mutex is already locked. This results in a circular locking bug. Avoid this by removing the lock. Johannes noted that there is a separate bug: The callback still breaks on SDIO hardware, because SDIO hardware access needs to sleep, but we are not allowed to sleep in the callback due to mac80211's RCU locking. Signed-off-by: Michael Buesch <mb@bu3sch.de> Tested-by: Larry Finger <Larry.Finger@lwfinger.net> Reported-by: kecsa@kutfo.hit.bme.hu Cc: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* ahci: use BIOS date in broken_suspend listTejun Heo2010-04-01
| | | | | | | | | | | | | | | | | | commit 9deb343189b3cf45e84dd08480f330575ffe2004 upstream. HP is recycling both DMI_PRODUCT_NAME and DMI_BIOS_VERSION making ahci_broken_suspend() trigger for later products which are not affected by the original problems. Match BIOS date instead of version and add references to bko's so that full information can be found easier later. This fixes http://bugzilla.kernel.org/show_bug.cgi?id=15462 Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: tigerfishdaisy@gmail.com Signed-off-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* r8169: offical fix for CVE-2009-4537 (overlength frame DMAs)Neil Horman2010-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit c0cd884af045338476b8e69a61fceb3f34ff22f1 ] Official patch to fix the r8169 frame length check error. Based on this initial thread: http://marc.info/?l=linux-netdev&m=126202972828626&w=1 This is the official patch to fix the frame length problems in the r8169 driver. As noted in the previous thread, while this patch incurs a performance hit on the driver, its possible to improve performance dynamically by updating the mtu and rx_copybreak values at runtime to return performance to what it was for those NICS which are unaffected by the ideosyncracy (if there are any). Summary: A while back Eric submitted a patch for r8169 in which the proper allocated frame size was written to RXMaxSize to prevent the NIC from dmaing too much data. This was done in commit fdd7b4c3302c93f6833e338903ea77245eb510b4. A long time prior to that however, Francois posted 126fa4b9ca5d9d7cb7d46f779ad3bd3631ca387c, which expiclitly disabled the MaxSize setting due to the fact that the hardware behaved in odd ways when overlong frames were received on NIC's supported by this driver. This was mentioned in a security conference recently: http://events.ccc.de/congress/2009/Fahrplan//events/3596.en.html It seems that if we can't enable frame size filtering, then, as Eric correctly noticed, we can find ourselves DMA-ing too much data to a buffer, causing corruption. As a result is seems that we are forced to allocate a frame which is ready to handle a maximally sized receive. This obviously has performance issues with it, so to mitigate that issue, this patch does two things: 1) Raises the copybreak value to the frame allocation size, which should force appropriately sized packets to get allocated on rx, rather than a full new 16k buffer. 2) This patch only disables frame filtering initially (i.e., during the NIC open), changing the MTU results in ring buffer allocation of a size in relation to the new mtu (along with a warning indicating that this is dangerous). Because of item (2), individuals who can't cope with the performance hit (or can otherwise filter frames to prevent the bug), or who have hardware they are sure is unaffected by this issue, can manually lower the copybreak and reset the mtu such that performance is restored easily. Signed-off-by: Neil Horman <nhorman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* e100: Fix ring parameter change handling regression.David S. Miller2010-04-01
| | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 211a0d941b1924e667483f822a55e2cc694cd212 ] When the PCI pool changes were added to fix resume failures: commit 98468efddb101f8a29af974101c17ba513b07be1 e100: Use pci pool to work around GFP_ATOMIC order 5 memory allocation failu and commit 70abc8cb90e679d8519721e2761d8366a18212a6 e100: Fix broken cbs accounting due to missing memset. This introduced a problem that can happen if the TX ring size is increased. We need to size the PCI pool using cbs->max instead of the default cbs->count value. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* bonding: fix device leak on error in bond_create()Patrick McHardy2010-04-01
| | | | | | | | | | | | [ Upstream commit 8d6184e4881b423522136aeb3ec1cbd9c35e8813 ] When the register_netdevice() call fails, the newly allocated device is not freed. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* l2tp: Fix UDP socket reference count bugs in the pppol2tp driverJames Chapman2010-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit c3259c8a7060d480e8eb2166da0a99d6879146b4 ] This patch fixes UDP socket refcnt bugs in the pppol2tp driver. A bug can cause a kernel stack trace when a tunnel socket is closed. A way to reproduce the issue is to prepare the UDP socket for L2TP (by opening a tunnel pppol2tp socket) and then close it before any L2TP sessions are added to it. The sequence is Create UDP socket Create tunnel pppol2tp socket to prepare UDP socket for L2TP pppol2tp_connect: session_id=0, peer_session_id=0 L2TP SCCRP control frame received (tunnel_id==0) pppol2tp_recv_core: sock_hold() pppol2tp_recv_core: sock_put L2TP ZLB control frame received (tunnel_id=nnn) pppol2tp_recv_core: sock_hold() pppol2tp_recv_core: sock_put Close tunnel management socket pppol2tp_release: session_id=0, peer_session_id=0 Close UDP socket udp_lib_close: BUG The addition of sock_hold() in pppol2tp_connect() solves the problem. For data frames, two sock_put() calls were added to plug a refcnt leak per received data frame. The ref that is grabbed at the top of pppol2tp_recv_core() must always be released, but this wasn't done for accepted data frames or data frames discarded because of bad UDP checksums. This leak meant that any UDP socket that had passed L2TP data traffic (i.e. L2TP data frames, not just L2TP control frames) using pppol2tp would not be released by the kernel. WARNING: at include/net/sock.h:435 udp_lib_unhash+0x117/0x120() Pid: 1086, comm: openl2tpd Not tainted 2.6.33-rc1 #8 Call Trace: [<c119e9b7>] ? udp_lib_unhash+0x117/0x120 [<c101b871>] ? warn_slowpath_common+0x71/0xd0 [<c119e9b7>] ? udp_lib_unhash+0x117/0x120 [<c101b8e3>] ? warn_slowpath_null+0x13/0x20 [<c119e9b7>] ? udp_lib_unhash+0x117/0x120 [<c11598a7>] ? sk_common_release+0x17/0x90 [<c11a5e33>] ? inet_release+0x33/0x60 [<c11577b0>] ? sock_release+0x10/0x60 [<c115780f>] ? sock_close+0xf/0x30 [<c106e542>] ? __fput+0x52/0x150 [<c106b68e>] ? filp_close+0x3e/0x70 [<c101d2e2>] ? put_files_struct+0x62/0xb0 [<c101eaf7>] ? do_exit+0x5e7/0x650 [<c1081623>] ? mntput_no_expire+0x13/0x70 [<c106b68e>] ? filp_close+0x3e/0x70 [<c101eb8a>] ? do_group_exit+0x2a/0x70 [<c101ebe1>] ? sys_exit_group+0x11/0x20 [<c10029b0>] ? sysenter_do_call+0x12/0x26 Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* l2tp: Fix oops in pppol2tp_xmitJames Chapman2010-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit 3feec9095d12e311b7d4eb7fe7e5dfa75d4a72a5 ] When transmitting L2TP frames, we derive the outgoing interface's UDP checksum hardware assist capabilities from the tunnel dst dev. This can sometimes be NULL, especially when routing protocols are used and routing changes occur. This patch just checks for NULL dst or dev pointers when checking for netdev hardware assist features. BUG: unable to handle kernel NULL pointer dereference at 0000000c IP: [<f89d074c>] pppol2tp_xmit+0x341/0x4da [pppol2tp] *pde = 00000000 Oops: 0000 [#1] SMP last sysfs file: /sys/class/net/lo/operstate Modules linked in: pppol2tp pppox