<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers, branch v2.6.38.2</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>dcdbas: force SMI to happen when expected</title>
<updated>2011-03-27T18:36:39+00:00</updated>
<author>
<name>Stuart Hayes</name>
<email>stuart_hayes@yahoo.com</email>
</author>
<published>2011-03-02T12:42:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=0dc58dee18c289cbbaa6fb4b5746d6b503ae5642'/>
<id>0dc58dee18c289cbbaa6fb4b5746d6b503ae5642</id>
<content type='text'>
commit dd65c736d1b5312c80c88a64bf521db4959eded5 upstream.

The dcdbas driver can do an I/O write to cause a SMI to occur.  The SMI handler
looks at certain registers and memory locations, so the SMI needs to happen
immediately.  On some systems I/O writes are posted, though, causing the SMI to
happen well after the "outb" occurred, which causes random failures.  Following
the "outb" with an "inb" forces the write to go through even if it is posted.

Signed-off-by: Stuart Hayes &lt;stuart_hayes@yahoo.com&gt;
Acked-by: Doug Warzecha &lt;douglas_warzecha@dell.com&gt;
Cc: Chuck Ebbert &lt;cebbert@redhat.com&gt;
Signed-off-by: Jiri Kosina &lt;jkosina@suse.cz&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit dd65c736d1b5312c80c88a64bf521db4959eded5 upstream.

The dcdbas driver can do an I/O write to cause a SMI to occur.  The SMI handler
looks at certain registers and memory locations, so the SMI needs to happen
immediately.  On some systems I/O writes are posted, though, causing the SMI to
happen well after the "outb" occurred, which causes random failures.  Following
the "outb" with an "inb" forces the write to go through even if it is posted.

Signed-off-by: Stuart Hayes &lt;stuart_hayes@yahoo.com&gt;
Acked-by: Doug Warzecha &lt;douglas_warzecha@dell.com&gt;
Cc: Chuck Ebbert &lt;cebbert@redhat.com&gt;
Signed-off-by: Jiri Kosina &lt;jkosina@suse.cz&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon/kms: fix hardcoded EDID handling</title>
<updated>2011-03-27T18:36:34+00:00</updated>
<author>
<name>Alex Deucher</name>
<email>alexdeucher@gmail.com</email>
</author>
<published>2011-03-23T08:10:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=0b62527f8258ce04782469e4521b43d4dd5fc5f0'/>
<id>0b62527f8258ce04782469e4521b43d4dd5fc5f0</id>
<content type='text'>
commit fafcf94e2b5732d1e13b440291c53115d2b172e9 upstream.

On some servers there is a hardcoded EDID provided
in the vbios so that the driver will always see a
display connected even if something like a KVM
prevents traditional means like DDC or load
detection from working properly.  Also most
server boards with DVI are not actually DVI, but
DVO connected to a virtual KVM service processor.
If we fail to detect a monitor via DDC or load
detection and a hardcoded EDID is available, use
it.

Additionally, when using the hardcoded EDID, use
a copy of it rather than the actual one stored
in the driver as the detect() and get_modes()
functions may free it if DDC is successful.

This fixes the virtual KVM on several internal
servers.

Signed-off-by: Alex Deucher &lt;alexdeucher@gmail.com&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit fafcf94e2b5732d1e13b440291c53115d2b172e9 upstream.

On some servers there is a hardcoded EDID provided
in the vbios so that the driver will always see a
display connected even if something like a KVM
prevents traditional means like DDC or load
detection from working properly.  Also most
server boards with DVI are not actually DVI, but
DVO connected to a virtual KVM service processor.
If we fail to detect a monitor via DDC or load
detection and a hardcoded EDID is available, use
it.

Additionally, when using the hardcoded EDID, use
a copy of it rather than the actual one stored
in the driver as the detect() and get_modes()
functions may free it if DDC is successful.

This fixes the virtual KVM on several internal
servers.

Signed-off-by: Alex Deucher &lt;alexdeucher@gmail.com&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/radeon/kms: prefer legacy pll algo for tv-out</title>
<updated>2011-03-27T18:36:33+00:00</updated>
<author>
<name>Alex Deucher</name>
<email>alexdeucher@gmail.com</email>
</author>
<published>2011-03-22T05:46:12+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3b7a3e87e21e4d0a7d231bdab2b00af84a89106b'/>
<id>3b7a3e87e21e4d0a7d231bdab2b00af84a89106b</id>
<content type='text'>
commit 64146f8b2af1ba77fe3c21d9d6d7213b9bb72b40 upstream.

ntsc seems to work fine with either algo, some
pal TVs seem pickier.

Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=30832

Signed-off-by: Alex Deucher &lt;alexdeucher@gmail.com&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 64146f8b2af1ba77fe3c21d9d6d7213b9bb72b40 upstream.

ntsc seems to work fine with either algo, some
pal TVs seem pickier.

Fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=30832

Signed-off-by: Alex Deucher &lt;alexdeucher@gmail.com&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm: Fix use-after-free in drm_gem_vm_close()</title>
<updated>2011-03-27T18:36:32+00:00</updated>
<author>
<name>Chris Wilson</name>
<email>chris@chris-wilson.co.uk</email>
</author>
<published>2011-03-17T22:33:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8ee663ceb3d0ee74a746800f3919baf5a621ead9'/>
<id>8ee663ceb3d0ee74a746800f3919baf5a621ead9</id>
<content type='text'>
commit b74ad5ae14def5e81ad0be3dddb96e485b861b1b upstream.

As we may release the last reference, we need to store the device in a
local variable in order to unlock afterwards.

