The bug can cause NULL pointer dereference in write_partial_msg_pages
Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
Reviewed-by: Alex Elder <elder@inktank.com>
(cherry picked from commit 43643528cc)
There were a few direct calls to ceph_con_{get,put}() instead of the con
ops from osd_client.c. This is a bug since those ops aren't defined to
be ceph_con_get/put.
This breaks refcounting on the ceph_osd structs that contain the
ceph_connections, and could lead to all manner of strangeness.
The purpose of the ->get and ->put methods in a ceph connection are
to allow the connection to indicate it has a reference to something
external to the messaging system, *not* to indicate something
external has a reference to the connection.
[elder@inktank.com: added that last sentence]
Signed-off-by: Sage Weil <sage@newdream.net>
Reviewed-by: Alex Elder <elder@inktank.com>
(cherry picked from commit 0d47766f14)
In ceph_osdc_release_request(), a reference to the r_reply message
is dropped. But just after that, that same message is revoked if it
was in use to receive an incoming reply. Reorder these so we are
sure we hold a reference until we're actually done with the message.
Signed-off-by: Alex Elder <elder@inktank.com>
Reviewed-by: Sage Weil <sage@inktank.com>
(cherry picked from commit ab8cb34a4b)
I got lots of NULL pointer dereference Oops when compiling kernel on ceph.
The bug is because the kernel page migration routine replaces some pages
in the page cache with new pages, these new pages' private can be non-zero.
Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
Signed-off-by: Sage Weil <sage@inktank.com>
(cherry picked from commit 28c0254ede)
Most of changes are fairly small and driver-specific.
A remaining regression fix for USB-audio sync pipe check, a fix for
HD-audio power-up sequence, fixes for ASoC pxa-ssp compile issues, and
bunch of ASoC codec and trivial fix patches.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)
iQIcBAABAgAGBQJP4WpIAAoJEGwxgFQ9KSmkmwMQAJ4kgUED9asypx3bGkw5hRdb
wgyZZJsyUYUIpK+xuwqpYnZFCd77+8su1PXnepmB7+0ChvxhyN2NyPPjxrXwL4Pz
Av3/s5jMSmHesu+xhy3hkpT/QBE5Gal6a3ZK9ZYTFBULC7w8SLaOAdld1+aJYul8
vMPL84dwsz3LYhItVNLKydRdzxiyQh1uIRCcUojqbvNusULMYsDv4P1jeBN7PzKJ
qPhqc9Tabjer1+MEXD5CvWB8YhsUBmbR6aWH7fi++/v+ve4YP/OKfxHkPPCE7tG3
W0wtKbZFXo177gzGe/p8JnzUYZ0IdmTf6KUv1KcqHBGDzSUj1dQtN/g6L4CjbBl1
DNuNZVmKzwlL8iMUpfPpxVnw2ZiqZ2w5Ze439/CTngZuR6LoeBvFBgYZ5nQ65fZw
TZ0tWK4/2XawDf1+FX7bDcXEM4U7zqqg1nl2X2WZwuDhw+TDQj1wKfKu52ZZVAfS
tCn9uT++33y1Id39bhKiRHZUbdovTED1kDaX9Fh2d8Kn3tZUyQnb4tciDyim4P1p
WSfzTouqUTTP9p+kbWyk8PW9RnbcK/BttS2p6G1e287eLF/poHEJxj00vQ85gdDo
pib7E2gEEQfrtbHv8c6yRDQsYL+ON6Zc1bjSBy9h8YhVaNHhe8UGqFVSmCMHwRFB
NyEGpUNuBmq3PI8Nhc8j
=oQ5N
-----END PGP SIGNATURE-----
Merge tag 'sound-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"Most of changes are fairly small and driver-specific.
A remaining regression fix for USB-audio sync pipe check, a fix for
HD-audio power-up sequence, fixes for ASoC pxa-ssp compile issues, and
bunch of ASoC codec and trivial fix patches."
* tag 'sound-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: 6fire: use NULL instead of 0 for pointer assignment
ALSA: hda - Handle open while transitioning to D3.
ALSA: snd-usb: make snd_usb_substream_capture_trigger static
ALSA: snd-usb: fix sync pipe check
ASoC: tegra+wm8903: turn of mic detect when card is removed
ASoC: wm8996: Mark the CODEC as cache only when powering off on boot
ASoC: wm8996: Move reset before the initial regulator disable
ASoC: wm8996: Remove spurious regulator_bulk_free()
ASoC: wm8904: Fix cache only management
ASoC: wm8904: Fix GPIO and MICBIAS initialisation for regmap conversion
ASoC: fix pxa-ssp compiling issue under mach-mmp
ARM: MMP: add pxa910-ssp into ssp_id_table
Change || check to the intended && when checking the QP type in a
received connection request against the listening endpoint.
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
This brings the in-kernel driver up to the level of the
csr-linux-wifi-5.1.0-oss.tar.gz tarball.