ppp_generic slhc ipv6 dummy loop snd_hda_codec_atihdmi snd_hda_intel snd_hda_codec snd_pcm snd_timer snd soundcore snd_page_alloc evdev psmouse serio_raw processor button i2c_piix4 i2c_core ati_agp agpgart pcspkr ext3 jbd mbcache sd_mod ide_pci_generic atiixp ide_core ahci ata_generic floppy ehci_hcd ohci_hcd libata e1000e scsi_mod usbcore nls_base thermal fan thermal_sys [last unloaded: scsi_wait_scan] Pid: 0, comm: swapper Not tainted (2.6.32.8 #1) EIP: 0060:[<f89d074c>] EFLAGS: 00010297 CPU: 3 EIP is at pppol2tp_xmit+0x341/0x4da [pppol2tp] EAX: 00000000 EBX: f64d1680 ECX: 000005b9 EDX: 00000000 ESI: f6b91850 EDI: f64d16ac EBP: f6a0c4c0 ESP: f70a9cac DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 Process swapper (pid: 0, ti=f70a8000 task=f70a31c0 task.ti=f70a8000) Stack: 000005a9 000005b9 f734c400 f66652c0 f7352e00 f67dc800 00000000 f6b91800 <0> 000005a3 f70ef6c4 f67dcda9 000005a3 f89b192e 00000246 000005a3 f64d1680 <0> f63633e0 f6363320 f64d1680 f65a7320 f65a7364 f65856c0 f64d1680 f679f02f Call Trace: [<f89b192e>] ? ppp_push+0x459/0x50e [ppp_generic] [<f89b217f>] ? ppp_xmit_process+0x3b6/0x430 [ppp_generic] [<f89b2306>] ? ppp_start_xmit+0x10d/0x120 [ppp_generic] [<c11c15cb>] ? dev_hard_start_xmit+0x21f/0x2b2 [<c11d0947>] ? sch_direct_xmit+0x48/0x10e [<c11c19a0>] ? dev_queue_xmit+0x263/0x3a6 [<c11e2a9f>] ? ip_finish_output+0x1f7/0x221 [<c11df682>] ? ip_forward_finish+0x2e/0x30 [<c11de645>] ? ip_rcv_finish+0x295/0x2a9 [<c11c0b19>] ? netif_receive_skb+0x3e9/0x404 [<f814b791>] ? e1000_clean_rx_irq+0x253/0x2fc [e1000e] [<f814cb7a>] ? e1000_clean+0x63/0x1fc [e1000e] [<c1047eff>] ? sched_clock_local+0x15/0x11b [<c11c1095>] ? net_rx_action+0x96/0x195 [<c1035750>] ? __do_softirq+0xaa/0x151 [<c1035828>] ? do_softirq+0x31/0x3c [<c10358fe>] ? irq_exit+0x26/0x58 [<c1004b21>] ? do_IRQ+0x78/0x89 [<c1003729>] ? common_interrupt+0x29/0x30 [<c101ac28>] ? native_safe_halt+0x2/0x3 [<c1008c54>] ? default_idle+0x55/0x75 [<c1009045>] ? c1e_idle+0xd2/0xd5 [<c100233c>] ? cpu_idle+0x46/0x62 Code: 8d 45 08 f0 ff 45 08 89 6b 08 c7 43 68 7e fb 9c f8 8a 45 24 83 e0 0c 3c 04 75 09 80 63 64 f3 e9 b4 00 00 00 8b 43 18 8b 4c 24 04 <8b> 40 0c 8d 79 11 f6 40 44 0e 8a 43 64 75 51 6a 00 8b 4c 24 08 EIP: [<f89d074c>] pppol2tp_xmit+0x341/0x4da [pppol2tp] SS:ESP 0068:f70a9cac CR2: 000000000000000c Signed-off-by: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* sparc64: Add very basic XVR-1000 framebuffer driver.David S. Miller2010-04-01
| | | | | | | | | | [ Upstream commits 2d378b9179881b46a0faf11430efb421fe03ddd8 and f04e879bf296d136bcafd8c5a26e95599b141671 ] Signed-off-by: David S. Miller <davem@davemloft.net> Acked-by: Frans van Berckel <fberckel@xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* qlogicpti: Remove slash in QlogicPTI irq nameMeelis Roos2010-04-01
| | | | | | | | | | | | | | | | | | | [ Upstream commit 77d3926306bf4eecac50150ba5625797219f14ba ] qlogicpti driver registers its irq with a name containing slash. This results in [ 71.049735] WARNING: at fs/proc/generic.c:316 __xlate_proc_name+0xa8/0xb8() [ 71.132815] name 'Qlogic/PTI' because proc_mkdir with the name of the irq fails. Fix it by just removing the slash from irq name. Discovered and tested on real hardware (Sun Ultra 1). Signed-off-by: Meelis Roos <mroos@linux.ee> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* ide: Fix Promise UDMA33 IDE driver (pdc202xx_old)Russell King2010-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit c3be57b6f35ef96a980ce84e59d6a5a8ca6184ad ] On Sun, Jan 03, 2010 at 12:23:14AM +0000, Russell King wrote: > - with IDE > - locks the interrupt line, and makes the machine extremely painful - > about an hour to get to the point of being able to unload the > pdc202xx_old module. Having manually bisected kernel versions, I've narrowed it down to some change between 2.6.30 and 2.6.31. There's not much which has changed between the two kernels, but one change stands out like a sore thumb: +static int pdc202xx_test_irq(ide_hwif_t *hwif) +{ + struct pci_dev *dev = to_pci_dev(hwif->dev); + unsigned long high_16 = pci_resource_start(dev, 4); + u8 sc1d = inb(high_16 + 0x1d); + + if (hwif->channel) { + /* + * bit 7: error, bit 6: interrupting, + * bit 5: FIFO full, bit 4: FIFO empty + */ + return ((sc1d & 0x50) == 0x40) ? 