[   60.140768] BUG: unable to handle kernel paging request at 6b6b6b9f
[   60.140973] IP: [&lt;c1536d11&gt;] __mutex_unlock_slowpath+0x5a/0x111
[   60.141014] *pdpt = 0000000024a54001 *pde = 0000000000000000
[   60.141014] Oops: 0002 [#1] PREEMPT SMP
[   60.141014] last sysfs file: /sys/devices/LNXSYSTM:00/device:00/PNP0A08:00/PNP0C0A:00/power_supply/BAT0/voltage_now
[   60.141014] Modules linked in: uvcvideo ath9k pegasus ath9k_common ath9k_hw hid_egalax ath3k joydev asus_laptop sparse_keymap battery input_polldev
[   60.141014]
[   60.141014] Pid: 771, comm: meego-ux-daemon Not tainted 2.6.37.2-7.1 #1 EXOPC EXOPG06411/EXOPG06411
[   60.141014] EIP: 0060:[&lt;c1536d11&gt;] EFLAGS: 00010046 CPU: 0
[   60.141014] EIP is at __mutex_unlock_slowpath+0x5a/0x111
[   60.141014] EAX: 00000100 EBX: 6b6b6b9b ECX: e9b4a1b0 EDX: e4a4e580
[   60.141014] ESI: db162558 EDI: 00000246 EBP: e480be50 ESP: e480be44
[   60.141014]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[   60.141014] Process meego-ux-daemon (pid: 771, ti=e480a000 task=e9b4a1b0 task.ti=e480a000)
[   60.141014] Stack:
[   60.141014]  e4a4e580 db162558 f5a2f838 e480be58 c1536dd0 e480be68 c125ab1b db162558
[   60.141014]  db1624e0 e480be78 c10ba071 db162558 f760241c e480be94 c10bb0bc 000155fe
[   60.141014]  f760241c f5a2f838 f5a2f8c8 00000000 e480bea4 c1037c24 00000000 f5a2f838
[   60.141014] Call Trace:
[   60.141014]  [&lt;c1536dd0&gt;] ? mutex_unlock+0x8/0xa
[   60.141014]  [&lt;c125ab1b&gt;] ? drm_gem_vm_close+0x39/0x3d
[   60.141014]  [&lt;c10ba071&gt;] ? remove_vma+0x2d/0x58
[   60.141014]  [&lt;c10bb0bc&gt;] ? exit_mmap+0x126/0x13f
[   60.141014]  [&lt;c1037c24&gt;] ? mmput+0x37/0x9a
[   60.141014]  [&lt;c10d450d&gt;] ? exec_mmap+0x178/0x19c
[   60.141014]  [&lt;c1537f85&gt;] ? _raw_spin_unlock+0x1d/0x36
[   60.141014]  [&lt;c10d4eb0&gt;] ? flush_old_exec+0x42/0x75
[   60.141014]  [&lt;c1104442&gt;] ? load_elf_binary+0x32a/0x922
[   60.141014]  [&lt;c10d3f76&gt;] ? search_binary_handler+0x200/0x2ea
[   60.141014]  [&lt;c10d3ecf&gt;] ? search_binary_handler+0x159/0x2ea
[   60.141014]  [&lt;c1104118&gt;] ? load_elf_binary+0x0/0x922
[   60.141014]  [&lt;c10d56b2&gt;] ? do_execve+0x1ff/0x2e6
[   60.141014]  [&lt;c100970e&gt;] ? sys_execve+0x2d/0x55
[   60.141014]  [&lt;c1002a5a&gt;] ? ptregs_execve+0x12/0x18
[   60.141014]  [&lt;c10029dc&gt;] ? sysenter_do_call+0x12/0x3c
[   60.141014]  [&lt;c1530000&gt;] ? init_centaur+0x9c/0x1ba
[   60.141014] Code: c1 00 75 0f ba 38 01 00 00 b8 8c 3a 6c c1 e8 cc 2e b0 ff 9c 58 8d 74 26 00 89 c7 fa 90 8d 74 26 00 e8 d2 b4 b2 ff b8 00 01 00 00 &lt;f0&gt; 66 0f c1 43 04 38 e0 74 07 f3 90 8a 43 04 eb f5 83 3d 64 ef
[   60.141014] EIP: [&lt;c1536d11&gt;] __mutex_unlock_slowpath+0x5a/0x111 SS:ESP 0068:e480be44
[   60.141014] CR2: 000000006b6b6b9f

Reported-by: Rusty Lynch &lt;rusty.lynch@intel.com&gt;
Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit b74ad5ae14def5e81ad0be3dddb96e485b861b1b upstream.

As we may release the last reference, we need to store the device in a
local variable in order to unlock afterwards.

[   60.140768] BUG: unable to handle kernel paging request at 6b6b6b9f
[   60.140973] IP: [&lt;c1536d11&gt;] __mutex_unlock_slowpath+0x5a/0x111
[   60.141014] *pdpt = 0000000024a54001 *pde = 0000000000000000
[   60.141014] Oops: 0002 [#1] PREEMPT SMP
[   60.141014] last sysfs file: /sys/devices/LNXSYSTM:00/device:00/PNP0A08:00/PNP0C0A:00/power_supply/BAT0/voltage_now
[   60.141014] Modules linked in: uvcvideo ath9k pegasus ath9k_common ath9k_hw hid_egalax ath3k joydev asus_laptop sparse_keymap battery input_polldev
[   60.141014]
[   60.141014] Pid: 771, comm: meego-ux-daemon Not tainted 2.6.37.2-7.1 #1 EXOPC EXOPG06411/EXOPG06411
[   60.141014] EIP: 0060:[&lt;c1536d11&gt;] EFLAGS: 00010046 CPU: 0
[   60.141014] EIP is at __mutex_unlock_slowpath+0x5a/0x111
[   60.141014] EAX: 00000100 EBX: 6b6b6b9b ECX: e9b4a1b0 EDX: e4a4e580
[   60.141014] ESI: db162558 EDI: 00000246 EBP: e480be50 ESP: e480be44
[   60.141014]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[   60.141014] Process meego-ux-daemon (pid: 771, ti=e480a000 task=e9b4a1b0 task.ti=e480a000)
[   60.141014] Stack:
[   60.141014]  e4a4e580 db162558 f5a2f838 e480be58 c1536dd0 e480be68 c125ab1b db162558
[   60.141014]  db1624e0 e480be78 c10ba071 db162558 f760241c e480be94 c10bb0bc 000155fe
[   60.141014]  f760241c f5a2f838 f5a2f8c8 00000000 e480bea4 c1037c24 00000000 f5a2f838
[   60.141014] Call Trace:
[   60.141014]  [&lt;c1536dd0&gt;] ? mutex_unlock+0x8/0xa
[   60.141014]  [&lt;c125ab1b&gt;] ? drm_gem_vm_close+0x39/0x3d
[   60.141014]  [&lt;c10ba071&gt;] ? remove_vma+0x2d/0x58
[   60.141014]  [&lt;c10bb0bc&gt;] ? exit_mmap+0x126/0x13f
[   60.141014]  [&lt;c1037c24&gt;] ? mmput+0x37/0x9a
[   60.141014]  [&lt;c10d450d&gt;] ? exec_mmap+0x178/0x19c
[   60.141014]  [&lt;c1537f85&gt;] ? _raw_spin_unlock+0x1d/0x36
[   60.141014]  [&lt;c10d4eb0&gt;] ? flush_old_exec+0x42/0x75
[   60.141014]  [&lt;c1104442&gt;] ? load_elf_binary+0x32a/0x922
[   60.141014]  [&lt;c10d3f76&gt;] ? search_binary_handler+0x200/0x2ea
[   60.141014]  [&lt;c10d3ecf&gt;] ? search_binary_handler+0x159/0x2ea
[   60.141014]  [&lt;c1104118&gt;] ? load_elf_binary+0x0/0x922
[   60.141014]  [&lt;c10d56b2&gt;] ? do_execve+0x1ff/0x2e6
[   60.141014]  [&lt;c100970e&gt;] ? sys_execve+0x2d/0x55
[   60.141014]  [&lt;c1002a5a&gt;] ? ptregs_execve+0x12/0x18
[   60.141014]  [&lt;c10029dc&gt;] ? sysenter_do_call+0x12/0x3c
[   60.141014]  [&lt;c1530000&gt;] ? init_centaur+0x9c/0x1ba
[   60.141014] Code: c1 00 75 0f ba 38 01 00 00 b8 8c 3a 6c c1 e8 cc 2e b0 ff 9c 58 8d 74 26 00 89 c7 fa 90 8d 74 26 00 e8 d2 b4 b2 ff b8 00 01 00 00 &lt;f0&gt; 66 0f c1 43 04 38 e0 74 07 f3 90 8a 43 04 eb f5 83 3d 64 ef
[   60.141014] EIP: [&lt;c1536d11&gt;] __mutex_unlock_slowpath+0x5a/0x111 SS:ESP 0068:e480be44
[   60.141014] CR2: 000000006b6b6b9f

