1. 29 Nov, 2013 5 commits
    • Linus Torvalds's avatar
      Merge branch 'for-3.13-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup · 2855987d
      Linus Torvalds authored
      Pull cgroup fixes from Tejun Heo:
       "Fixes for three issues.
      
         - cgroup destruction path could swamp system_wq possibly leading to
           deadlock.  This actually seems to happen in the wild with memcg
           because memcg destruction path adds nested dependency on system_wq.
      
           Resolved by isolating cgroup destruction work items on its
           dedicated workqueue.
      
         - Possible locking context deadlock through seqcount reported by
           lockdep
      
         - Memory leak under certain conditions"
      
      * 'for-3.13-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
        cgroup: fix cgroup_subsys_state leak for seq_files
        cpuset: Fix memory allocator deadlock
        cgroup: use a dedicated workqueue for cgroup destruction
      2855987d
    • Linus Torvalds's avatar
      Merge tag 'sound-3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · b8495995
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Quite a few HD-Audio fixes, a WUSB audio fix and a fix for FireWire
        audio.  The HD-audio part contains a couple of fixes for the generic
        parser, and these are the only intrusive fixes.  The rest are mostly
        device-specific fixes"
      
      * tag 'sound-3.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - Add LFE chmap to ASUS ET2700
        ALSA: hda - Initialize missing bass speaker pin for ASUS AIO ET2700
        ALSA: hda - limit mic boost on Asus UX31[A,E]
        ALSA: hda - Check leaf nodes to find aamix amps
        ALSA: hda - Fix hp-mic mode without VREF bits
        ALSA: hda - Create Headhpone Mic Jack Mode when really needed
        ALSA: usb: use multiple packets per urb for Wireless USB inbound audio
        ALSA: hda - Enable mute/mic-mute LEDs for more Thinkpads with Conexant codec
        ALSA: hda - Drop bus->avoid_link_reset flag
        ALSA: hda/realtek - Set pcbeep amp for ALC668
        ALSA: hda/realtek - Add support of ALC231 codec
        ALSA: firewire-lib: fix wrong value for FDF field as an empty packet
      b8495995
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · b01537bf
      Linus Torvalds authored
      Pull vfs dentry reference count fix from Al Viro.
      
      This fixes a possible inode_permission NULL pointer dereference (and
      other problems) that were due to the root dentry count being decremented
      too much.  In commit 48a066e7 ("RCU'd vfsmounts") the placement of
      clearing the LOOKUP_RCU bit changed, and we then returned failure of
      incrementing the lockref on the parent dentry with LOOKUP_RCU cleared.
      
      But that meant we needed to go through the same cleanup routines that
      the later failures did wrt LOOKUP_ROOT and nd->root.
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        fix bogus path_put() of nd->root after some unlazy_walk() failures
      b01537bf
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 282c183b
      Linus Torvalds authored
      Pull drm qxl leak fix from Dave Airlie:
       "As usual 5 mins after I send a trivial pull fix I find a real bug!
      
        This fixes a memory leak and I'd like to get it into stable queue
        asap"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/qxl: fix memory leak in release list handling
      282c183b
    • Al Viro's avatar
      fix bogus path_put() of nd->root after some unlazy_walk() failures · d870b4a1
      Al Viro authored
      Failure to grab reference to parent dentry should go through the
      same cleanup as nd->seq mismatch.  As it is, we might end up with
      caller thinking it needs to path_put() nd->root, with obvious
      nasty results once we'd hit that bug enough times to drive the
      refcount of root dentry all the way to zero...
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      d870b4a1
  2. 28 Nov, 2013 24 commits
  3. 27 Nov, 2013 11 commits
    • Tejun Heo's avatar
      cgroup: fix cgroup_subsys_state leak for seq_files · e605b365
      Tejun Heo authored
      If a cgroup file implements either read_map() or read_seq_string(),
      such file is served using seq_file by overriding file->f_op to
      cgroup_seqfile_operations, which also overrides the release method to
      single_release() from cgroup_file_release().
      
      Because cgroup_file_open() didn't use to acquire any resources, this
      used to be fine, but since f7d58818 ("cgroup: pin
      cgroup_subsys_state when opening a cgroupfs file"), cgroup_file_open()
      pins the css (cgroup_subsys_state) which is put by
      cgroup_file_release().  The patch forgot to update the release path
      for seq_files and each open/release cycle leaks a css reference.
      