1 : 0; + } else { + /* + * bit 3: error, bit 2: interrupting, + * bit 1: FIFO full, bit 0: FIFO empty + */ + return ((sc1d & 0x05) == 0x04) ? 1 : 0; + } +} Reading the (documented as a 32-bit) system control register when the interface is idle gives: 0x01da110c So, the byte at 0x1d is 0x11, which is documented as meaning that the primary and secondary FIFOs are empty. The code above, which is trying to see whether an IRQ is pending, checks for the IRQ bit to be one, and the FIFO bit to be zero - or in English, to be non-empty. Since during a BM-DMA read, the FIFOs will naturally be drained to the PCI bus, the chance of us getting to the interface before this happens are extremely small - and if we don't, it means we decide not to service the interrupt. Hence, the screaming interrupt problem with drivers/ide. Fix this by only indicating an interrupt is ready if both the interrupt and FIFO empty bits are at '1'. This bug only affects PDC20246/PDC20247 (Promise Ultra33) based cards, and has been tested on 2.6.31 and 2.6.33-rc2. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Tested-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Revert "ide: skip probe if there are no devices on the port (v2)"David S. Miller2010-04-01
| | | | | | | | | | | | | | [ Upstream commit 9ce41aed0d392246eb788786253f242e829fd5e1 ] This reverts commit a20b2a44eca52818ef52a94959480b7e6ea2f528. As requested by David Fries. This makes CDROMs which are slave drives on a ribbon without a master disappear and causes other similar kinds of badness. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* icside: bring back ->maskproc methodBartlomiej Zolnierkiewicz2010-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ Upstream commit f75d4a238770d83d3a0475ce7f34e3fa37de161e ] Bring back ->maskproc method since it is still needed for proper operation, as noticed by Russell King: > This change is bogus. > > writeb(0, base + ICS_ARCIN_V6_INTROFFSET_1); > readb(base + ICS_ARCIN_V6_INTROFFSET_2); > > writeb(0, base + ICS_ARCIN_V6_INTROFFSET_2); > readb(base + ICS_ARCIN_V6_INTROFFSET_1); > > This sequence of code does: > > 1. enable interrupt 1 > 2. disable interrupt 2 > 3. enable interrupt 2 > 4. disable interrupt 1 > > which results in the interrupt for the second channel being enabled - > leaving channel 1 blocked. > > Firstly, icside shares its two IDE channels with one DMA engine - so it's > a simplex interface. IDE supports those (or did when the code was written) > serializing requests between the two interfaces. libata does not. > > Secondly, the interrupt lines on icside float when there's no drive connected > or when the drive has its NIEN bit set, which means that you get spurious > screaming interrupts which can kill off all expansion card interrupts on > the machine unless you disable the channel interrupt on the card. > > Since libata can not serialize the operation of the two channels like IDE > can, the libata version of the icside driver does not contain the interrupt > stearing logic. Instead, it looks at the status after reset, and if > nothing was found on that channel, it masks the interrupt from that > channel. This patch reverts changes done in commit dff8817 (I became confused due to non-standard & undocumented ->maskproc method, anyway sorry about that). Noticed-by: Russell King <rmk@arm.linux.org.uk> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* leds-gpio: fix default state handling on OF platformsAnton Vorontsov2010-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 0493a4ff10959ff4c8e0d65efee25b7ffd4fa5db upstream. The driver wrongly sets default state for LEDs that don't specify default-state property. Currently the driver handles default state this way: memset(&led, 0, sizeof(led)); for_each_child_of_node(np, child) { state = of_get_property(child, "default-state", NULL); if (state) { if (!strcmp(state, "keep")) led.default_state = LEDS_GPIO_DEFSTATE_KEEP; ... } ret = create_gpio_led(&led, ...); } Which means that all LEDs that do not specify default-state will inherit the last value of the default-state property, which is wrong. This patch fixes the issue by moving LED's template initialization into the loop body. Signed-off-by: Anton Vorontsov <avorontsov@ru.mvista.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Richard Purdie <rpurdie@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* ath9k: Enable IEEE80211_HW_REPORTS_TX_ACK_STATUS flag for ath9kVivek Natarajan2010-04-01
| | | | | | | | | | commit 05df49865be08b30e7ba91b9d3d94d7d52dd3033 upstream. Signed-off-by: Vivek Natarajan <vnatarajan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* ath9k: configure the beacon only if the STA is associatedSenthil Balasubramanian2010-04-01
| | | | | | | | | | | | commit 1a20034a73a40b8056731f9db0c535cec2961eb7 upstream. beacons configuration SHOULD be done only if the STA is associated. Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* ath9k: Enable TIM timer interrupt only when needed.Senthil Balasubramanian2010-04-01
| | | | | | | | | | | | | | | | commit 3f7c5c10e9dc6bf90179eb9f7c06151d508fb324 upstream. The TIM timer interrupt is enabled even before the ACK of nullqos is received which is unnecessary. Also clean up the CONF_PS part of config callback properly for better readability. Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* hwmon: (coretemp) Add missing newline to dev_warn() messageDean Nelson2010-04-01
| | | | | | | | | | | | | commit 4d7a5644e4adfafe76c2bd8ee168e3f3b5dae3a8 upstream. Add missing newline to dev_warn() message string. This is more of an issue with older kernels that don't automatically add a newline if it was missing from the end of the previous line. Signed-off-by: Dean Nelson <dnelson@redhat.com> Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* drm/nouveau: report unknown connector state if lid closedBen Skeggs2010-04-01
| | | | | | | | | | | | | commit b30083bdb990bcc2829fce83d871a86059ff4fc1 upstream. This is in preference to disconnected. If there's no other outputs connected this will cause LVDS to be programmed even with the lid closed rather than having X fail to start because of no available outputs. Signed-off-by: Ben Skeggs <bskeggs@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* drm/i915: Avoid NULL deref in get_pages() unwind after error.Chris Wilson2010-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | commit 1f2b10131f83f7caa67bf1273cec126b4283015d upstream. Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=15527 NULL pointer dereference in i915_gem_object_save_bit_17_swizzle BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<f82b5d2b>] i915_gem_object_save_bit_17_swizzle+0x5b/0xc0 [i915] Call Trace: [<f82aea55>] ? i915_gem_object_put_pages+0x125/0x150 [i915] [<f82aeb71>] ? i915_gem_object_get_pages+0xf1/0x110 [i915] [<f82b0de8>] ? i915_gem_object_bind_to_gtt+0xb8/0x2a0 [i915] [<c02db74d>] ? drm_mm_get_block_generic+0x4d/0x180 [<f82b11cd>] ? i915_gem_mmap_gtt_ioctl+0x16d/0x240 [i915] [<f82ae786>] ? i915_gem_madvise_ioctl+0x86/0x120 [i915] Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reported-by: maciej.rutecki@gmail.com Cc: stable@kernel.org Reviewed-by: Eric Anholt <eric@anholt.net> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* drm/i915: fix small leak on overlay error pathDan Carpenter2010-04-01