Cc: Mikko Virkkilä <mikko.virkkila@bluegiga.com>
Cc: Lauri Hintsala <Lauri.Hintsala@bluegiga.com>
Cc: Riku Mettälä <riku.mettala@bluegiga.com>
Cc: Veli-Pekka Peltola <veli-pekka.peltola@bluegiga.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This consists of two modules, the driver, and a "helper" module that is
just a wrapper around common kernel functions. The wrapper module will
be removed soon, but for now it's needed.
These files were based on the csr-linux-wifi-5.0.3-oss.tar.gz package
provided by CSR and Blue Giga, and is covered under the license
specified in the LICENSE.txt file (basically dual BSD and GPLv2). The
files were flattened out of the deep directory mess they were originally
in, and a few EXPORT_SYMBOL_GPL() were added in order for everything to
link properly with the helper module setup.
Cc: Mikko Virkkilä <mikko.virkkila@bluegiga.com>
Cc: Lauri Hintsala <Lauri.Hintsala@bluegiga.com>
Cc: Riku Mettälä <riku.mettala@bluegiga.com>
Cc: Veli-Pekka Peltola <veli-pekka.peltola@bluegiga.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This module is used by the CSR wifi driver to "abstract" away the
OS-specific parts of core functions. It will be eventually deleted, but
for now is needed as the CSR driver relies on it.
Cc: Mikko Virkkilä <mikko.virkkila@bluegiga.com>
Cc: Lauri Hintsala <Lauri.Hintsala@bluegiga.com>
Cc: Riku Mettälä <riku.mettala@bluegiga.com>
Cc: Veli-Pekka Peltola <veli-pekka.peltola@bluegiga.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In nfs_direct_write_reschedule(), the requests from nfs_scan_commit_list
have a refcount of 2, whereas the operations in
nfs_direct_write_completion_ops expect them to have a refcount of 1.
This patch adds a call to release the extra references.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Fred Isaman <iisaman@netapp.com>
One small bug fix, plus a rename of all the ST Ericsson regulators in
the device tree since all the device trees had been written with
different names and some infelicities in the test proceedures meant that
the device tree code had apparently never actually been run against the
upstream device tree.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAABAgAGBQJP3hQ6AAoJEBus8iNuMP3dbToP/iFWsPR14SRqtmv5N0AEftyD
SdDYZRdWAlwSunRkZhE12Kk1+q2wpxYmG2rJgYHJWw2Mk4biaW6XHKKGYjKxJ0C6
WdskxhAs+Pl0KFqq0Z2+zrWEjSFMqkFHQrt3zfSHFb/ju3Us6jn8VaxR0i+WlWSJ
IIZRvHPRU0et+BXuVUwcF6JOPNnoWlsFVugCBH7r56mCgPkU78NTKycUD6oprQvy
BIMrHek5TWK39a6oHICWGLgQBxMKDNz+91yq9+4mIjxE84XcsAGuZcoDcbpNHtbA
YmusSqKHQ0ShZVDvGj58xntbmh0SjqC/8CnVrzgXGOHaHisHiErZ/1y4sEiLrPnL
o/6/42wyO+DKfftAOYOydks4AfOFPUJsfpvR/wDFvVSwwCSYJCwxP0ZxfQ9GGGcl
IH8oLb84F3uHqg7De/zCW5+Qsw+EUxq76K+lnKx8vab5mJWtwxl9kMOsttYjr/f0
8/q5ndln0C3rnAoB6hPMqE7bCswDkk3dXuAbln3OIkbhNglpSsyU5R+b2h5hugTG
oENPkMTYFf8dRJ1hZsWrKM9HZaHWgxUe5KcEMyYEel3qdiYHWjmprnOeNHNo/u/o
uG4tVlHO0rvOZpRbuvzc72Uonyri/oTfJ3b5Z9ZkRhmd/9pV83jJx12HlXxQoIae
nvHtEhp2dKYVBIXfc+0s
=NS0T
-----END PGP SIGNATURE-----
Merge tag 'regulator-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"One small bug fix, plus a rename of all the ST Ericsson regulators in
the device tree since all the device trees had been written with
different names and some infelicities in the test proceedures meant
that the device tree code had apparently never actually been run
against the upstream device tree."
* tag 'regulator-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: Change db8500-prcmu match names to reflect Device Tree
regulator: Change ab8500 match names to reflect Device Tree
regulator: Fix the s5m8767a problem of the division by null
The call to try_module_get() dereferences ld_type outside the
spin locks, which means that it may be pointing to garbage if
a module unload was in progress.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
At the moment we call kvmppc_pin_guest_page() in kvmppc_update_vpa()
with two spinlocks held: the vcore lock and the vcpu->vpa_update_lock.
This is not good, since kvmppc_pin_guest_page() calls down_read() and
get_user_pages_fast(), both of which can sleep. This bug was introduced
in 2e25aa5f ("KVM: PPC: Book3S HV: Make virtual processor area
registration more robust").