Reported-by: Rusty Lynch &lt;rusty.lynch@intel.com&gt;
Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/i915: Prevent racy removal of request from client list</title>
<updated>2011-03-27T18:36:31+00:00</updated>
<author>
<name>Herton Ronaldo Krzesinski</name>
<email>herton.krzesinski@canonical.com</email>
</author>
<published>2011-03-17T13:45:12+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=07e8926d65b0d393a67cdbc61a81515e714cc702'/>
<id>07e8926d65b0d393a67cdbc61a81515e714cc702</id>
<content type='text'>
commit 09bfa51773c1e90f13000dc2fc0c4b84047009bc upstream.

When i915_gem_retire_requests_ring calls i915_gem_request_remove_from_client,
the client_list for that request may already be removed in i915_gem_release.
So we may call twice list_del(&amp;request-&gt;client_list), resulting in an
oops like this report:

[126167.230394] BUG: unable to handle kernel paging request at 00100104
[126167.230699] IP: [&lt;f8c2ce44&gt;] i915_gem_retire_requests_ring+0xd4/0x240 [i915]
[126167.231042] *pdpt = 00000000314c1001 *pde = 0000000000000000
[126167.231314] Oops: 0002 [#1] SMP
[126167.231471] last sysfs file: /sys/devices/LNXSYSTM:00/device:00/PNP0C0A:00/power_supply/BAT1/current_now
[126167.231901] Modules linked in: snd_seq_dummy nls_utf8 isofs btrfs zlib_deflate libcrc32c ufs qnx4 hfsplus hfs minix ntfs vfat msdos fat jfs xfs exportfs reiserfs cryptd aes_i586 aes_generic binfmt_misc vboxnetadp vboxnetflt vboxdrv parport_pc ppdev snd_hda_codec_hdmi snd_hda_codec_conexant snd_hda_intel snd_hda_codec snd_hwdep arc4 snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq uvcvideo videodev snd_timer snd_seq_device joydev iwlagn iwlcore mac80211 snd cfg80211 soundcore i915 drm_kms_helper snd_page_alloc psmouse drm serio_raw i2c_algo_bit video lp parport usbhid hid sky2 sdhci_pci ahci sdhci libahci
[126167.232018]
[126167.232018] Pid: 1101, comm: Xorg Not tainted 2.6.38-6-generic-pae #34-Ubuntu Gateway                          MC7833U /
[126167.232018] EIP: 0060:[&lt;f8c2ce44&gt;] EFLAGS: 00213246 CPU: 0
[126167.232018] EIP is at i915_gem_retire_requests_ring+0xd4/0x240 [i915]
[126167.232018] EAX: 00200200 EBX: f1ac25b0 ECX: 00000040 EDX: 00100100
[126167.232018] ESI: f1a2801c EDI: e87fc060 EBP: ef4d7dd8 ESP: ef4d7db0
[126167.232018]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[126167.232018] Process Xorg (pid: 1101, ti=ef4d6000 task=f1ba6500 task.ti=ef4d6000)
[126167.232018] Stack:
[126167.232018]  f1a28000 f1a2809c f1a28094 0058bd97 f1aa2400 f1a2801c 0058bd7b 0058bd85
[126167.232018]  f1a2801c f1a28000 ef4d7e38 f8c2e995 ef4d7e30 ef4d7e60 c14d1ebc f6b3a040
[126167.232018]  f1522cc0 000000db 00000000 f1ba6500 ffffffa1 00000000 00000001 f1a29214
[126167.232018] Call Trace:

Unfortunately the call trace reported was cut, but looking at debug
symbols the crash is at __list_del, when probably list_del is called
twice on the same request-&gt;client_list, as the dereferenced value is
LIST_POISON1 + 4, and by looking more at the debug symbols before
list_del call it should have being called by
i915_gem_request_remove_from_client

And as I can see in the code, it seems we indeed have the possibility
to remove a request-&gt;client_list twice, which would cause the above,
because we do list_del(&amp;request-&gt;client_list) on both
i915_gem_request_remove_from_client and i915_gem_release

As Chris Wilson pointed out, it's indeed the case:
"(...) I had thought that the actual insertion/deletion was serialised
under the struct mutex and the intention of the spinlock was to protect
the unlocked list traversal during throttling. However, I missed that
i915_gem_release() is also called without struct mutex and so we do need
the double check for i915_gem_request_remove_from_client()."

This change does the required check to avoid the duplicate remove of
request-&gt;client_list.

Bugzilla: http://bugs.launchpad.net/bugs/733780
Signed-off-by: Herton Ronaldo Krzesinski &lt;herton.krzesinski@canonical.com&gt;
Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 09bfa51773c1e90f13000dc2fc0c4b84047009bc upstream.

When i915_gem_retire_requests_ring calls i915_gem_request_remove_from_client,
the client_list for that request may already be removed in i915_gem_release.
So we may call twice list_del(&amp;request-&gt;client_list), resulting in an
oops like this report:

[126167.230394] BUG: unable to handle kernel paging request at 00100104
[126167.230699] IP: [&lt;f8c2ce44&gt;] i915_gem_retire_requests_ring+0xd4/0x240 [i915]
[126167.231042] *pdpt = 00000000314c1001 *pde = 0000000000000000
[126167.231314] Oops: 0002 [#1] SMP
[126167.231471] last sysfs file: /sys/devices/LNXSYSTM:00/device:00/PNP0C0A:00/power_supply/BAT1/current_now
[126167.231901] Modules linked in: snd_seq_dummy nls_utf8 isofs btrfs zlib_deflate libcrc32c ufs qnx4 hfsplus hfs minix ntfs vfat msdos fat jfs xfs exportfs reiserfs cryptd aes_i586 aes_generic binfmt_misc vboxnetadp vboxnetflt vboxdrv parport_pc ppdev snd_hda_codec_hdmi snd_hda_codec_conexant snd_hda_intel snd_hda_codec snd_hwdep arc4 snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq uvcvideo videodev snd_timer snd_seq_device joydev iwlagn iwlcore mac80211 snd cfg80211 soundcore i915 drm_kms_helper snd_page_alloc psmouse drm serio_raw i2c_algo_bit video lp parport usbhid hid sky2 sdhci_pci ahci sdhci libahci
[126167.232018]
[126167.232018] Pid: 1101, comm: Xorg Not tainted 2.6.38-6-generic-pae #34-Ubuntu Gateway                          MC7833U /
[126167.232018] EIP: 0060:[&lt;f8c2ce44&gt;] EFLAGS: 00213246 CPU: 0
[126167.232018] EIP is at i915_gem_retire_requests_ring+0xd4/0x240 [i915]
[126167.232018] EAX: 00200200 EBX: f1ac25b0 ECX: 00000040 EDX: 00100100
[126167.232018] ESI: f1a2801c EDI: e87fc060 EBP: ef4d7dd8 ESP: ef4d7db0
[126167.232018]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[126167.232018] Process Xorg (pid: 1101, ti=ef4d6000 task=f1ba6500 task.ti=ef4d6000)
[126167.232018] Stack:
[126167.232018]  f1a28000 f1a2809c f1a28094 0058bd97 f1aa2400 f1a2801c 0058bd7b 0058bd85
[126167.232018]  f1a2801c f1a28000 ef4d7e38 f8c2e995 ef4d7e30 ef4d7e60 c14d1ebc f6b3a040
[126167.232018]  f1522cc0 000000db 00000000 f1ba6500 ffffffa1 00000000 00000001 f1a29214
[126167.232018] Call Trace:

Unfortunately the call trace reported was cut, but looking at debug
symbols the crash is at __list_del, when probably list_del is called
twice on the same request-&gt;client_list, as the dereferenced value is
LIST_POISON1 + 4, and by looking more at the debug symbols before
list_del call it should have being called by
i915_gem_request_remove_from_client

And as I can see in the code, it seems we indeed have the possibility
to remove a request-&gt;client_list twice, which would cause the above,
because we do list_del(&amp;request-&gt;client_list) on both
i915_gem_request_remove_from_client and i915_gem_release

As Chris Wilson pointed out, it's indeed the case:
"(...) I had thought that the actual insertion/deletion was serialised
under the struct mutex and the intention of the spinlock was to protect
the unlocked list traversal during throttling. However, I missed that
i915_gem_release() is also called without struct mutex and so we do need
the double check for i915_gem_request_remove_from_client()."

This change does the required check to avoid the duplicate remove of
request-&gt;client_list.

Bugzilla: http://bugs.launchpad.net/bugs/733780
Signed-off-by: Herton Ronaldo Krzesinski &lt;herton.krzesinski@canonical.com&gt;
Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm/i915: Disable pagefaults along execbuffer relocation fast path</title>
<updated>2011-03-27T18:36:30+00:00</updated>
<author>
<name>Chris Wilson</name>
<email>chris@chris-wilson.co.uk</email>
</author>
<published>2011-03-14T15:11:24+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=d449b2a924941d023fb9dc1ad397c5b4b740aba4'/>
<id>d449b2a924941d023fb9dc1ad397c5b4b740aba4</id>
<content type='text'>
commit d4aeee776017b6da6dcd12f453cd82a3c951a0dc upstream.

Along the fast path for relocation handling, we attempt to copy directly
from the user data structures whilst holding our mutex. This causes
lockdep to warn about circular lock dependencies if we need to pagefault
the user pages. [Since when handling a page fault on a mmapped bo, we
need to acquire the struct mutex whilst already holding the mm
semaphore, it is then verboten to acquire the mm semaphore when already
holding the struct mutex. The likelihood of the user passing in the
relocations contained in a GTT mmaped bo is low, but conceivable for
extreme pathology.] In order to force the mm to return EFAULT rather
than handle the pagefault, we therefore need to disable pagefaults
across the relocation fast path.

Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Reviewed-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit d4aeee776017b6da6dcd12f453cd82a3c951a0dc upstream.

Along the fast path for relocation handling, we attempt to copy directly
from the user data structures whilst holding our mutex. This causes
lockdep to warn about circular lock dependencies if we need to pagefault
the user pages. [Since when handling a page fault on a mmapped bo, we
need to acquire the struct mutex whilst already holding the mm
semaphore, it is then verboten to acquire the mm semaphore when already
holding the struct mutex. The likelihood of the user passing in the
relocations contained in a GTT mmaped bo is low, but conceivable for
extreme pathology.] In order to force the mm to return EFAULT rather
than handle the pagefault, we therefore need to disable pagefaults
across the relocation fast path.

Signed-off-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Reviewed-by: Daniel Vetter &lt;daniel.vetter@ffwll.ch&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>drm: check for modesetting on modeset ioctls</title>
<updated>2011-03-27T18:36:28+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2011-02-08T03:55:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=de3da06e17ed82edfefef6cca8116548828f45b4'/>
<id>de3da06e17ed82edfefef6cca8116548828f45b4</id>
<content type='text'>
commit fb3b06c8a1fd1a80298f13b738ab38ef8c73baff upstream.

Noticed this while working on some other things, helps if we check for modeset
enabled on modesetting ioctls.

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit fb3b06c8a1fd1a80298f13b738ab38ef8c73baff upstream.

Noticed this while working on some other things, helps if we check for modeset
enabled on modesetting ioctls.

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>USB: cdc-acm: fix potential null-pointer dereference on disconnect</title>
<updated>2011-03-27T18:36:24+00:00</updated>
<author>
<name>Johan Hovold</name>
<email>jhovold@gmail.com</email>
</author>
<published>2011-03-22T10:12:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=98f637b2ec791ddec58d90f9706feac2c5011ed8'/>
<id>98f637b2ec791ddec58d90f9706feac2c5011ed8</id>
<content type='text'>
commit 7e7797e7f6f7bfab73fca02c65e40eaa5bb9000c upstream.

Fix potential null-pointer exception on disconnect introduced by commit
11ea859d64b69a747d6b060b9ed1520eab1161fe (USB: additional power savings
for cdc-acm devices that support remote wakeup).

Only access acm-&gt;dev after making sure it is non-null in control urb
completion handler.

Signed-off-by: Johan Hovold &lt;jhovold@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 7e7797e7f6f7bfab73fca02c65e40eaa5bb9000c upstream.

Fix potential null-pointer exception on disconnect introduced by commit
11ea859d64b69a747d6b060b9ed1520eab1161fe (USB: additional power savings
for cdc-acm devices that support remote wakeup).

Only access acm-&gt;dev after making sure it is non-null in control urb
completion handler.

Signed-off-by: Johan Hovold &lt;jhovold@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>USB: cdc-acm: fix potential null-pointer dereference</title>
<updated>2011-03-27T18:36:23+00:00</updated>
<author>
<name>Johan Hovold</name>
<email>jhovold@gmail.com</email>
</author>
<published>2011-03-22T10:12:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c2bf2aa8c59305072aff51fbaa011079f9062c90'/>
<id>c2bf2aa8c59305072aff51fbaa011079f9062c90</id>
<content type='text'>
commit 15e5bee33ffc11d0e5c6f819a65e7881c5c407be upstream.

Must check return value of tty_port_tty_get.

Signed-off-by: Johan Hovold &lt;jhovold@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 15e5bee33ffc11d0e5c6f819a65e7881c5c407be upstream.

Must check return value of tty_port_tty_get.

Signed-off-by: Johan Hovold &lt;jhovold@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>USB: cdc-acm: fix memory corruption / panic</title>
<updated>2011-03-27T18:36:22+00:00</updated>
<author>
<name>Johan Hovold</name>
<email>jhovold@gmail.com</email>
</author>
<published>2011-03-22T10:12:09+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=4f798939ccff5624f0d1976093e1282692687e8e'/>
<id>4f798939ccff5624f0d1976093e1282692687e8e</id>
<content type='text'>
commit 23b80550e2aa61d0ba3af98b831b9195be0db9ee upstream.

Prevent read urbs from being resubmitted from tasklet after port close.

The receive tasklet was not disabled on port close, which could lead to
corruption of receive lists on consecutive port open. In particular,
read urbs could be re-submitted before port open, added to free list in
open, and then added a second time to the free list in the completion
handler.

cdc-acm.c: Entering acm_tty_open.
cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0
cdc-acm.c: Entering acm_rx_tasklet
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64
cdc-acm.c: set line: 115200 0 0 8
cdc-acm.c: acm_control_msg: rq: 0x20 val: 0x0 len: 0x7 result: 7
cdc-acm.c: acm_tty_close
cdc-acm.c: acm_port_down
cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x0 len: 0x0 result: 0
cdc-acm.c: acm_ctrl_irq - urb shutting down with status: -2
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50
cdc-acm.c: Entering acm_read_bulk with status -2
cdc_acm 4-1:1.1: Aborting, acm not ready
cdc-acm.c: Entering acm_read_bulk with status -2
cdc_acm 4-1:1.1: Aborting, acm not ready
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da400, rcv 0xf57fbbe8, buf 0xf57fbd28
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da480, rcv 0xf57fbbd4, buf 0xf57fbd14
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da900, rcv 0xf57fbbc0, buf 0xf57fbd00
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da980, rcv 0xf57fbbac, buf 0xf57fbcec
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa00, rcv 0xf57fbb98, buf 0xf57fbcd8
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa80, rcv 0xf57fbb84, buf 0xf57fbcc4
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab00, rcv 0xf57fbb70, buf 0xf57fbcb0
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab80, rcv 0xf57fbb5c, buf 0xf57fbc9c
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac00, rcv 0xf57fbb48, buf 0xf57fbc88
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac80, rcv 0xf57fbb34, buf 0xf57fbc74
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad00, rcv 0xf57fbb20, buf 0xf57fbc60
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad80, rcv 0xf57fbb0c, buf 0xf57fbc4c
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da880, rcv 0xf57fbaf8, buf 0xf57fbc38
cdc-acm.c: Entering acm_tty_open.
cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0
cdc-acm.c: Entering acm_rx_tasklet
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64
cdc-acm.c: Entering acm_tty_write to write 3 bytes,
cdc-acm.c: Get 3 bytes...
cdc-acm.c: acm_write_start susp_count: 0
cdc-acm.c: Entering acm_read_bulk with status 0
------------[ cut here ]------------
WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120()
Hardware name: Vostro 1520
list_del corruption. next-&gt;prev should be f57fbc10, but was f57fbaf8
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Not tainted 2.6.37+ #39
Call Trace:
 [&lt;c103c7e2&gt;] warn_slowpath_common+0x72/0xa0
 [&lt;c11dd8ac&gt;] ? list_del+0x10c/0x120
 [&lt;c11dd8ac&gt;] ? list_del+0x10c/0x120
 [&lt;c103c8b3&gt;] warn_slowpath_fmt+0x33/0x40
 [&lt;c11dd8ac&gt;] list_del+0x10c/0x120
 [&lt;f8051dbf&gt;] acm_rx_tasklet+0xef/0x3e0 [cdc_acm]
 [&lt;c135465d&gt;] ? net_rps_action_and_irq_enable+0x6d/0x80
 [&lt;c1042bb6&gt;] tasklet_action+0xe6/0x140
 [&lt;c104342f&gt;] __do_softirq+0xaf/0x210
 [&lt;c1043380&gt;] ? __do_softirq+0x0/0x210
 &lt;IRQ&gt;  [&lt;c1042c9a&gt;] ? run_ksoftirqd+0x8a/0x1c0
 [&lt;c1042c10&gt;] ? run_ksoftirqd+0x0/0x1c0
 [&lt;c105ac24&gt;] ? kthread+0x74/0x80
 [&lt;c105abb0&gt;] ? kthread+0x0/0x80
 [&lt;c100337a&gt;] ? kernel_thread_helper+0x6/0x10
---[ end trace efd9a11434f0082e ]---
------------[ cut here ]------------
WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120()
Hardware name: Vostro 1520
list_del corruption. next-&gt;prev should be f57fbd50, but was f57fbdb0
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Tainted: G        W   2.6.37+ #39
Call Trace:
 [&lt;c103c7e2&gt;] warn_slowpath_common+0x72/0xa0
 [&lt;c11dd8ac&gt;] ? list_del+0x10c/0x120
 [&lt;c11dd8ac&gt;] ? list_del+0x10c/0x120
 [&lt;c103c8b3&gt;] warn_slowpath_fmt+0x33/0x40
 [&lt;c11dd8ac&gt;] list_del+0x10c/0x120
 [&lt;f8051dd6&gt;] acm_rx_tasklet+0x106/0x3e0 [cdc_acm]
 [&lt;c135465d&gt;] ? net_rps_action_and_irq_enable+0x6d/0x80
 [&lt;c1042bb6&gt;] tasklet_action+0xe6/0x140
 [&lt;c104342f&gt;] __do_softirq+0xaf/0x210
 [&lt;c1043380&gt;] ? __do_softirq+0x0/0x210
 &lt;IRQ&gt;  [&lt;c1042c9a&gt;] ? run_ksoftirqd+0x8a/0x1c0
 [&lt;c1042c10&gt;] ? run_ksoftirqd+0x0/0x1c0
 [&lt;c105ac24&gt;] ? kthread+0x74/0x80
 [&lt;c105abb0&gt;] ? kthread+0x0/0x80
 [&lt;c100337a&gt;] ? kernel_thread_helper+0x6/0x10
---[ end trace efd9a11434f0082f ]---
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50
cdc-acm.c: disconnected from network
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c
cdc-acm.c: Entering acm_rx_tasklet
------------[ cut here ]------------
WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:48 list_del+0xd5/0x120()
Hardware name: Vostro 1520
list_del corruption, next is LIST_POISON1 (00100100)
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Tainted: G        W   2.6.37+ #39
Call Trace:
 [&lt;c103c7e2&gt;] warn_slowpath_common+0x72/0xa0
 [&lt;c11dd875&gt;] ? list_del+0xd5/0x120
 [&lt;c11dd875&gt;] ? list_del+0xd5/0x120
 [&lt;c103c8b3&gt;] warn_slowpath_fmt+0x33/0x40
 [&lt;c11dd875&gt;] list_del+0xd5/0x120
 [&lt;f8051fac&gt;] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
 [&lt;c106dbab&gt;] ? trace_hardirqs_on+0xb/0x10
 [&lt;c1042b30&gt;] ? tasklet_action+0x60/0x140
 [&lt;c1042bb6&gt;] tasklet_action+0xe6/0x140
 [&lt;c104342f&gt;] __do_softirq+0xaf/0x210
 [&lt;c1043380&gt;] ? __do_softirq+0x0/0x210
 &lt;IRQ&gt;  [&lt;c1042c9a&gt;] ? run_ksoftirqd+0x8a/0x1c0
 [&lt;c1042c10&gt;] ? run_ksoftirqd+0x0/0x1c0
 [&lt;c105ac24&gt;] ? kthread+0x74/0x80
 [&lt;c105abb0&gt;] ? kthread+0x0/0x80
 [&lt;c100337a&gt;] ? kernel_thread_helper+0x6/0x10
---[ end trace efd9a11434f00830 ]---
BUG: unable to handle kernel paging request at 00200200
IP: [&lt;c11dd7bd&gt;] list_del+0x1d/0x120
*pde = 00000000
Oops: 0000 [#1] PREEMPT SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1a.1/usb4/4-1/4-1:1.0/tty/ttyACM0/uevent
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Tainted: G        W   2.6.37+ #39 0T816J/Vostro 1520
EIP: 0060:[&lt;c11dd7bd&gt;] EFLAGS: 00010046 CPU: 0
EIP is at list_del+0x1d/0x120
EAX: f57fbd3c EBX: f57fb800 ECX: ffff8000 EDX: 00200200
ESI: f57fbe90 EDI: f57fbd3c EBP: f600bf54 ESP: f600bf3c
 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
Process ksoftirqd/0 (pid: 3, ti=f600a000 task=f60791c0 task.ti=f6082000)
Stack:
 c1527e84 00000030 c1527e54 00100100 f57fb800 f57fbd3c f600bf98 f8051fac
 f8053104 f8052b94 f600bf6c c106dbab f600bf80 00000286 f60791c0 c1042b30
 f57fbda8 f57f5800 f57fbdb0 f57fbd80 f57fbe7c c1656b04 00000000 f600bfb0
Call Trace:
 [&lt;f8051fac&gt;] ? acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
 [&lt;c106dbab&gt;] ? trace_hardirqs_on+0xb/0x10
 [&lt;c1042b30&gt;] ? tasklet_action+0x60/0x140
 [&lt;c1042bb6&gt;] ? tasklet_action+0xe6/0x140
 [&lt;c104342f&gt;] ? __do_softirq+0xaf/0x210
 [&lt;c1043380&gt;] ? __do_softirq+0x0/0x210
 &lt;IRQ&gt;
 [&lt;c1042c9a&gt;] ? run_ksoftirqd+0x8a/0x1c0
 [&lt;c1042c10&gt;] ? run_ksoftirqd+0x0/0x1c0
 [&lt;c105ac24&gt;] ? kthread+0x74/0x80
 [&lt;c105abb0&gt;] ? kthread+0x0/0x80
 [&lt;c100337a&gt;] ? kernel_thread_helper+0x6/0x10
Code: ff 48 14 e9 57 ff ff ff 90 90 90 90 90 90 55 89 e5 83 ec 18 81 38 00 01 10 00 0f 84 9c 00 00 00 8b 50 04 81 fa 00 02 20 00 74 33 &lt;8b&gt; 12 39 d0 75 5c 8b 10 8b 4a 04 39 c8 0f 85 b5 00 00 00 8b 48
EIP: [&lt;c11dd7bd&gt;] list_del+0x1d/0x120 SS:ESP 0068:f600bf3c
CR2: 0000000000200200
---[ end trace efd9a11434f00831 ]---
Kernel panic - not syncing: Fatal exception in interrupt
Pid: 3, comm: ksoftirqd/0 Tainted: G      D W   2.6.37+ #39
Call Trace:
 [&lt;c13fede1&gt;] ? printk+0x1d/0x24
 [&lt;c13fecce&gt;] panic+0x66/0x15c
 [&lt;c10067df&gt;] oops_end+0x8f/0x90
 [&lt;c1025476&gt;] no_context+0xc6/0x160
 [&lt;c10255a8&gt;] __bad_area_nosemaphore+0x98/0x140
 [&lt;c103cf68&gt;] ? release_console_sem+0x1d8/0x210
 [&lt;c1025667&gt;] bad_area_nosemaphore+0x17/0x20
 [&lt;c1025a49&gt;] do_page_fault+0x279/0x420
 [&lt;c1006a8f&gt;] ? show_trace+0x1f/0x30
 [&lt;c13fede1&gt;] ? printk+0x1d/0x24
 [&lt;c10257d0&gt;] ? do_page_fault+0x0/0x420
 [&lt;c140333b&gt;] error_code+0x5f/0x64
 [&lt;c103007b&gt;] ? select_task_rq_fair+0x37b/0x6a0
 [&lt;c10257d0&gt;] ? do_page_fault+0x0/0x420
 [&lt;c11dd7bd&gt;] ? list_del+0x1d/0x120
 [&lt;f8051fac&gt;] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
 [&lt;c106dbab&gt;] ? trace_hardirqs_on+0xb/0x10
 [&lt;c1042b30&gt;] ? tasklet_action+0x60/0x140
 [&lt;c1042bb6&gt;] tasklet_action+0xe6/0x140
 [&lt;c104342f&gt;] __do_softirq+0xaf/0x210
 [&lt;c1043380&gt;] ? __do_softirq+0x0/0x210
 &lt;IRQ&gt;  [&lt;c1042c9a&gt;] ? run_ksoftirqd+0x8a/0x1c0
 [&lt;c1042c10&gt;] ? run_ksoftirqd+0x0/0x1c0
 [&lt;c105ac24&gt;] ? kthread+0x74/0x80
 [&lt;c105abb0&gt;] ? kthread+0x0/0x80
 [&lt;c100337a&gt;] ? kernel_thread_helper+0x6/0x10
panic occurred, switching back to text console
------------[ cut here ]------------

Signed-off-by: Johan Hovold &lt;jhovold@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 23b80550e2aa61d0ba3af98b831b9195be0db9ee upstream.

Prevent read urbs from being resubmitted from tasklet after port close.

The receive tasklet was not disabled on port close, which could lead to
corruption of receive lists on consecutive port open. In particular,
read urbs could be re-submitted before port open, added to free list in
open, and then added a second time to the free list in the completion
handler.

cdc-acm.c: Entering acm_tty_open.
cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0
cdc-acm.c: Entering acm_rx_tasklet
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64
cdc-acm.c: set line: 115200 0 0 8
cdc-acm.c: acm_control_msg: rq: 0x20 val: 0x0 len: 0x7 result: 7
cdc-acm.c: acm_tty_close
cdc-acm.c: acm_port_down
cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x0 len: 0x0 result: 0
cdc-acm.c: acm_ctrl_irq - urb shutting down with status: -2
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50
cdc-acm.c: Entering acm_read_bulk with status -2
cdc_acm 4-1:1.1: Aborting, acm not ready
cdc-acm.c: Entering acm_read_bulk with status -2
cdc_acm 4-1:1.1: Aborting, acm not ready
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da400, rcv 0xf57fbbe8, buf 0xf57fbd28
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da480, rcv 0xf57fbbd4, buf 0xf57fbd14
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da900, rcv 0xf57fbbc0, buf 0xf57fbd00
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da980, rcv 0xf57fbbac, buf 0xf57fbcec
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa00, rcv 0xf57fbb98, buf 0xf57fbcd8
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa80, rcv 0xf57fbb84, buf 0xf57fbcc4
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab00, rcv 0xf57fbb70, buf 0xf57fbcb0
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab80, rcv 0xf57fbb5c, buf 0xf57fbc9c
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac00, rcv 0xf57fbb48, buf 0xf57fbc88
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac80, rcv 0xf57fbb34, buf 0xf57fbc74
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad00, rcv 0xf57fbb20, buf 0xf57fbc60
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad80, rcv 0xf57fbb0c, buf 0xf57fbc4c
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da880, rcv 0xf57fbaf8, buf 0xf57fbc38
cdc-acm.c: Entering acm_tty_open.
cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0
cdc-acm.c: Entering acm_rx_tasklet
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64
cdc-acm.c: Entering acm_tty_write to write 3 bytes,
cdc-acm.c: Get 3 bytes...
cdc-acm.c: acm_write_start susp_count: 0
cdc-acm.c: Entering acm_read_bulk with status 0
------------[ cut here ]------------
WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120()
Hardware name: Vostro 1520
list_del corruption. next-&gt;prev should be f57fbc10, but was f57fbaf8
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Not tainted 2.6.37+ #39
Call Trace:
 [&lt;c103c7e2&gt;] warn_slowpath_common+0x72/0xa0
 [&lt;c11dd8ac&gt;] ? list_del+0x10c/0x120
 [&lt;c11dd8ac&gt;] ? list_del+0x10c/0x120
 [&lt;c103c8b3&gt;] warn_slowpath_fmt+0x33/0x40
 [&lt;c11dd8ac&gt;] list_del+0x10c/0x120
 [&lt;f8051dbf&gt;] acm_rx_tasklet+0xef/0x3e0 [cdc_acm]
 [&lt;c135465d&gt;] ? net_rps_action_and_irq_enable+0x6d/0x80
 [&lt;c1042bb6&gt;] tasklet_action+0xe6/0x140
 [&lt;c104342f&gt;] __do_softirq+0xaf/0x210
 [&lt;c1043380&gt;] ? __do_softirq+0x0/0x210
 &lt;IRQ&gt;  [&lt;c1042c9a&gt;] ? run_ksoftirqd+0x8a/0x1c0
 [&lt;c1042c10&gt;] ? run_ksoftirqd+0x0/0x1c0
 [&lt;c105ac24&gt;] ? kthread+0x74/0x80
 [&lt;c105abb0&gt;] ? kthread+0x0/0x80
 [&lt;c100337a&gt;] ? kernel_thread_helper+0x6/0x10
---[ end trace efd9a11434f0082e ]---
------------[ cut here ]------------
WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120()
Hardware name: Vostro 1520
list_del corruption. next-&gt;prev should be f57fbd50, but was f57fbdb0
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Tainted: G        W   2.6.37+ #39
Call Trace:
 [&lt;c103c7e2&gt;] warn_slowpath_common+0x72/0xa0
 [&lt;c11dd8ac&gt;] ? list_del+0x10c/0x120
 [&lt;c11dd8ac&gt;] ? list_del+0x10c/0x120
 [&lt;c103c8b3&gt;] warn_slowpath_fmt+0x33/0x40
 [&lt;c11dd8ac&gt;] list_del+0x10c/0x120
 [&lt;f8051dd6&gt;] acm_rx_tasklet+0x106/0x3e0 [cdc_acm]
 [&lt;c135465d&gt;] ? net_rps_action_and_irq_enable+0x6d/0x80
 [&lt;c1042bb6&gt;] tasklet_action+0xe6/0x140
 [&lt;c104342f&gt;] __do_softirq+0xaf/0x210
 [&lt;c1043380&gt;] ? __do_softirq+0x0/0x210
 &lt;IRQ&gt;  [&lt;c1042c9a&gt;] ? run_ksoftirqd+0x8a/0x1c0
 [&lt;c1042c10&gt;] ? run_ksoftirqd+0x0/0x1c0
 [&lt;c105ac24&gt;] ? kthread+0x74/0x80
 [&lt;c105abb0&gt;] ? kthread+0x0/0x80
 [&lt;c100337a&gt;] ? kernel_thread_helper+0x6/0x10
---[ end trace efd9a11434f0082f ]---
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50
cdc-acm.c: disconnected from network
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c
cdc-acm.c: Entering acm_rx_tasklet
------------[ cut here ]------------
WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:48 list_del+0xd5/0x120()
Hardware name: Vostro 1520
list_del corruption, next is LIST_POISON1 (00100100)
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Tainted: G        W   2.6.37+ #39
Call Trace:
 [&lt;c103c7e2&gt;] warn_slowpath_common+0x72/0xa0
 [&lt;c11dd875&gt;] ? list_del+0xd5/0x120
 [&lt;c11dd875&gt;] ? list_del+0xd5/0x120
 [&lt;c103c8b3&gt;] warn_slowpath_fmt+0x33/0x40
 [&lt;c11dd875&gt;] list_del+0xd5/0x120
 [&lt;f8051fac&gt;] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
 [&lt;c106dbab&gt;] ? trace_hardirqs_on+0xb/0x10
 [&lt;c1042b30&gt;] ? tasklet_action+0x60/0x140
 [&lt;c1042bb6&gt;] tasklet_action+0xe6/0x140
 [&lt;c104342f&gt;] __do_softirq+0xaf/0x210
 [&lt;c1043380&gt;] ? __do_softirq+0x0/0x210
 &lt;IRQ&gt;  [&lt;c1042c9a&gt;] ? run_ksoftirqd+0x8a/0x1c0
 [&lt;c1042c10&gt;] ? run_ksoftirqd+0x0/0x1c0
 [&lt;c105ac24&gt;] ? kthread+0x74/0x80
 [&lt;c105abb0&gt;] ? kthread+0x0/0x80
 [&lt;c100337a&gt;] ? kernel_thread_helper+0x6/0x10
---[ end trace efd9a11434f00830 ]---
BUG: unable to handle kernel paging request at 00200200
IP: [&lt;c11dd7bd&gt;] list_del+0x1d/0x120
*pde = 00000000
Oops: 0000 [#1] PREEMPT SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1a.1/usb4/4-1/4-1:1.0/tty/ttyACM0/uevent
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Tainted: G        W   2.6.37+ #39 0T816J/Vostro 1520
EIP: 0060:[&lt;c11dd7bd&gt;] EFLAGS: 00010046 CPU: 0
EIP is at list_del+0x1d/0x120
EAX: f57fbd3c EBX: f57fb800 ECX: ffff8000 EDX: 00200200
ESI: f57fbe90 EDI: f57fbd3c EBP: f600bf54 ESP: f600bf3c
 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
Process ksoftirqd/0 (pid: 3, ti=f600a000 task=f60791c0 task.ti=f6082000)
Stack:
 c1527e84 00000030 c1527e54 00100100 f57fb800 f57fbd3c f600bf98 f8051fac
 f8053104 f8052b94 f600bf6c c106dbab f600bf80 00000286 f60791c0 c1042b30
 f57fbda8 f57f5800 f57fbdb0 f57fbd80 f57fbe7c c1656b04 00000000 f600bfb0
Call Trace:
 [&lt;f8051fac&gt;] ? acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
 [&lt;c106dbab&gt;] ? trace_hardirqs_on+0xb/0x10
 [&lt;c1042b30&gt;] ? tasklet_action+0x60/0x140
 [&lt;c1042bb6&gt;] ? tasklet_action+0xe6/0x140
 [&lt;c104342f&gt;] ? __do_softirq+0xaf/0x210
 [&lt;c1043380&gt;] ? __do_softirq+0x0/0x210
 &lt;IRQ&gt;
 [&lt;c1042c9a&gt;] ? run_ksoftirqd+0x8a/0x1c0
 [&lt;c1042c10&gt;] ? run_ksoftirqd+0x0/0x1c0
 [&lt;c105ac24&gt;] ? kthread+0x74/0x80
 [&lt;c105abb0&gt;] ? kthread+0x0/0x80
 [&lt;c100337a&gt;] ? kernel_thread_helper+0x6/0x10
Code: ff 48 14 e9 57 ff ff ff 90 90 90 90 90 90 55 89 e5 83 ec 18 81 38 00 01 10 00 0f 84 9c 00 00 00 8b 50 04 81 fa 00 02 20 00 74 33 &lt;8b&gt; 12 39 d0 75 5c 8b 10 8b 4a 04 39 c8 0f 85 b5 00 00 00 8b 48
EIP: [&lt;c11dd7bd&gt;] list_del+0x1d/0x120 SS:ESP 0068:f600bf3c
CR2: 0000000000200200
---[ end trace efd9a11434f00831 ]---
Kernel panic - not syncing: Fatal exception in interrupt
Pid: 3, comm: ksoftirqd/0 Tainted: G      D W   2.6.37+ #39
Call Trace:
 [&lt;c13fede1&gt;] ? printk+0x1d/0x24
 [&lt;c13fecce&gt;] panic+0x66/0x15c
 [&lt;c10067df&gt;] oops_end+0x8f/0x90
 [&lt;c1025476&gt;] no_context+0xc6/0x160
 [&lt;c10255a8&gt;] __bad_area_nosemaphore+0x98/0x140
 [&lt;c103cf68&gt;] ? release_console_sem+0x1d8/0x210
 [&lt;c1025667&gt;] bad_area_nosemaphore+0x17/0x20
 [&lt;c1025a49&gt;] do_page_fault+0x279/0x420
 [&lt;c1006a8f&gt;] ? show_trace+0x1f/0x30
 [&lt;c13fede1&gt;] ? printk+0x1d/0x24
 [&lt;c10257d0&gt;] ? do_page_fault+0x0/0x420
 [&lt;c140333b&gt;] error_code+0x5f/0x64
 [&lt;c103007b&gt;] ? select_task_rq_fair+0x37b/0x6a0
 [&lt;c10257d0&gt;] ? do_page_fault+0x0/0x420
 [&lt;c11dd7bd&gt;] ? list_del+0x1d/0x120
 [&lt;f8051fac&gt;] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
 [&lt;c106dbab&gt;] ? trace_hardirqs_on+0xb/0x10
 [&lt;c1042b30&gt;] ? tasklet_action+0x60/0x140
 [&lt;c1042bb6&gt;] tasklet_action+0xe6/0x140
 [&lt;c104342f&gt;] __do_softirq+0xaf/0x210
 [&lt;c1043380&gt;] ? __do_softirq+0x0/0x210
 &lt;IRQ&gt;  [&lt;c1042c9a&gt;] ? run_ksoftirqd+0x8a/0x1c0
 [&lt;c1042c10&gt;] ? run_ksoftirqd+0x0/0x1c0
 [&lt;c105ac24&gt;] ? kthread+0x74/0x80
 [&lt;c105abb0&gt;] ? kthread+0x0/0x80
 [&lt;c100337a&gt;] ? kernel_thread_helper+0x6/0x10
panic occurred, switching back to text console
------------[ cut here ]------------

Signed-off-by: Johan Hovold &lt;jhovold@gmail.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
</feed>