| | | | | | | | | | | | commit 915a428e43acfd05e4ffeaf40549b0cf163eebe2 upstream. We should free "params" before returning. Signed-off-by: Dan Carpenter <error27@gmail.com> Reviewed-by: Daniel Vetter <daniel@ffwll.ch> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* ath9k: fix BUG_ON triggered by PAE framesFelix Fietkau2010-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 4fdec031b9169b3c17938b9c4168f099f457169c upstream. When I initially stumbled upon sequence number problems with PAE frames in ath9k, I submitted a patch to remove all special cases for PAE frames and let them go through the normal transmit path. Out of concern about crypto incompatibility issues, this change was merged instead: commit 6c8afef551fef87a3bf24f8a74c69a7f2f72fc82 Author: Sujith <Sujith.Manoharan@atheros.com> Date: Tue Feb 9 10:07:00 2010 +0530 ath9k: Fix sequence numbers for PAE frames After a lot of testing, I'm able to reliably trigger a driver crash on rekeying with current versions with this change in place. It seems that the driver does not support sending out regular MPDUs with the same TID while an A-MPDU session is active. This leads to duplicate entries in the TID Tx buffer, which hits the following BUG_ON in ath_tx_addto_baw(): index = ATH_BA_INDEX(tid->seq_start, bf->bf_seqno); cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1); BUG_ON(tid->tx_buf[cindex] != NULL); I believe until we actually have a reproducible case of an incompatibility with another AP using no PAE special cases, we should simply get rid of this mess. This patch completely fixes my crash issues in STA mode and makes it stay connected without throughput drops or connectivity issues even when the AP is configured to a very short group rekey interval. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* PCI: cleanup error return for pcix get and set mmrbc functionsDean Nelson2010-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 7c9e2b1c4784c6e574f69dbd904b2822f2e04d6e upstream. pcix_get_mmrbc() returns the maximum memory read byte count (mmrbc), if successful, or an appropriate error value, if not. Distinguishing errors from correct values and understanding the meaning of an error can be somewhat confusing in that: correct values: 512, 1024, 2048, 4096 errors: -EINVAL -22 PCIBIOS_FUNC_NOT_SUPPORTED 0x81 PCIBIOS_BAD_VENDOR_ID 0x83 PCIBIOS_DEVICE_NOT_FOUND 0x86 PCIBIOS_BAD_REGISTER_NUMBER 0x87 PCIBIOS_SET_FAILED 0x88 PCIBIOS_BUFFER_TOO_SMALL 0x89 The PCIBIOS_ errors are returned from the PCI functions generated by the PCI_OP_READ() and PCI_OP_WRITE() macros. In a similar manner, pcix_set_mmrbc() also returns the PCIBIOS_ error values returned from pci_read_config_[word|dword]() and pci_write_config_word(). Following pcix_get_max_mmrbc()'s example, the following patch simply returns -EINVAL for all PCIBIOS_ errors encountered by pcix_get_mmrbc(), and -EINVAL or -EIO for those encountered by pcix_set_mmrbc(). This simplification was chosen in light of the fact that none of the current callers of these functions are interested in the specific type of error encountered. In the future, should this change, one could simply create a function that maps each PCIBIOS_ error to a corresponding unique errno value, which could be called by pcix_get_max_mmrbc(), pcix_get_mmrbc(), and pcix_set_mmrbc(). Additionally, this patch eliminates some unnecessary variables. Signed-off-by: Dean Nelson <dnelson@redhat.