This arranges to drop those spinlocks before calling
kvmppc_pin_guest_page() and re-take them afterwards. Dropping the
vcore lock in kvmppc_run_core() means we have to set the vcore_state
field to VCORE_RUNNING before we drop the lock, so that other vcpus
won't try to run this vcore.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Acked-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Avi Kivity <avi@redhat.com>
When CONFIG_COMPAT is not defined, comedi_compat_ioctl should be
NULL not 0 in order to set the file_operations compat_ioctl variable
correctly.
This quiets a sparse warning about:
warning: Using plain integer as NULL pointer
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Cc: Frank Mori Hess <fmhess@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The comedi_async 'inttrig' member is a pointer to a callback
function. NULL should be used to clear it not 0.
This quiets a number of sparse warnings about:
Warning: Using plain integer as NULL pointer
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Cc: Frank Mori Hess <fmhess@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
beware, does change the ABI as proximity_on_chip_ambient_infrared_supression
is changed to proximity_on_chip_ambient_infrared_suppression
Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Acked-by: Laxman Dewangan <ldewangan@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
just drop execute permission
Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the new triggered buffer setup helper function to allocate and register
buffer and pollfunc.
Also as part of the conversion drop scan_timestamp being enabled by default,
since it is a left over of an earlier cleanup.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the new triggered buffer setup helper function to allocate and register
buffer and pollfunc.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the new triggered buffer setup helper function to allocate and register
buffer and pollfunc.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the new triggered buffer setup helper function to allocate and register
buffer and pollfunc.
Also as part of the conversion drop scan_timestamp being enabled by default,
since it is a left over of an earlier cleanup.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the new triggered buffer setup helper function to allocate and register
buffer and pollfunc.
Also as part of the conversion drop scan_timestamp being enabled by default,
since it is a left over of an earlier cleanup.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the new triggered buffer setup helper function to allocate and register
buffer and pollfunc.
The previous code was not passing the temperature channel to iio_buffer_register
since the temperature channel can not be used in buffered mode. With the new
helper functions it is not possible to do this, instead the scan index for the
temperature channel is set to -1 which will cause iio_buffer_register to ignore
the channel. (Also While we are at it also assign the symbolic constant instead
of the raw value to the channel address for the temperature channel).
Also as part of the conversion drop scan_timestamp being enabled by default,
since it is a left over of an earlier cleanup.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the new triggered buffer setup helper function to allocate and register
buffer and pollfunc.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use the new triggered buffer setup helper function to allocate and register
buffer and pollfunc.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add a helper function for executing the common tasks which are usually involved
in setting up a simple software ringbuffer. It will allocate the buffer,
allocate the pollfunc and register the buffer.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
It is not always the case that all channels can be used in buffered mode. This
patch allows channels, which can not be used in buffered mode, to set their scan
index to a negative number, which will cause iio_buffer_register to ignore the
channel.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The below patch fixes a typo found while reading through staging/slicoss
Signed-off-by: Justin P. Mattock <justinmattock@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes some typos that was found while reading through staging/serqt_usb2
Signed-off-by: Justin P. Mattock <justinmattock@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Replace pr_* calls with dev_* ones when the device structure is available.
Signed-off-by: Miguel Gómez <magomez@igalia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add include files with function definitions to avoid sparse warnings.
Signed-off-by: Miguel Gómez <magomez@igalia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
XGIFAIL() prints a message and returns a value, but it's used only in one
place. Better remove it and replace the call with the macro content.
Signed-off-by: Miguel Gómez <magomez@igalia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Define real content of dumpVGAReg() only in debug mode. Remove old condition.
Signed-off-by: Miguel Gómez <magomez@igalia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove DEBUGPRN() macro which is defined as empty.
Signed-off-by: Miguel Gómez <magomez@igalia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The 'io_bits' variable in the comedi_subdevice struct is a bitmask of
the input/output configuration of the the subdevice. It should be an
unsigned int to correctly represent this.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Cc: Frank Mori Hess: <fmhess@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The comedi_subdevice 'insn_bits' functions return the number of data
elements used to perform the command. Most of the insn_bits functions
return an open coded '2' to indicate this. The same value is available
as 'insn->n'. Return that instead to better indicate what the return
means.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Cc: Frank Mori Hess <fmhess@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The comedi core does the sanity check to make sure that the data length
the INSN_BITS instruction is 2. There is no need for the drivers to do
this check. Remove all the sanity checks in the drivers.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Cc: Frank Mori Hess <fmhess@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change the usbduxsigma driver to use the new attach_usb() hook in struct
comedi_driver to auto-configure probed USB devices after the firmware is
loaded.
Move the release of the driver's static 'start_stop_sem' semaphore in
usbduxsigma_attach() to occur a bit later for convenience, otherwise the
new usbduxsigma_attach_common() would need to be split in two. I don't
think the slight delay in releasing the semaphore matters too much; it's
only used in the USB probe and disconnect functions and when attaching
and detaching comedi devices.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change the vmv80xx driver to use the new attach_usb() hook in struct
comedi_driver to auto-configure probed USB devices after the firmware is
loaded.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change the usbduxfast driver to use the new attach_usb() hook in struct
comedi_driver to auto-configure probed USB devices after the firmware is
loaded.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