      Fix it by updating cgroup_file_release() to also handle seq_files and
      using it for seq_file release path too.
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Cc: stable@vger.kernel.org # v3.12
      e605b365
    • Peter Zijlstra's avatar
      cpuset: Fix memory allocator deadlock · 0fc0287c
      Peter Zijlstra authored
      Juri hit the below lockdep report:
      
      [    4.303391] ======================================================
      [    4.303392] [ INFO: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected ]
      [    4.303394] 3.12.0-dl-peterz+ #144 Not tainted
      [    4.303395] ------------------------------------------------------
      [    4.303397] kworker/u4:3/689 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
      [    4.303399]  (&p->mems_allowed_seq){+.+...}, at: [<ffffffff8114e63c>] new_slab+0x6c/0x290
      [    4.303417]
      [    4.303417] and this task is already holding:
      [    4.303418]  (&(&q->__queue_lock)->rlock){..-...}, at: [<ffffffff812d2dfb>] blk_execute_rq_nowait+0x5b/0x100
      [    4.303431] which would create a new lock dependency:
      [    4.303432]  (&(&q->__queue_lock)->rlock){..-...} -> (&p->mems_allowed_seq){+.+...}
      [    4.303436]
      
      [    4.303898] the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock:
      [    4.303918] -> (&p->mems_allowed_seq){+.+...} ops: 2762 {
      [    4.303922]    HARDIRQ-ON-W at:
      [    4.303923]                     [<ffffffff8108ab9a>] __lock_acquire+0x65a/0x1ff0
      [    4.303926]                     [<ffffffff8108cbe3>] lock_acquire+0x93/0x140
      [    4.303929]                     [<ffffffff81063dd6>] kthreadd+0x86/0x180
      [    4.303931]                     [<ffffffff816ded6c>] ret_from_fork+0x7c/0xb0
      [    4.303933]    SOFTIRQ-ON-W at:
      [    4.303933]                     [<ffffffff8108abcc>] __lock_acquire+0x68c/0x1ff0
      [    4.303935]                     [<ffffffff8108cbe3>] lock_acquire+0x93/0x140
      [    4.303940]                     [<ffffffff81063dd6>] kthreadd+0x86/0x180
      [    4.303955]                     [<ffffffff816ded6c>] ret_from_fork+0x7c/0xb0
      [    4.303959]    INITIAL USE at:
      [    4.303960]                    [<ffffffff8108a884>] __lock_acquire+0x344/0x1ff0
      [    4.303963]                    [<ffffffff8108cbe3>] lock_acquire+0x93/0x140
      [    4.303966]                    [<ffffffff81063dd6>] kthreadd+0x86/0x180
      [    4.303969]                    [<ffffffff816ded6c>] ret_from_fork+0x7c/0xb0
      [    4.303972]  }
      
      Which reports that we take mems_allowed_seq with interrupts enabled. A
      little digging found that this can only be from
      cpuset_change_task_nodemask().
      
      This is an actual deadlock because an interrupt doing an allocation will
      hit get_mems_allowed()->...->__read_seqcount_begin(), which will spin
      forever waiting for the write side to complete.
      
      Cc: John Stultz <john.stultz@linaro.org>
      Cc: Mel Gorman <mgorman@suse.de>
      Reported-by: default avatarJuri Lelli <juri.lelli@gmail.com>
      Signed-off-by: default avatarPeter Zijlstra <peterz@infradead.org>
      Tested-by: default avatarJuri Lelli <juri.lelli@gmail.com>
      Acked-by: default avatarLi Zefan <lizefan@huawei.com>
      Acked-by: default avatarMel Gorman <mgorman@suse.de>
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Cc: stable@vger.kernel.org
      0fc0287c
    • Greg Kroah-Hartman's avatar
      Revert "sysfs: handle duplicate removal attempts in sysfs_remove_group()" · 81440e73
      Greg Kroah-Hartman authored
      This reverts commit 54d71145.
      
      The root cause of these "inverted" sysfs removals have now been found,
      so there is no need for this patch.  Keep this functionality around so
      that this type of error doesn't show up in driver code again.
      
      Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
      Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
      Cc: Tejun Heo <tj@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      81440e73
    • Greg Kroah-Hartman's avatar
      Staging: tidspbridge: disable driver · 930ba4a3
      Greg Kroah-Hartman authored
      There seems to be no active maintainer for the driver, and there is an
      unfixed security bug, so disable the driver for now.
      