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* PCI: fix access of PCI_X_CMD by pcix get and set mmrbc functionsDean Nelson2010-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit bdc2bda7c4dd253026cc1fce45fc939304749029 upstream. An e1000 driver on a system with a PCI-X bus was always being returned a value of 135 from both pcix_get_mmrbc() and pcix_set_mmrbc(). This value reflects an error return of PCIBIOS_BAD_REGISTER_NUMBER from pci_bus_read_config_dword(,, cap + PCI_X_CMD,). This is because for a dword, the following portion of the PCI_OP_READ() macro: if (PCI_##size##_BAD) return PCIBIOS_BAD_REGISTER_NUMBER; expands to: if (pos & 3) return PCIBIOS_BAD_REGISTER_NUMBER; And is always true for 'cap + PCI_X_CMD', which is 0xe4 + 2 = 0xe6. ('cap' is the result of calling pci_find_capability(, PCI_CAP_ID_PCIX).) The same problem exists for pci_bus_write_config_dword(,, cap + PCI_X_CMD,). In both cases, instead of calling _dword(), _word() should be called. Signed-off-by: Dean Nelson <dnelson@redhat.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* PCI: fix return value from pcix_get_max_mmrbc()Dean Nelson2010-04-01
| | | | | | | | | | | | | | | | | | | | | | | commit 25daeb550b69e89aff59bc6a84218a12b5203531 upstream. For the PCI_X_STATUS register, pcix_get_max_mmrbc() is returning an incorrect value, which is based on: (stat & PCI_X_STATUS_MAX_READ) >> 12 Valid return values are 512, 1024, 2048, 4096, which correspond to a 'stat' (masked and right shifted by 21) of 0, 1, 2, 3, respectively. A right shift by 11 would generate the correct return value when 'stat' (masked and right shifted by 21) has a value of 1 or 2. But for a value of 0 or 3 it's not possible to generate the correct return value by only right shifting. Fix is based on pcix_get_mmrbc()'s similar dealings with the PCI_X_CMD register. Signed-off-by: Dean Nelson <dnelson@redhat.com> Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* iwlwifi: Silence tfds_in_queue messageAdel Gadllah2010-04-01
| | | | | | | | | | | | | | | | commit c8406ea8fa1adde8dc5400127281d497bbcdb84a upstream. Commit a239a8b47cc0e5e6d7416a89f340beac06d5edaa introduced a noisy message, that fills up the log very fast. The error seems not to be fatal (the connection is stable and performance is ok), so make it IWL_DEBUG_TX rather than IWL_ERR. Signed-off-by: Adel Gadllah <adel.gadllah@gmail.com> Acked-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* edac, mce: Filter out invalid valuesBorislav Petkov2010-04-01
| | | | | | | | | | commit 5b89d2f9ace1970324facc68ca9b8fae19ce8096 upstream. Print the CPU associated with the error only when the field is valid. Signed-off-by: Borislav Petkov <borislav.petkov@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* jme: Protect vlgrp structure by pause RX actions.Guo-Fu Tseng2010-04-01
| | | | | | | | | | | | commit bf5e5360fd1df1ae429ebbd81838d7d0879797d1 upstream. Temporary stop the RX IRQ, and disable (sync) tasklet or napi. And restore it after finished the vlgrp pointer assignment. Signed-off-by: Guo-Fu Tseng <cooldavid@cooldavid.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* jme: Fix VLAN memory leakGuo-Fu Tseng2010-04-01
| | | | | | | | | | | | commit 17da69b8bfbe441a33a873ad5dd7d3d85800bf2b upstream. Fix memory leak while receiving 8021q tagged packet which is not registered by user. Signed-off-by: Guo-Fu Tseng <cooldavid@cooldavid.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* wl1251: fix potential crashGrazvydas Ignotas2010-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 3f60ebc9d6291863652d564bacc430629271e6a9 upstream. In case debugfs does not init for some reason (or is disabled on older kernels) driver does not allocate stats.fw_stats structure, but tries to clear it later and trips on a NULL pointer: Unable to handle kernel NULL pointer dereference at virtual address 00000000 PC is at __memzero+0x24/0x80 Backtrace: [<bf0ddb88>] (wl1251_debugfs_reset+0x0/0x30 [wl1251]) [<bf0d6a2c>] (wl1251_op_stop+0x0/0x12c [wl1251]) [<bf0bc228>] (ieee80211_stop_device+0x0/0x74 [mac80211]) [<bf0b0d10>] (ieee80211_stop+0x0/0x4ac [mac80211]) [<c02deeac>] (dev_close+0x0/0xb4) [<c02deac0>] (dev_change_flags+0x0/0x184) [<c031f478>] (devinet_ioctl+0x0/0x704) [<c0320720>] (inet_ioctl+0x0/0x100) Add a NULL pointer check to fix this. Signed-off-by: Grazvydas Ignotas <notasas@gmail.com> Acked-by: Kalle Valo <kalle.valo@iki.fi> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* usb: r8a66597-hcd: fix removed from an attached hubYoshihiro Shimoda2010-04-01
| | | | | | | | | | | | commit d835933436ac0d1e8f5b35fe809fd4e767e55d6e upstream. fix the problem that when a USB hub is attached to the r8a66597-hcd and a device is removed from that hub, it's likely that a kernel panic follows. Reported-by: Markus Pietrek <Markus.Pietrek@emtrion.de> Signed-off-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* USB: option: add support for a new CMOTECH device to usb/serial/optionNathaniel McCallum2010-04-01
| | | | | | | | commit 3b04872aa75006e2a4adaaec21e9c9ede8b8ad9d upstream. Signed-off-by: Nathaniel McCallum <nathaniel@natemccallum.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* USB: option: move hardcoded PID to a macro in usb/serial/optionNathaniel McCallum2010-04-01
| | | | | | | | commit bb73ed2a268a29ab1b7d8cc50b5f248578e7e188 upstream. Signed-off-by: Nathaniel McCallum <nathaniel@natemccallum.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* USB: option: fix incorrect manufacturer name in usb/serial/option: ↵Nathaniel McCallum2010-04-01
| | | | | | | | | | MAXON->CMOTECH commit eaff4cdc978f414cf7b5441a333de3070d80e9c7 upstream. Signed-off-by: Nathaniel McCallum <nathaniel@natemccallum.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* USB: serial: ftdi: add CONTEC vendor and product idDaniel Sangorrin2010-04-01
| | | | | | | | | | | | | | | commit dee5658b482e9e2ac7d6205dc876fc11d4008138 upstream. This is a patch to ftdi_sio_ids.h and ftdi_sio.c that adds identifiers for CONTEC USB serial converter. I tested it with the device COM-1(USB)H [akpm@linux-foundation.org: keep the VIDs sorted a bit] Signed-off-by: Daniel Sangorrin <daniel.sangorrin@gmail.com> Cc: Andreas Mohr <andi@lisas.de> Cc: Radek Liboska <liboska@uochb.cas.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* USB: xHCI: re-initialize cmd_completionAndiry Xu2010-04-01
| | | | | | | | | | | | | | commit 1d68064a7d80da4a7334cab0356162e36229c1a1 upstream. When a signal interrupts a Configure Endpoint command, the cmd_completion used in xhci_configure_endpoint() is not re-initialized and the wait_for_completion_interruptible_timeout() will return failure. Initialize cmd_completion in xhci_configure_endpoint(). Signed-off-by: Andiry Xu <andiry.xu@amd.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* USB: qcserial: add new device idsBernhard Rosenkraenzer2010-04-01
| | | | | | | | | | | commit 0725e95ea56698774e893edb7e7276b1d6890954 upstream. This patch adds various USB device IDs for Gobi 2000 devices, as found in the drivers available at https://www.codeaurora.org/wiki/GOBI_Releases Signed-off-by: Bernhard Rosenkraenzer <bero@arklinux.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* USB: EHCI: adjust ehci_iso_stream for changes in ehci_qhClemens Ladisch2010-04-01
| | | | | | | | | | | | | | | | | | | | commit 1082f57abfa26590b60c43f503afb24102a37016 upstream. The EHCI driver stores in usb_host_endpoint.hcpriv a pointer to either an ehci_qh or an ehci_iso_stream structure, and uses the contents of the hw_info1 field to distinguish the two cases. After ehci_qh was split into hw and sw parts, ehci_iso_stream must also be adjusted so that it again looks like an ehci_qh structure. This fixes a NULL pointer access in ehci_endpoint_disable() when it tries to access qh->hw->hw_info1. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Reported-by: Colin Fletcher <colin.m.fletcher@googlemail.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
generated by cgit v1.2.2 (git 2.25.0) at 2025-03-14 22:18:35 -0400