user/sven/linux.git, branch v3.3-rc5

Linux 3.3-rc5

2012-02-25T20:18:16Z

Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

2012-02-25T20:12:08Z

Couple of minor driver fixes. * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (max34440) Fix resetting temperature history hwmon: (f75375s) Fix register write order when setting fans to full speed hwmon: (ads1015) Fix file leak in probe function hwmon: (max6639) Fix PPR register initialization to set both channels hwmon: (max6639) Fix FAN_FROM_REG calculation

Merge branch 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild

2012-02-25T20:11:25Z

three kbuild fixes for 3.3: - make deb-pkg symlink race fix. - make coccicheck fix. - Dropping the check for modutils. This is not a regression, but allows the module-init-tools replacement kmod work with the 3.3 kernel. * 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild: coccicheck: change handling of C={1,2} when M= is set builddeb: Don't create files in /tmp with predictable names kbuild: do not check for ancient modutils tools

autofs: work around unhappy compat problem on x86-64

2012-02-25T20:10:27Z

When the autofs protocol version 5 packet type was added in commit 5c0a32fc2cd0 ("autofs4: add new packet type for v5 communications"), it obvously tried quite hard to be word-size agnostic, and uses explicitly sized fields that are all correctly aligned. However, with the final "char name[NAME_MAX+1]" array at the end, the actual size of the structure ends up being not very well defined: because the struct isn't marked 'packed', doing a "sizeof()" on it will align the size of the struct up to the biggest alignment of the members it has. And despite all the members being the same, the alignment of them is different: a "__u64" has 4-byte alignment on x86-32, but native 8-byte alignment on x86-64. And while 'NAME_MAX+1' ends up being a nice round number (256), the name[] array starts out a 4-byte aligned. End result: the "packed" size of the structure is 300 bytes: 4-byte, but not 8-byte aligned. As a result, despite all the fields being in the same place on all architectures, sizeof() will round up that size to 304 bytes on architectures that have 8-byte alignment for u64. Note that this is *not* a problem for 32-bit compat mode on POWER, since there __u64 is 8-byte aligned even in 32-bit mode. But on x86, 32-bit and 64-bit alignment is different for 64-bit entities, and as a result the structure that has exactly the same layout has different sizes. So on x86-64, but no other architecture, we will just subtract 4 from the size of the structure when running in a compat task. That way we will write the properly sized packet that user mode expects. Not pretty. Sadly, this very subtle, and unnecessary, size difference has been encoded in user space that wants to read packets of *exactly* the right size, and will refuse to touch anything else. Reported-and-tested-by: Thomas Meyer Signed-off-by: Ian Kent Signed-off-by: Linus Torvalds

Merge tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband

2012-02-25T04:03:14Z

One InfiniBand/RDMA regression fix for 3.3: - mlx4 SR-IOV changes added static exported functions, which doesn't build on powerpc at least. Fix from Doug Ledford for this. * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: mlx4_core: Exported functions can't be static

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6

2012-02-25T00:08:51Z

SCSI fixes on 20120224: "This is a set of assorted bug fixes for power management, mpt2sas, ipr, the rdac device handler and quite a big chunk for qla2xxx (plus a use after free of scsi_host in scsi_scan.c). " * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] scsi_dh_rdac: Fix for unbalanced reference count [SCSI] scsi_pm: Fix bug in the SCSI power management handler [SCSI] scsi_scan: Fix 'Poison overwritten' warning caused by using freed 'shost' [SCSI] qla2xxx: Update version number to 8.03.07.13-k. [SCSI] qla2xxx: Proper detection of firmware abort error code for ISP82xx. [SCSI] qla2xxx: Remove resetting memory during device initialization for ISP82xx. [SCSI] qla2xxx: Complete mailbox command timedout to avoid initialization failures during next reset cycle. [SCSI] qla2xxx: Remove check for null fcport from host reset handler. [SCSI] qla2xxx: Correct out of bounds read of ISP2200 mailbox registers. [SCSI] qla2xxx: Remove errant clearing of MBX_INTERRUPT flag during CT-IOCB processing. [SCSI] qla2xxx: Clear options-flags while issuing stop-firmware mbx command. [SCSI] qla2xxx: Add an "is reset active" helper. [SCSI] qla2xxx: Add check for null fcport references in qla2xxx_queuecommand. [SCSI] qla2xxx: Propagate up abort failures. [SCSI] isci: Fix NULL ptr dereference when no firmware is being loaded [SCSI] ipr: fix eeh recovery for 64-bit adapters [SCSI] mpt2sas: Fix mismatch in mpt2sas_base_hard_reset_handler() mutex lock-unlock