      Hopefully someone steps up to be the maintainer, and works to get this
      out of staging, otherwise it will be deleted soon.
      Reported-by: default avatarNico Golde <nico@ngolde.de>
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Cc: Omar Ramirez Luna <omar.ramirez@copitl.com>
      Cc: Omar Ramirez Luna <omar.ramirez@ti.com>
      Cc: Kanigeri, Hari <h-kanigeri2@ti.com>
      Cc: Ameya Palande <ameya.palande@nokia.com>
      Cc: Guzman Lugo, Fernando <fernando.lugo@ti.com>
      Cc: Hebbar, Shivananda <x0hebbar@ti.com>
      Cc: Ramos Falcon, Ernesto <ernesto@ti.com>
      Cc: Felipe Contreras <felipe.contreras@gmail.com>
      Cc: Anna, Suman <s-anna@ti.com>
      Cc: Gupta, Ramesh <grgupta@ti.com>
      Cc: Gomez Castellanos, Ivan <ivan.gomez@ti.com>
      Cc: Andy Shevchenko <ext-andriy.shevchenko@nokia.com>
      Cc: Armando Uribe De Leon <x0095078@ti.com>
      Cc: Deepak Chitriki <deepak.chitriki@ti.com>
      Cc: Menon, Nishanth <nm@ti.com>
      Cc: Phil Carmody <ext-phil.2.carmody@nokia.com>
      Cc: Ohad Ben-Cohen <ohad@wizery.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      930ba4a3
    • Markus Mayer's avatar
      gpio: bcm281xx: Fix return value of bcm_kona_gpio_get() · e2f0b005
      Markus Mayer authored
      We need to return the corresponding bit for a particular GPIO. This bit
      contains shift not mask.
      Signed-off-by: default avatarMarkus Mayer <markus.mayer@linaro.org>
      Reviewed-by: default avatarTim Kryger <tim.kryger@linaro.org>
      Reviewed-by: default avatarMatt Porter <matt.porter@linaro.org>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      e2f0b005
    • Takashi Iwai's avatar
      ALSA: hda - Fix hp-mic mode without VREF bits · 16c0cefe
      Takashi Iwai authored
      When the hp mic pin has no VREF bits, the driver forgot to set PIN_IN
      bit.  Spotted during debugging old MacBook Airs.
      
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=65681
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      16c0cefe
    • Takashi Iwai's avatar
      ALSA: hda - Create Headhpone Mic Jack Mode when really needed · ced4cefc
      Takashi Iwai authored
      When a headphone jack is configurable as input, the generic parser
      tries to make it retaskable as Headphone Mic.  The switching can be
      done smoothly if Capture Source control exists (i.e. there is another
      input source).  Or when user explicitly enables the creation of jack
      mode controls, "Headhpone Mic Jack Mode" will be created accordingly.
      
      However, if the headphone mic is the only input source, we have to
      create "Headphone Mic Jack Mode" control because there is no capture
      source selection.  Otherwise, the generic parser assumes that the
      input is constantly enabled, thus the headphone is permanently set
      as input.  This situation happens on the old MacBook Airs where no
      input is supported properly, for example.
      
      This patch fixes the problem: now "Headphone Mic Jack Mode" is created
      when such an input selection isn't possible.
      
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=65681
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      ced4cefc
    • Linus Walleij's avatar
      gpio: pl061: move irqdomain initialization · 2ba3154d
      Linus Walleij authored
      The PL061 driver had the irqdomain initialization in an unfortunate
      place: when used with device tree (and thus passing the base IRQ
      0) the driver would work, as this registers an irqdomain and waits
      for mappings to be done dynamically as the devices request their
      IRQs, whereas when booting using platform data the irqdomain core
      would attempt to allocate IRQ descriptors dynamically (which works
      fine) but also to associate the irq_domain_associate_many() on all
      IRQs, which in turn will call the mapping function which at this
      point will try to set the type of the IRQ and then tries to acquire
      a non-initialized spinlock yielding a backtrace like this:
      
      CPU: 0 PID: 1 Comm: swapper Not tainted 3.13.0-rc1+ #652
      Backtrace:
      [<c0016f0c>] (dump_backtrace) from [<c00172ac>] (show_stack+0x18/0x1c)
       r6:c798ace0 r5:00000000 r4:c78257e0 r3:00200140
      [<c0017294>] (show_stack) from [<c0329ea0>] (dump_stack+0x20/0x28)
      [<c0329e80>] (dump_stack) from [<c004fa80>] (__lock_acquire+0x1c0/0x1b80)
      [<c004f8c0>] (__lock_acquire) from [<c0051970>] (lock_acquire+0x6c/0x80)
       r10:00000000 r9:c0455234 r8:00000060 r7:c047d798 r6:600000d3 r5:00000000
       r4:c782c000
      [<c0051904>] (lock_acquire) from [<c032e484>] (_raw_spin_lock_irqsave+0x60/0x74)
       r6:c01a1100 r5:800000d3 r4:c798acd0
      [<c032e424>] (_raw_spin_lock_irqsave) from [<c01a1100>] (pl061_irq_type+0x28/0x)
       r6:00000000 r5:00000000 r4:c798acd0
      [<c01a10d8>] (pl061_irq_type) from [<c0059ef4>] (__irq_set_trigger+0x70/0x104)
       r6:00000000 r5:c01a10d8 r4:c046da1c r3:c01a10d8
      [<c0059e84>] (__irq_set_trigger) from [<c005b348>] (irq_set_irq_type+0x40/0x60)
       r10:c043240c r8:00000060 r7:00000000 r6:c046da1c r5:00000060 r4:00000000
      [<c005b308>] (irq_set_irq_type) from [<c01a1208>] (pl061_irq_map+0x40/0x54)
       r6:c79693c0 r5:c798acd0 r4:00000060
      [<c01a11c8>] (pl061_irq_map) from [<c005d27c>] (irq_domain_associate+0xc0/0x190)
       r5:00000060 r4:c046da1c
      [<c005d1bc>] (irq_domain_associate) from [<c005d604>] (irq_domain_associate_man)
       r8:00000008 r7:00000000 r6:c79693c0 r5:00000060 r4:00000000
      [<c005d5d0>] (irq_domain_associate_many) from [<c005d864>] (irq_domain_add_simp)
       r8:c046578c r7:c035b72c r6:c79693c0 r5:00000060 r4:00000008 r3:00000008
      [<c005d814>] (irq_domain_add_simple) from [<c01a1380>] (pl061_probe+0xc4/0x22c)
       r6:00000060 r5:c0464380 r4:c798acd0
      [<c01a12bc>] (pl061_probe) from [<c01c0450>] (amba_probe+0x74/0xe0)
       r10:c043240c r9:c0455234 r8:00000000 r7:c047d7f8 r6:c047d744 r5:00000000
       r4:c0464380
      
      This moves the irqdomain initialization to a point where the spinlock
      and GPIO chip are both fully propulated, so the callbacks can be used
      without crashes.
      
      I had some problem reproducing the crash, as the devm_kzalloc():ed
      zeroed memory would seemingly mask the spinlock as something OK,
      but by poisoning the lock like this:
      
      u32 *dum;
      dum = (u32 *) &chip->lock;
      *dum = 0xaaaaaaaaU;
      
      I could reproduce, fix and test the patch.
      Reported-by: default avatarRussell King <linux@arm.linux.org.uk>
      Cc: Rob Herring <robherring2@gmail.com>
      Cc: Haojian Zhuang <haojian.zhuang@linaro.org>
      Cc: Baruch Siach <baruch@tkos.co.il>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      2ba3154d
    • Thomas Pugliese's avatar
      ALSA: usb: use multiple packets per urb for Wireless USB inbound audio · a93455e1
      Thomas Pugliese authored
      For Wireless USB audio devices, use multiple isoc packets per URB for
      inbound endpoints with a datainterval < 5.  This allows the WUSB host
      controller to take advantage of bursting to service endpoints whose
      logical polling interval is less than the 4ms minimum polling interval
      limit in WUSB.
      Signed-off-by: default avatarThomas Pugliese <thomas.pugliese@gmail.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      a93455e1
    • David Herrmann's avatar
      HID: uhid: fix leak for 64/32 UHID_CREATE · 80897aa7
      David Herrmann authored
      UHID allows short writes so user-space can omit unused fields. We
      automatically set them to 0 in the kernel. However, the 64/32 bit
      compat-handler didn't do that in the UHID_CREATE fallback. This will
      reveal random kernel heap data (of random size, even) to user-space.
      
      Fixes: befde022 ('HID: uhid: make creating devices work on 64/32 systems')
      Reported-by: default avatarBen Hutchings <ben@decadent.org.uk>
      Signed-off-by: default avatarDavid Herrmann <dh.herrmann@gmail.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      80897aa7
    • Hui Wang's avatar
      ALSA: hda - Enable mute/mic-mute LEDs for more Thinkpads with Conexant codec · 2fd3f170
      Hui Wang authored
      Most Thinkpad Edge series laptops use conexant codec, so far although
      the codecs have different minor Vendor Id and minor Subsystem Id,
      they all belong to the cxt5066 family, this change can make the
      mute/mic-mute LEDs support more generic among cxt_5066 family.
      
      This design refers to the similar solution for the realtek codec
      ALC269 family in the patch_realtek.c.
      
      Cc: Alex Hung <alex.hung@canonical.com>
      Signed-off-by: default avatarHui Wang <hui.wang@canonical.com>
      Acked-by: default avatarDavid Henningsson <david.henningsson@canonical.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      2fd3f170