coccicheck: change handling of C={1,2} when M= is set

2012-02-24T22:50:19Z

This patch reverts a portion of d0bc1fb4 so that coccicheck will work properly when C=1 or C=2. Reported-and-tested-by: Brice Goglin Signed-off-by: Greg Dietsche Signed-off-by: Julia Lawall Signed-off-by: Michal Marek

Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2012-02-24T20:32:51Z

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] hdpvr: update picture controls to support firmware versions > 0.15 [media] wl128x: fix build errors when GPIOLIB is not enabled [media] hdpvr: fix race conditon during start of streaming [media] omap3isp: Fix crash caused by subdevs now having a pointer to devnodes [media] imon: don't wedge hardware after early callbacks

epoll: ep_unregister_pollwait() can use the freed pwq->whead

2012-02-24T19:42:50Z

signalfd_cleanup() ensures that ->signalfd_wqh is not used, but this is not enough. eppoll_entry->whead still points to the memory we are going to free, ep_unregister_pollwait()->remove_wait_queue() is obviously unsafe. Change ep_poll_callback(POLLFREE) to set eppoll_entry->whead = NULL, change ep_unregister_pollwait() to check pwq->whead != NULL under rcu_read_lock() before remove_wait_queue(). We add the new helper, ep_remove_wait_queue(), for this. This works because sighand_cachep is SLAB_DESTROY_BY_RCU and because ->signalfd_wqh is initialized in sighand_ctor(), not in copy_sighand. ep_unregister_pollwait()->remove_wait_queue() can play with already freed and potentially reused ->sighand, but this is fine. This memory must have the valid ->signalfd_wqh until rcu_read_unlock(). Reported-by: Maxime Bizon Cc: Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds

epoll: introduce POLLFREE to flush ->signalfd_wqh before kfree()

2012-02-24T19:42:50Z

This patch is intentionally incomplete to simplify the review. It ignores ep_unregister_pollwait() which plays with the same wqh. See the next change. epoll assumes that the EPOLL_CTL_ADD'ed file controls everything f_op->poll() needs. In particular it assumes that the wait queue can't go away until eventpoll_release(). This is not true in case of signalfd, the task which does EPOLL_CTL_ADD uses its ->sighand which is not connected to the file. This patch adds the special event, POLLFREE, currently only for epoll. It expects that init_poll_funcptr()'ed hook should do the necessary cleanup. Perhaps it should be defined as EPOLLFREE in eventpoll. __cleanup_sighand() is changed to do wake_up_poll(POLLFREE) if ->signalfd_wqh is not empty, we add the new signalfd_cleanup() helper. ep_poll_callback(POLLFREE) simply does list_del_init(task_list). This make this poll entry inconsistent, but we don't care. If you share epoll fd which contains our sigfd with another process you should blame yourself. signalfd is "really special". I simply do not know how we can define the "right" semantics if it used with epoll. The main problem is, epoll calls signalfd_poll() once to establish the connection with the wait queue, after that signalfd_poll(NULL) returns the different/inconsistent results depending on who does EPOLL_CTL_MOD/signalfd_read/etc. IOW: apart from sigmask, signalfd has nothing to do with the file, it works with the current thread. In short: this patch is the hack which tries to fix the symptoms. It also assumes that nobody can take tasklist_lock under epoll locks, this seems to be true. Note: - we do not have wake_up_all_poll() but wake_up_poll() is fine, poll/epoll doesn't use WQ_FLAG_EXCLUSIVE. - signalfd_cleanup() uses POLLHUP along with POLLFREE, we need a couple of simple changes in eventpoll.c to make sure it can't be "lost". Reported-by: Maxime Bizon Cc: Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds