* [PATCH 3.19 001/101] ALSA: hda - Add dock support for Thinkpad T450s (17aa:5036)
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
@ 2015-04-17 13:27 ` Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 002/101] ALSA: hda - Add one more node in the EAPD supporting candidate list Greg Kroah-Hartman
` (92 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:27 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sebastian Wicki, Takashi Iwai
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Wicki <gandro@gmx.net>
commit 80b311d3118842eb681397233faa0d588df13f92 upstream.
This model uses the same dock port as the previous generation.
Signed-off-by: Sebastian Wicki <gandro@gmx.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4941,6 +4941,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 002/101] ALSA: hda - Add one more node in the EAPD supporting candidate list
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 001/101] ALSA: hda - Add dock support for Thinkpad T450s (17aa:5036) Greg Kroah-Hartman
@ 2015-04-17 13:27 ` Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 003/101] ALSA: usb - Creative USB X-Fi Pro SB1095 volume knob support Greg Kroah-Hartman
` (91 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:27 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hui Wang, Takashi Iwai
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <hui.wang@canonical.com>
commit af95b41426e0b58279f8ff0ebe420df49a4e96b8 upstream.
We have a HP machine which use the codec node 0x17 connecting the
internal speaker, and from the node capability, we saw the EAPD,
if we don't set the EAPD on for this node, the internal speaker
can't output any sound.
BugLink: https://bugs.launchpad.net/bugs/1436745
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -394,7 +394,7 @@ static void alc_auto_setup_eapd(struct h
{
/* We currently only handle front, HP */
static hda_nid_t pins[] = {
- 0x0f, 0x10, 0x14, 0x15, 0
+ 0x0f, 0x10, 0x14, 0x15, 0x17, 0
};
hda_nid_t *p;
for (p = pins; *p; p++)
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 003/101] ALSA: usb - Creative USB X-Fi Pro SB1095 volume knob support
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 001/101] ALSA: hda - Add dock support for Thinkpad T450s (17aa:5036) Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 002/101] ALSA: hda - Add one more node in the EAPD supporting candidate list Greg Kroah-Hartman
@ 2015-04-17 13:27 ` Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 004/101] ALSA: bebob: fix to processing in big-endian machine for sending cue Greg Kroah-Hartman
` (90 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:27 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry M. Fedin, Takashi Iwai
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Dmitry M. Fedin" <dmitry.fedin@gmail.com>
commit 3dc8523fa7412e731441c01fb33f003eb3cfece1 upstream.
Adds an entry for Creative USB X-Fi to the rc_config array in
mixer_quirks.c to allow use of volume knob on the device.
Adds support for newer X-Fi Pro card, known as "Model No. SB1095"
with USB ID "041e:3237"
Signed-off-by: Dmitry M. Fedin <dmitry.fedin@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_quirks.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -192,6 +192,7 @@ static const struct rc_config {
{ USB_ID(0x041e, 0x3040), 2, 2, 6, 6, 2, 0x6e91 }, /* Live! 24-bit */
{ USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */
{ USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
+ { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
{ USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */
};
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 004/101] ALSA: bebob: fix to processing in big-endian machine for sending cue
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2015-04-17 13:27 ` [PATCH 3.19 003/101] ALSA: usb - Creative USB X-Fi Pro SB1095 volume knob support Greg Kroah-Hartman
@ 2015-04-17 13:27 ` Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 005/101] ALSA: hda/realtek - Make more stable to get pin sense for ALC283 Greg Kroah-Hartman
` (89 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:27 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Takayuki Shiroma, Takashi Sakamoto,
Takashi Iwai
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
commit a053fc318bc5d28cd25168c948255fd48a29ea26 upstream.
Some M-Audio devices require to receive bootup command just after
powering on, while codes in BeBoB driver doesn't work properly in
big-endian machine because the command should be aligned by
little-endian.
This commit fixes this bug. This fix should go to stable kernel.
Cc: Takayuki Shiroma <t.shiroma.oki@gmail.com>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/firewire/bebob/bebob_maudio.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/sound/firewire/bebob/bebob_maudio.c
+++ b/sound/firewire/bebob/bebob_maudio.c
@@ -96,10 +96,10 @@ int snd_bebob_maudio_load_firmware(struc
struct fw_device *device = fw_parent_device(unit);
int err, rcode;
u64 date;
- __be32 cues[3] = {
- MAUDIO_BOOTLOADER_CUE1,
- MAUDIO_BOOTLOADER_CUE2,
- MAUDIO_BOOTLOADER_CUE3
+ __le32 cues[3] = {
+ cpu_to_le32(MAUDIO_BOOTLOADER_CUE1),
+ cpu_to_le32(MAUDIO_BOOTLOADER_CUE2),
+ cpu_to_le32(MAUDIO_BOOTLOADER_CUE3)
};
/* check date of software used to build */
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 005/101] ALSA: hda/realtek - Make more stable to get pin sense for ALC283
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2015-04-17 13:27 ` [PATCH 3.19 004/101] ALSA: bebob: fix to processing in big-endian machine for sending cue Greg Kroah-Hartman
@ 2015-04-17 13:27 ` Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 006/101] ALSA: hda - Fix headphone pin config for Lifebook T731 Greg Kroah-Hartman
` (88 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:27 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <kailang@realtek.com>
commit a59d7199f62b8336570972dcc288321d0ec999fe upstream.
Pin sense will active when power pin is wake up.
Power pin will not wake up immediately during resume state.
Add some delay to wait for power pin activated.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2910,6 +2910,8 @@ static void alc283_init(struct hda_codec
if (!hp_pin)
return;
+
+ msleep(30);
hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
/* Index 0x43 Direct Drive HP AMP LPM Control 1 */
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 006/101] ALSA: hda - Fix headphone pin config for Lifebook T731
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2015-04-17 13:27 ` [PATCH 3.19 005/101] ALSA: hda/realtek - Make more stable to get pin sense for ALC283 Greg Kroah-Hartman
@ 2015-04-17 13:27 ` Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 007/101] PCI/AER: Avoid info leak in __print_tlp_header() Greg Kroah-Hartman
` (87 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:27 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit cc7016ab1a22fb26f388c2fb2b692b89897cbc3e upstream.
Some BIOS version of Fujitsu Lifebook T731 seems to set up the
headphone pin (0x21) without the assoc number 0x0f while it's set only
to the output on the docking port (0x1a). With the recent commit
[03ad6a8c93b6: ALSA: hda - Fix "PCM" name being used on one DAC when
there are two DACs], this resulted in the weird mixer element
mapping where the headphone on the laptop is assigned as a shared
volume with the speaker and the docking port is assigned as an
individual headphone.
This patch improves the situation by correcting the headphone pin
config to the more appropriate value.
Reported-and-tested-by: Taylor Smock <smocktaylor@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4291,6 +4291,7 @@ enum {
ALC269_FIXUP_QUANTA_MUTE,
ALC269_FIXUP_LIFEBOOK,
ALC269_FIXUP_LIFEBOOK_EXTMIC,
+ ALC269_FIXUP_LIFEBOOK_HP_PIN,
ALC269_FIXUP_AMIC,
ALC269_FIXUP_DMIC,
ALC269VB_FIXUP_AMIC,
@@ -4442,6 +4443,13 @@ static const struct hda_fixup alc269_fix
{ }
},
},
+ [ALC269_FIXUP_LIFEBOOK_HP_PIN] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x21, 0x0221102f }, /* HP out */
+ { }
+ },
+ },
[ALC269_FIXUP_AMIC] = {
.type = HDA_FIXUP_PINS,
.v.pins = (const struct hda_pintbl[]) {
@@ -4917,6 +4925,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX),
SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
+ SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_BXBT2807_MIC),
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 007/101] PCI/AER: Avoid info leak in __print_tlp_header()
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2015-04-17 13:27 ` [PATCH 3.19 006/101] ALSA: hda - Fix headphone pin config for Lifebook T731 Greg Kroah-Hartman
@ 2015-04-17 13:27 ` Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 008/101] PCI: cpcihp: Add missing curly braces in cpci_configure_slot() Greg Kroah-Hartman
` (86 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:27 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rasmus Villemoes, Bjorn Helgaas,
Borislav Petkov
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
commit a1b7f2f6367944d445c6853035830a35c6343939 upstream.
Commit fab4c256a58b ("PCI/AER: Add a TLP header print helper") introduced
the helper function __print_tlp_header(), but contrary to the intention,
the behaviour did change: Since we're taking the address of the parameter
t, the first 4 or 8 bytes printed will be the value of the pointer t
itself, and the remaining 12 or 8 bytes will be who-knows-what (something
from the stack).
We want to show the values of the four members of the struct
aer_header_log_regs; that can be done without ugly and error-prone casts.
On little-endian this should produce the same output as originally
intended, and since no-one has complained about getting garbage output so
far, I think big-endian should be ok too.
Fixes: fab4c256a58b ("PCI/AER: Add a TLP header print helper")
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pcie/aer/aerdrv_errprint.c | 12 ++----------
1 file changed, 2 insertions(+), 10 deletions(-)
--- a/drivers/pci/pcie/aer/aerdrv_errprint.c
+++ b/drivers/pci/pcie/aer/aerdrv_errprint.c
@@ -132,16 +132,8 @@ static const char *aer_agent_string[] =
static void __print_tlp_header(struct pci_dev *dev,
struct aer_header_log_regs *t)
{
- unsigned char *tlp = (unsigned char *)&t;
-
- dev_err(&dev->dev, " TLP Header:"
- " %02x%02x%02x%02x %02x%02x%02x%02x"
- " %02x%02x%02x%02x %02x%02x%02x%02x\n",
- *(tlp + 3), *(tlp + 2), *(tlp + 1), *tlp,
- *(tlp + 7), *(tlp + 6), *(tlp + 5), *(tlp + 4),
- *(tlp + 11), *(tlp + 10), *(tlp + 9),
- *(tlp + 8), *(tlp + 15), *(tlp + 14),
- *(tlp + 13), *(tlp + 12));
+ dev_err(&dev->dev, " TLP Header: %08x %08x %08x %08x\n",
+ t->dw0, t->dw1, t->dw2, t->dw3);
}
static void __aer_print_error(struct pci_dev *dev,
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 008/101] PCI: cpcihp: Add missing curly braces in cpci_configure_slot()
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2015-04-17 13:27 ` [PATCH 3.19 007/101] PCI/AER: Avoid info leak in __print_tlp_header() Greg Kroah-Hartman
@ 2015-04-17 13:27 ` Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 009/101] Revert "sparc/PCI: Clip bridge windows to fit in upstream windows" Greg Kroah-Hartman
` (85 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:27 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Bjorn Helgaas,
Yijing Wang
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit bc3b5b47c80da8838758731d423179262c9c36ec upstream.
I don't have this hardware but it looks like we weren't adding bridge
devices as intended. Maybe the bridge is always the last device?
Fixes: 05b125004815 ("PCI: cpcihp: Iterate over all devices in slot, not functions 0-7")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Yijing Wang <wangyijing@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/hotplug/cpci_hotplug_pci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/pci/hotplug/cpci_hotplug_pci.c
+++ b/drivers/pci/hotplug/cpci_hotplug_pci.c
@@ -286,11 +286,12 @@ int cpci_configure_slot(struct slot *slo
}
parent = slot->dev->bus;
- list_for_each_entry(dev, &parent->devices, bus_list)
+ list_for_each_entry(dev, &parent->devices, bus_list) {
if (PCI_SLOT(dev->devfn) != PCI_SLOT(slot->devfn))
continue;
if (pci_is_bridge(dev))
pci_hp_add_bridge(dev);
+ }
pci_assign_unassigned_bridge_resources(parent->self);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 009/101] Revert "sparc/PCI: Clip bridge windows to fit in upstream windows"
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2015-04-17 13:27 ` [PATCH 3.19 008/101] PCI: cpcihp: Add missing curly braces in cpci_configure_slot() Greg Kroah-Hartman
@ 2015-04-17 13:27 ` Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 010/101] PCI: Dont look for ACPI hotplug parameters if ACPI is disabled Greg Kroah-Hartman
` (84 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:27 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bjorn Helgaas
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <bhelgaas@google.com>
commit d10b730f97a7f1fa58c9ec300828f87157cd6b95 upstream.
This reverts commit d63e2e1f3df904bf6bd150bdafb42ddbb3257ea8.
David Ahern reported that d63e2e1f3df9 breaks booting on an 8-socket T5
sparc system. He also verified that the system boots with d63e2e1f3df9
reverted. Yinghai has some fixes, but they need a little more polishing
than we can do before v4.0.
Link: http://lkml.kernel.org/r/5514391F.2030300@oracle.com # report
Link: http://lkml.kernel.org/r/1427857069-6789-1-git-send-email-yinghai@kernel.org # patches
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/sparc/kernel/pci.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/arch/sparc/kernel/pci.c
+++ b/arch/sparc/kernel/pci.c
@@ -639,10 +639,7 @@ static void pci_claim_bus_resources(stru
(unsigned long long)r->end,
(unsigned int)r->flags);
- if (pci_claim_resource(dev, i) == 0)
- continue;
-
- pci_claim_bridge_resource(dev, i);
+ pci_claim_resource(dev, i);
}
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 010/101] PCI: Dont look for ACPI hotplug parameters if ACPI is disabled
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2015-04-17 13:27 ` [PATCH 3.19 009/101] Revert "sparc/PCI: Clip bridge windows to fit in upstream windows" Greg Kroah-Hartman
@ 2015-04-17 13:27 ` Greg Kroah-Hartman
2015-04-17 13:27 ` [PATCH 3.19 011/101] PCI: spear: Drop __initdata from spear13xx_pcie_driver Greg Kroah-Hartman
` (83 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:27 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael D Labriola, Bjorn Helgaas
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <bhelgaas@google.com>
commit 8647ca9ad5a0065ad53a2ad7e39163592b6ed35e upstream.
Booting a v3.18 or newer Xen domU kernel with PCI devices passed through
results in an oops (this is a 32-bit 3.13.11 dom0 with a 64-bit 4.4.0
hypervisor and 32-bit domU):
BUG: unable to handle kernel paging request at 0030303e
IP: [<c06ed0e6>] acpi_ns_validate_handle+0x12/0x1a
Call Trace:
[<c06eda4d>] ? acpi_evaluate_object+0x31/0x1fc
[<c06b78e1>] ? pci_get_hp_params+0x111/0x4e0
[<c0407bc7>] ? xen_force_evtchn_callback+0x17/0x30
[<c04085fb>] ? xen_restore_fl_direct_reloc+0x4/0x4
[<c0699d34>] ? pci_device_add+0x24/0x450
Don't look for ACPI configuration information if ACPI has been disabled.
I don't think this is the best fix, because we can boot plain Linux (no
Xen) with "acpi=off", and we don't need this check in pci_get_hp_params().
There should be a better fix that would make Xen domU work the same way.
The domU kernel has ACPI support but it has no AML. There should be a way
to initialize the ACPI data structures so things fail gracefully rather
than oopsing. This is an interim fix to address the regression.
Fixes: 6cd33649fa83 ("PCI: Add pci_configure_device() during enumeration")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=96301
Reported-by: Michael D Labriola <mlabriol@gdeb.com>
Tested-by: Michael D Labriola <mlabriol@gdeb.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci-acpi.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -248,6 +248,9 @@ int pci_get_hp_params(struct pci_dev *de
acpi_handle handle, phandle;
struct pci_bus *pbus;
+ if (acpi_pci_disabled)
+ return -ENODEV;
+
handle = NULL;
for (pbus = dev->bus; pbus; pbus = pbus->parent) {
handle = acpi_pci_get_bridge_handle(pbus);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 011/101] PCI: spear: Drop __initdata from spear13xx_pcie_driver
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2015-04-17 13:27 ` [PATCH 3.19 010/101] PCI: Dont look for ACPI hotplug parameters if ACPI is disabled Greg Kroah-Hartman
@ 2015-04-17 13:27 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 012/101] ARC: SA_SIGINFO ucontext regs off-by-one Greg Kroah-Hartman
` (82 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:27 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Matwey V. Kornilov, Bjorn Helgaas,
Viresh Kumar
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matwey V. Kornilov" <matwey@sai.msu.ru>
commit a43f32d647273023edddb0dc8f91c4c6378b252b upstream.
Struct spear13xx_pcie_driver was in initdata, but we passed a pointer to it
to platform_driver_register(), which can use the pointer at arbitrary times
in the future, even after the initdata is freed. That leads to crashes.
Move spear13xx_pcie_driver and things referenced by it
(spear13xx_pcie_probe() and dw_pcie_host_init()) out of initdata.
[bhelgaas: changelog]
Fixes: 6675ef212dac ("PCI: spear: Fix Section mismatch compilation warning for probe()")
Signed-off-by: Matwey V. Kornilov <matwey@sai.msu.ru>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/host/pcie-designware.c | 2 +-
drivers/pci/host/pcie-spear13xx.c | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/pci/host/pcie-designware.c
+++ b/drivers/pci/host/pcie-designware.c
@@ -342,7 +342,7 @@ static const struct irq_domain_ops msi_d
.map = dw_pcie_msi_map,
};
-int __init dw_pcie_host_init(struct pcie_port *pp)
+int dw_pcie_host_init(struct pcie_port *pp)
{
struct device_node *np = pp->dev->of_node;
struct platform_device *pdev = to_platform_device(pp->dev);
--- a/drivers/pci/host/pcie-spear13xx.c
+++ b/drivers/pci/host/pcie-spear13xx.c
@@ -269,7 +269,7 @@ static struct pcie_host_ops spear13xx_pc
.host_init = spear13xx_pcie_host_init,
};
-static int __init spear13xx_add_pcie_port(struct pcie_port *pp,
+static int spear13xx_add_pcie_port(struct pcie_port *pp,
struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -299,7 +299,7 @@ static int __init spear13xx_add_pcie_por
return 0;
}
-static int __init spear13xx_pcie_probe(struct platform_device *pdev)
+static int spear13xx_pcie_probe(struct platform_device *pdev)
{
struct spear13xx_pcie *spear13xx_pcie;
struct pcie_port *pp;
@@ -370,7 +370,7 @@ static const struct of_device_id spear13
};
MODULE_DEVICE_TABLE(of, spear13xx_pcie_of_match);
-static struct platform_driver spear13xx_pcie_driver __initdata = {
+static struct platform_driver spear13xx_pcie_driver = {
.probe = spear13xx_pcie_probe,
.driver = {
.name = "spear-pcie",
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 012/101] ARC: SA_SIGINFO ucontext regs off-by-one
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2015-04-17 13:27 ` [PATCH 3.19 011/101] PCI: spear: Drop __initdata from spear13xx_pcie_driver Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 013/101] ARC: signal handling robustify Greg Kroah-Hartman
` (81 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vineet Gupta
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <vgupta@synopsys.com>
commit 6914e1e3f63caa829431160f0f7093292daef2d5 upstream.
The regfile provided to SA_SIGINFO signal handler as ucontext was off by
one due to pt_regs gutter cleanups in 2013.
Before handling signal, user pt_regs are copied onto user_regs_struct and copied
back later. Both structs are binary compatible. This was all fine until
commit 2fa919045b72 (ARC: pt_regs update #2) which removed the empty stack slot
at top of pt_regs (corresponding to first pad) and made the corresponding
fixup in struct user_regs_struct (the pad in there was moved out of
@scratch - not removed altogether as it is part of ptrace ABI)
struct user_regs_struct {
+ long pad;
struct {
- long pad;
long bta, lp_start, lp_end,....
} scratch;
...
}
This meant that now user_regs_struct was off by 1 reg w.r.t pt_regs and
signal code needs to user_regs_struct.scratch to reflect it as pt_regs,
which is what this commit does.
This problem was hidden for 2 years, because both save/restore, despite
using wrong location, were using the same location. Only an interim
inspection (reproducer below) exposed the issue.
void handle_segv(int signo, siginfo_t *info, void *context)
{
ucontext_t *uc = context;
struct user_regs_struct *regs = &(uc->uc_mcontext.regs);
printf("regs %x %x\n", <=== prints 7 8 (vs. 8 9)
regs->scratch.r8, regs->scratch.r9);
}
int main()
{
struct sigaction sa;
sa.sa_sigaction = handle_segv;
sa.sa_flags = SA_SIGINFO;
sigemptyset(&sa.sa_mask);
sigaction(SIGSEGV, &sa, NULL);
asm volatile(
"mov r7, 7 \n"
"mov r8, 8 \n"
"mov r9, 9 \n"
"mov r10, 10 \n"
:::"r7","r8","r9","r10");
*((unsigned int*)0x10) = 0;
}
Fixes: 2fa919045b72ec892e "ARC: pt_regs update #2: Remove unused gutter at start of pt_regs"
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arc/kernel/signal.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arc/kernel/signal.c
+++ b/arch/arc/kernel/signal.c
@@ -67,7 +67,7 @@ stash_usr_regs(struct rt_sigframe __user
sigset_t *set)
{
int err;
- err = __copy_to_user(&(sf->uc.uc_mcontext.regs), regs,
+ err = __copy_to_user(&(sf->uc.uc_mcontext.regs.scratch), regs,
sizeof(sf->uc.uc_mcontext.regs.scratch));
err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t));
@@ -83,7 +83,7 @@ static int restore_usr_regs(struct pt_re
if (!err)
set_current_blocked(&set);
- err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs),
+ err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs.scratch),
sizeof(sf->uc.uc_mcontext.regs.scratch));
return err;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 013/101] ARC: signal handling robustify
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 012/101] ARC: SA_SIGINFO ucontext regs off-by-one Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 014/101] ARM: sunxi: Have ARCH_SUNXI select RESET_CONTROLLER for clock driver usage Greg Kroah-Hartman
` (80 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexey Brodkin, Vineet Gupta
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <vgupta@synopsys.com>
commit e4140819dadc3624accac8294881bca8a3cba4ed upstream.
A malicious signal handler / restorer can DOS the system by fudging the
user regs saved on stack, causing weird things such as sigreturn returning
to user mode PC but cpu state still being kernel mode....
Ensure that in sigreturn path status32 always has U bit; any other bogosity
(gargbage PC etc) will be taken care of by normal user mode exceptions mechanisms.
Reproducer signal handler:
void handle_sig(int signo, siginfo_t *info, void *context)
{
ucontext_t *uc = context;
struct user_regs_struct *regs = &(uc->uc_mcontext.regs);
regs->scratch.status32 = 0;
}
Before the fix, kernel would go off to weeds like below:
--------->8-----------
[ARCLinux]$ ./signal-test
Path: /signal-test
CPU: 0 PID: 61 Comm: signal-test Not tainted 4.0.0-rc5+ #65
task: 8f177880 ti: 5ffe6000 task.ti: 8f15c000
[ECR ]: 0x00220200 => Invalid Write @ 0x00000010 by insn @ 0x00010698
[EFA ]: 0x00000010
[BLINK ]: 0x2007c1ee
[ERET ]: 0x10698
[STAT32]: 0x00000000 : <--------
BTA: 0x00010680 SP: 0x5ffe7e48 FP: 0x00000000
LPS: 0x20003c6c LPE: 0x20003c70 LPC: 0x00000000
...
--------->8-----------
Reported-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arc/kernel/signal.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
--- a/arch/arc/kernel/signal.c
+++ b/arch/arc/kernel/signal.c
@@ -131,6 +131,15 @@ SYSCALL_DEFINE0(rt_sigreturn)
/* Don't restart from sigreturn */
syscall_wont_restart(regs);
+ /*
+ * Ensure that sigreturn always returns to user mode (in case the
+ * regs saved on user stack got fudged between save and sigreturn)
+ * Otherwise it is easy to panic the kernel with a custom
+ * signal handler and/or restorer which clobberes the status32/ret
+ * to return to a bogus location in kernel mode.
+ */
+ regs->status32 |= STATUS_U_MASK;
+
return regs->r0;
badframe:
@@ -229,8 +238,11 @@ setup_rt_frame(struct ksignal *ksig, sig
/*
* handler returns using sigreturn stub provided already by userpsace
+ * If not, nuke the process right away
*/
- BUG_ON(!(ksig->ka.sa.sa_flags & SA_RESTORER));
+ if(!(ksig->ka.sa.sa_flags & SA_RESTORER))
+ return 1;
+
regs->blink = (unsigned long)ksig->ka.sa.sa_restorer;
/* User Stack for signal handler will be above the frame just carved */
@@ -296,12 +308,12 @@ static void
handle_signal(struct ksignal *ksig, struct pt_regs *regs)
{
sigset_t *oldset = sigmask_to_save();
- int ret;
+ int failed;
/* Set up the stack frame */
- ret = setup_rt_frame(ksig, oldset, regs);
+ failed = setup_rt_frame(ksig, oldset, regs);
- signal_setup_done(ret, ksig, 0);
+ signal_setup_done(failed, ksig, 0);
}
void do_signal(struct pt_regs *regs)
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 014/101] ARM: sunxi: Have ARCH_SUNXI select RESET_CONTROLLER for clock driver usage
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 013/101] ARC: signal handling robustify Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 015/101] selinux: fix sel_write_enforce broken return value Greg Kroah-Hartman
` (79 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lourens Rozema, Arnd Bergmann,
Chen-Yu Tsai, Maxime Ripard
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@csie.org>
commit fdc0074c5fc8c7adb8186cbb123fe2082d9bd05f upstream.
As the sunxi usb clocks all contain a reset controller, it is not
possible to build the sunxi clock driver without RESET_CONTROLLER
enabled. Doing so results in an undefined symbol error:
drivers/built-in.o: In function `sunxi_gates_clk_setup':
linux/drivers/clk/sunxi/clk-sunxi.c:1071: undefined reference to
`reset_controller_register'
This is possible if building a minimal kernel without PHY_SUN4I_USB.
The dependency issue is made visible at compile time instead of
link time by the new A80 mmc clocks, which also use a reset control
itself.
This patch makes ARCH_SUNXI select ARCH_HAS_RESET_CONTROLLER and
RESET_CONTROLLER.
Fixes: 559482d1f950 ARM: sunxi: Split the various SoCs support in Kconfig
Reported-by: Lourens Rozema <ik@lourensrozema.nl>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-sunxi/Kconfig | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/arch/arm/mach-sunxi/Kconfig
+++ b/arch/arm/mach-sunxi/Kconfig
@@ -1,10 +1,12 @@
menuconfig ARCH_SUNXI
bool "Allwinner SoCs" if ARCH_MULTI_V7
select ARCH_REQUIRE_GPIOLIB
+ select ARCH_HAS_RESET_CONTROLLER
select CLKSRC_MMIO
select GENERIC_IRQ_CHIP
select PINCTRL
select SUN4I_TIMER
+ select RESET_CONTROLLER
if ARCH_SUNXI
@@ -20,10 +22,8 @@ config MACH_SUN5I
config MACH_SUN6I
bool "Allwinner A31 (sun6i) SoCs support"
default ARCH_SUNXI
- select ARCH_HAS_RESET_CONTROLLER
select ARM_GIC
select MFD_SUN6I_PRCM
- select RESET_CONTROLLER
select SUN5I_HSTIMER
config MACH_SUN7I
@@ -37,16 +37,12 @@ config MACH_SUN7I
config MACH_SUN8I
bool "Allwinner A23 (sun8i) SoCs support"
default ARCH_SUNXI
- select ARCH_HAS_RESET_CONTROLLER
select ARM_GIC
select MFD_SUN6I_PRCM
- select RESET_CONTROLLER
config MACH_SUN9I
bool "Allwinner (sun9i) SoCs support"
default ARCH_SUNXI
- select ARCH_HAS_RESET_CONTROLLER
select ARM_GIC
- select RESET_CONTROLLER
endif
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 015/101] selinux: fix sel_write_enforce broken return value
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 014/101] ARM: sunxi: Have ARCH_SUNXI select RESET_CONTROLLER for clock driver usage Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 016/101] blk-mq: fix use of incorrect goto label in blk_mq_init_queue error path Greg Kroah-Hartman
` (78 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joe Perches, Stephen Smalley,
Paul Moore
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Perches <joe@perches.com>
commit 6436a123a147db51a0b06024a8350f4c230e73ff upstream.
Return a negative error value like the rest of the entries in this function.
Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
[PM: tweaked subject line]
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/selinux/selinuxfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -152,7 +152,7 @@ static ssize_t sel_write_enforce(struct
goto out;
/* No partial writes. */
- length = EINVAL;
+ length = -EINVAL;
if (*ppos != 0)
goto out;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 016/101] blk-mq: fix use of incorrect goto label in blk_mq_init_queue error path
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 015/101] selinux: fix sel_write_enforce broken return value Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 017/101] blkmq: Fix NULL pointer deref when all reserved tags in Greg Kroah-Hartman
` (77 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Snitzer, Ming Lei, Jens Axboe
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@redhat.com>
commit 9a30b096b543932de218dd3501b5562e00a8792d upstream.
If percpu_ref_init() fails the allocated q and hctxs must get cleaned
up; using 'err_map' doesn't allow that to happen.
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Reviewed-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-mq.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1937,7 +1937,7 @@ struct request_queue *blk_mq_init_queue(
*/
if (percpu_ref_init(&q->mq_usage_counter, blk_mq_usage_counter_release,
PERCPU_REF_INIT_ATOMIC, GFP_KERNEL))
- goto err_map;
+ goto err_mq_usage;
setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
blk_queue_rq_timeout(q, 30000);
@@ -1980,7 +1980,7 @@ struct request_queue *blk_mq_init_queue(
blk_mq_init_cpu_queues(q, set->nr_hw_queues);
if (blk_mq_init_hw_queues(q, set))
- goto err_hw;
+ goto err_mq_usage;
mutex_lock(&all_q_mutex);
list_add_tail(&q->all_q_node, &all_q_list);
@@ -1992,7 +1992,7 @@ struct request_queue *blk_mq_init_queue(
return q;
-err_hw:
+err_mq_usage:
blk_cleanup_queue(q);
err_hctxs:
kfree(map);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 017/101] blkmq: Fix NULL pointer deref when all reserved tags in
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 016/101] blk-mq: fix use of incorrect goto label in blk_mq_init_queue error path Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 018/101] Fix bug in blk_rq_merge_ok Greg Kroah-Hartman
` (76 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sam Bradshaw, Selvan Mani, Jens Axboe
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Bradshaw <sbradshaw@micron.com>
commit bc188d818edf325ae38cfa43254a0b10a4defd65 upstream.
When allocating from the reserved tags pool, bt_get() is called with
a NULL hctx. If all tags are in use, the hw queue is kicked to push
out any pending IO, potentially freeing tags, and tag allocation is
retried. The problem is that blk_mq_run_hw_queue() doesn't check for
a NULL hctx. So we avoid it with a simple NULL hctx test.
Tested by hammering mtip32xx with concurrent smartctl/hdparm.
Signed-off-by: Sam Bradshaw <sbradshaw@micron.com>
Signed-off-by: Selvan Mani <smani@micron.com>
Fixes: b32232073e80 ("blk-mq: fix hang in bt_get()")
Added appropriate comment.
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-mq-tag.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -265,9 +265,11 @@ static int bt_get(struct blk_mq_alloc_da
/*
* We're out of tags on this hardware queue, kick any
* pending IO submits before going to sleep waiting for
- * some to complete.
+ * some to complete. Note that hctx can be NULL here for
+ * reserved tag allocation.
*/
- blk_mq_run_hw_queue(hctx, false);
+ if (hctx)
+ blk_mq_run_hw_queue(hctx, false);
/*
* Retry tag allocation after running the hardware queue,
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 018/101] Fix bug in blk_rq_merge_ok
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 017/101] blkmq: Fix NULL pointer deref when all reserved tags in Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 019/101] block: fix blk_stack_limits() regression due to lcm() change Greg Kroah-Hartman
` (75 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wenbo Wang, Chong Yuan, Jens Axboe
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenbo Wang <wenbo.wang@memblaze.com>
commit 7ee8e4f3983c4ff700958a6099c8fd212ea67b94 upstream.
Use the right array index to reference the last
element of rq->biotail->bi_io_vec[]
Signed-off-by: Wenbo Wang <wenbo.wang@memblaze.com>
Reviewed-by: Chong Yuan <chong.yuan@memblaze.com>
Fixes: 66cb45aa41315 ("block: add support for limiting gaps in SG lists")
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-merge.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -609,7 +609,7 @@ bool blk_rq_merge_ok(struct request *rq,
if (q->queue_flags & (1 << QUEUE_FLAG_SG_GAPS)) {
struct bio_vec *bprev;
- bprev = &rq->biotail->bi_io_vec[bio->bi_vcnt - 1];
+ bprev = &rq->biotail->bi_io_vec[rq->biotail->bi_vcnt - 1];
if (bvec_gap_to_prev(bprev, bio->bi_io_vec[0].bv_offset))
return false;
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 019/101] block: fix blk_stack_limits() regression due to lcm() change
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 018/101] Fix bug in blk_rq_merge_ok Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 020/101] drm: Fixup racy refcounting in plane_force_disable Greg Kroah-Hartman
` (74 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Snitzer, Martin K. Petersen,
Jens Axboe
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@redhat.com>
commit e9637415a92cf25ad800b7fdeddcd30cce7b44ab upstream.
Linux 3.19 commit 69c953c ("lib/lcm.c: lcm(n,0)=lcm(0,n) is 0, not n")
caused blk_stack_limits() to not properly stack queue_limits for stacked
devices (e.g. DM).
Fix this regression by establishing lcm_not_zero() and switching
blk_stack_limits() over to using it.
DM uses blk_set_stacking_limits() to establish the initial top-level
queue_limits that are then built up based on underlying devices' limits
using blk_stack_limits(). In the case of optimal_io_size (io_opt)
blk_set_stacking_limits() establishes a default value of 0. With commit
69c953c, lcm(0, n) is no longer n, which compromises proper stacking of
the underlying devices' io_opt.
Test:
$ modprobe scsi_debug dev_size_mb=10 num_tgts=1 opt_blks=1536
$ cat /sys/block/sde/queue/optimal_io_size
786432
$ dmsetup create node --table "0 100 linear /dev/sde 0"
Before this fix:
$ cat /sys/block/dm-5/queue/optimal_io_size
0
After this fix:
$ cat /sys/block/dm-5/queue/optimal_io_size
786432
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-settings.c | 6 +++---
include/linux/lcm.h | 1 +
lib/lcm.c | 11 +++++++++++
3 files changed, 15 insertions(+), 3 deletions(-)
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -585,7 +585,7 @@ int blk_stack_limits(struct queue_limits
b->physical_block_size);
t->io_min = max(t->io_min, b->io_min);
- t->io_opt = lcm(t->io_opt, b->io_opt);
+ t->io_opt = lcm_not_zero(t->io_opt, b->io_opt);
t->cluster &= b->cluster;
t->discard_zeroes_data &= b->discard_zeroes_data;
@@ -616,7 +616,7 @@ int blk_stack_limits(struct queue_limits
b->raid_partial_stripes_expensive);
/* Find lowest common alignment_offset */
- t->alignment_offset = lcm(t->alignment_offset, alignment)
+ t->alignment_offset = lcm_not_zero(t->alignment_offset, alignment)
% max(t->physical_block_size, t->io_min);
/* Verify that new alignment_offset is on a logical block boundary */
@@ -643,7 +643,7 @@ int blk_stack_limits(struct queue_limits
b->max_discard_sectors);
t->discard_granularity = max(t->discard_granularity,
b->discard_granularity);
- t->discard_alignment = lcm(t->discard_alignment, alignment) %
+ t->discard_alignment = lcm_not_zero(t->discard_alignment, alignment) %
t->discard_granularity;
}
--- a/include/linux/lcm.h
+++ b/include/linux/lcm.h
@@ -4,5 +4,6 @@
#include <linux/compiler.h>
unsigned long lcm(unsigned long a, unsigned long b) __attribute_const__;
+unsigned long lcm_not_zero(unsigned long a, unsigned long b) __attribute_const__;
#endif /* _LCM_H */
--- a/lib/lcm.c
+++ b/lib/lcm.c
@@ -12,3 +12,14 @@ unsigned long lcm(unsigned long a, unsig
return 0;
}
EXPORT_SYMBOL_GPL(lcm);
+
+unsigned long lcm_not_zero(unsigned long a, unsigned long b)
+{
+ unsigned long l = lcm(a, b);
+
+ if (l)
+ return l;
+
+ return (b ? : a);
+}
+EXPORT_SYMBOL_GPL(lcm_not_zero);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 020/101] drm: Fixup racy refcounting in plane_force_disable
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 019/101] block: fix blk_stack_limits() regression due to lcm() change Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 021/101] drm/edid: set ELD for firmware and debugfs override EDIDs Greg Kroah-Hartman
` (73 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Matt Roper, Daniel Vetter,
Dave Airlie
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <daniel.vetter@ffwll.ch>
commit 8218c3f4df3bb1c637c17552405039a6dd3c1ee1 upstream.
Originally it was impossible to be dropping the last refcount in this
function since there was always one around still from the idr. But in
commit 83f45fc360c8e16a330474860ebda872d1384c8c
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date: Wed Aug 6 09:10:18 2014 +0200
drm: Don't grab an fb reference for the idr
we've switched to weak references, broke that assumption but forgot to
fix it up.
Since we still force-disable planes it's only possible to hit this
when racing multiple rmfb with fbdev restoring or similar evil things.
As long as userspace is nice it's impossible to hit the BUG_ON.
But the BUG_ON would most likely be hit from fbdev code, which usually
invovles the console_lock besides all modeset locks. So very likely
we'd never get the bug reports if this was hit in the wild, hence
better be safe than sorry and backport.
Spotted by Matt Roper while reviewing other patches.
[airlied: pull this back into 4.0 - the oops happens there]
Cc: Matt Roper <matthew.d.roper@intel.com>
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_crtc.c | 13 +------------
1 file changed, 1 insertion(+), 12 deletions(-)
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -531,17 +531,6 @@ void drm_framebuffer_reference(struct dr
}
EXPORT_SYMBOL(drm_framebuffer_reference);
-static void drm_framebuffer_free_bug(struct kref *kref)
-{
- BUG();
-}
-
-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
-{
- DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
- kref_put(&fb->refcount, drm_framebuffer_free_bug);
-}
-
/**
* drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
* @fb: fb to unregister
@@ -1322,7 +1311,7 @@ void drm_plane_force_disable(struct drm_
return;
}
/* disconnect the plane from the fb and crtc: */
- __drm_framebuffer_unreference(plane->old_fb);
+ drm_framebuffer_unreference(plane->old_fb);
plane->old_fb = NULL;
plane->fb = NULL;
plane->crtc = NULL;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 021/101] drm/edid: set ELD for firmware and debugfs override EDIDs
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 020/101] drm: Fixup racy refcounting in plane_force_disable Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 023/101] drm/radeon/dpm: fix 120hz handling harder Greg Kroah-Hartman
` (72 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Emil, Rob Engle, Jolan Luff,
Daniel Vetter, Jani Nikula
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
commit ad692b46dbf122ef90aadce3b389ef64c90e861d upstream.
If the user supplies EDID through firmware or debugfs override, the
driver callbacks are bypassed and the connector ELD does not get
updated, and audio fails. Set ELD for firmware and debugfs EDIDs too.
There should be no harm in gratuitously doing this for non HDMI/DP
connectors, as it's still up to the driver to use the ELD, if any.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82349
Reference: https://bugs.freedesktop.org/show_bug.cgi?id=80691
Reported-by: Emil <emilsvennesson@gmail.com>
Reported-by: Rob Engle <grenoble@gmail.com>
Tested-by: Jolan Luff <jolan@gormsby.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_edid_load.c | 1 +
drivers/gpu/drm/drm_probe_helper.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/gpu/drm/drm_edid_load.c
+++ b/drivers/gpu/drm/drm_edid_load.c
@@ -287,6 +287,7 @@ int drm_load_edid_firmware(struct drm_co
drm_mode_connector_update_edid_property(connector, edid);
ret = drm_add_edid_modes(connector, edid);
+ drm_edid_to_eld(connector, edid);
kfree(edid);
return ret;
--- a/drivers/gpu/drm/drm_probe_helper.c
+++ b/drivers/gpu/drm/drm_probe_helper.c
@@ -152,6 +152,7 @@ static int drm_helper_probe_single_conne
struct edid *edid = (struct edid *) connector->edid_blob_ptr->data;
count = drm_add_edid_modes(connector, edid);
+ drm_edid_to_eld(connector, edid);
} else
count = (*connector_funcs->get_modes)(connector);
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 023/101] drm/radeon/dpm: fix 120hz handling harder
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 021/101] drm/edid: set ELD for firmware and debugfs override EDIDs Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 027/101] drm/i915/vlv: save/restore the power context base reg Greg Kroah-Hartman
` (71 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 3899ca844b82fb201fb764f56eec483acb59a29c upstream.
Need to expand the check to handle short circuiting
if the selected state is the same as current state.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=87796
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon.h | 1 +
drivers/gpu/drm/radeon/radeon_pm.c | 22 +++++++++++++++++-----
2 files changed, 18 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1565,6 +1565,7 @@ struct radeon_dpm {
int new_active_crtc_count;
u32 current_active_crtcs;
int current_active_crtc_count;
+ bool single_display;
struct radeon_dpm_dynamic_state dyn_state;
struct radeon_dpm_fan fan;
u32 tdp_limit;
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -704,12 +704,8 @@ static void radeon_dpm_thermal_work_hand
radeon_pm_compute_clocks(rdev);
}
-static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
- enum radeon_pm_state_type dpm_state)
+static bool radeon_dpm_single_display(struct radeon_device *rdev)
{
- int i;
- struct radeon_ps *ps;
- u32 ui_class;
bool single_display = (rdev->pm.dpm.new_active_crtc_count < 2) ?
true : false;
@@ -719,6 +715,17 @@ static struct radeon_ps *radeon_dpm_pick
single_display = false;
}
+ return single_display;
+}
+
+static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev,
+ enum radeon_pm_state_type dpm_state)
+{
+ int i;
+ struct radeon_ps *ps;
+ u32 ui_class;
+ bool single_display = radeon_dpm_single_display(rdev);
+
/* certain older asics have a separare 3D performance state,
* so try that first if the user selected performance
*/
@@ -844,6 +851,7 @@ static void radeon_dpm_change_power_stat
struct radeon_ps *ps;
enum radeon_pm_state_type dpm_state;
int ret;
+ bool single_display = radeon_dpm_single_display(rdev);
/* if dpm init failed */
if (!rdev->pm.dpm_enabled)
@@ -868,6 +876,9 @@ static void radeon_dpm_change_power_stat
/* vce just modifies an existing state so force a change */
if (ps->vce_active != rdev->pm.dpm.vce_active)
goto force;
+ /* user has made a display change (such as timing) */
+ if (rdev->pm.dpm.single_display != single_display)
+ goto force;
if ((rdev->family < CHIP_BARTS) || (rdev->flags & RADEON_IS_IGP)) {
/* for pre-BTC and APUs if the num crtcs changed but state is the same,
* all we need to do is update the display configuration.
@@ -930,6 +941,7 @@ force:
rdev->pm.dpm.current_active_crtcs = rdev->pm.dpm.new_active_crtcs;
rdev->pm.dpm.current_active_crtc_count = rdev->pm.dpm.new_active_crtc_count;
+ rdev->pm.dpm.single_display = single_display;
/* wait for the rings to drain */
for (i = 0; i < RADEON_NUM_RINGS; i++) {
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 027/101] drm/i915/vlv: save/restore the power context base reg
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 023/101] drm/radeon/dpm: fix 120hz handling harder Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 028/101] drm/i915/vlv: remove wait for previous GFX clk disable request Greg Kroah-Hartman
` (70 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jesse Barnes, Darren Hart, Imre Deak,
Deepak S, Jani Nikula
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Barnes <jbarnes@virtuousgeek.org>
commit 9c25210fd30991e68f93e2ec0857de2d967b5766 upstream.
Some BIOSes (e.g. the one on the Minnowboard) don't save/restore this
reg. If it's unlocked, we can just restore the previous value, and if
it's locked (in case the BIOS re-programmed it for us) the write will be
ignored and we'll still have "did it move" sanity check in the PM code to
warn us if something is still amiss.
References: https://bugs.freedesktop.org/show_bug.cgi?id=89611
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Tested-by: Darren Hart <dvhart@linux.intel.com>
Reviewed-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: Deepak S <deepak.s@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_drv.c | 2 ++
drivers/gpu/drm/i915/i915_drv.h | 1 +
2 files changed, 3 insertions(+)
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1093,6 +1093,7 @@ static void vlv_save_gunit_s0ix_state(st
/* Gunit-Display CZ domain, 0x182028-0x1821CF */
s->gu_ctl0 = I915_READ(VLV_GU_CTL0);
s->gu_ctl1 = I915_READ(VLV_GU_CTL1);
+ s->pcbr = I915_READ(VLV_PCBR);
s->clock_gate_dis2 = I915_READ(VLV_GUNIT_CLOCK_GATE2);
/*
@@ -1187,6 +1188,7 @@ static void vlv_restore_gunit_s0ix_state
/* Gunit-Display CZ domain, 0x182028-0x1821CF */
I915_WRITE(VLV_GU_CTL0, s->gu_ctl0);
I915_WRITE(VLV_GU_CTL1, s->gu_ctl1);
+ I915_WRITE(VLV_PCBR, s->pcbr);
I915_WRITE(VLV_GUNIT_CLOCK_GATE2, s->clock_gate_dis2);
}
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -985,6 +985,7 @@ struct vlv_s0ix_state {
/* Display 2 CZ domain */
u32 gu_ctl0;
u32 gu_ctl1;
+ u32 pcbr;
u32 clock_gate_dis2;
};
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 028/101] drm/i915/vlv: remove wait for previous GFX clk disable request
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 027/101] drm/i915/vlv: save/restore the power context base reg Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 030/101] drm/i915: Align initial plane backing objects correctly Greg Kroah-Hartman
` (69 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jesse Barnes, Darren Hart, Deepak S,
Jani Nikula
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Barnes <jbarnes@virtuousgeek.org>
commit 5df0582bf036bb5f9a8ad8db5884fe13a55347d1 upstream.
Looks like it was introduced in:
commit 650ad970a39f8b6164fe8613edc150f585315289
Author: Imre Deak <imre.deak@intel.com>
Date: Fri Apr 18 16:35:02 2014 +0300
drm/i915: vlv: factor out vlv_force_gfx_clock and check for pending force-of
but I'm not sure why. It has caused problems for us in the past (see
85250ddff7a6 "drm/i915/chv: Remove Wait for a previous gfx force-off"
and 8d4eee9cd7a1 "drm/i915: vlv: increase timeout when forcing on the
GFX clock") and doesn't seem to be required, so let's just drop it.
References: https://bugs.freedesktop.org/show_bug.cgi?id=89611
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Tested-by: Darren Hart <dvhart@linux.intel.com>
Reviewed-by: Deepak S <deepak.s@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_drv.c | 14 --------------
1 file changed, 14 deletions(-)
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1197,21 +1197,7 @@ int vlv_force_gfx_clock(struct drm_i915_
u32 val;
int err;
- val = I915_READ(VLV_GTLC_SURVIVABILITY_REG);
-
#define COND (I915_READ(VLV_GTLC_SURVIVABILITY_REG) & VLV_GFX_CLK_STATUS_BIT)
- /* Wait for a previous force-off to settle */
- if (force_on && !IS_CHERRYVIEW(dev_priv->dev)) {
- /* WARN_ON only for the Valleyview */
- WARN_ON(!!(val & VLV_GFX_CLK_FORCE_ON_BIT) == force_on);
-
- err = wait_for(!COND, 20);
- if (err) {
- DRM_ERROR("timeout waiting for GFX clock force-off (%08x)\n",
- I915_READ(VLV_GTLC_SURVIVABILITY_REG));
- return err;
- }
- }
val = I915_READ(VLV_GTLC_SURVIVABILITY_REG);
val &= ~VLV_GFX_CLK_FORCE_ON_BIT;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 030/101] drm/i915: Align initial plane backing objects correctly
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 028/101] drm/i915/vlv: remove wait for previous GFX clk disable request Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 031/101] btrfs: simplify insert_orphan_item Greg Kroah-Hartman
` (68 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johannes W, Chris Wilson, Jani Nikula,
Daniel Vetter, Jani Nikula
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <daniel.vetter@ffwll.ch>
commit f37b5c2be8979993efee2da50b51126e3908eb8b upstream.
Some bios really like to joke and start the planes at an offset ...
hooray!
Align start and end to fix this.
v2: Fixup calculation of size, spotted by Chris Wilson.
v3: Fix serious fumble I've just spotted.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=86883
Cc: Johannes W <jargon@molb.org>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Reported-and-tested-by: Johannes W <jargon@molb.org>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
[Jani: split WARN_ONs, rebase on v4.0-rc1]
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/i915_gem_stolen.c | 5 +----
drivers/gpu/drm/i915/intel_display.c | 18 +++++++++++-------
2 files changed, 12 insertions(+), 11 deletions(-)
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -485,10 +485,7 @@ i915_gem_object_create_stolen_for_preall
stolen_offset, gtt_offset, size);
/* KISS and expect everything to be page-aligned */
- BUG_ON(stolen_offset & 4095);
- BUG_ON(size & 4095);
-
- if (WARN_ON(size == 0))
+ if (WARN_ON(size == 0 || stolen_offset & 4095 || size & 4095))
return NULL;
stolen = kzalloc(sizeof(*stolen), GFP_KERNEL);
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2339,13 +2339,19 @@ static bool intel_alloc_plane_obj(struct
struct drm_device *dev = crtc->base.dev;
struct drm_i915_gem_object *obj = NULL;
struct drm_mode_fb_cmd2 mode_cmd = { 0 };
- u32 base = plane_config->base;
+ u32 base_aligned = round_down(plane_config->base, PAGE_SIZE);
+ u32 size_aligned = round_up(plane_config->base + plane_config->size,
+ PAGE_SIZE);
+
+ size_aligned -= base_aligned;
if (plane_config->size == 0)
return false;
- obj = i915_gem_object_create_stolen_for_preallocated(dev, base, base,
- plane_config->size);
+ obj = i915_gem_object_create_stolen_for_preallocated(dev,
+ base_aligned,
+ base_aligned,
+ size_aligned);
if (!obj)
return false;
@@ -6660,8 +6666,7 @@ static void i9xx_get_plane_config(struct
aligned_height = intel_align_height(dev, crtc->base.primary->fb->height,
plane_config->tiled);
- plane_config->size = PAGE_ALIGN(crtc->base.primary->fb->pitches[0] *
- aligned_height);
+ plane_config->size = crtc->base.primary->fb->pitches[0] * aligned_height;
DRM_DEBUG_KMS("pipe/plane %d/%d with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
pipe, plane, crtc->base.primary->fb->width,
@@ -7711,8 +7716,7 @@ static void ironlake_get_plane_config(st
aligned_height = intel_align_height(dev, crtc->base.primary->fb->height,
plane_config->tiled);
- plane_config->size = PAGE_ALIGN(crtc->base.primary->fb->pitches[0] *
- aligned_height);
+ plane_config->size = crtc->base.primary->fb->pitches[0] * aligned_height;
DRM_DEBUG_KMS("pipe/plane %d/%d with fb: size=%dx%d@%d, offset=%x, pitch %d, size 0x%x\n",
pipe, plane, crtc->base.primary->fb->width,
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 031/101] btrfs: simplify insert_orphan_item
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 030/101] drm/i915: Align initial plane backing objects correctly Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 032/101] IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic Greg Kroah-Hartman
` (67 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Sterba, Chris Mason,
Roman Mamedov
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <dsterba@suse.cz>
commit 9c4f61f01d269815bb7c37be3ede59c5587747c6 upstream.
We can search and add the orphan item in one go,
btrfs_insert_orphan_item will find out if the item already exists.
Signed-off-by: David Sterba <dsterba@suse.cz>
Cc: Chris Mason <clm@fb.com>
Cc: Roman Mamedov <rm@romanrm.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/tree-log.c | 16 ++++------------
1 file changed, 4 insertions(+), 12 deletions(-)
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -1266,21 +1266,13 @@ out:
}
static int insert_orphan_item(struct btrfs_trans_handle *trans,
- struct btrfs_root *root, u64 offset)
+ struct btrfs_root *root, u64 ino)
{
int ret;
- struct btrfs_path *path;
- path = btrfs_alloc_path();
- if (!path)
- return -ENOMEM;
-
- ret = btrfs_find_item(root, path, BTRFS_ORPHAN_OBJECTID,
- offset, BTRFS_ORPHAN_ITEM_KEY, NULL);
- if (ret > 0)
- ret = btrfs_insert_orphan_item(trans, root, offset);
-
- btrfs_free_path(path);
+ ret = btrfs_insert_orphan_item(trans, root, ino);
+ if (ret == -EEXIST)
+ ret = 0;
return ret;
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 032/101] IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 031/101] btrfs: simplify insert_orphan_item Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 033/101] iwlwifi: dvm: run INIT firmware again upon .start() Greg Kroah-Hartman
` (66 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shachar Raindel, Jack Morgenstein,
Or Gerlitz, Roland Dreier
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shachar Raindel <raindel@mellanox.com>
commit 8494057ab5e40df590ef6ef7d66324d3ae33356b upstream.
Properly verify that the resulting page aligned end address is larger
than both the start address and the length of the memory area requested.
Both the start and length arguments for ib_umem_get are controlled by
the user. A misbehaving user can provide values which will cause an
integer overflow when calculating the page aligned end address.
This overflow can cause also miscalculation of the number of pages
mapped, and additional logic issues.
Addresses: CVE-2014-8159
Signed-off-by: Shachar Raindel <raindel@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/umem.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -99,6 +99,14 @@ struct ib_umem *ib_umem_get(struct ib_uc
if (dmasync)
dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+ /*
+ * If the combination of the addr and size requested for this memory
+ * region causes an integer overflow, return error.
+ */
+ if ((PAGE_ALIGN(addr + size) <= size) ||
+ (PAGE_ALIGN(addr + size) <= addr))
+ return ERR_PTR(-EINVAL);
+
if (!can_do_mlock())
return ERR_PTR(-EPERM);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 033/101] iwlwifi: dvm: run INIT firmware again upon .start()
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 032/101] IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 034/101] x86/xen: prepare p2m list for memory hotplug Greg Kroah-Hartman
` (65 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Emmanuel Grumbach
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
commit 9c8928f5176766bec79f272bd47b7124e11cccbd upstream.
The assumption before this patch was that we don't need to
run again the INIT firmware after the system booted. The
INIT firmware runs calibrations which impact the physical
layer's behavior.
Users reported that it may be helpful to run these
calibrations again every time the interface is brought up.
The penatly is minimal, since the calibrations run fast.
This fixes:
https://bugzilla.kernel.org/show_bug.cgi?id=94341
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/dvm/dev.h | 1 -
drivers/net/wireless/iwlwifi/dvm/ucode.c | 5 -----
2 files changed, 6 deletions(-)
--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -708,7 +708,6 @@ struct iwl_priv {
unsigned long reload_jiffies;
int reload_count;
bool ucode_loaded;
- bool init_ucode_run; /* Don't run init uCode again */
u8 plcp_delta_threshold;
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -418,9 +418,6 @@ int iwl_run_init_ucode(struct iwl_priv *
if (!priv->fw->img[IWL_UCODE_INIT].sec[0].len)
return 0;
- if (priv->init_ucode_run)
- return 0;
-
iwl_init_notification_wait(&priv->notif_wait, &calib_wait,
calib_complete, ARRAY_SIZE(calib_complete),
iwlagn_wait_calib, priv);
@@ -440,8 +437,6 @@ int iwl_run_init_ucode(struct iwl_priv *
*/
ret = iwl_wait_notification(&priv->notif_wait, &calib_wait,
UCODE_CALIB_TIMEOUT);
- if (!ret)
- priv->init_ucode_run = true;
goto out;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 034/101] x86/xen: prepare p2m list for memory hotplug
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 033/101] iwlwifi: dvm: run INIT firmware again upon .start() Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 035/101] xen/balloon: before adding hotplugged memory, set frames to invalid Greg Kroah-Hartman
` (64 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Juergen Gross, Daniel Kiper,
David Vrabel
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <jgross@suse.com>
commit 633d6f17cd91ad5bf2370265946f716e42d388c6 upstream.
Commit 054954eb051f35e74b75a566a96fe756015352c8 ("xen: switch to linear
virtual mapped sparse p2m list") introduced a regression regarding to
memory hotplug for a pv-domain: as the virtual space for the p2m list
is allocated for the to be expected memory size of the domain only,
hotplugged memory above that size will not be usable by the domain.
Correct this by using a configurable size for the p2m list in case of
memory hotplug enabled (default supported memory size is 512 GB for
64 bit domains and 4 GB for 32 bit domains).
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/xen/p2m.c | 10 +++++++++-
drivers/xen/Kconfig | 17 +++++++++++++++++
2 files changed, 26 insertions(+), 1 deletion(-)
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -93,6 +93,12 @@ EXPORT_SYMBOL_GPL(xen_p2m_size);
unsigned long xen_max_p2m_pfn __read_mostly;
EXPORT_SYMBOL_GPL(xen_max_p2m_pfn);
+#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
+#define P2M_LIMIT CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
+#else
+#define P2M_LIMIT 0
+#endif
+
static DEFINE_SPINLOCK(p2m_update_lock);
static unsigned long *p2m_mid_missing_mfn;
@@ -387,9 +393,11 @@ static void __init xen_rebuild_p2m_list(
void __init xen_vmalloc_p2m_tree(void)
{
static struct vm_struct vm;
+ unsigned long p2m_limit;
+ p2m_limit = (phys_addr_t)P2M_LIMIT * 1024 * 1024 * 1024 / PAGE_SIZE;
vm.flags = VM_ALLOC;
- vm.size = ALIGN(sizeof(unsigned long) * xen_max_p2m_pfn,
+ vm.size = ALIGN(sizeof(unsigned long) * max(xen_max_p2m_pfn, p2m_limit),
PMD_SIZE * PMDS_PER_MID_PAGE);
vm_area_register_early(&vm, PMD_SIZE * PMDS_PER_MID_PAGE);
pr_notice("p2m virtual area at %p, size is %lx\n", vm.addr, vm.size);
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -55,6 +55,23 @@ config XEN_BALLOON_MEMORY_HOTPLUG
In that case step 3 should be omitted.
+config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
+ int "Hotplugged memory limit (in GiB) for a PV guest"
+ default 512 if X86_64
+ default 4 if X86_32
+ range 0 64 if X86_32
+ depends on XEN_HAVE_PVMMU
+ depends on XEN_BALLOON_MEMORY_HOTPLUG
+ help
+ Maxmium amount of memory (in GiB) that a PV guest can be
+ expanded to when using memory hotplug.
+
+ A PV guest can have more memory than this limit if is
+ started with a larger maximum.
+
+ This value is used to allocate enough space in internal
+ tables needed for physical memory administration.
+
config XEN_SCRUB_PAGES
bool "Scrub pages before returning them to system"
depends on XEN_BALLOON
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 035/101] xen/balloon: before adding hotplugged memory, set frames to invalid
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 034/101] x86/xen: prepare p2m list for memory hotplug Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 036/101] nfsd: return correct openowner when there is a race to put one in the hash Greg Kroah-Hartman
` (63 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Vrabel, Juergen Gross,
Daniel Kiper
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <jgross@suse.com>
commit 3c56b3a12ce52f361468cbdd2f79b2f3b8da0ea6 upstream.
Commit 25b884a83d487fd62c3de7ac1ab5549979188482 ("x86/xen: set
regions above the end of RAM as 1:1") introduced a regression.
To be able to add memory pages which were added via memory hotplug to
a pv domain, the pages must be "invalid" instead of "identity" in the
p2m list before they can be added.
Suggested-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/balloon.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -230,6 +230,29 @@ static enum bp_state reserve_additional_
balloon_hotplug = round_up(balloon_hotplug, PAGES_PER_SECTION);
nid = memory_add_physaddr_to_nid(hotplug_start_paddr);
+#ifdef CONFIG_XEN_HAVE_PVMMU
+ /*
+ * add_memory() will build page tables for the new memory so
+ * the p2m must contain invalid entries so the correct
+ * non-present PTEs will be written.
+ *
+ * If a failure occurs, the original (identity) p2m entries
+ * are not restored since this region is now known not to
+ * conflict with any devices.
+ */
+ if (!xen_feature(XENFEAT_auto_translated_physmap)) {
+ unsigned long pfn, i;
+
+ pfn = PFN_DOWN(hotplug_start_paddr);
+ for (i = 0; i < balloon_hotplug; i++) {
+ if (!set_phys_to_machine(pfn + i, INVALID_P2M_ENTRY)) {
+ pr_warn("set_phys_to_machine() failed, no memory added\n");
+ return BP_ECANCELED;
+ }
+ }
+ }
+#endif
+
rc = add_memory(nid, hotplug_start_paddr, balloon_hotplug << PAGE_SHIFT);
if (rc) {
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 036/101] nfsd: return correct openowner when there is a race to put one in the hash
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 035/101] xen/balloon: before adding hotplugged memory, set frames to invalid Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 037/101] nfsd: return correct lockowner when there is a race on hash insert Greg Kroah-Hartman
` (62 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Christoph Hellwig,
Christoph Hellwig, Jeff Layton, J. Bruce Fields
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@poochiereds.net>
commit c5952338bfc234e54deda45b7228f610a545e28a upstream.
alloc_init_open_stateowner can return an already freed entry if there is
a race to put openowners in the hashtable.
In commit 7ffb588086e9, we changed it so that we allocate and initialize
an openowner, and then check to see if a matching one got stuffed into
the hashtable in the meantime. If it did, then we free the one we just
allocated and take a reference on the one already there. There is a bug
here though. The code will then return the pointer to the one that was
allocated (and has now been freed).
This wasn't evident before as this race almost never occurred. The Linux
kernel client used to serialize requests for a single openowner. That
has changed now with v4.0 kernels, and this race can now easily occur.
Fixes: 7ffb588086e9
Cc: Trond Myklebust <trond.myklebust@primarydata.com>
Reported-by: Christoph Hellwig <hch@infradead.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3228,7 +3228,7 @@ alloc_init_open_stateowner(unsigned int
} else
nfs4_free_openowner(&oo->oo_owner);
spin_unlock(&clp->cl_lock);
- return oo;
+ return ret;
}
static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 037/101] nfsd: return correct lockowner when there is a race on hash insert
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 036/101] nfsd: return correct openowner when there is a race to put one in the hash Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 038/101] sunrpc: make debugfs file creation failure non-fatal Greg Kroah-Hartman
` (61 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Jeff Layton,
J. Bruce Fields
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit 340f0ba1c6c8412aa35fd6476044836b84361ea6 upstream.
alloc_init_lock_stateowner can return an already freed entry if there is
a race to put openowners in the hashtable.
Noticed by inspection after Jeff Layton fixed the same bug for open
owners. Depending on client behavior, this one may be trickier to
trigger in practice.
Fixes: c58c6610ec24 "nfsd: Protect adding/removing lock owners using client_lock"
Cc: Trond Myklebust <trond.myklebust@primarydata.com>
Acked-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -5065,7 +5065,7 @@ alloc_init_lock_stateowner(unsigned int
} else
nfs4_free_lockowner(&lo->lo_owner);
spin_unlock(&clp->cl_lock);
- return lo;
+ return ret;
}
static void
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 038/101] sunrpc: make debugfs file creation failure non-fatal
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 037/101] nfsd: return correct lockowner when there is a race on hash insert Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 039/101] powerpc: fix memory corruption by pnv_alloc_idle_core_states Greg Kroah-Hartman
` (60 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeff Layton, J. Bruce Fields
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@poochiereds.net>
commit f9c72d10d6fbf949558cd088389a42213ed7b12d upstream.
We currently have a problem that SELinux policy is being enforced when
creating debugfs files. If a debugfs file is created as a side effect of
doing some syscall, then that creation can fail if the SELinux policy
for that process prevents it.
This seems wrong. We don't do that for files under /proc, for instance,
so Bruce has proposed a patch to fix that.
While discussing that patch however, Greg K.H. stated:
"No kernel code should care / fail if a debugfs function fails, so
please fix up the sunrpc code first."
This patch converts all of the sunrpc debugfs setup code to be void
return functins, and the callers to not look for errors from those
functions.
This should allow rpc_clnt and rpc_xprt creation to work, even if the
kernel fails to create debugfs files for some reason.
Symptoms were failing krb5 mounts on systems using gss-proxy and
selinux.
Fixes: 388f0c776781 "sunrpc: add a debugfs rpc_xprt directory..."
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/sunrpc/debug.h | 18 +++++++-------
net/sunrpc/clnt.c | 4 ---
net/sunrpc/debugfs.c | 52 +++++++++++++++++++++++--------------------
net/sunrpc/sunrpc_syms.c | 7 -----
net/sunrpc/xprt.c | 7 -----
5 files changed, 41 insertions(+), 47 deletions(-)
--- a/include/linux/sunrpc/debug.h
+++ b/include/linux/sunrpc/debug.h
@@ -60,17 +60,17 @@ struct rpc_xprt;
#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
void rpc_register_sysctl(void);
void rpc_unregister_sysctl(void);
-int sunrpc_debugfs_init(void);
+void sunrpc_debugfs_init(void);
void sunrpc_debugfs_exit(void);
-int rpc_clnt_debugfs_register(struct rpc_clnt *);
+void rpc_clnt_debugfs_register(struct rpc_clnt *);
void rpc_clnt_debugfs_unregister(struct rpc_clnt *);
-int rpc_xprt_debugfs_register(struct rpc_xprt *);
+void rpc_xprt_debugfs_register(struct rpc_xprt *);
void rpc_xprt_debugfs_unregister(struct rpc_xprt *);
#else
-static inline int
+static inline void
sunrpc_debugfs_init(void)
{
- return 0;
+ return;
}
static inline void
@@ -79,10 +79,10 @@ sunrpc_debugfs_exit(void)
return;
}
-static inline int
+static inline void
rpc_clnt_debugfs_register(struct rpc_clnt *clnt)
{
- return 0;
+ return;
}
static inline void
@@ -91,10 +91,10 @@ rpc_clnt_debugfs_unregister(struct rpc_c
return;
}
-static inline int
+static inline void
rpc_xprt_debugfs_register(struct rpc_xprt *xprt)
{
- return 0;
+ return;
}
static inline void
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -303,9 +303,7 @@ static int rpc_client_register(struct rp
struct super_block *pipefs_sb;
int err;
- err = rpc_clnt_debugfs_register(clnt);
- if (err)
- return err;
+ rpc_clnt_debugfs_register(clnt);
pipefs_sb = rpc_get_sb_net(net);
if (pipefs_sb) {
--- a/net/sunrpc/debugfs.c
+++ b/net/sunrpc/debugfs.c
@@ -129,48 +129,52 @@ static const struct file_operations task
.release = tasks_release,
};
-int
+void
rpc_clnt_debugfs_register(struct rpc_clnt *clnt)
{
- int len, err;
+ int len;
char name[24]; /* enough for "../../rpc_xprt/ + 8 hex digits + NULL */
+ struct rpc_xprt *xprt;
/* Already registered? */
- if (clnt->cl_debugfs)
- return 0;
+ if (clnt->cl_debugfs || !rpc_clnt_dir)
+ return;
len = snprintf(name, sizeof(name), "%x", clnt->cl_clid);
if (len >= sizeof(name))
- return -EINVAL;
+ return;
/* make the per-client dir */
clnt->cl_debugfs = debugfs_create_dir(name, rpc_clnt_dir);
if (!clnt->cl_debugfs)
- return -ENOMEM;
+ return;
/* make tasks file */
- err = -ENOMEM;
if (!debugfs_create_file("tasks", S_IFREG | S_IRUSR, clnt->cl_debugfs,
clnt, &tasks_fops))
goto out_err;
- err = -EINVAL;
rcu_read_lock();
+ xprt = rcu_dereference(clnt->cl_xprt);
+ /* no "debugfs" dentry? Don't bother with the symlink. */
+ if (!xprt->debugfs) {
+ rcu_read_unlock();
+ return;
+ }
len = snprintf(name, sizeof(name), "../../rpc_xprt/%s",
- rcu_dereference(clnt->cl_xprt)->debugfs->d_name.name);
+ xprt->debugfs->d_name.name);
rcu_read_unlock();
+
if (len >= sizeof(name))
goto out_err;
- err = -ENOMEM;
if (!debugfs_create_symlink("xprt", clnt->cl_debugfs, name))
goto out_err;
- return 0;
+ return;
out_err:
debugfs_remove_recursive(clnt->cl_debugfs);
clnt->cl_debugfs = NULL;
- return err;
}
void
@@ -226,33 +230,33 @@ static const struct file_operations xprt
.release = xprt_info_release,
};
-int
+void
rpc_xprt_debugfs_register(struct rpc_xprt *xprt)
{
int len, id;
static atomic_t cur_id;
char name[9]; /* 8 hex digits + NULL term */
+ if (!rpc_xprt_dir)
+ return;
+
id = (unsigned int)atomic_inc_return(&cur_id);
len = snprintf(name, sizeof(name), "%x", id);
if (len >= sizeof(name))
- return -EINVAL;
+ return;
/* make the per-client dir */
xprt->debugfs = debugfs_create_dir(name, rpc_xprt_dir);
if (!xprt->debugfs)
- return -ENOMEM;
+ return;
/* make tasks file */
if (!debugfs_create_file("info", S_IFREG | S_IRUSR, xprt->debugfs,
xprt, &xprt_info_fops)) {
debugfs_remove_recursive(xprt->debugfs);
xprt->debugfs = NULL;
- return -ENOMEM;
}
-
- return 0;
}
void
@@ -266,14 +270,17 @@ void __exit
sunrpc_debugfs_exit(void)
{
debugfs_remove_recursive(topdir);
+ topdir = NULL;
+ rpc_clnt_dir = NULL;
+ rpc_xprt_dir = NULL;
}
-int __init
+void __init
sunrpc_debugfs_init(void)
{
topdir = debugfs_create_dir("sunrpc", NULL);
if (!topdir)
- goto out;
+ return;
rpc_clnt_dir = debugfs_create_dir("rpc_clnt", topdir);
if (!rpc_clnt_dir)
@@ -283,10 +290,9 @@ sunrpc_debugfs_init(void)
if (!rpc_xprt_dir)
goto out_remove;
- return 0;
+ return;
out_remove:
debugfs_remove_recursive(topdir);
topdir = NULL;
-out:
- return -ENOMEM;
+ rpc_clnt_dir = NULL;
}
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -98,10 +98,7 @@ init_sunrpc(void)
if (err)
goto out4;
- err = sunrpc_debugfs_init();
- if (err)
- goto out5;
-
+ sunrpc_debugfs_init();
#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
rpc_register_sysctl();
#endif
@@ -109,8 +106,6 @@ init_sunrpc(void)
init_socket_xprt(); /* clnt sock transport */
return 0;
-out5:
- unregister_rpc_pipefs();
out4:
unregister_pernet_subsys(&sunrpc_net_ops);
out3:
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1303,7 +1303,6 @@ static void xprt_init(struct rpc_xprt *x
*/
struct rpc_xprt *xprt_create_transport(struct xprt_create *args)
{
- int err;
struct rpc_xprt *xprt;
struct xprt_class *t;
@@ -1344,11 +1343,7 @@ found:
return ERR_PTR(-ENOMEM);
}
- err = rpc_xprt_debugfs_register(xprt);
- if (err) {
- xprt_destroy(xprt);
- return ERR_PTR(err);
- }
+ rpc_xprt_debugfs_register(xprt);
dprintk("RPC: created transport %p with %u slots\n", xprt,
xprt->max_reqs);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 039/101] powerpc: fix memory corruption by pnv_alloc_idle_core_states
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 038/101] sunrpc: make debugfs file creation failure non-fatal Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 040/101] powerpc: Re-enable dynticks Greg Kroah-Hartman
` (59 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Stancek, Michael Ellerman,
Preet U. Murthy
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Stancek <jstancek@redhat.com>
commit d52356e7f48e400ca258c6763a232a92fa82ff68 upstream.
Space allocated for paca is based off nr_cpu_ids,
but pnv_alloc_idle_core_states() iterates paca with
cpu_nr_cores()*threads_per_core, which is using NR_CPUS.
This causes pnv_alloc_idle_core_states() to write over memory,
which is outside of paca array and may later lead to various panics.
Fixes: 7cba160ad789 (powernv/cpuidle: Redesign idle states management)
Signed-off-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Preet U. Murthy <preeti@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/cputhreads.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/include/asm/cputhreads.h
+++ b/arch/powerpc/include/asm/cputhreads.h
@@ -55,7 +55,7 @@ static inline cpumask_t cpu_thread_mask_
static inline int cpu_nr_cores(void)
{
- return NR_CPUS >> threads_shift;
+ return nr_cpu_ids >> threads_shift;
}
static inline cpumask_t cpu_online_cores_map(void)
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 040/101] powerpc: Re-enable dynticks
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 039/101] powerpc: fix memory corruption by pnv_alloc_idle_core_states Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 041/101] nbd: fix possible memory leak Greg Kroah-Hartman
` (58 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Frederic Weisbecker, Paul A. Clarke,
Paul E. McKenney, Michael Ellerman
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Clarke <pc@us.ibm.com>
commit fea559f303567e558bfab9c8ba4a2af5b309205a upstream.
Implement arch_irq_work_has_interrupt() for powerpc
Commit 9b01f5bf3 introduced a dependency on "IRQ work self-IPIs" for
full dynamic ticks to be enabled, by expecting architectures to
implement a suitable arch_irq_work_has_interrupt() routine.
Several arches have implemented this routine, including x86 (3010279f)
and arm (09f6edd4), but powerpc was omitted.
This patch implements this routine for powerpc.
The symptom, at boot (on powerpc systems) with "nohz_full=<CPU list>"
is displayed:
NO_HZ: Can't run full dynticks because arch doesn't support irq work self-IPIs
after this patch:
NO_HZ: Full dynticks CPUs: <CPU list>.
Tested against 3.19.
powerpc implements "IRQ work self-IPIs" by setting the decrementer to 1 in
arch_irq_work_raise(), which causes a decrementer exception on the next
timebase tick. We then handle the work in __timer_interrupt().
CC: Frederic Weisbecker <fweisbec@gmail.com>
Signed-off-by: Paul A. Clarke <pc@us.ibm.com>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
[mpe: Flesh out change log, fix ws & include guards, remove include of processor.h]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/irq_work.h | 9 +++++++++
1 file changed, 9 insertions(+)
--- /dev/null
+++ b/arch/powerpc/include/asm/irq_work.h
@@ -0,0 +1,9 @@
+#ifndef _ASM_POWERPC_IRQ_WORK_H
+#define _ASM_POWERPC_IRQ_WORK_H
+
+static inline bool arch_irq_work_has_interrupt(void)
+{
+ return true;
+}
+
+#endif /* _ASM_POWERPC_IRQ_WORK_H */
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 041/101] nbd: fix possible memory leak
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 040/101] powerpc: Re-enable dynticks Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 042/101] mac80211: fix RX A-MPDU session reorder timer deletion Greg Kroah-Hartman
` (57 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sudip Mukherjee, Paul Clements,
Markus Pargmann
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
commit ff6b8090e26ef7649ef0cc6b42389141ef48b0cf upstream.
we have already allocated memory for nbd_dev, but we were not
releasing that memory and just returning the error value.
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Acked-by: Paul Clements <Paul.Clements@SteelEye.com>
Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/nbd.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -803,10 +803,6 @@ static int __init nbd_init(void)
return -EINVAL;
}
- nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
- if (!nbd_dev)
- return -ENOMEM;
-
part_shift = 0;
if (max_part > 0) {
part_shift = fls(max_part);
@@ -828,6 +824,10 @@ static int __init nbd_init(void)
if (nbds_max > 1UL << (MINORBITS - part_shift))
return -EINVAL;
+ nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
+ if (!nbd_dev)
+ return -ENOMEM;
+
for (i = 0; i < nbds_max; i++) {
struct gendisk *disk = alloc_disk(1 << part_shift);
if (!disk)
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 042/101] mac80211: fix RX A-MPDU session reorder timer deletion
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 041/101] nbd: fix possible memory leak Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 043/101] mm: fix anon_vma->degree underflow in anon_vma endless growing prevention Greg Kroah-Hartman
` (56 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johannes Berg
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit 788211d81bfdf9b6a547d0530f206ba6ee76b107 upstream.
There's an issue with the way the RX A-MPDU reorder timer is
deleted that can cause a kernel crash like this:
* tid_rx is removed - call_rcu(ieee80211_free_tid_rx)
* station is destroyed
* reorder timer fires before ieee80211_free_tid_rx() runs,
accessing the station, thus potentially crashing due to
the use-after-free
The station deletion is protected by synchronize_net(), but
that isn't enough -- ieee80211_free_tid_rx() need not have
run when that returns (it deletes the timer.) We could use
rcu_barrier() instead of synchronize_net(), but that's much
more expensive.
Instead, to fix this, add a field tracking that the session
is being deleted. In this case, the only re-arming of the
timer happens with the reorder spinlock held, so make that
code not rearm it if the session is being deleted and also
delete the timer after setting that field. This ensures the
timer cannot fire after ___ieee80211_stop_rx_ba_session()
returns, which fixes the problem.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/agg-rx.c | 8 ++++++--
net/mac80211/rx.c | 7 ++++---
net/mac80211/sta_info.h | 2 ++
3 files changed, 12 insertions(+), 5 deletions(-)
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct
container_of(h, struct tid_ampdu_rx, rcu_head);
int i;
- del_timer_sync(&tid_rx->reorder_timer);
-
for (i = 0; i < tid_rx->buf_size; i++)
__skb_queue_purge(&tid_rx->reorder_buf[i]);
kfree(tid_rx->reorder_buf);
@@ -93,6 +91,12 @@ void ___ieee80211_stop_rx_ba_session(str
del_timer_sync(&tid_rx->session_timer);
+ /* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
+ spin_lock_bh(&tid_rx->reorder_lock);
+ tid_rx->removed = true;
+ spin_unlock_bh(&tid_rx->reorder_lock);
+ del_timer_sync(&tid_rx->reorder_timer);
+
call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
}
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -870,9 +870,10 @@ static void ieee80211_sta_reorder_releas
set_release_timer:
- mod_timer(&tid_agg_rx->reorder_timer,
- tid_agg_rx->reorder_time[j] + 1 +
- HT_RX_REORDER_BUF_TIMEOUT);
+ if (!tid_agg_rx->removed)
+ mod_timer(&tid_agg_rx->reorder_timer,
+ tid_agg_rx->reorder_time[j] + 1 +
+ HT_RX_REORDER_BUF_TIMEOUT);
} else {
del_timer(&tid_agg_rx->reorder_timer);
}
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -175,6 +175,7 @@ struct tid_ampdu_tx {
* @reorder_lock: serializes access to reorder buffer, see below.
* @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
* and ssn.
+ * @removed: this session is removed (but might have been found due to RCU)
*
* This structure's lifetime is managed by RCU, assignments to
* the array holding it must hold the aggregation mutex.
@@ -199,6 +200,7 @@ struct tid_ampdu_rx {
u16 timeout;
u8 dialog_token;
bool auto_seq;
+ bool removed;
};
/**
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 043/101] mm: fix anon_vma->degree underflow in anon_vma endless growing prevention
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 042/101] mac80211: fix RX A-MPDU session reorder timer deletion Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 044/101] mm/memory hotplug: postpone the reset of obsolete pgdat Greg Kroah-Hartman
` (55 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Leon Yu, Konstantin Khlebnikov,
Michal Hocko, Rik van Riel, David Rientjes, Andrew Morton,
Linus Torvalds
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Yu <chianglungyu@gmail.com>
commit 3fe89b3e2a7bbf3e97657104b9b33a9d81b950b3 upstream.
I have constantly stumbled upon "kernel BUG at mm/rmap.c:399!" after
upgrading to 3.19 and had no luck with 4.0-rc1 neither.
So, after looking into new logic introduced by commit 7a3ef208e662 ("mm:
prevent endless growth of anon_vma hierarchy"), I found chances are that
unlink_anon_vmas() is called without incrementing dst->anon_vma->degree
in anon_vma_clone() due to allocation failure. If dst->anon_vma is not
NULL in error path, its degree will be incorrectly decremented in
unlink_anon_vmas() and eventually underflow when exiting as a result of
another call to unlink_anon_vmas(). That's how "kernel BUG at
mm/rmap.c:399!" is triggered for me.
This patch fixes the underflow by dropping dst->anon_vma when allocation
fails. It's safe to do so regardless of original value of dst->anon_vma
because dst->anon_vma doesn't have valid meaning if anon_vma_clone()
fails. Besides, callers don't care dst->anon_vma in such case neither.
Also suggested by Michal Hocko, we can clean up vma_adjust() a bit as
anon_vma_clone() now does the work.
[akpm@linux-foundation.org: tweak comment]
Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy")
Signed-off-by: Leon Yu <chianglungyu@gmail.com>
Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
Reviewed-by: Michal Hocko <mhocko@suse.cz>
Acked-by: Rik van Riel <riel@redhat.com>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mmap.c | 4 +---
mm/rmap.c | 7 +++++++
2 files changed, 8 insertions(+), 3 deletions(-)
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -780,10 +780,8 @@ again: remove_next = 1 + (end > next->
importer->anon_vma = exporter->anon_vma;
error = anon_vma_clone(importer, exporter);
- if (error) {
- importer->anon_vma = NULL;
+ if (error)
return error;
- }
}
}
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -287,6 +287,13 @@ int anon_vma_clone(struct vm_area_struct
return 0;
enomem_failure:
+ /*
+ * dst->anon_vma is dropped here otherwise its degree can be incorrectly
+ * decremented in unlink_anon_vmas().
+ * We can safely do this because callers of anon_vma_clone() don't care
+ * about dst->anon_vma if anon_vma_clone() failed.
+ */
+ dst->anon_vma = NULL;
unlink_anon_vmas(dst);
return -ENOMEM;
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 044/101] mm/memory hotplug: postpone the reset of obsolete pgdat
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 043/101] mm: fix anon_vma->degree underflow in anon_vma endless growing prevention Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 045/101] mm/page_alloc.c: call kernel_map_pages in unset_migrateype_isolate Greg Kroah-Hartman
` (54 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gu Zheng, Xishi Qiu,
KAMEZAWA Hiroyuki, David Rientjes, Yasuaki Ishimatsu, Taku Izumi,
Tang Chen, Xie XiuQi, Andrew Morton, Linus Torvalds
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gu Zheng <guz.fnst@cn.fujitsu.com>
commit b0dc3a342af36f95a68fe229b8f0f73552c5ca08 upstream.
Qiu Xishi reported the following BUG when testing hot-add/hot-remove node under
stress condition:
BUG: unable to handle kernel paging request at 0000000000025f60
IP: next_online_pgdat+0x1/0x50
PGD 0
Oops: 0000 [#1] SMP
ACPI: Device does not support D3cold
Modules linked in: fuse nls_iso8859_1 nls_cp437 vfat fat loop dm_mod coretemp mperf crc32c_intel ghash_clmulni_intel aesni_intel ablk_helper cryptd lrw gf128mul glue_helper aes_x86_64 pcspkr microcode igb dca i2c_algo_bit ipv6 megaraid_sas iTCO_wdt i2c_i801 i2c_core iTCO_vendor_support tg3 sg hwmon ptp lpc_ich pps_core mfd_core acpi_pad rtc_cmos button ext3 jbd mbcache sd_mod crc_t10dif scsi_dh_alua scsi_dh_rdac scsi_dh_hp_sw scsi_dh_emc scsi_dh ahci libahci libata scsi_mod [last unloaded: rasf]
CPU: 23 PID: 238 Comm: kworker/23:1 Tainted: G O 3.10.15-5885-euler0302 #1
Hardware name: HUAWEI TECHNOLOGIES CO.,LTD. Huawei N1/Huawei N1, BIOS V100R001 03/02/2015
Workqueue: events vmstat_update
task: ffffa800d32c0000 ti: ffffa800d32ae000 task.ti: ffffa800d32ae000
RIP: 0010: next_online_pgdat+0x1/0x50
RSP: 0018:ffffa800d32afce8 EFLAGS: 00010286
RAX: 0000000000001440 RBX: ffffffff81da53b8 RCX: 0000000000000082
RDX: 0000000000000000 RSI: 0000000000000082 RDI: 0000000000000000
RBP: ffffa800d32afd28 R08: ffffffff81c93bfc R09: ffffffff81cbdc96
R10: 00000000000040ec R11: 00000000000000a0 R12: ffffa800fffb3440
R13: ffffa800d32afd38 R14: 0000000000000017 R15: ffffa800e6616800
FS: 0000000000000000(0000) GS:ffffa800e6600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000025f60 CR3: 0000000001a0b000 CR4: 00000000001407e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
refresh_cpu_vm_stats+0xd0/0x140
vmstat_update+0x11/0x50
process_one_work+0x194/0x3d0
worker_thread+0x12b/0x410
kthread+0xc6/0xd0
ret_from_fork+0x7c/0xb0
The cause is the "memset(pgdat, 0, sizeof(*pgdat))" at the end of
try_offline_node, which will reset all the content of pgdat to 0, as the
pgdat is accessed lock-free, so that the users still using the pgdat
will panic, such as the vmstat_update routine.
process A: offline node XX:
vmstat_updat()
refresh_cpu_vm_stats()
for_each_populated_zone()
find online node XX
cond_resched()
offline cpu and memory, then try_offline_node()
node_set_offline(nid), and memset(pgdat, 0, sizeof(*pgdat))
zone = next_zone(zone)
pg_data_t *pgdat = zone->zone_pgdat; // here pgdat is NULL now
next_online_pgdat(pgdat)
next_online_node(pgdat->node_id); // NULL pointer access
So the solution here is postponing the reset of obsolete pgdat from
try_offline_node() to hotadd_new_pgdat(), and just resetting
pgdat->nr_zones and pgdat->classzone_idx to be 0 rather than the memset
0 to avoid breaking pointer information in pgdat.
Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
Reported-by: Xishi Qiu <qiuxishi@huawei.com>
Suggested-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Cc: Taku Izumi <izumi.taku@jp.fujitsu.com>
Cc: Tang Chen <tangchen@cn.fujitsu.com>
Cc: Xie XiuQi <xiexiuqi@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memory_hotplug.c | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1092,6 +1092,10 @@ static pg_data_t __ref *hotadd_new_pgdat
return NULL;
arch_refresh_nodedata(nid, pgdat);
+ } else {
+ /* Reset the nr_zones and classzone_idx to 0 before reuse */
+ pgdat->nr_zones = 0;
+ pgdat->classzone_idx = 0;
}
/* we can use NODE_DATA(nid) from here */
@@ -1977,15 +1981,6 @@ void try_offline_node(int nid)
if (is_vmalloc_addr(zone->wait_table))
vfree(zone->wait_table);
}
-
- /*
- * Since there is no way to guarentee the address of pgdat/zone is not
- * on stack of any kernel threads or used by other kernel objects
- * without reference counting or other symchronizing method, do not
- * reset node_data and free pgdat here. Just reset it to 0 and reuse
- * the memory when the node is online again.
- */
- memset(pgdat, 0, sizeof(*pgdat));
}
EXPORT_SYMBOL(try_offline_node);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 045/101] mm/page_alloc.c: call kernel_map_pages in unset_migrateype_isolate
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 044/101] mm/memory hotplug: postpone the reset of obsolete pgdat Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 046/101] sched: Fix RLIMIT_RTTIME when PI-boosting to RT Greg Kroah-Hartman
` (53 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Laura Abbott, Naoya Horiguchi,
Mel Gorman, Rik van Riel, Yasuaki Ishimatsu, Zhang Yanfei,
Xishi Qiu, Vladimir Davydov, Joonsoo Kim, Gioh Kim,
Michal Nazarewicz, Marek Szyprowski, Vlastimil Babka,
Andrew Morton, Linus Torvalds
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laura Abbott <lauraa@codeaurora.org>
commit cfa869438282be84ad4110bba5027ef1fbbe71e4 upstream.
Commit 3c605096d315 ("mm/page_alloc: restrict max order of merging on
isolated pageblock") changed the logic of unset_migratetype_isolate to
check the buddy allocator and explicitly call __free_pages to merge.
The page that is being freed in this path never had prep_new_page called
so set_page_refcounted is called explicitly but there is no call to
kernel_map_pages. With the default kernel_map_pages this is mostly
harmless but if kernel_map_pages does any manipulation of the page
tables (unmapping or setting pages to read only) this may trigger a
fault:
alloc_contig_range test_pages_isolated(ceb00, ced00) failed
Unable to handle kernel paging request at virtual address ffffffc0cec00000
pgd = ffffffc045fc4000
[ffffffc0cec00000] *pgd=0000000000000000
Internal error: Oops: 9600004f [#1] PREEMPT SMP
Modules linked in: exfatfs
CPU: 1 PID: 23237 Comm: TimedEventQueue Not tainted 3.10.49-gc72ad36-dirty #1
task: ffffffc03de52100 ti: ffffffc015388000 task.ti: ffffffc015388000
PC is at memset+0xc8/0x1c0
LR is at kernel_map_pages+0x1ec/0x244
Fix this by calling kernel_map_pages to ensure the page is set in the
page table properly
Fixes: 3c605096d315 ("mm/page_alloc: restrict max order of merging on isolated pageblock")
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Mel Gorman <mgorman@suse.de>
Acked-by: Rik van Riel <riel@redhat.com>
Cc: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Cc: Zhang Yanfei <zhangyanfei@cn.fujitsu.com>
Cc: Xishi Qiu <qiuxishi@huawei.com>
Cc: Vladimir Davydov <vdavydov@parallels.com>
Acked-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Gioh Kim <gioh.kim@lge.com>
Cc: Michal Nazarewicz <mina86@mina86.com>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_isolation.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -103,6 +103,7 @@ void unset_migratetype_isolate(struct pa
if (!is_migrate_isolate_page(buddy)) {
__isolate_free_page(page, order);
+ kernel_map_pages(page, (1 << order), 1);
set_page_refcounted(page);
isolated_page = page;
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 046/101] sched: Fix RLIMIT_RTTIME when PI-boosting to RT
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 045/101] mm/page_alloc.c: call kernel_map_pages in unset_migrateype_isolate Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 047/101] cpufreq: Schedule work for the first-online CPU on resume Greg Kroah-Hartman
` (52 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brian Silverman,
Peter Zijlstra (Intel), austin, Ingo Molnar
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Silverman <brian@peloton-tech.com>
commit 746db9443ea57fd9c059f62c4bfbf41cf224fe13 upstream.
When non-realtime tasks get priority-inheritance boosted to a realtime
scheduling class, RLIMIT_RTTIME starts to apply to them. However, the
counter used for checking this (the same one used for SCHED_RR
timeslices) was not getting reset. This meant that tasks running with a
non-realtime scheduling class which are repeatedly boosted to a realtime
one, but never block while they are running realtime, eventually hit the
timeout without ever running for a time over the limit. This patch
resets the realtime timeslice counter when un-PI-boosting from an RT to
a non-RT scheduling class.
I have some test code with two threads and a shared PTHREAD_PRIO_INHERIT
mutex which induces priority boosting and spins while boosted that gets
killed by a SIGXCPU on non-fixed kernels but doesn't with this patch
applied. It happens much faster with a CONFIG_PREEMPT_RT kernel, and
does happen eventually with PREEMPT_VOLUNTARY kernels.
Signed-off-by: Brian Silverman <brian@peloton-tech.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: austin@peloton-tech.com
Link: http://lkml.kernel.org/r/1424305436-6716-1-git-send-email-brian@peloton-tech.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3079,6 +3079,8 @@ void rt_mutex_setprio(struct task_struct
} else {
if (dl_prio(oldprio))
p->dl.dl_boosted = 0;
+ if (rt_prio(oldprio))
+ p->rt.timeout = 0;
p->sched_class = &fair_sched_class;
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 047/101] cpufreq: Schedule work for the first-online CPU on resume
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 046/101] sched: Fix RLIMIT_RTTIME when PI-boosting to RT Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 048/101] writeback: add missing INITIAL_JIFFIES init in global_update_bandwidth() Greg Kroah-Hartman
` (51 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Saravana Kannan, Viresh Kumar,
Rafael J. Wysocki
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <viresh.kumar@linaro.org>
commit c75de0ac0756d4b442f460e10461720c7c2412c2 upstream.
All CPUs leaving the first-online CPU are hotplugged out on suspend and
and cpufreq core stops managing them.
On resume, we need to call cpufreq_update_policy() for this CPU's policy
to make sure its frequency is in sync with cpufreq's cached value, as it
might have got updated by hardware during suspend/resume.
The policies are always added to the top of the policy-list. So, in
normal circumstances, CPU 0's policy will be the last one in the list.
And so the code checks for the last policy.
But there are cases where it will fail. Consider quad-core system, with
policy-per core. If CPU0 is hotplugged out and added back again, the
last policy will be on CPU1 :(
To fix this in a proper way, always look for the policy of the first
online CPU. That way we will be sure that we are calling
cpufreq_update_policy() for the only CPU that wasn't hotplugged out.
Fixes: 2f0aea936360 ("cpufreq: suspend governors on system suspend/hibernate")
Reported-by: Saravana Kannan <skannan@codeaurora.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Acked-by: Saravana Kannan <skannan@codeaurora.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/cpufreq.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1724,15 +1724,18 @@ void cpufreq_resume(void)
|| __cpufreq_governor(policy, CPUFREQ_GOV_LIMITS))
pr_err("%s: Failed to start governor for policy: %p\n",
__func__, policy);
-
- /*
- * schedule call cpufreq_update_policy() for boot CPU, i.e. last
- * policy in list. It will verify that the current freq is in
- * sync with what we believe it to be.
- */
- if (list_is_last(&policy->policy_list, &cpufreq_policy_list))
- schedule_work(&policy->update);
}
+
+ /*
+ * schedule call cpufreq_update_policy() for first-online CPU, as that
+ * wouldn't be hotplugged-out on suspend. It will verify that the
+ * current freq is in sync with what we believe it to be.
+ */
+ policy = cpufreq_cpu_get_raw(cpumask_first(cpu_online_mask));
+ if (WARN_ON(!policy))
+ return;
+
+ schedule_work(&policy->update);
}
/**
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 048/101] writeback: add missing INITIAL_JIFFIES init in global_update_bandwidth()
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 047/101] cpufreq: Schedule work for the first-online CPU on resume Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 049/101] writeback: fix possible underflow in write bandwidth calculation Greg Kroah-Hartman
` (50 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tejun Heo, Jan Kara, Wu Fengguang,
Jens Axboe, Jens Axboe
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 7d70e15480c0450d2bfafaad338a32e884fc215e upstream.
global_update_bandwidth() uses static variable update_time as the
timestamp for the last update but forgets to initialize it to
INITIALIZE_JIFFIES.
This means that global_dirty_limit will be 5 mins into the future on
32bit and some large amount jiffies into the past on 64bit. This
isn't critical as the only effect is that global_dirty_limit won't be
updated for the first 5 mins after booting on 32bit machines,
especially given the auxiliary nature of global_dirty_limit's role -
protecting against global dirty threshold's sudden dips; however, it
does lead to unintended suboptimal behavior. Fix it.
Fixes: c42843f2f0bb ("writeback: introduce smoothed global dirty limit")
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Jan Kara <jack@suse.cz>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page-writeback.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -922,7 +922,7 @@ static void global_update_bandwidth(unsi
unsigned long now)
{
static DEFINE_SPINLOCK(dirty_lock);
- static unsigned long update_time;
+ static unsigned long update_time = INITIAL_JIFFIES;
/*
* check locklessly first to optimize away locking for the most time
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 049/101] writeback: fix possible underflow in write bandwidth calculation
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 048/101] writeback: add missing INITIAL_JIFFIES init in global_update_bandwidth() Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 050/101] libata: Update Crucial/Micron blacklist Greg Kroah-Hartman
` (49 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tejun Heo, Jens Axboe, Jan Kara,
Wu Fengguang, Greg Thelen, Jens Axboe
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit c72efb658f7c8b27ca3d0efb5cfd5ded9fcac89e upstream.
>>From 1ebf33901ecc75d9496862dceb1ef0377980587c Mon Sep 17 00:00:00 2001
From: Tejun Heo <tj@kernel.org>
Date: Mon, 23 Mar 2015 00:08:19 -0400
2f800fbd777b ("writeback: fix dirtied pages accounting on redirty")
introduced account_page_redirty() which reverts stat updates for a
redirtied page, making BDI_DIRTIED no longer monotonically increasing.
bdi_update_write_bandwidth() uses the delta in BDI_DIRTIED as the
basis for bandwidth calculation. While unlikely, since the above
patch, the newer value may be lower than the recorded past value and
underflow the bandwidth calculation leading to a wild result.
Fix it by subtracing min of the old and new values when calculating
delta. AFAIK, there hasn't been any report of it happening but the
resulting erratic behavior would be non-critical and temporary, so
it's possible that the issue is happening without being reported. The
risk of the fix is very low, so tagged for -stable.
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Jan Kara <jack@suse.cz>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Cc: Greg Thelen <gthelen@google.com>
Fixes: 2f800fbd777b ("writeback: fix dirtied pages accounting on redirty")
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page-writeback.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -857,8 +857,11 @@ static void bdi_update_write_bandwidth(s
* bw * elapsed + write_bandwidth * (period - elapsed)
* write_bandwidth = ---------------------------------------------------
* period
+ *
+ * @written may have decreased due to account_page_redirty().
+ * Avoid underflowing @bw calculation.
*/
- bw = written - bdi->written_stamp;
+ bw = written - min(written, bdi->written_stamp);
bw *= HZ;
if (unlikely(elapsed > period)) {
do_div(bw, elapsed);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 050/101] libata: Update Crucial/Micron blacklist
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 049/101] writeback: fix possible underflow in write bandwidth calculation Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 051/101] libata: Blacklist queued TRIM on Samsung SSD 850 Pro Greg Kroah-Hartman
` (48 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin K. Petersen, Tejun Heo
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Martin K. Petersen" <martin.petersen@oracle.com>
commit ff7f53fb82a7801a778e5902bdbbc5e195ab0de0 upstream.
Micron has released an updated firmware (MU02) for M510/M550/MX100
drives to fix the issues with queued TRIM. Queued TRIM remains broken on
M500 but is working fine on later drives such as M600 and MX200.
Tweak our blacklist to reflect the above.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=71371
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-core.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4233,9 +4233,16 @@ static const struct ata_blacklist_entry
{ "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER },
/* devices that don't properly handle queued TRIM commands */
- { "Micron_M[56]*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Micron_M5[15]0*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Crucial_CT*M550*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
ATA_HORKAGE_ZERO_AFTER_TRIM, },
- { "Crucial_CT*SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
/*
* As defined, the DRAT (Deterministic Read After Trim) and RZAT
@@ -4255,6 +4262,8 @@ static const struct ata_blacklist_entry
*/
{ "INTEL*SSDSC2MH*", NULL, 0, },
+ { "Micron*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Crucial*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
{ "INTEL*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
{ "SSD*INTEL*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
{ "Samsung*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 051/101] libata: Blacklist queued TRIM on Samsung SSD 850 Pro
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 050/101] libata: Update Crucial/Micron blacklist Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 053/101] USB: keyspan_pda: add new device id Greg Kroah-Hartman
` (47 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Keller, Martin K. Petersen,
Tejun Heo
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Martin K. Petersen" <martin.petersen@oracle.com>
commit 6fc4d97a4987c5d247655a157a9377996626221a upstream.
Blacklist queued TRIM on this drive for now.
Reported-by: Stefan Keller <linux-list@zahlenfresser.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4243,6 +4243,8 @@ static const struct ata_blacklist_entry
ATA_HORKAGE_ZERO_AFTER_TRIM, },
{ "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Samsung SSD 850 PRO*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
/*
* As defined, the DRAT (Deterministic Read After Trim) and RZAT
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 053/101] USB: keyspan_pda: add new device id
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 051/101] libata: Blacklist queued TRIM on Samsung SSD 850 Pro Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 054/101] USB: ftdi_sio: Added custom PID for Synapse Wireless product Greg Kroah-Hartman
` (46 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathaniel Wesley Filardo,
Johan Hovold
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathaniel W Filardo <nwf@cs.jhu.edu>
commit 5e71fc8629cefae5f3c1a4f498de3fe4f631924a upstream.
Add USB VID/PID for Xircom PGMFHUB USB/serial component. (The hub and SCSI
bridge on that hardware are recognized out of the box by existing drivers.)
Tested VID/PID using new_id and loopback connection and was met with
success, but that's all the testing done.
Signed-off-by: Nathaniel Wesley Filardo <nwf@cs.jhu.edu>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/keyspan_pda.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -61,6 +61,7 @@ struct keyspan_pda_private {
/* For Xircom PGSDB9 and older Entrega version of the same device */
#define XIRCOM_VENDOR_ID 0x085a
#define XIRCOM_FAKE_ID 0x8027
+#define XIRCOM_FAKE_ID_2 0x8025 /* "PGMFHUB" serial */
#define ENTREGA_VENDOR_ID 0x1645
#define ENTREGA_FAKE_ID 0x8093
@@ -70,6 +71,7 @@ static const struct usb_device_id id_tab
#endif
#ifdef XIRCOM
{ USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID) },
+ { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID_2) },
{ USB_DEVICE(ENTREGA_VENDOR_ID, ENTREGA_FAKE_ID) },
#endif
{ USB_DEVICE(KEYSPAN_VENDOR_ID, KEYSPAN_PDA_ID) },
@@ -93,6 +95,7 @@ static const struct usb_device_id id_tab
#ifdef XIRCOM
static const struct usb_device_id id_table_fake_xircom[] = {
{ USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID) },
+ { USB_DEVICE(XIRCOM_VENDOR_ID, XIRCOM_FAKE_ID_2) },
{ USB_DEVICE(ENTREGA_VENDOR_ID, ENTREGA_FAKE_ID) },
{ }
};
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 054/101] USB: ftdi_sio: Added custom PID for Synapse Wireless product
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 053/101] USB: keyspan_pda: add new device id Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 055/101] USB: ftdi_sio: Use jtag quirk for SNAP Connect E10 Greg Kroah-Hartman
` (45 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Doug Goldstein, Johan Hovold
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Goldstein <cardoe@cardoe.com>
commit 4899c054a90439477b24da8977db8d738376fe90 upstream.
Synapse Wireless uses the FTDI VID with a custom PID of 0x9090 for their
SNAP Stick 200 product.
Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
2 files changed, 7 insertions(+)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -604,6 +604,7 @@ static const struct usb_device_id id_tab
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
{ USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
/*
* ELV devices:
*/
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -561,6 +561,12 @@
*/
#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
+/*
+ * Synapse Wireless product ids (FTDI_VID)
+ * http://www.synapse-wireless.com
+ */
+#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
+
/********************************/
/** third-party VID/PID combos **/
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 055/101] USB: ftdi_sio: Use jtag quirk for SNAP Connect E10
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 054/101] USB: ftdi_sio: Added custom PID for Synapse Wireless product Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 056/101] Defer processing of REQ_PREEMPT requests for blocked devices Greg Kroah-Hartman
` (44 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Doug Goldstein, Johan Hovold
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Goldstein <cardoe@cardoe.com>
commit b229a0f840f774d29d8fedbf5deb344ca36b7f1a upstream.
This patch uses the existing CALAO Systems ftdi_8u2232c_probe in order
to avoid attaching a TTY to the JTAG port as this board is based on the
CALAO Systems reference design and needs the same fix up.
Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
[johan: clean up probe logic ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1884,8 +1884,12 @@ static int ftdi_8u2232c_probe(struct usb
{
struct usb_device *udev = serial->dev;
- if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) ||
- (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2")))
+ if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems"))
+ return ftdi_jtag_probe(serial);
+
+ if (udev->product &&
+ (!strcmp(udev->product, "BeagleBone/XDS100V2") ||
+ !strcmp(udev->product, "SNAP Connect E10")))
return ftdi_jtag_probe(serial);
return 0;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 056/101] Defer processing of REQ_PREEMPT requests for blocked devices
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 055/101] USB: ftdi_sio: Use jtag quirk for SNAP Connect E10 Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 057/101] iio: inv_mpu6050: Clear timestamps fifo while resetting hardware fifo Greg Kroah-Hartman
` (43 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Max Gurtuvoy, Bart Van Assche,
Mike Christie, James Bottomley
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@sandisk.com>
commit bba0bdd7ad4713d82338bcd9b72d57e9335a664b upstream.
SCSI transport drivers and SCSI LLDs block a SCSI device if the
transport layer is not operational. This means that in this state
no requests should be processed, even if the REQ_PREEMPT flag has
been set. This patch avoids that a rescan shortly after a cable
pull sporadically triggers the following kernel oops:
BUG: unable to handle kernel paging request at ffffc9001a6bc084
IP: [<ffffffffa04e08f2>] mlx4_ib_post_send+0xd2/0xb30 [mlx4_ib]
Process rescan-scsi-bus (pid: 9241, threadinfo ffff88053484a000, task ffff880534aae100)
Call Trace:
[<ffffffffa0718135>] srp_post_send+0x65/0x70 [ib_srp]
[<ffffffffa071b9df>] srp_queuecommand+0x1cf/0x3e0 [ib_srp]
[<ffffffffa0001ff1>] scsi_dispatch_cmd+0x101/0x280 [scsi_mod]
[<ffffffffa0009ad1>] scsi_request_fn+0x411/0x4d0 [scsi_mod]
[<ffffffff81223b37>] __blk_run_queue+0x27/0x30
[<ffffffff8122a8d2>] blk_execute_rq_nowait+0x82/0x110
[<ffffffff8122a9c2>] blk_execute_rq+0x62/0xf0
[<ffffffffa000b0e8>] scsi_execute+0xe8/0x190 [scsi_mod]
[<ffffffffa000b2f3>] scsi_execute_req+0xa3/0x130 [scsi_mod]
[<ffffffffa000c1aa>] scsi_probe_lun+0x17a/0x450 [scsi_mod]
[<ffffffffa000ce86>] scsi_probe_and_add_lun+0x156/0x480 [scsi_mod]
[<ffffffffa000dc2f>] __scsi_scan_target+0xdf/0x1f0 [scsi_mod]
[<ffffffffa000dfa3>] scsi_scan_host_selected+0x183/0x1c0 [scsi_mod]
[<ffffffffa000edfb>] scsi_scan+0xdb/0xe0 [scsi_mod]
[<ffffffffa000ee13>] store_scan+0x13/0x20 [scsi_mod]
[<ffffffff811c8d9b>] sysfs_write_file+0xcb/0x160
[<ffffffff811589de>] vfs_write+0xce/0x140
[<ffffffff81158b53>] sys_write+0x53/0xa0
[<ffffffff81464592>] system_call_fastpath+0x16/0x1b
[<00007f611c9d9300>] 0x7f611c9d92ff
Reported-by: Max Gurtuvoy <maxg@mellanox.com>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_lib.c | 4 +++-
include/linux/blk_types.h | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1311,9 +1311,11 @@ scsi_prep_state_check(struct scsi_device
"rejecting I/O to dead device\n");
ret = BLKPREP_KILL;
break;
- case SDEV_QUIESCE:
case SDEV_BLOCK:
case SDEV_CREATED_BLOCK:
+ ret = BLKPREP_DEFER;
+ break;
+ case SDEV_QUIESCE:
/*
* If the devices is blocked we defer normal commands.
*/
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -181,7 +181,9 @@ enum rq_flag_bits {
__REQ_ELVPRIV, /* elevator private data attached */
__REQ_FAILED, /* set if the request failed */
__REQ_QUIET, /* don't worry about errors */
- __REQ_PREEMPT, /* set for "ide_preempt" requests */
+ __REQ_PREEMPT, /* set for "ide_preempt" requests and also
+ for requests for which the SCSI "quiesce"
+ state must be ignored. */
__REQ_ALLOCED, /* request came from our alloc pool */
__REQ_COPY_USER, /* contains copies of user pages */
__REQ_FLUSH_SEQ, /* request for flush sequence */
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 057/101] iio: inv_mpu6050: Clear timestamps fifo while resetting hardware fifo
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 056/101] Defer processing of REQ_PREEMPT requests for blocked devices Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 058/101] iio: core: Fix double free Greg Kroah-Hartman
` (42 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Viorel Suman, Jonathan Cameron
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viorel Suman <viorel.suman@gmail.com>
commit 4dac0a8eefd55bb1f157d1a5a084531334a2d74c upstream.
A hardware fifo reset always imply an invalidation of the
existing timestamps, so we'll clear timestamps fifo on
successfull hardware fifo reset.
Signed-off-by: Viorel Suman <viorel.suman@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
@@ -24,6 +24,16 @@
#include <linux/poll.h>
#include "inv_mpu_iio.h"
+static void inv_clear_kfifo(struct inv_mpu6050_state *st)
+{
+ unsigned long flags;
+
+ /* take the spin lock sem to avoid interrupt kick in */
+ spin_lock_irqsave(&st->time_stamp_lock, flags);
+ kfifo_reset(&st->timestamps);
+ spin_unlock_irqrestore(&st->time_stamp_lock, flags);
+}
+
int inv_reset_fifo(struct iio_dev *indio_dev)
{
int result;
@@ -50,6 +60,10 @@ int inv_reset_fifo(struct iio_dev *indio
INV_MPU6050_BIT_FIFO_RST);
if (result)
goto reset_fifo_fail;
+
+ /* clear timestamps fifo */
+ inv_clear_kfifo(st);
+
/* enable interrupt */
if (st->chip_config.accl_fifo_enable ||
st->chip_config.gyro_fifo_enable) {
@@ -83,16 +97,6 @@ reset_fifo_fail:
return result;
}
-static void inv_clear_kfifo(struct inv_mpu6050_state *st)
-{
- unsigned long flags;
-
- /* take the spin lock sem to avoid interrupt kick in */
- spin_lock_irqsave(&st->time_stamp_lock, flags);
- kfifo_reset(&st->timestamps);
- spin_unlock_irqrestore(&st->time_stamp_lock, flags);
-}
-
/**
* inv_mpu6050_irq_handler() - Cache a timestamp at each data ready interrupt.
*/
@@ -184,7 +188,6 @@ end_session:
flush_fifo:
/* Flush HW and SW FIFOs. */
inv_reset_fifo(indio_dev);
- inv_clear_kfifo(st);
mutex_unlock(&indio_dev->mlock);
iio_trigger_notify_done(indio_dev->trig);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 058/101] iio: core: Fix double free.
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 057/101] iio: inv_mpu6050: Clear timestamps fifo while resetting hardware fifo Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 059/101] iio: bmc150: change sampling frequency Greg Kroah-Hartman
` (41 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Fuzzey, Jonathan Cameron
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Fuzzey <mfuzzey@parkeon.com>
commit c1b03ab5e886760bdd38c9c7a27af149046ffe01 upstream.
When an error occurred during event registration memory was freed twice
resulting in kernel memory corruption and a crash in unrelated code.
The problem was caused by
iio_device_unregister_eventset()
iio_device_unregister_sysfs()
being called twice, once on the error path and then
again via iio_dev_release().
Fix this by making these two functions idempotent so they
may be called multiple times.
The problem was observed before applying
78b33216 iio:core: Handle error when mask type is not separate
Signed-off-by: Martin Fuzzey <mfuzzey@parkeon.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-core.c | 5 +++--
drivers/iio/industrialio-event.c | 1 +
2 files changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -832,8 +832,7 @@ static int iio_device_add_channel_sysfs(
* @attr_list: List of IIO device attributes
*
* This function frees the memory allocated for each of the IIO device
- * attributes in the list. Note: if you want to reuse the list after calling
- * this function you have to reinitialize it using INIT_LIST_HEAD().
+ * attributes in the list.
*/
void iio_free_chan_devattr_list(struct list_head *attr_list)
{
@@ -841,6 +840,7 @@ void iio_free_chan_devattr_list(struct l
list_for_each_entry_safe(p, n, attr_list, l) {
kfree(p->dev_attr.attr.name);
+ list_del(&p->l);
kfree(p);
}
}
@@ -921,6 +921,7 @@ static void iio_device_unregister_sysfs(
iio_free_chan_devattr_list(&indio_dev->channel_attr_list);
kfree(indio_dev->chan_attr_group.attrs);
+ indio_dev->chan_attr_group.attrs = NULL;
}
static void iio_dev_release(struct device *device)
--- a/drivers/iio/industrialio-event.c
+++ b/drivers/iio/industrialio-event.c
@@ -493,6 +493,7 @@ int iio_device_register_eventset(struct
error_free_setup_event_lines:
iio_free_chan_devattr_list(&indio_dev->event_interface->dev_attr_list);
kfree(indio_dev->event_interface);
+ indio_dev->event_interface = NULL;
return ret;
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 059/101] iio: bmc150: change sampling frequency
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 058/101] iio: core: Fix double free Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 060/101] iio: adc: vf610: use ADC clock within specification Greg Kroah-Hartman
` (40 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sathyanarayanan Kuppuswamy,
Octavian Purdila, Jonathan Cameron
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sathyanarayanan Kuppuswamy <sathyanarayanan.kuppuswamy@intel.com>
commit 0ba8da961bd868c67a8dae3dbbee145514515e9c upstream.
Currently driver reports device bandwidth list as available
sampling frequency. But sampling frequency is actually twice
the device bandwidth. This patch fixes this issue.
Signed-off-by: Sathyanarayanan Kuppuswamy <sathyanarayanan.kuppuswamy@intel.com>
Signed-off-by: Octavian Purdila <octavian.purdila@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/bmc150-accel.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
--- a/drivers/iio/accel/bmc150-accel.c
+++ b/drivers/iio/accel/bmc150-accel.c
@@ -168,14 +168,14 @@ static const struct {
int val;
int val2;
u8 bw_bits;
-} bmc150_accel_samp_freq_table[] = { {7, 810000, 0x08},
- {15, 630000, 0x09},
- {31, 250000, 0x0A},
- {62, 500000, 0x0B},
- {125, 0, 0x0C},
- {250, 0, 0x0D},
- {500, 0, 0x0E},
- {1000, 0, 0x0F} };
+} bmc150_accel_samp_freq_table[] = { {15, 620000, 0x08},
+ {31, 260000, 0x09},
+ {62, 500000, 0x0A},
+ {125, 0, 0x0B},
+ {250, 0, 0x0C},
+ {500, 0, 0x0D},
+ {1000, 0, 0x0E},
+ {2000, 0, 0x0F} };
static const struct {
int bw_bits;
@@ -840,7 +840,7 @@ static int bmc150_accel_validate_trigger
}
static IIO_CONST_ATTR_SAMP_FREQ_AVAIL(
- "7.810000 15.630000 31.250000 62.500000 125 250 500 1000");
+ "15.620000 31.260000 62.50000 125 250 500 1000 2000");
static struct attribute *bmc150_accel_attributes[] = {
&iio_const_attr_sampling_frequency_available.dev_attr.attr,
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 060/101] iio: adc: vf610: use ADC clock within specification
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 059/101] iio: bmc150: change sampling frequency Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 061/101] iio: imu: Use iio_trigger_get for indio_dev->trig assignment Greg Kroah-Hartman
` (39 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Agner, Fugang Duan,
Jonathan Cameron
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <stefan@agner.ch>
commit f54e9f2be312a4e71b54aea865b2e33ccb95ef0c upstream.
Depending on conversion mode used, the ADC clock (ADCK) needs
to be below a maximum frequency. According to Vybrid's data
sheet this is 20MHz for the low power conversion mode.
The ADC clock is depending on input clock, which is the bus
clock by default. Vybrid SoC are typically clocked at at 400MHz
or 500MHz, which leads to 66MHz or 83MHz bus clock respectively.
Hence, a divider of 8 is required to stay below the specified
maximum clock of 20MHz.
Due to the different bus clock speeds, the resulting sampling
frequency is not static. Hence use the ADC clock and calculate
the actual available sampling frequency dynamically.
This fixes bogous values observed on some 500MHz clocked Vybrid
SoC. The resulting value usually showed Bit 9 being stuck at 1,
or 0, which lead to a value of +/-512.
Signed-off-by: Stefan Agner <stefan@agner.ch>
Acked-by: Fugang Duan <B38611@freescale.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/vf610_adc.c | 91 +++++++++++++++++++++++++++++---------------
1 file changed, 61 insertions(+), 30 deletions(-)
--- a/drivers/iio/adc/vf610_adc.c
+++ b/drivers/iio/adc/vf610_adc.c
@@ -141,9 +141,13 @@ struct vf610_adc {
struct regulator *vref;
struct vf610_adc_feature adc_feature;
+ u32 sample_freq_avail[5];
+
struct completion completion;
};
+static const u32 vf610_hw_avgs[] = { 1, 4, 8, 16, 32 };
+
#define VF610_ADC_CHAN(_idx, _chan_type) { \
.type = (_chan_type), \
.indexed = 1, \
@@ -180,35 +184,47 @@ static const struct iio_chan_spec vf610_
/* sentinel */
};
-/*
- * ADC sample frequency, unit is ADCK cycles.
- * ADC clk source is ipg clock, which is the same as bus clock.
- *
- * ADC conversion time = SFCAdder + AverageNum x (BCT + LSTAdder)
- * SFCAdder: fixed to 6 ADCK cycles
- * AverageNum: 1, 4, 8, 16, 32 samples for hardware average.
- * BCT (Base Conversion Time): fixed to 25 ADCK cycles for 12 bit mode
- * LSTAdder(Long Sample Time): fixed to 3 ADCK cycles
- *
- * By default, enable 12 bit resolution mode, clock source
- * set to ipg clock, So get below frequency group:
- */
-static const u32 vf610_sample_freq_avail[5] =
-{1941176, 559332, 286957, 145374, 73171};
+static inline void vf610_adc_calculate_rates(struct vf610_adc *info)
+{
+ unsigned long adck_rate, ipg_rate = clk_get_rate(info->clk);
+ int i;
+
+ /*
+ * Calculate ADC sample frequencies
+ * Sample time unit is ADCK cycles. ADCK clk source is ipg clock,
+ * which is the same as bus clock.
+ *
+ * ADC conversion time = SFCAdder + AverageNum x (BCT + LSTAdder)
+ * SFCAdder: fixed to 6 ADCK cycles
+ * AverageNum: 1, 4, 8, 16, 32 samples for hardware average.
+ * BCT (Base Conversion Time): fixed to 25 ADCK cycles for 12 bit mode
+ * LSTAdder(Long Sample Time): fixed to 3 ADCK cycles
+ */
+ adck_rate = ipg_rate / info->adc_feature.clk_div;
+ for (i = 0; i < ARRAY_SIZE(vf610_hw_avgs); i++)
+ info->sample_freq_avail[i] =
+ adck_rate / (6 + vf610_hw_avgs[i] * (25 + 3));
+}
static inline void vf610_adc_cfg_init(struct vf610_adc *info)
{
+ struct vf610_adc_feature *adc_feature = &info->adc_feature;
+
/* set default Configuration for ADC controller */
- info->adc_feature.clk_sel = VF610_ADCIOC_BUSCLK_SET;
- info->adc_feature.vol_ref = VF610_ADCIOC_VR_VREF_SET;
+ adc_feature->clk_sel = VF610_ADCIOC_BUSCLK_SET;
+ adc_feature->vol_ref = VF610_ADCIOC_VR_VREF_SET;
+
+ adc_feature->calibration = true;
+ adc_feature->ovwren = true;
- info->adc_feature.calibration = true;
- info->adc_feature.ovwren = true;
+ adc_feature->res_mode = 12;
+ adc_feature->sample_rate = 1;
+ adc_feature->lpm = true;
- info->adc_feature.clk_div = 1;
- info->adc_feature.res_mode = 12;
- info->adc_feature.sample_rate = 1;
- info->adc_feature.lpm = true;
+ /* Use a save ADCK which is below 20MHz on all devices */
+ adc_feature->clk_div = 8;
+
+ vf610_adc_calculate_rates(info);
}
static void vf610_adc_cfg_post_set(struct vf610_adc *info)
@@ -290,12 +306,10 @@ static void vf610_adc_cfg_set(struct vf6
cfg_data = readl(info->regs + VF610_REG_ADC_CFG);
- /* low power configuration */
cfg_data &= ~VF610_ADC_ADLPC_EN;
if (adc_feature->lpm)
cfg_data |= VF610_ADC_ADLPC_EN;
- /* disable high speed */
cfg_data &= ~VF610_ADC_ADHSC_EN;
writel(cfg_data, info->regs + VF610_REG_ADC_CFG);
@@ -435,10 +449,27 @@ static irqreturn_t vf610_adc_isr(int irq
return IRQ_HANDLED;
}
-static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("1941176, 559332, 286957, 145374, 73171");
+static ssize_t vf610_show_samp_freq_avail(struct device *dev,
+ struct device_attribute *attr, char *buf)
+{
+ struct vf610_adc *info = iio_priv(dev_to_iio_dev(dev));
+ size_t len = 0;
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(info->sample_freq_avail); i++)
+ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "%u ", info->sample_freq_avail[i]);
+
+ /* replace trailing space by newline */
+ buf[len - 1] = '\n';
+
+ return len;
+}
+
+static IIO_DEV_ATTR_SAMP_FREQ_AVAIL(vf610_show_samp_freq_avail);
static struct attribute *vf610_attributes[] = {
- &iio_const_attr_sampling_frequency_available.dev_attr.attr,
+ &iio_dev_attr_sampling_frequency_available.dev_attr.attr,
NULL
};
@@ -502,7 +533,7 @@ static int vf610_read_raw(struct iio_dev
return IIO_VAL_FRACTIONAL_LOG2;
case IIO_CHAN_INFO_SAMP_FREQ:
- *val = vf610_sample_freq_avail[info->adc_feature.sample_rate];
+ *val = info->sample_freq_avail[info->adc_feature.sample_rate];
*val2 = 0;
return IIO_VAL_INT;
@@ -525,9 +556,9 @@ static int vf610_write_raw(struct iio_de
switch (mask) {
case IIO_CHAN_INFO_SAMP_FREQ:
for (i = 0;
- i < ARRAY_SIZE(vf610_sample_freq_avail);
+ i < ARRAY_SIZE(info->sample_freq_avail);
i++)
- if (val == vf610_sample_freq_avail[i]) {
+ if (val == info->sample_freq_avail[i]) {
info->adc_feature.sample_rate = i;
vf610_adc_sample_set(info);
return 0;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 061/101] iio: imu: Use iio_trigger_get for indio_dev->trig assignment
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 060/101] iio: adc: vf610: use ADC clock within specification Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 062/101] dmaengine: edma: fix memory leak when terminating running transfers Greg Kroah-Hartman
` (38 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Darshana Padmadas, Jonathan Cameron
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darshana Padmadas <darshanapadmadas@gmail.com>
commit 4ce7ca89d6e8eae9e201cd0e972ba323f33e2fb4 upstream.
This patch uses iio_trigger_get to increment the reference
count of trigger device, to avoid incorrect assignment.
Can result in a null pointer dereference during removal if the
trigger has been changed before removal.
This patch refers to a similar situation encountered through the
following discussion:
http://www.spinics.net/lists/linux-iio/msg13669.html
Signed-off-by: Darshana Padmadas <darshanapadmadas@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/adis_trigger.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/imu/adis_trigger.c
+++ b/drivers/iio/imu/adis_trigger.c
@@ -60,7 +60,7 @@ int adis_probe_trigger(struct adis *adis
iio_trigger_set_drvdata(adis->trig, adis);
ret = iio_trigger_register(adis->trig);
- indio_dev->trig = adis->trig;
+ indio_dev->trig = iio_trigger_get(adis->trig);
if (ret)
goto error_free_irq;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 062/101] dmaengine: edma: fix memory leak when terminating running transfers
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 061/101] iio: imu: Use iio_trigger_get for indio_dev->trig assignment Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 063/101] dmaengine: omap-dma: Fix memory leak when terminating running transfer Greg Kroah-Hartman
` (37 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Petr Kulhavy, Peter Ujfalusi,
linux-omap, Vinod Koul
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Kulhavy <petr@barix.com>
commit 5ca9e7ce6eebec53362ff779264143860ccf68cd upstream.
If edma_terminate_all() was called while a transfer was running (i.e. after
edma_execute() but before edma_callback()) the echan->edesc was not freed.
This was due to the fact that a running transfer is on none of the
vchan lists: desc_submitted, desc_issued, desc_completed (edma_execute()
removes it from the desc_issued list), so the vchan_dma_desc_free_list()
called at the end of edma_terminate_all() didn't find it and didn't free it.
This bug was found on an AM1808 based hardware (very similar to da850evm,
however using the second MMC/SD controller), where intense operations on the SD
card wasted the device 128MB RAM within a couple of days.
Peter Ujfalusi:
The issue is even more severe since it affects cyclic (audio) transfers as
well. In this case starting/stopping audio will results memory leak.
Signed-off-by: Petr Kulhavy <petr@barix.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
CC: <linux-omap@vger.kernel.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/edma.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -258,6 +258,13 @@ static int edma_terminate_all(struct edm
*/
if (echan->edesc) {
int cyclic = echan->edesc->cyclic;
+
+ /*
+ * free the running request descriptor
+ * since it is not in any of the vdesc lists
+ */
+ edma_desc_free(&echan->edesc->vdesc);
+
echan->edesc = NULL;
edma_stop(echan->ch_num);
/* Move the cyclic channel back to default queue */
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 063/101] dmaengine: omap-dma: Fix memory leak when terminating running transfer
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 062/101] dmaengine: edma: fix memory leak when terminating running transfers Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 064/101] ath9k: fix tracking of enabled AP beacons Greg Kroah-Hartman
` (36 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, linux-omap,
Vinod Koul
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
commit 02d88b735f5a60f04dbf6d051b76e1877a0d0844 upstream.
In omap_dma_start_desc the vdesc->node is removed from the virt-dma
framework managed lists (to be precise from the desc_issued list).
If a terminate_all comes before the transfer finishes the omap_desc will
not be freed up because it is not in any of the lists and we stopped the
DMA channel so the transfer will not going to complete.
There is no special sequence for leaking memory when using cyclic (audio)
transfer: with every start and stop of a cyclic transfer the driver leaks
struct omap_desc worth of memory.
Free up the allocated memory directly in omap_dma_terminate_all() since the
framework will not going to do that for us.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
CC: <linux-omap@vger.kernel.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/omap-dma.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/dma/omap-dma.c
+++ b/drivers/dma/omap-dma.c
@@ -978,6 +978,7 @@ static int omap_dma_terminate_all(struct
* c->desc is NULL and exit.)
*/
if (c->desc) {
+ omap_dma_desc_free(&c->desc->vd);
c->desc = NULL;
/* Avoid stopping the dma twice */
if (!c->paused)
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 064/101] ath9k: fix tracking of enabled AP beacons
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 063/101] dmaengine: omap-dma: Fix memory leak when terminating running transfer Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 065/101] x86/reboot: Add ASRock Q1900DC-ITX mainboard reboot quirk Greg Kroah-Hartman
` (35 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Kalle Valo
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@openwrt.org>
commit 1cf48f22c98ae24a49a3f1b6900e4c9a9a0fcc62 upstream.
sc->nbcnvifs tracks assigned beacon slots, not enabled beacons.
Therefore, it cannot be used to decide if cur_conf->enable_beacon (bool)
should be updated, or if beacons have been enabled already.
With the current code (depending on the order of calls), beacons often
do not get enabled in an AP+STA setup.
To fix tracking of enabled beacons, convert cur_conf->enable_beacon to a
bitmask of enabled beacon slots.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/beacon.c | 20 ++++++++++++--------
drivers/net/wireless/ath/ath9k/common.h | 2 +-
2 files changed, 13 insertions(+), 9 deletions(-)
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -219,12 +219,15 @@ void ath9k_beacon_remove_slot(struct ath
struct ath_common *common = ath9k_hw_common(sc->sc_ah);
struct ath_vif *avp = (void *)vif->drv_priv;
struct ath_buf *bf = avp->av_bcbuf;
+ struct ath_beacon_config *cur_conf = &sc->cur_chan->beacon;
ath_dbg(common, CONFIG, "Removing interface at beacon slot: %d\n",
avp->av_bslot);
tasklet_disable(&sc->bcon_tasklet);
+ cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
+
if (bf && bf->bf_mpdu) {
struct sk_buff *skb = bf->bf_mpdu;
dma_unmap_single(sc->dev, bf->bf_buf_addr,
@@ -521,8 +524,7 @@ static bool ath9k_allow_beacon_config(st
}
if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
- if ((vif->type != NL80211_IFTYPE_AP) ||
- (sc->nbcnvifs > 1)) {
+ if (vif->type != NL80211_IFTYPE_AP) {
ath_dbg(common, CONFIG,
"An AP interface is already present !\n");
return false;
@@ -616,12 +618,14 @@ void ath9k_beacon_config(struct ath_soft
* enabling/disabling SWBA.
*/
if (changed & BSS_CHANGED_BEACON_ENABLED) {
- if (!bss_conf->enable_beacon &&
- (sc->nbcnvifs <= 1)) {
- cur_conf->enable_beacon = false;
- } else if (bss_conf->enable_beacon) {
- cur_conf->enable_beacon = true;
- ath9k_cache_beacon_config(sc, ctx, bss_conf);
+ bool enabled = cur_conf->enable_beacon;
+
+ if (!bss_conf->enable_beacon) {
+ cur_conf->enable_beacon &= ~BIT(avp->av_bslot);
+ } else {
+ cur_conf->enable_beacon |= BIT(avp->av_bslot);
+ if (!enabled)
+ ath9k_cache_beacon_config(sc, ctx, bss_conf);
}
}
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -54,7 +54,7 @@ struct ath_beacon_config {
u16 dtim_period;
u16 bmiss_timeout;
u8 dtim_count;
- bool enable_beacon;
+ u8 enable_beacon;
bool ibss_creator;
u32 nexttbtt;
u32 intval;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 065/101] x86/reboot: Add ASRock Q1900DC-ITX mainboard reboot quirk
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 064/101] ath9k: fix tracking of enabled AP beacons Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 066/101] can: flexcan: fix bus-off error state handling Greg Kroah-Hartman
` (34 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Lippers-Hollmann, Matt Fleming,
Ingo Molnar
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Lippers-Hollmann <s.l-h@gmx.de>
commit 80313b3078fcd2ca51970880d90757f05879a193 upstream.
The ASRock Q1900DC-ITX mainboard (Baytrail-D) hangs randomly in
both BIOS and UEFI mode while rebooting unless reboot=pci is
used. Add a quirk to reboot via the pci method.
The problem is very intermittent and hard to debug, it might succeed
rebooting just fine 40 times in a row - but fails half a dozen times
the next day. It seems to be slightly less common in BIOS CSM mode
than native UEFI (with the CSM disabled), but it does happen in either
mode. Since I've started testing this patch in late january, rebooting
has been 100% reliable.
Most of the time it already hangs during POST, but occasionally it
might even make it through the bootloader and the kernel might even
start booting, but then hangs before the mode switch. The same symptoms
occur with grub-efi, gummiboot and grub-pc, just as well as (at least)
kernel 3.16-3.19 and 4.0-rc6 (I haven't tried older kernels than 3.16).
Upgrading to the most current mainboard firmware of the ASRock
Q1900DC-ITX, version 1.20, does not improve the situation.
( Searching the web seems to suggest that other Bay Trail-D mainboards
might be affected as well. )
--
Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
Cc: Matt Fleming <matt.fleming@intel.com>
Link: http://lkml.kernel.org/r/20150330224427.0fb58e42@mir
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/reboot.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -183,6 +183,16 @@ static struct dmi_system_id __initdata r
},
},
+ /* ASRock */
+ { /* Handle problems with rebooting on ASRock Q1900DC-ITX */
+ .callback = set_pci_reboot,
+ .ident = "ASRock Q1900DC-ITX",
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "ASRock"),
+ DMI_MATCH(DMI_BOARD_NAME, "Q1900DC-ITX"),
+ },
+ },
+
/* ASUS */
{ /* Handle problems with rebooting on ASUS P4S800 */
.callback = set_bios_reboot,
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 066/101] can: flexcan: fix bus-off error state handling.
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 065/101] x86/reboot: Add ASRock Q1900DC-ITX mainboard reboot quirk Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 067/101] can: flexcan: Deferred on Regulator return EPROBE_DEFER Greg Kroah-Hartman
` (33 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andri Yngvason, Marc Kleine-Budde
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andri Yngvason <andri.yngvason@marel.com>
commit 258ce80e19211f06c97a562a71308ec21a9ab98f upstream.
Making sure that the bus-off state gets passed to can_change_state().
Signed-off-by: Andri Yngvason <andri.yngvason@marel.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/flexcan.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -593,13 +593,12 @@ static int flexcan_poll_state(struct net
rx_state = unlikely(reg_esr & FLEXCAN_ESR_RX_WRN) ?
CAN_STATE_ERROR_WARNING : CAN_STATE_ERROR_ACTIVE;
new_state = max(tx_state, rx_state);
- } else if (unlikely(flt == FLEXCAN_ESR_FLT_CONF_PASSIVE)) {
+ } else {
__flexcan_get_berr_counter(dev, &bec);
- new_state = CAN_STATE_ERROR_PASSIVE;
+ new_state = flt == FLEXCAN_ESR_FLT_CONF_PASSIVE ?
+ CAN_STATE_ERROR_PASSIVE : CAN_STATE_BUS_OFF;
rx_state = bec.rxerr >= bec.txerr ? new_state : 0;
tx_state = bec.rxerr <= bec.txerr ? new_state : 0;
- } else {
- new_state = CAN_STATE_BUS_OFF;
}
/* state hasn't changed */
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 067/101] can: flexcan: Deferred on Regulator return EPROBE_DEFER
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 066/101] can: flexcan: fix bus-off error state handling Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 068/101] firmware: dmi_scan: Prevent dmi_num integer overflow Greg Kroah-Hartman
` (32 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreas Werner, Marc Kleine-Budde
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Werner <kernel@andy89.org>
commit 555828ef45f825d6ee06559f0304163550eed380 upstream.
Return EPROBE_DEFER if Regulator returns EPROBE_DEFER
If the Flexcan driver is built into kernel and a regulator is used to
enable the CAN transceiver, the Flexcan driver may not use the regulator.
When initializing the Flexcan device with a regulator defined in the device
tree, but not initialized, the regulator subsystem returns EPROBE_DEFER, hence
the Flexcan init fails.
The solution for this is to return EPROBE_DEFER if regulator is not initialized
and wait until the regulator is initialized.
Signed-off-by: Andreas Werner <kernel@andy89.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/flexcan.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1158,12 +1158,19 @@ static int flexcan_probe(struct platform
const struct flexcan_devtype_data *devtype_data;
struct net_device *dev;
struct flexcan_priv *priv;
+ struct regulator *reg_xceiver;
struct resource *mem;
struct clk *clk_ipg = NULL, *clk_per = NULL;
void __iomem *base;
int err, irq;
u32 clock_freq = 0;
+ reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
+ if (PTR_ERR(reg_xceiver) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+ else if (IS_ERR(reg_xceiver))
+ reg_xceiver = NULL;
+
if (pdev->dev.of_node)
of_property_read_u32(pdev->dev.of_node,
"clock-frequency", &clock_freq);
@@ -1225,9 +1232,7 @@ static int flexcan_probe(struct platform
priv->pdata = dev_get_platdata(&pdev->dev);
priv->devtype_data = devtype_data;
- priv->reg_xceiver = devm_regulator_get(&pdev->dev, "xceiver");
- if (IS_ERR(priv->reg_xceiver))
- priv->reg_xceiver = NULL;
+ priv->reg_xceiver = reg_xceiver;
netif_napi_add(dev, &priv->napi, flexcan_poll, FLEXCAN_NAPI_WEIGHT);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 068/101] firmware: dmi_scan: Prevent dmi_num integer overflow
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 067/101] can: flexcan: Deferred on Regulator return EPROBE_DEFER Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 069/101] cpuidle: remove state_count field from struct cpuidle_device Greg Kroah-Hartman
` (31 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jean Delvare, Matt Fleming,
Ivan Khoronzhuk, Ard Biesheuvel
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean Delvare <jdelvare@suse.de>
commit bfbaafae8519d82d10da6abe75f5766dd5b20475 upstream.
dmi_num is a u16, dmi_len is a u32, so this construct:
dmi_num = dmi_len / 4;
would result in an integer overflow for a DMI table larger than
256 kB. I've never see such a large table so far, but SMBIOS 3.0
makes it possible so maybe we'll see such tables in the future.
So instead of faking a structure count when the entry point does
not provide it, adjust the loop condition in dmi_table() to properly
deal with the case where dmi_num is not set.
This bug was introduced with the initial SMBIOS 3.0 support in commit
fc43026278b2 ("dmi: add support for SMBIOS 3.0 64-bit entry point").
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Cc: Matt Fleming <matt.fleming@intel.com>
Cc: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/dmi_scan.c | 22 +++++++---------------
1 file changed, 7 insertions(+), 15 deletions(-)
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -86,10 +86,13 @@ static void dmi_table(u8 *buf, u32 len,
int i = 0;
/*
- * Stop when we see all the items the table claimed to have
- * OR we run off the end of the table (also happens)
+ * Stop when we have seen all the items the table claimed to have
+ * (SMBIOS < 3.0 only) OR we reach an end-of-table marker OR we run
+ * off the end of the table (should never happen but sometimes does
+ * on bogus implementations.)
*/
- while ((i < num) && (data - buf + sizeof(struct dmi_header)) <= len) {
+ while ((!num || i < num) &&
+ (data - buf + sizeof(struct dmi_header)) <= len) {
const struct dmi_header *dm = (const struct dmi_header *)data;
/*
@@ -529,21 +532,10 @@ static int __init dmi_smbios3_present(co
if (memcmp(buf, "_SM3_", 5) == 0 &&
buf[6] < 32 && dmi_checksum(buf, buf[6])) {
dmi_ver = get_unaligned_be16(buf + 7);
+ dmi_num = 0; /* No longer specified */
dmi_len = get_unaligned_le32(buf + 12);
dmi_base = get_unaligned_le64(buf + 16);
- /*
- * The 64-bit SMBIOS 3.0 entry point no longer has a field
- * containing the number of structures present in the table.
- * Instead, it defines the table size as a maximum size, and
- * relies on the end-of-table structure type (#127) to be used
- * to signal the end of the table.
- * So let's define dmi_num as an upper bound as well: each
- * structure has a 4 byte header, so dmi_len / 4 is an upper
- * bound for the number of structures in the table.
- */
- dmi_num = dmi_len / 4;
-
if (dmi_walk_early(dmi_decode) == 0) {
pr_info("SMBIOS %d.%d present.\n",
dmi_ver >> 8, dmi_ver & 0xFF);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 069/101] cpuidle: remove state_count field from struct cpuidle_device
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 068/101] firmware: dmi_scan: Prevent dmi_num integer overflow Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 070/101] cpuidle: ACPI: do not overwrite name and description of C0 Greg Kroah-Hartman
` (30 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Schlichter,
Bartlomiej Zolnierkiewicz, Kyungmin Park, Daniel Lezcano,
Rafael J. Wysocki
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
commit d75e4af14e228bbe3f86e29bcecb8e6be98d4e04 upstream.
Thomas Schlichter reports the following issue on his Samsung NC20:
"The C-states C1 and C2 to the OS when connected to AC, and additionally
provides the C3 C-state when disconnected from AC. However, the number
of C-states shown in sysfs is fixed to the number of C-states present
at boot.
If I boot with AC connected, I always only see the C-states up to C2
even if I disconnect AC.
The reason is commit 130a5f692425 (ACPI / cpuidle: remove dev->state_count
setting). It removes the update of dev->state_count, but sysfs uses
exactly this variable to show the C-states.
The fix is to use drv->state_count in sysfs. As this is currently the
last user of dev->state_count, this variable can be completely removed."
Remove dev->state_count as per the above.
Reported-by: Thomas Schlichter <thomas.schlichter@web.de>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
[ rjw: Changelog ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpuidle/cpuidle.c | 3 ---
drivers/cpuidle/sysfs.c | 5 +++--
include/linux/cpuidle.h | 1 -
3 files changed, 3 insertions(+), 6 deletions(-)
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -297,9 +297,6 @@ int cpuidle_enable_device(struct cpuidle
if (!dev->registered)
return -EINVAL;
- if (!dev->state_count)
- dev->state_count = drv->state_count;
-
ret = cpuidle_add_device_sysfs(dev);
if (ret)
return ret;
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -401,7 +401,7 @@ static int cpuidle_add_state_sysfs(struc
struct cpuidle_driver *drv = cpuidle_get_cpu_driver(device);
/* state statistics */
- for (i = 0; i < device->state_count; i++) {
+ for (i = 0; i < drv->state_count; i++) {
kobj = kzalloc(sizeof(struct cpuidle_state_kobj), GFP_KERNEL);
if (!kobj)
goto error_state;
@@ -433,9 +433,10 @@ error_state:
*/
static void cpuidle_remove_state_sysfs(struct cpuidle_device *device)
{
+ struct cpuidle_driver *drv = cpuidle_get_cpu_driver(device);
int i;
- for (i = 0; i < device->state_count; i++)
+ for (i = 0; i < drv->state_count; i++)
cpuidle_free_state_kobj(device, i);
}
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -68,7 +68,6 @@ struct cpuidle_device {
unsigned int cpu;
int last_residency;
- int state_count;
struct cpuidle_state_usage states_usage[CPUIDLE_STATE_MAX];
struct cpuidle_state_kobj *kobjs[CPUIDLE_STATE_MAX];
struct cpuidle_driver_kobj *kobj_driver;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 070/101] cpuidle: ACPI: do not overwrite name and description of C0
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 069/101] cpuidle: remove state_count field from struct cpuidle_device Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:28 ` [PATCH 3.19 071/101] usb: xhci: handle Config Error Change (CEC) in xhci driver Greg Kroah-Hartman
` (29 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Schlichter,
Bartlomiej Zolnierkiewicz, Rafael J. Wysocki
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Schlichter <thomas.schlichter@web.de>
commit c7e8bdf5872c5a8f5a6494e16fe839c38a0d3d3d upstream.
Fix a bug that leads to showing the name and description of C-state C0
as "<null>" in sysfs after the ACPI C-states changed (e.g. after AC->DC
or DC->AC
transition).
The function poll_idle_init() in drivers/cpuidle/driver.c initializes the
state 0 during cpuidle_register_driver(), so we better do not overwrite it
again with '\0' during acpi_processor_cst_has_changed().
Signed-off-by: Thomas Schlichter <thomas.schlichter@web.de>
Reviewed-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/processor_idle.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -962,7 +962,7 @@ static int acpi_processor_setup_cpuidle_
return -EINVAL;
drv->safe_state_index = -1;
- for (i = 0; i < CPUIDLE_STATE_MAX; i++) {
+ for (i = CPUIDLE_DRIVER_STATE_START; i < CPUIDLE_STATE_MAX; i++) {
drv->states[i].name[0] = '\0';
drv->states[i].desc[0] = '\0';
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 071/101] usb: xhci: handle Config Error Change (CEC) in xhci driver
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 070/101] cpuidle: ACPI: do not overwrite name and description of C0 Greg Kroah-Hartman
@ 2015-04-17 13:28 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 072/101] usb: xhci: apply XHCI_AVOID_BEI quirk to all Intel xHCI controllers Greg Kroah-Hartman
` (28 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:28 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gregory CLEMENT, Lu Baolu,
Mathias Nyman
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <baolu.lu@linux.intel.com>
commit 9425183d177aa4a2f09d01a74925124f0778b595 upstream.
Linux xHCI driver doesn't report and handle port cofig error change.
If Port Configure Error for root hub port occurs, CEC bit in PORTSC
would be set by xHC and remains 1. This happends when the root port
fails to configure its link partner, e.g. the port fails to exchange
port capabilities information using Port Capability LMPs.
Then the Port Status Change Events will be blocked until all status
change bits(CEC is one of the change bits) are cleared('0') (refer to
xHCI spec 4.19.2). Otherwise, the port status change event for this
root port will not be generated anymore, then root port would look
like dead for user and can't be recovered until a Host Controller
Reset(HCRST).
This patch is to check CEC bit in PORTSC in xhci_get_port_status()
and set a Config Error in the return status if CEC is set. This will
cause a ClearPortFeature request, where CEC bit is cleared in
xhci_clear_port_change_bit().
[The commit log is based on initial Marvell patch posted at
http://marc.info/?l=linux-kernel&m=142323612321434&w=2]
Reported-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-hub.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -387,6 +387,10 @@ static void xhci_clear_port_change_bit(s
status = PORT_PLC;
port_change_bit = "link state";
break;
+ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
+ status = PORT_CEC;
+ port_change_bit = "config error";
+ break;
default:
/* Should never happen */
return;
@@ -588,6 +592,8 @@ static u32 xhci_get_port_status(struct u
status |= USB_PORT_STAT_C_LINK_STATE << 16;
if ((raw_port_status & PORT_WRC))
status |= USB_PORT_STAT_C_BH_RESET << 16;
+ if ((raw_port_status & PORT_CEC))
+ status |= USB_PORT_STAT_C_CONFIG_ERROR << 16;
}
if (hcd->speed != HCD_USB3) {
@@ -1005,6 +1011,7 @@ int xhci_hub_control(struct usb_hcd *hcd
case USB_PORT_FEAT_C_OVER_CURRENT:
case USB_PORT_FEAT_C_ENABLE:
case USB_PORT_FEAT_C_PORT_LINK_STATE:
+ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
xhci_clear_port_change_bit(xhci, wValue, wIndex,
port_array[wIndex], temp);
break;
@@ -1069,7 +1076,7 @@ int xhci_hub_status_data(struct usb_hcd
*/
status = bus_state->resuming_ports;
- mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC;
+ mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;
spin_lock_irqsave(&xhci->lock, flags);
/* For each port, did anything change? If so, set that bit in buf. */
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 072/101] usb: xhci: apply XHCI_AVOID_BEI quirk to all Intel xHCI controllers
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2015-04-17 13:28 ` [PATCH 3.19 071/101] usb: xhci: handle Config Error Change (CEC) in xhci driver Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 073/101] tty: serial: fsl_lpuart: specify transmit FIFO size Greg Kroah-Hartman
` (27 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lu Baolu, Alistair Grant,
Mathias Nyman
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <baolu.lu@linux.intel.com>
commit 227a4fd801c8a9fa2c4700ab98ec1aec06e3b44d upstream.
When a device with an isochronous endpoint is plugged into the Intel
xHCI host controller, and the driver submits multiple frames per URB,
the xHCI driver will set the Block Event Interrupt (BEI) flag on all
but the last TD for the URB. This causes the host controller to place
an event on the event ring, but not send an interrupt. When the last
TD for the URB completes, BEI is cleared, and we get an interrupt for
the whole URB.
However, under Intel xHCI host controllers, if the event ring is full
of events from transfers with BEI set, an "Event Ring is Full" event
will be posted to the last entry of the event ring, but no interrupt
is generated. Host will cease all transfer and command executions and
wait until software completes handling the pending events in the event
ring. That means xHC stops, but event of "event ring is full" is not
notified. As the result, the xHC looks like dead to user.
This patch is to apply XHCI_AVOID_BEI quirk to Intel xHC devices. And
it should be backported to kernels as old as 3.0, that contains the
commit 69e848c2090a ("Intel xhci: Support EHCI/xHCI port switching.").
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Tested-by: Alistair Grant <akgrant0710@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -115,6 +115,7 @@ static void xhci_pci_quirks(struct devic
if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
xhci->quirks |= XHCI_LPM_SUPPORT;
xhci->quirks |= XHCI_INTEL_HOST;
+ xhci->quirks |= XHCI_AVOID_BEI;
}
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
@@ -130,7 +131,6 @@ static void xhci_pci_quirks(struct devic
* PPT chipsets.
*/
xhci->quirks |= XHCI_SPURIOUS_REBOOT;
- xhci->quirks |= XHCI_AVOID_BEI;
}
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 073/101] tty: serial: fsl_lpuart: specify transmit FIFO size
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 072/101] usb: xhci: apply XHCI_AVOID_BEI quirk to all Intel xHCI controllers Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 074/101] tty: serial: fsl_lpuart: clear receive flag on FIFO flush Greg Kroah-Hartman
` (26 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Agner
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <stefan@agner.ch>
commit 4e8f245937091b2c9eebf3d4909c9ceda4f0a78e upstream.
Specify transmit FIFO size which might be different depending on
LPUART instance. This makes sure uart_wait_until_sent in serial
core getting called, which in turn waits and checks if the FIFO
is really empty on shutdown by using the tx_empty callback.
Without the call of this callback, the last several characters
might not yet be transmitted when closing the serial port. This
can be reproduced by simply using echo and redirect the output to
a ttyLP device.
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/fsl_lpuart.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1095,6 +1095,8 @@ static int lpuart_startup(struct uart_po
sport->txfifo_size = 0x1 << (((temp >> UARTPFIFO_TXSIZE_OFF) &
UARTPFIFO_FIFOSIZE_MASK) + 1);
+ sport->port.fifosize = sport->txfifo_size;
+
sport->rxfifo_size = 0x1 << (((temp >> UARTPFIFO_RXSIZE_OFF) &
UARTPFIFO_FIFOSIZE_MASK) + 1);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 074/101] tty: serial: fsl_lpuart: clear receive flag on FIFO flush
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 073/101] tty: serial: fsl_lpuart: specify transmit FIFO size Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 075/101] n_tty: Fix read buffer overwrite when no newline Greg Kroah-Hartman
` (25 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Agner
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <stefan@agner.ch>
commit 8e4934c6d6c659e22b1b746af4196683e77ce6ca upstream.
When the receiver was enabled during startup, a character could
have been in the FIFO when the UART get initially used. The
driver configures the (receive) watermark level, and flushes the
FIFO. However, the receive flag (RDRF) could still be set at that
stage (as mentioned in the register description of UARTx_RWFIFO).
This leads to an interrupt which won't be handled properly in
interrupt mode: The receive interrupt function lpuart_rxint checks
the FIFO count, which is 0 at that point (due to the flush
during initialization). The problem does not manifest when using
DMA to receive characters.
Fix this situation by explicitly read the status register, which
leads to clearing of the RDRF flag. Due to the flush just after
the status flag read, a explicit data read is not to required.
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/fsl_lpuart.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -910,6 +910,9 @@ static void lpuart_setup_watermark(struc
writeb(val | UARTPFIFO_TXFE | UARTPFIFO_RXFE,
sport->port.membase + UARTPFIFO);
+ /* explicitly clear RDRF */
+ readb(sport->port.membase + UARTSR1);
+
/* flush Tx and Rx FIFO */
writeb(UARTCFIFO_TXFLUSH | UARTCFIFO_RXFLUSH,
sport->port.membase + UARTCFIFO);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 075/101] n_tty: Fix read buffer overwrite when no newline
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 074/101] tty: serial: fsl_lpuart: clear receive flag on FIFO flush Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 076/101] cifs: smb2_clone_range() - exit on unhandled error Greg Kroah-Hartman
` (24 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Hurley, Joseph Salisbury
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <peter@hurleysoftware.com>
commit fb5ef9e7da39968fec6d6f37f20a23d23740c75e upstream.
In canon mode, the read buffer head will advance over the buffer tail
if the input > 4095 bytes without receiving a line termination char.
Discard additional input until a line termination is received.
Before evaluating for overflow, the 'room' value is normalized for
I_PARMRK and 1 byte is reserved for line termination (even in !icanon
mode, in case the mode is switched). The following table shows the
transform:
actual buffer | 'room' value before overflow calc
space avail | !I_PARMRK | I_PARMRK
--------------------------------------------------
0 | -1 | -1
1 | 0 | 0
2 | 1 | 0
3 | 2 | 0
4+ | 3 | 1
When !icanon or when icanon and the read buffer contains newlines,
normalized 'room' values of -1 and 0 are clamped to 0, and
'overflow' is 0, so read_head is not adjusted and the input i/o loop
exits (setting no_room if called from flush_to_ldisc()). No input
is discarded since the reader does have input available to read
which ensures forward progress.
When icanon and the read buffer does not contain newlines and the
normalized 'room' value is 0, then overflow and room are reset to 1,
so that the i/o loop will process the next input char normally
(except for parity errors which are ignored). Thus, erasures, signalling
chars, 7-bit mode, etc. will continue to be handled properly.
If the input char processed was not a line termination char, then
the canon_head index will not have advanced, so the normalized 'room'
value will now be -1 and 'overflow' will be set, which indicates the
read_head can safely be reset, effectively erasing the last char
processed.
If the input char processed was a line termination, then the
canon_head index will have advanced, so 'overflow' is cleared to 0,
the read_head is not reset, and 'room' is cleared to 0, which exits
the i/o loop (because the reader now have input available to read
which ensures forward progress).
Note that it is possible for a line termination to be received, and
for the reader to copy the line to the user buffer before the
input i/o loop is ready to process the next input char. This is
why the i/o loop recomputes the room/overflow state with every
input char while handling overflow.
Finally, if the input data was processed without receiving
a line termination (so that overflow is still set), the pty
driver must receive a write wakeup. A pty writer may be waiting
to write more data in n_tty_write() but without unthrottling
here that wakeup will not arrive, and forward progress will halt.
(Normally, the pty writer is woken when the reader reads data out
of the buffer and more space become available).
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(backported from commit fb5ef9e7da39968fec6d6f37f20a23d23740c75e)
Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
---
drivers/tty/n_tty.c | 106 ++++++++++++++++++++++++++++++++++++++--------------
1 file changed, 79 insertions(+), 27 deletions(-)
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -247,8 +247,6 @@ static void n_tty_write_wakeup(struct tt
static void n_tty_check_throttle(struct tty_struct *tty)
{
- if (tty->driver->type == TTY_DRIVER_TYPE_PTY)
- return;
/*
* Check the remaining room for the input canonicalization
* mode. We don't want to throttle the driver if we're in
@@ -1512,23 +1510,6 @@ n_tty_receive_char_lnext(struct tty_stru
n_tty_receive_char_flagged(tty, c, flag);
}
-/**
- * n_tty_receive_buf - data receive
- * @tty: terminal device
- * @cp: buffer
- * @fp: flag buffer
- * @count: characters
- *
- * Called by the terminal driver when a block of characters has
- * been received. This function must be called from soft contexts
- * not from interrupt context. The driver is responsible for making
- * calls one at a time and in order (or using flush_to_ldisc)
- *
- * n_tty_receive_buf()/producer path:
- * claims non-exclusive termios_rwsem
- * publishes read_head and canon_head
- */
-
static void
n_tty_receive_buf_real_raw(struct tty_struct *tty, const unsigned char *cp,
char *fp, int count)
@@ -1684,24 +1665,85 @@ static void __receive_buf(struct tty_str
}
}
+/**
+ * n_tty_receive_buf_common - process input
+ * @tty: device to receive input
+ * @cp: input chars
+ * @fp: flags for each char (if NULL, all chars are TTY_NORMAL)
+ * @count: number of input chars in @cp
+ *
+ * Called by the terminal driver when a block of characters has
+ * been received. This function must be called from soft contexts
+ * not from interrupt context. The driver is responsible for making
+ * calls one at a time and in order (or using flush_to_ldisc)
+ *
+ * Returns the # of input chars from @cp which were processed.
+ *
+ * In canonical mode, the maximum line length is 4096 chars (including
+ * the line termination char); lines longer than 4096 chars are
+ * truncated. After 4095 chars, input data is still processed but
+ * not stored. Overflow processing ensures the tty can always
+ * receive more input until at least one line can be read.
+ *
+ * In non-canonical mode, the read buffer will only accept 4095 chars;
+ * this provides the necessary space for a newline char if the input
+ * mode is switched to canonical.
+ *
+ * Note it is possible for the read buffer to _contain_ 4096 chars
+ * in non-canonical mode: the read buffer could already contain the
+ * maximum canon line of 4096 chars when the mode is switched to
+ * non-canonical.
+ *
+ * n_tty_receive_buf()/producer path:
+ * claims non-exclusive termios_rwsem
+ * publishes commit_head or canon_head
+ */
static int
n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
char *fp, int count, int flow)
{
struct n_tty_data *ldata = tty->disc_data;
- int room, n, rcvd = 0;
+ int room, n, rcvd = 0, overflow;
down_read(&tty->termios_rwsem);
while (1) {
- room = receive_room(tty);
+ /*
+ * When PARMRK is set, each input char may take up to 3 chars
+ * in the read buf; reduce the buffer space avail by 3x
+ *
+ * If we are doing input canonicalization, and there are no
+ * pending newlines, let characters through without limit, so
+ * that erase characters will be handled. Other excess
+ * characters will be beeped.
+ *
+ * paired with store in *_copy_from_read_buf() -- guarantees
+ * the consumer has loaded the data in read_buf up to the new
+ * read_tail (so this producer will not overwrite unread data)
+ */
+ size_t tail = ldata->read_tail;
+
+ room = N_TTY_BUF_SIZE - (ldata->read_head - tail);
+ if (I_PARMRK(tty))
+ room = (room + 2) / 3;
+ room--;
+ if (room <= 0) {
+ overflow = ldata->icanon && ldata->canon_head == tail;
+ if (overflow && room < 0)
+ ldata->read_head--;
+ room = overflow;
+ ldata->no_room = flow && !room;
+ } else
+ overflow = 0;
+
n = min(count, room);
- if (!n) {
- if (flow && !room)
- ldata->no_room = 1;
+ if (!n)
break;
- }
- __receive_buf(tty, cp, fp, n);
+
+ /* ignore parity errors if handling overflow */
+ if (!overflow || !fp || *fp != TTY_PARITY)
+ __receive_buf(tty, cp, fp, n);
+
cp += n;
if (fp)
fp += n;
@@ -1710,7 +1752,17 @@ n_tty_receive_buf_common(struct tty_stru
}
tty->receive_room = room;
- n_tty_check_throttle(tty);
+
+ /* Unthrottle if handling overflow on pty */
+ if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
+ if (overflow) {
+ tty_set_flow_change(tty, TTY_UNTHROTTLE_SAFE);
+ tty_unthrottle_safe(tty);
+ __tty_set_flow_change(tty, 0);
+ }
+ } else
+ n_tty_check_throttle(tty);
+
up_read(&tty->termios_rwsem);
return rcvd;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 076/101] cifs: smb2_clone_range() - exit on unhandled error
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 075/101] n_tty: Fix read buffer overwrite when no newline Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 077/101] cifs: fix use-after-free bug in find_writable_file Greg Kroah-Hartman
` (23 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sachin Prabhu, Steve French,
Steve French
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sachin Prabhu <sprabhu@redhat.com>
commit 2477bc58d49edb1c0baf59df7dc093dce682af2b upstream.
While attempting to clone a file on a samba server, we receive a
STATUS_INVALID_DEVICE_REQUEST. This is mapped to -EOPNOTSUPP which
isn't handled in smb2_clone_range(). We end up looping in the while loop
making same call to the samba server over and over again.
The proposed fix is to exit and return the error value when encountered
with an unhandled error.
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Signed-off-by: Steve French <steve.french@primarydata.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2ops.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -684,7 +684,8 @@ smb2_clone_range(const unsigned int xid,
/* No need to change MaxChunks since already set to 1 */
chunk_sizes_updated = true;
- }
+ } else
+ goto cchunk_out;
}
cchunk_out:
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 077/101] cifs: fix use-after-free bug in find_writable_file
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 076/101] cifs: smb2_clone_range() - exit on unhandled error Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 078/101] brcmfmac: disable MBSS feature for BCM43362 Greg Kroah-Hartman
` (22 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Disseldorp, Jeff Layton,
Steve French
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Disseldorp <ddiss@suse.de>
commit e1e9bda22d7ddf88515e8fe401887e313922823e upstream.
Under intermittent network outages, find_writable_file() is susceptible
to the following race condition, which results in a user-after-free in
the cifs_writepages code-path:
Thread 1 Thread 2
======== ========
inv_file = NULL
refind = 0
spin_lock(&cifs_file_list_lock)
// invalidHandle found on openFileList
inv_file = open_file
// inv_file->count currently 1
cifsFileInfo_get(inv_file)
// inv_file->count = 2
spin_unlock(&cifs_file_list_lock);
cifs_reopen_file() cifs_close()
// fails (rc != 0) ->cifsFileInfo_put()
spin_lock(&cifs_file_list_lock)
// inv_file->count = 1
spin_unlock(&cifs_file_list_lock)
spin_lock(&cifs_file_list_lock);
list_move_tail(&inv_file->flist,
&cifs_inode->openFileList);
spin_unlock(&cifs_file_list_lock);
cifsFileInfo_put(inv_file);
->spin_lock(&cifs_file_list_lock)
// inv_file->count = 0
list_del(&cifs_file->flist);
// cleanup!!
kfree(cifs_file);
spin_unlock(&cifs_file_list_lock);
spin_lock(&cifs_file_list_lock);
++refind;
// refind = 1
goto refind_writable;
At this point we loop back through with an invalid inv_file pointer
and a refind value of 1. On second pass, inv_file is not overwritten on
openFileList traversal, and is subsequently dereferenced.
Signed-off-by: David Disseldorp <ddiss@suse.de>
Reviewed-by: Jeff Layton <jlayton@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/file.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1829,6 +1829,7 @@ refind_writable:
cifsFileInfo_put(inv_file);
spin_lock(&cifs_file_list_lock);
++refind;
+ inv_file = NULL;
goto refind_writable;
}
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 078/101] brcmfmac: disable MBSS feature for BCM43362
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 077/101] cifs: fix use-after-free bug in find_writable_file Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 079/101] iommu/vt-d: Detach domain *only* from attached iommus Greg Kroah-Hartman
` (21 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jorg Krause, Hante Meuleman,
Pieter-Paul Giesberts, Arend van Spriel, Kalle Valo
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arend van Spriel <arend@broadcom.com>
commit f93a25b38cbd840f26c9fd2dd8a6611a57b259b7 upstream.
The BCM43362 firmware falsely reports it is capable of providing
MBSS. As a result AP mode no longer works for this device. Therefor
disable MBSS in the driver for this chipset.
Reported-by: Jorg Krause <jkrause@posteo.de>
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/brcm80211/brcmfmac/feature.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/feature.c
@@ -126,7 +126,8 @@ void brcmf_feat_attach(struct brcmf_pub
brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_MCHAN, "mchan");
if (drvr->bus_if->wowl_supported)
brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
- brcmf_feat_iovar_int_set(ifp, BRCMF_FEAT_MBSS, "mbss", 0);
+ if (drvr->bus_if->chip != BRCM_CC_43362_CHIP_ID)
+ brcmf_feat_iovar_int_set(ifp, BRCMF_FEAT_MBSS, "mbss", 0);
/* set chip related quirks */
switch (drvr->bus_if->chip) {
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 079/101] iommu/vt-d: Detach domain *only* from attached iommus
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 078/101] brcmfmac: disable MBSS feature for BCM43362 Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 080/101] rtlwifi: Fix IOMMU mapping leak in AP mode Greg Kroah-Hartman
` (20 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Williamson, Jiang Liu,
Joerg Roedel
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <alex.williamson@redhat.com>
commit 71684406905f98f86a85e008b51f5c4c5d83af5a upstream.
Device domains never span IOMMU hardware units, which allows the
domain ID space for each IOMMU to be an independent address space.
Therefore we can have multiple, independent domains, each with the
same domain->id, but attached to different hardware units. This is
also why we need to do a heavy-weight search for VM domains since
they can span multiple IOMMUs hardware units and we don't require a
single global ID to use for all hardware units.
Therefore, if we call iommu_detach_domain() across all active IOMMU
hardware units for a non-VM domain, the result is that we clear domain
IDs that are not associated with our domain, allowing them to be
re-allocated and causing apparent coherency issues when the device
cannot access IOVAs for the intended domain.
This bug was introduced in commit fb170fb4c548 ("iommu/vt-d: Introduce
helper functions to make code symmetric for readability"), but is
significantly exacerbated by the more recent commit 62c22167dd70
("iommu/vt-d: Fix dmar_domain leak in iommu_attach_device") which calls
domain_exit() more frequently to resolve a domain leak.
Fixes: fb170fb4c548 ("iommu/vt-d: Introduce helper functions to make code symmetric for readability")
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Cc: Jiang Liu <jiang.liu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel-iommu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1749,8 +1749,8 @@ static int domain_init(struct dmar_domai
static void domain_exit(struct dmar_domain *domain)
{
struct dmar_drhd_unit *drhd;
- struct intel_iommu *iommu;
struct page *freelist = NULL;
+ int i;
/* Domain 0 is reserved, so dont process it */
if (!domain)
@@ -1770,8 +1770,8 @@ static void domain_exit(struct dmar_doma
/* clear attached or cached domains */
rcu_read_lock();
- for_each_active_iommu(iommu, drhd)
- iommu_detach_domain(domain, iommu);
+ for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
+ iommu_detach_domain(domain, g_iommus[i]);
rcu_read_unlock();
dma_free_pagelist(freelist);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 080/101] rtlwifi: Fix IOMMU mapping leak in AP mode
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 079/101] iommu/vt-d: Detach domain *only* from attached iommus Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 081/101] drivers/of: Add empty ranges quirk for PA-Semi Greg Kroah-Hartman
` (19 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kevin Mullican, Shao Fu, Larry Finger,
Kalle Valo
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <Larry.Finger@lwfinger.net>
commit be0b5e635883678bfbc695889772fed545f3427d upstream.
Transmission of an AP beacon does not call the TX interrupt service routine,
which usually does the cleanup. Instead, cleanup is handled in a tasklet
completion routine. Unfortunately, this routine has a serious bug in that it does
not release the DMA mapping before it frees the skb, thus one IOMMU mapping is
leaked for each beacon. The test system failed with no free IOMMU mapping slots
approximately one hour after hostapd was used to start an AP.
This issue was reported and tested at https://github.com/lwfinger/rtlwifi_new/issues/30.
Reported-and-tested-by: Kevin Mullican <kevin@mullican.com>
Cc: Kevin Mullican <kevin@mullican.com>
Signed-off-by: Shao Fu <shaofu@realtek.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rtlwifi/pci.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -1118,12 +1118,22 @@ static void _rtl_pci_prepare_bcn_tasklet
/*This is for new trx flow*/
struct rtl_tx_buffer_desc *pbuffer_desc = NULL;
u8 temp_one = 1;
+ u8 *entry;
memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
ring = &rtlpci->tx_ring[BEACON_QUEUE];
pskb = __skb_dequeue(&ring->queue);
- if (pskb)
+ if (rtlpriv->use_new_trx_flow)
+ entry = (u8 *)(&ring->buffer_desc[ring->idx]);
+ else
+ entry = (u8 *)(&ring->desc[ring->idx]);
+ if (pskb) {
+ pci_unmap_single(rtlpci->pdev,
+ rtlpriv->cfg->ops->get_desc(
+ (u8 *)entry, true, HW_DESC_TXBUFF_ADDR),
+ pskb->len, PCI_DMA_TODEVICE);
kfree_skb(pskb);
+ }
/*NB: the beacon data buffer must be 32-bit aligned. */
pskb = ieee80211_beacon_get(hw, mac->vif);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 081/101] drivers/of: Add empty ranges quirk for PA-Semi
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 080/101] rtlwifi: Fix IOMMU mapping leak in AP mode Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 082/101] Revert "PM / hibernate: avoid unsafe pages in e820 reserved regions" Greg Kroah-Hartman
` (18 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Steven Rostedt,
Benjamin Herrenschmidt, Grant Likely
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
commit 41d9489319f28f06cf51731131bc353d5a6bce59 upstream.
The "sdc" node is missing the ranges property, it needs to be treated
as having an empty one otherwise translation fails for its children.
Fixes 746c9e9f92dd, "of/base: Fix PowerPC address parsing hack"
Tested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/address.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -450,12 +450,17 @@ static struct of_bus *of_match_bus(struc
return NULL;
}
-static int of_empty_ranges_quirk(void)
+static int of_empty_ranges_quirk(struct device_node *np)
{
if (IS_ENABLED(CONFIG_PPC)) {
- /* To save cycles, we cache the result */
+ /* To save cycles, we cache the result for global "Mac" setting */
static int quirk_state = -1;
+ /* PA-SEMI sdc DT bug */
+ if (of_device_is_compatible(np, "1682m-sdc"))
+ return true;
+
+ /* Make quirk cached */
if (quirk_state < 0)
quirk_state =
of_machine_is_compatible("Power Macintosh") ||
@@ -490,7 +495,7 @@ static int of_translate_one(struct devic
* This code is only enabled on powerpc. --gcl
*/
ranges = of_get_property(parent, rprop, &rlen);
- if (ranges == NULL && !of_empty_ranges_quirk()) {
+ if (ranges == NULL && !of_empty_ranges_quirk(parent)) {
pr_debug("OF: no ranges; cannot translate\n");
return 1;
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 082/101] Revert "PM / hibernate: avoid unsafe pages in e820 reserved regions"
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 081/101] drivers/of: Add empty ranges quirk for PA-Semi Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 083/101] Revert "libceph: use memalloc flags for net IO" Greg Kroah-Hartman
` (17 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, rhn, Rafael J. Wysocki
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
commit f82daee49c09cf6a99c28303d93438a2566e5552 upstream.
Commit 84c91b7ae07c (PM / hibernate: avoid unsafe pages in e820 reserved
regions) is reported to make resume from hibernation on Lenovo x230
unreliable, so revert it.
We will revisit the issue the commit in question was supposed to fix
in the future.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=96111
Reported-by: rhn <kebuac.rhn@porcupinefactory.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/power/snapshot.c | 21 +--------------------
1 file changed, 1 insertion(+), 20 deletions(-)
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -955,25 +955,6 @@ static void mark_nosave_pages(struct mem
}
}
-static bool is_nosave_page(unsigned long pfn)
-{
- struct nosave_region *region;
-
- list_for_each_entry(region, &nosave_regions, list) {
- if (pfn >= region->start_pfn && pfn < region->end_pfn) {
- pr_err("PM: %#010llx in e820 nosave region: "
- "[mem %#010llx-%#010llx]\n",
- (unsigned long long) pfn << PAGE_SHIFT,
- (unsigned long long) region->start_pfn << PAGE_SHIFT,
- ((unsigned long long) region->end_pfn << PAGE_SHIFT)
- - 1);
- return true;
- }
- }
-
- return false;
-}
-
/**
* create_basic_memory_bitmaps - create bitmaps needed for marking page
* frames that should not be saved and free page frames. The pointers
@@ -2039,7 +2020,7 @@ static int mark_unsafe_pages(struct memo
do {
pfn = memory_bm_next_pfn(bm);
if (likely(pfn != BM_END_OF_MAP)) {
- if (likely(pfn_valid(pfn)) && !is_nosave_page(pfn))
+ if (likely(pfn_valid(pfn)))
swsusp_set_page_free(pfn_to_page(pfn));
else
return -EFAULT;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 083/101] Revert "libceph: use memalloc flags for net IO"
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 082/101] Revert "PM / hibernate: avoid unsafe pages in e820 reserved regions" Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 084/101] be2iscsi: Fix kernel panic when device initialization fails Greg Kroah-Hartman
` (16 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Christie, Mel Gorman, Sage Weil,
Ilya Dryomov
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <idryomov@gmail.com>
commit 6d7fdb0ab351b33d4c12d53fe44be030b90fc9d4 upstream.
This reverts commit 89baaa570ab0b476db09408d209578cfed700e9f.
Dirty page throttling should be sufficient for us in the general case
so there is no need to use __GFP_MEMALLOC - it would be needed only in
the swap-over-rbd case, which we currently don't support. (It would
probably take approximately the commit that is being reverted to add
that support, but we would also need the "swap" option to distinguish
from the general case and make sure swap ceph_client-s aren't shared
with anything else.) See ceph-devel threads [1] and [2] for the
details of why enabling pfmemalloc reserves for all cases is a bad
thing.
On top of potential system lockups related to drained emergency
reserves, this turned out to cause ceph lockups in case peers are on
the same host and communicating via loopback due to sk_filter()
dropping pfmemalloc skbs on the receiving side because the receiving
loopback socket is not tagged with SOCK_MEMALLOC.
[1] "SOCK_MEMALLOC vs loopback"
http://www.spinics.net/lists/ceph-devel/msg22998.html
[2] "[PATCH] libceph: don't set memalloc flags in loopback case"
http://www.spinics.net/lists/ceph-devel/msg23392.html
Conflicts:
net/ceph/messenger.c [ context: tcp_nodelay option ]
Cc: Mike Christie <michaelc@cs.wisc.edu>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Sage Weil <sage@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Acked-by: Mike Christie <michaelc@cs.wisc.edu>
Acked-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/messenger.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -484,7 +484,7 @@ static int ceph_tcp_connect(struct ceph_
IPPROTO_TCP, &sock);
if (ret)
return ret;
- sock->sk->sk_allocation = GFP_NOFS | __GFP_MEMALLOC;
+ sock->sk->sk_allocation = GFP_NOFS;
#ifdef CONFIG_LOCKDEP
lockdep_set_class(&sock->sk->sk_lock, &socket_class);
@@ -510,8 +510,6 @@ static int ceph_tcp_connect(struct ceph_
return ret;
}
- sk_set_memalloc(sock->sk);
-
con->sock = sock;
return 0;
}
@@ -2798,11 +2796,8 @@ static void con_work(struct work_struct
{
struct ceph_connection *con = container_of(work, struct ceph_connection,
work.work);
- unsigned long pflags = current->flags;
bool fault;
- current->flags |= PF_MEMALLOC;
-
mutex_lock(&con->mutex);
while (true) {
int ret;
@@ -2856,8 +2851,6 @@ static void con_work(struct work_struct
con_fault_finish(con);
con->ops->put(con);
-
- tsk_restore_flags(current, pflags, PF_MEMALLOC);
}
/*
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 084/101] be2iscsi: Fix kernel panic when device initialization fails
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 083/101] Revert "libceph: use memalloc flags for net IO" Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 085/101] ocfs2: _really_ sync the right range Greg Kroah-Hartman
` (15 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, John Soni Jose, Mike Christie,
James Bottomley
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Soni Jose <sony.john-n@emulex.com>
commit 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 upstream.
Kernel panic was happening as iscsi_host_remove() was called on
a host which was not yet added.
Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/be2iscsi/be_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -5735,9 +5735,9 @@ free_port:
hba_free:
if (phba->msix_enabled)
pci_disable_msix(phba->pcidev);
- iscsi_host_remove(phba->shost);
pci_dev_put(phba->pcidev);
iscsi_host_free(phba->shost);
+ pci_set_drvdata(pcidev, NULL);
disable_pci:
pci_disable_device(pcidev);
return ret;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 085/101] ocfs2: _really_ sync the right range
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 084/101] be2iscsi: Fix kernel panic when device initialization fails Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 086/101] ioctx_alloc(): fix vma (and file) leak on failure Greg Kroah-Hartman
` (14 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a upstream.
"ocfs2 syncs the wrong range" had been broken; prior to it the
code was doing the wrong thing in case of O_APPEND, all right,
but _after_ it we were syncing the wrong range in 100% cases.
*ppos, aka iocb->ki_pos is incremented prior to that point,
so we are always doing sync on the area _after_ the one we'd
written to.
Spotted by Joseph Qi <joseph.qi@huawei.com> back in January;
unfortunately, I'd missed his mail back then ;-/
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/file.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -2374,10 +2374,14 @@ out_dio:
/* buffered aio wouldn't have proper lock coverage today */
BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
+ if (unlikely(written <= 0))
+ goto no_sync;
+
if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
((file->f_flags & O_DIRECT) && !direct_io)) {
- ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
- *ppos + count - 1);
+ ret = filemap_fdatawrite_range(file->f_mapping,
+ iocb->ki_pos - written,
+ iocb->ki_pos - 1);
if (ret < 0)
written = ret;
@@ -2388,10 +2392,12 @@ out_dio:
}
if (!ret)
- ret = filemap_fdatawait_range(file->f_mapping, *ppos,
- *ppos + count - 1);
+ ret = filemap_fdatawait_range(file->f_mapping,
+ iocb->ki_pos - written,
+ iocb->ki_pos - 1);
}
+no_sync:
/*
* deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
* function pointer which is called when o_direct io completes so that
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 086/101] ioctx_alloc(): fix vma (and file) leak on failure
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 085/101] ocfs2: _really_ sync the right range Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 087/101] iscsi target: fix oops when adding reject pdu Greg Kroah-Hartman
` (13 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit deeb8525f9bcea60f5e86521880c1161de7a5829 upstream.
If we fail past the aio_setup_ring(), we need to destroy the
mapping. We don't need to care about anybody having found ctx,
or added requests to it, since the last failure exit is exactly
the failure to make ctx visible to lookups.
Reproducer (based on one by Joe Mario <jmario@redhat.com>):
void count(char *p)
{
char s[80];
printf("%s: ", p);
fflush(stdout);
sprintf(s, "/bin/cat /proc/%d/maps|/bin/fgrep -c '/[aio] (deleted)'", getpid());
system(s);
}
int main()
{
io_context_t *ctx;
int created, limit, i, destroyed;
FILE *f;
count("before");
if ((f = fopen("/proc/sys/fs/aio-max-nr", "r")) == NULL)
perror("opening aio-max-nr");
else if (fscanf(f, "%d", &limit) != 1)
fprintf(stderr, "can't parse aio-max-nr\n");
else if ((ctx = calloc(limit, sizeof(io_context_t))) == NULL)
perror("allocating aio_context_t array");
else {
for (i = 0, created = 0; i < limit; i++) {
if (io_setup(1000, ctx + created) == 0)
created++;
}
for (i = 0, destroyed = 0; i < created; i++)
if (io_destroy(ctx[i]) == 0)
destroyed++;
printf("created %d, failed %d, destroyed %d\n",
created, limit - created, destroyed);
count("after");
}
}
Found-by: Joe Mario <jmario@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/aio.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -740,6 +740,9 @@ static struct kioctx *ioctx_alloc(unsign
err_cleanup:
aio_nr_sub(ctx->max_reqs);
err_ctx:
+ atomic_set(&ctx->dead, 1);
+ if (ctx->mmap_size)
+ vm_munmap(ctx->mmap_base, ctx->mmap_size);
aio_free_ring(ctx);
err:
mutex_unlock(&ctx->ring_lock);
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 087/101] iscsi target: fix oops when adding reject pdu
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 086/101] ioctx_alloc(): fix vma (and file) leak on failure Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 088/101] [media] sh_veu: v4l2_dev wasnt set Greg Kroah-Hartman
` (12 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Christie, Nicholas Bellinger
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <michaelc@cs.wisc.edu>
commit b815fc12d4dd2b5586184fb4f867caff05a810d4 upstream.
This fixes a oops due to a double list add when adding a reject PDU for
iscsit_allocate_iovecs allocation failures. The cmd has already been
added to the conn_cmd_list in iscsit_setup_scsi_cmd, so this has us call
iscsit_reject_cmd.
Note that for ERL0 the reject PDU is not actually sent, so this patch
is not completely tested. Just verified we do not oops. The problem is the
add reject functions return -1 which is returned all the way up to
iscsi_target_rx_thread which for ERL0 will drop the connection.
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/iscsi/iscsi_target.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1185,7 +1185,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn
* traditional iSCSI block I/O.
*/
if (iscsit_allocate_iovecs(cmd) < 0) {
- return iscsit_add_reject_cmd(cmd,
+ return iscsit_reject_cmd(cmd,
ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
}
immed_data = cmd->immediate_data;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 088/101] [media] sh_veu: v4l2_dev wasnt set
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 087/101] iscsi target: fix oops when adding reject pdu Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 089/101] [media] media: s5p-mfc: fix mmap support for 64bit arch Greg Kroah-Hartman
` (11 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Mauro Carvalho Chehab
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hverkuil@xs4all.nl>
commit ab3120300be067a2d41a027c41db0b2c662ab200 upstream.
The v4l2_dev field of struct video_device must be set correctly.
This was never done for this driver, so no video nodes were created
anymore.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/sh_veu.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/platform/sh_veu.c
+++ b/drivers/media/platform/sh_veu.c
@@ -1179,6 +1179,7 @@ static int sh_veu_probe(struct platform_
}
*vdev = sh_veu_videodev;
+ vdev->v4l2_dev = &veu->v4l2_dev;
spin_lock_init(&veu->lock);
mutex_init(&veu->fop_lock);
vdev->lock = &veu->fop_lock;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 089/101] [media] media: s5p-mfc: fix mmap support for 64bit arch
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 088/101] [media] sh_veu: v4l2_dev wasnt set Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 090/101] [media] cx23885: fix querycap Greg Kroah-Hartman
` (10 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Kamil Debski,
Mauro Carvalho Chehab
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
commit 05b676ab42f624425d5f6519276e506b812fa058 upstream.
TASK_SIZE is depends on the systems architecture (32 or 64 bits) and it
should not be used for defining offset boundary for mmaping buffers for
CAPTURE and OUTPUT queues. This patch fixes support for MMAP calls on
the CAPTURE queue on 64bit architectures (like ARM64).
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Kamil Debski <k.debski@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/s5p-mfc/s5p_mfc_common.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
@@ -29,7 +29,7 @@
/* Offset base used to differentiate between CAPTURE and OUTPUT
* while mmaping */
-#define DST_QUEUE_OFF_BASE (TASK_SIZE / 2)
+#define DST_QUEUE_OFF_BASE (1 << 30)
#define MFC_BANK1_ALLOC_CTX 0
#define MFC_BANK2_ALLOC_CTX 1
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 090/101] [media] cx23885: fix querycap
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 089/101] [media] media: s5p-mfc: fix mmap support for 64bit arch Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 091/101] [media] soc-camera: Fix devm_kfree() in soc_of_bind() Greg Kroah-Hartman
` (9 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joseph Jasi, Hans Verkuil,
Mauro Carvalho Chehab
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hverkuil@xs4all.nl>
commit 6b46211f0a3b18b2360275ac29c4d6bfdf7bc015 upstream.
cap->device_caps wasn't set in cx23885-417.c causing a warning from
the v4l2-core.
Reported-by: Joseph Jasi <joe.yasi@gmail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/cx23885/cx23885-417.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--- a/drivers/media/pci/cx23885/cx23885-417.c
+++ b/drivers/media/pci/cx23885/cx23885-417.c
@@ -1339,14 +1339,13 @@ static int vidioc_querycap(struct file *
strlcpy(cap->driver, dev->name, sizeof(cap->driver));
strlcpy(cap->card, cx23885_boards[tsport->dev->board].name,
sizeof(cap->card));
- sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci));
- cap->capabilities =
- V4L2_CAP_VIDEO_CAPTURE |
- V4L2_CAP_READWRITE |
- V4L2_CAP_STREAMING |
- 0;
+ sprintf(cap->bus_info, "PCIe:%s", pci_name(dev->pci));
+ cap->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_READWRITE |
+ V4L2_CAP_STREAMING;
if (dev->tuner_type != TUNER_ABSENT)
- cap->capabilities |= V4L2_CAP_TUNER;
+ cap->device_caps |= V4L2_CAP_TUNER;
+ cap->capabilities = cap->device_caps | V4L2_CAP_VBI_CAPTURE |
+ V4L2_CAP_AUDIO | V4L2_CAP_DEVICE_CAPS;
return 0;
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 091/101] [media] soc-camera: Fix devm_kfree() in soc_of_bind()
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 090/101] [media] cx23885: fix querycap Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 092/101] [media] vb2: Fix dma_dir setting for dma-contig mem type Greg Kroah-Hartman
` (8 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven,
Guennadi Liakhovetski, Mauro Carvalho Chehab
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
commit 8e48a2d54c5d74ea3e9dc4c3b9037786bb447f36 upstream.
Unlike scan_async_group(), soc_of_bind() doesn't allocate its
soc_camera_async_client structure using devm_kzalloc(), but has it
embedded inside the soc_of_info structure. Hence on failure, it must
free the whole soc_of_info structure, and not just the embedded
soc_camera_async_client structure, as the latter causes a warning, and
may cause slab corruption:
soc-camera-pdrv soc-camera-pdrv.0: Probing soc-camera-pdrv.0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1 at drivers/base/devres.c:887 devm_kfree+0x30/0x40()
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.19.0-shmobile-08386-g37feb0d093cb2d8e #128
Hardware name: Generic R8A7791 (Flattened Device Tree)
Backtrace:
[<c0011e7c>] (dump_backtrace) from [<c0012024>] (show_stack+0x18/0x1c)
r6:c05a923b r5:00000009 r4:00000000 r3:00204140
[<c001200c>] (show_stack) from [<c048ed30>] (dump_stack+0x78/0x94)
[<c048ecb8>] (dump_stack) from [<c002687c>] (warn_slowpath_common+0x8c/0xb8)
r4:00000000 r3:00000000
[<c00267f0>] (warn_slowpath_common) from [<c0026980>] (warn_slowpath_null+0x24/0x2c)
r8:ee7d8214 r7:ed83b810 r6:ed83bc20 r5:fffffffa r4:ed83e510
[<c002695c>] (warn_slowpath_null) from [<c025e0cc>] (devm_kfree+0x30/0x40)
[<c025e09c>] (devm_kfree) from [<c032bbf4>] (soc_of_bind.isra.14+0x194/0x1d4)
[<c032ba60>] (soc_of_bind.isra.14) from [<c032c6b8>] (soc_camera_host_register+0x208/0x31c)
r9:00000070 r8:ee7e05d0 r7:ee153210 r6:00000000 r5:ee7e0218 r4:ed83bc20
[<c032c4b0>] (soc_camera_host_register) from [<c032e80c>] (rcar_vin_probe+0x1f4/0x238)
r8:ee153200 r7:00000008 r6:ee153210 r5:ed83bc10 r4:c066319c r3:000000c0
[<c032e618>] (rcar_vin_probe) from [<c025c334>] (platform_drv_probe+0x50/0xa0)
r10:00000000 r9:c0662fa8 r8:00000000 r7:c06a3700 r6:c0662fa8 r5:ee153210
r4:00000000
[<c025c2e4>] (platform_drv_probe) from [<c025af08>] (driver_probe_device+0xc4/0x208)
r6:c06a36f4 r5:00000000 r4:ee153210 r3:c025c2e4
[<c025ae44>] (driver_probe_device) from [<c025b108>] (__driver_attach+0x70/0x94)
r9:c066f9c0 r8:c0624a98 r7:c065b790 r6:c0662fa8 r5:ee153244 r4:ee153210
[<c025b098>] (__driver_attach) from [<c025984c>] (bus_for_each_dev+0x74/0x98)
r6:c025b098 r5:c0662fa8 r4:00000000 r3:00000001
[<c02597d8>] (bus_for_each_dev) from [<c025b1dc>] (driver_attach+0x20/0x28)
r6:ed83c200 r5:00000000 r4:c0662fa8
[<c025b1bc>] (driver_attach) from [<c025a00c>] (bus_add_driver+0xdc/0x1c4)
[<c0259f30>] (bus_add_driver) from [<c025b8f4>] (driver_register+0xa4/0xe8)
r7:c0624a98 r6:00000000 r5:c060b010 r4:c0662fa8
[<c025b850>] (driver_register) from [<c025ccd0>] (__platform_driver_register+0x50/0x64)
r5:c060b010 r4:ed8394c0
[<c025cc80>] (__platform_driver_register) from [<c060b028>] (rcar_vin_driver_init+0x18/0x20)
[<c060b010>] (rcar_vin_driver_init) from [<c05edde8>] (do_one_initcall+0x108/0x1b8)
[<c05edce0>] (do_one_initcall) from [<c05edfb4>] (kernel_init_freeable+0x11c/0x1e4)
r9:c066f9c0 r8:c066f9c0 r7:c062eab0 r6:c06252c4 r5:000000ad r4:00000006
[<c05ede98>] (kernel_init_freeable) from [<c048c3d0>] (kernel_init+0x10/0xec)
r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:c048c3c0 r4:00000000
[<c048c3c0>] (kernel_init) from [<c000eba0>] (ret_from_fork+0x14/0x34)
r4:00000000 r3:ee04e000
---[ end trace e3a984cc0335c8a0 ]---
rcar_vin e6ef1000.video: group probe failed: -6
Fixes: 1ddc6a6caa94e1e1 ("[media] soc_camera: add support for dt binding soc_camera drivers")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/soc_camera/soc_camera.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/soc_camera/soc_camera.c
+++ b/drivers/media/platform/soc_camera/soc_camera.c
@@ -1681,7 +1681,7 @@ eclkreg:
eaddpdev:
platform_device_put(sasc->pdev);
eallocpdev:
- devm_kfree(ici->v4l2_dev.dev, sasc);
+ devm_kfree(ici->v4l2_dev.dev, info);
dev_err(ici->v4l2_dev.dev, "group probe failed: %d\n", ret);
return ret;
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 092/101] [media] vb2: Fix dma_dir setting for dma-contig mem type
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 091/101] [media] soc-camera: Fix devm_kfree() in soc_of_bind() Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 093/101] [media] vb2: fix UNBALANCED warnings when calling vb2_thread_stop() Greg Kroah-Hartman
` (7 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sakari Ailus, Hans Verkuil,
Mauro Carvalho Chehab
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
commit 4879785ed511083676f27a016c9ad6c46c8e5737 upstream.
The last argument of vb2_dc_get_user_pages() is of type enum
dma_data_direction, but the caller, vb2_dc_get_userptr() passes a value
which is the result of comparison dma_dir == DMA_FROM_DEVICE. This results
in the write parameter to get_user_pages() being zero in all cases, i.e.
that the caller has no intent to write there.
This was broken by patch "vb2: replace 'write' by 'dma_dir'".
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/videobuf2-dma-contig.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -632,8 +632,7 @@ static void *vb2_dc_get_userptr(void *al
}
/* extract page list from userspace mapping */
- ret = vb2_dc_get_user_pages(start, pages, n_pages, vma,
- dma_dir == DMA_FROM_DEVICE);
+ ret = vb2_dc_get_user_pages(start, pages, n_pages, vma, dma_dir);
if (ret) {
unsigned long pfn;
if (vb2_dc_get_user_pfn(start, n_pages, vma, &pfn) == 0) {
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 093/101] [media] vb2: fix UNBALANCED warnings when calling vb2_thread_stop()
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 092/101] [media] vb2: Fix dma_dir setting for dma-contig mem type Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 096/101] IB/mlx4: Saturate RoCE port PMA counters in case of overflow Greg Kroah-Hartman
` (6 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jurgen Kramer, Hans Verkuil,
Mauro Carvalho Chehab
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hverkuil@xs4all.nl>
commit 0e661006370b7e7fb9ac9d94f9c3500a62cd559b upstream.
Stopping the vb2 thread (as used by several DVB devices) can result
in an 'UNBALANCED' warning such as this:
vb2: counters for queue ffff880407ee9828: UNBALANCED!
vb2: setup: 1 start_streaming: 1 stop_streaming: 1
vb2: wait_prepare: 249333 wait_finish: 249334
This is due to a race condition between stopping the thread and
calling vb2_internal_streamoff(). While I have not been able to deduce
the exact mechanism how this race condition can produce this warning,
I can see that the way the stream is stopped is likely to lead to a
race somewhere.
This patch simplifies how this is done by first ensuring that the
thread is completely stopped before cleaning up the vb2 queue. It
does that by setting threadio->stop to true, followed by a call to
vb2_queue_error() which will wake up the thread. The thread sees that
'stop' is true and it will exit.
The call to kthread_stop() waits until the thread has exited, and only
then is the queue cleaned up by calling __vb2_cleanup_fileio().
This is a much cleaner sequence and the warning has now disappeared.
Reported-by: Jurgen Kramer <gtmkramer@xs4all.nl>
Tested-by: Jurgen Kramer <gtmkramer@xs4all.nl>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/videobuf2-core.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -3230,18 +3230,13 @@ int vb2_thread_stop(struct vb2_queue *q)
if (threadio == NULL)
return 0;
- call_void_qop(q, wait_finish, q);
threadio->stop = true;
- vb2_internal_streamoff(q, q->type);
- call_void_qop(q, wait_prepare, q);
+ /* Wake up all pending sleeps in the thread */
+ vb2_queue_error(q);
err = kthread_stop(threadio->thread);
- q->fileio = NULL;
- fileio->req.count = 0;
- vb2_reqbufs(q, &fileio->req);
- kfree(fileio);
+ __vb2_cleanup_fileio(q);
threadio->thread = NULL;
kfree(threadio);
- q->fileio = NULL;
q->threadio = NULL;
return err;
}
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 096/101] IB/mlx4: Saturate RoCE port PMA counters in case of overflow
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 093/101] [media] vb2: fix UNBALANCED warnings when calling vb2_thread_stop() Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 097/101] timers/tick/broadcast-hrtimer: Fix suspicious RCU usage in idle loop Greg Kroah-Hartman
` (5 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Majd Dibbiny, Eran Ben Elisha,
Hadar Hen Zion, Or Gerlitz, David S. Miller
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Majd Dibbiny <majd@mellanox.com>
commit 61a3855bb726cbb062ef02a31a832dea455456e0 upstream.
For RoCE ports, we set the u32 PMA values based on u64 HCA counters. In case of
overflow, according to the IB spec, we have to saturate a counter to its
max value, do that.
Fixes: c37791349cc7 ('IB/mlx4: Support PMA counters for IBoE')
Signed-off-by: Majd Dibbiny <majd@mellanox.com>
Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
Signed-off-by: Hadar Hen Zion <hadarh@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx4/mad.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -64,6 +64,14 @@ enum {
#define GUID_TBL_BLK_NUM_ENTRIES 8
#define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES)
+/* Counters should be saturate once they reach their maximum value */
+#define ASSIGN_32BIT_COUNTER(counter, value) do {\
+ if ((value) > U32_MAX) \
+ counter = cpu_to_be32(U32_MAX); \
+ else \
+ counter = cpu_to_be32(value); \
+} while (0)
+
struct mlx4_mad_rcv_buf {
struct ib_grh grh;
u8 payload[256];
@@ -806,10 +814,14 @@ static int ib_process_mad(struct ib_devi
static void edit_counter(struct mlx4_counter *cnt,
struct ib_pma_portcounters *pma_cnt)
{
- pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
- pma_cnt->port_rcv_data = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
- pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
- pma_cnt->port_rcv_packets = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
+ ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
+ (be64_to_cpu(cnt->tx_bytes) >> 2));
+ ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
+ (be64_to_cpu(cnt->rx_bytes) >> 2));
+ ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
+ be64_to_cpu(cnt->tx_frames));
+ ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
+ be64_to_cpu(cnt->rx_frames));
}
static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 097/101] timers/tick/broadcast-hrtimer: Fix suspicious RCU usage in idle loop
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 096/101] IB/mlx4: Saturate RoCE port PMA counters in case of overflow Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 098/101] ext4: fix indirect punch hole corruption Greg Kroah-Hartman
` (4 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Preeti U Murthy,
Peter Zijlstra (Intel), Paul E. McKenney, linuxppc-dev, mpe, tglx,
Ingo Molnar
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Preeti U Murthy <preeti@linux.vnet.ibm.com>
commit a127d2bcf1fbc8c8e0b5cf0dab54f7d3ff50ce47 upstream.
The hrtimer mode of broadcast queues hrtimers in the idle entry
path so as to wakeup cpus in deep idle states. The associated
call graph is :
cpuidle_idle_call()
|____ clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, ....))
|_____tick_broadcast_set_event()
|____clockevents_program_event()
|____bc_set_next()
The hrtimer_{start/cancel} functions call into tracing which uses RCU.
But it is not legal to call into RCU in cpuidle because it is one of the
quiescent states. Hence protect this region with RCU_NONIDLE which informs
RCU that the cpu is momentarily non-idle.
As an aside it is helpful to point out that the clock event device that is
programmed here is not a per-cpu clock device; it is a
pseudo clock device, used by the broadcast framework alone.
The per-cpu clock device programming never goes through bc_set_next().
Signed-off-by: Preeti U Murthy <preeti@linux.vnet.ibm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: linuxppc-dev@ozlabs.org
Cc: mpe@ellerman.id.au
Cc: tglx@linutronix.de
Link: http://lkml.kernel.org/r/20150318104705.17763.56668.stgit@preeti.in.ibm.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/tick-broadcast-hrtimer.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/kernel/time/tick-broadcast-hrtimer.c
+++ b/kernel/time/tick-broadcast-hrtimer.c
@@ -49,6 +49,7 @@ static void bc_set_mode(enum clock_event
*/
static int bc_set_next(ktime_t expires, struct clock_event_device *bc)
{
+ int bc_moved;
/*
* We try to cancel the timer first. If the callback is on
* flight on some other cpu then we let it handle it. If we
@@ -60,9 +61,15 @@ static int bc_set_next(ktime_t expires,
* restart the timer because we are in the callback, but we
* can set the expiry time and let the callback return
* HRTIMER_RESTART.
+ *
+ * Since we are in the idle loop at this point and because
+ * hrtimer_{start/cancel} functions call into tracing,
+ * calls to these functions must be bound within RCU_NONIDLE.
*/
- if (hrtimer_try_to_cancel(&bctimer) >= 0) {
- hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED);
+ RCU_NONIDLE(bc_moved = (hrtimer_try_to_cancel(&bctimer) >= 0) ?
+ !hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED) :
+ 0);
+ if (bc_moved) {
/* Bind the "device" to the cpu */
bc->bound_on = smp_processor_id();
} else if (bc->bound_on == smp_processor_id()) {
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 098/101] ext4: fix indirect punch hole corruption
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 097/101] timers/tick/broadcast-hrtimer: Fix suspicious RCU usage in idle loop Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 099/101] xfs: ensure truncate forces zeroed blocks to disk Greg Kroah-Hartman
` (3 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Omar Sandoval, Chris J Arges
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Omar Sandoval <osandov@osandov.com>
commit 6f30b7e37a8239f9d27db626a1d3427bc7951908 upstream.
Commit 4f579ae7de56 (ext4: fix punch hole on files with indirect
mapping) rewrote FALLOC_FL_PUNCH_HOLE for ext4 files with indirect
mapping. However, there are bugs in several corner cases. This fixes 5
distinct bugs:
1. When there is at least one entire level of indirection between the
start and end of the punch range and the end of the punch range is the
first block of its level, we can't return early; we have to free the
intervening levels.
2. When the end is at a higher level of indirection than the start and
ext4_find_shared returns a top branch for the end, we still need to free
the rest of the shared branch it returns; we can't decrement partial2.
3. When a punch happens within one level of indirection, we need to
converge on an indirect block that contains the start and end. However,
because the branches returned from ext4_find_shared do not necessarily
start at the same level (e.g., the partial2 chain will be shallower if
the last block occurs at the beginning of an indirect group), the walk
of the two chains can end up "missing" each other and freeing a bunch of
extra blocks in the process. This mismatch can be handled by first
making sure that the chains are at the same level, then walking them
together until they converge.
4. When the punch happens within one level of indirection and
ext4_find_shared returns a top branch for the start, we must free it,
but only if the end does not occur within that branch.
5. When the punch happens within one level of indirection and
ext4_find_shared returns a top branch for the end, then we shouldn't
free the block referenced by the end of the returned chain (this mirrors
the different levels case).
Signed-off-by: Omar Sandoval <osandov@osandov.com>
Cc: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/indirect.c | 105 +++++++++++++++++++++++++++++++++++------------------
1 file changed, 71 insertions(+), 34 deletions(-)
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -1393,10 +1393,7 @@ end_range:
* to free. Everything was covered by the start
* of the range.
*/
- return 0;
- } else {
- /* Shared branch grows from an indirect block */
- partial2--;
+ goto do_indirects;
}
} else {
/*
@@ -1427,56 +1424,96 @@ end_range:
/* Punch happened within the same level (n == n2) */
partial = ext4_find_shared(inode, n, offsets, chain, &nr);
partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
- /*
- * ext4_find_shared returns Indirect structure which
- * points to the last element which should not be
- * removed by truncate. But this is end of the range
- * in punch_hole so we need to point to the next element
- */
- partial2->p++;
- while ((partial > chain) || (partial2 > chain2)) {
- /* We're at the same block, so we're almost finished */
- if ((partial->bh && partial2->bh) &&
- (partial->bh->b_blocknr == partial2->bh->b_blocknr)) {
- if ((partial > chain) && (partial2 > chain2)) {
+
+ /* Free top, but only if partial2 isn't its subtree. */
+ if (nr) {
+ int level = min(partial - chain, partial2 - chain2);
+ int i;
+ int subtree = 1;
+
+ for (i = 0; i <= level; i++) {
+ if (offsets[i] != offsets2[i]) {
+ subtree = 0;
+ break;
+ }
+ }
+
+ if (!subtree) {
+ if (partial == chain) {
+ /* Shared branch grows from the inode */
+ ext4_free_branches(handle, inode, NULL,
+ &nr, &nr+1,
+ (chain+n-1) - partial);
+ *partial->p = 0;
+ } else {
+ /* Shared branch grows from an indirect block */
+ BUFFER_TRACE(partial->bh, "get_write_access");
ext4_free_branches(handle, inode, partial->bh,
- partial->p + 1,
- partial2->p,
+ partial->p,
+ partial->p+1,
(chain+n-1) - partial);
- BUFFER_TRACE(partial->bh, "call brelse");
- brelse(partial->bh);
- BUFFER_TRACE(partial2->bh, "call brelse");
- brelse(partial2->bh);
}
- return 0;
}
+ }
+
+ if (!nr2) {
/*
- * Clear the ends of indirect blocks on the shared branch
- * at the start of the range
+ * ext4_find_shared returns Indirect structure which
+ * points to the last element which should not be
+ * removed by truncate. But this is end of the range
+ * in punch_hole so we need to point to the next element
*/
- if (partial > chain) {
+ partial2->p++;
+ }
+
+ while (partial > chain || partial2 > chain2) {
+ int depth = (chain+n-1) - partial;
+ int depth2 = (chain2+n2-1) - partial2;
+
+ if (partial > chain && partial2 > chain2 &&
+ partial->bh->b_blocknr == partial2->bh->b_blocknr) {
+ /*
+ * We've converged on the same block. Clear the range,
+ * then we're done.
+ */
ext4_free_branches(handle, inode, partial->bh,
- partial->p + 1,
- (__le32 *)partial->bh->b_data+addr_per_block,
- (chain+n-1) - partial);
+ partial->p + 1,
+ partial2->p,
+ (chain+n-1) - partial);
BUFFER_TRACE(partial->bh, "call brelse");
brelse(partial->bh);
- partial--;
+ BUFFER_TRACE(partial2->bh, "call brelse");
+ brelse(partial2->bh);
+ return 0;
}
+
/*
- * Clear the ends of indirect blocks on the shared branch
- * at the end of the range
+ * The start and end partial branches may not be at the same
+ * level even though the punch happened within one level. So, we
+ * give them a chance to arrive at the same level, then walk
+ * them in step with each other until we converge on the same
+ * block.
*/
- if (partial2 > chain2) {
+ if (partial > chain && depth <= depth2) {
+ ext4_free_branches(handle, inode, partial->bh,
+ partial->p + 1,
+ (__le32 *)partial->bh->b_data+addr_per_block,
+ (chain+n-1) - partial);
+ BUFFER_TRACE(partial->bh, "call brelse");
+ brelse(partial->bh);
+ partial--;
+ }
+ if (partial2 > chain2 && depth2 <= depth) {
ext4_free_branches(handle, inode, partial2->bh,
(__le32 *)partial2->bh->b_data,
partial2->p,
- (chain2+n-1) - partial2);
+ (chain2+n2-1) - partial2);
BUFFER_TRACE(partial2->bh, "call brelse");
brelse(partial2->bh);
partial2--;
}
}
+ return 0;
do_indirects:
/* Kill the remaining (whole) subtrees */
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 099/101] xfs: ensure truncate forces zeroed blocks to disk
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 098/101] ext4: fix indirect punch hole corruption Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 13:29 ` [PATCH 3.19 101/101] kvm: avoid page allocation failure in kvm_set_memory_region() Greg Kroah-Hartman
` (2 subsequent siblings)
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Liu Bo, Dave Chinner, Brian Foster,
Dave Chinner
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Chinner <dchinner@redhat.com>
commit 5885ebda878b47c4b4602d4b0410cb4b282af024 upstream.
A new fsync vs power fail test in xfstests indicated that XFS can
have unreliable data consistency when doing extending truncates that
require block zeroing. The blocks beyond EOF get zeroed in memory,
but we never force those changes to disk before we run the
transaction that extends the file size and exposes those blocks to
userspace. This can result in the blocks not being correctly zeroed
after a crash.
Because in-memory behaviour is correct, tools like fsx don't pick up
any coherency problems - it's not until the filesystem is shutdown
or the system crashes after writing the truncate transaction to the
journal but before the zeroed data in the page cache is flushed that
the issue is exposed.
Fix this by also flushing the dirty data in memory region between
the old size and new size when we've found blocks that need zeroing
in the truncate process.
Reported-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_file.c | 14 ++++++++++----
fs/xfs/xfs_inode.h | 5 +++--
fs/xfs/xfs_iops.c | 36 ++++++++++++++----------------------
3 files changed, 27 insertions(+), 28 deletions(-)
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -360,7 +360,8 @@ STATIC int /* error (positive) */
xfs_zero_last_block(
struct xfs_inode *ip,
xfs_fsize_t offset,
- xfs_fsize_t isize)
+ xfs_fsize_t isize,
+ bool *did_zeroing)
{
struct xfs_mount *mp = ip->i_mount;
xfs_fileoff_t last_fsb = XFS_B_TO_FSBT(mp, isize);
@@ -388,6 +389,7 @@ xfs_zero_last_block(
zero_len = mp->m_sb.sb_blocksize - zero_offset;
if (isize + zero_len > offset)
zero_len = offset - isize;
+ *did_zeroing = true;
return xfs_iozero(ip, isize, zero_len);
}
@@ -406,7 +408,8 @@ int /* error (positive) */
xfs_zero_eof(
struct xfs_inode *ip,
xfs_off_t offset, /* starting I/O offset */
- xfs_fsize_t isize) /* current inode size */
+ xfs_fsize_t isize, /* current inode size */
+ bool *did_zeroing)
{
struct xfs_mount *mp = ip->i_mount;
xfs_fileoff_t start_zero_fsb;
@@ -428,7 +431,7 @@ xfs_zero_eof(
* We only zero a part of that block so it is handled specially.
*/
if (XFS_B_FSB_OFFSET(mp, isize) != 0) {
- error = xfs_zero_last_block(ip, offset, isize);
+ error = xfs_zero_last_block(ip, offset, isize, did_zeroing);
if (error)
return error;
}
@@ -488,6 +491,7 @@ xfs_zero_eof(
if (error)
return error;
+ *did_zeroing = true;
start_zero_fsb = imap.br_startoff + imap.br_blockcount;
ASSERT(start_zero_fsb <= (end_zero_fsb + 1));
}
@@ -526,13 +530,15 @@ restart:
* having to redo all checks before.
*/
if (*pos > i_size_read(inode)) {
+ bool zero = false;
+
if (*iolock == XFS_IOLOCK_SHARED) {
xfs_rw_iunlock(ip, *iolock);
*iolock = XFS_IOLOCK_EXCL;
xfs_rw_ilock(ip, *iolock);
goto restart;
}
- error = xfs_zero_eof(ip, *pos, i_size_read(inode));
+ error = xfs_zero_eof(ip, *pos, i_size_read(inode), &zero);
if (error)
return error;
}
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -377,8 +377,9 @@ int xfs_droplink(struct xfs_trans *, st
int xfs_bumplink(struct xfs_trans *, struct xfs_inode *);
/* from xfs_file.c */
-int xfs_zero_eof(struct xfs_inode *, xfs_off_t, xfs_fsize_t);
-int xfs_iozero(struct xfs_inode *, loff_t, size_t);
+int xfs_zero_eof(struct xfs_inode *ip, xfs_off_t offset,
+ xfs_fsize_t isize, bool *did_zeroing);
+int xfs_iozero(struct xfs_inode *ip, loff_t pos, size_t count);
#define IHOLD(ip) \
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -741,6 +741,7 @@ xfs_setattr_size(
int error;
uint lock_flags = 0;
uint commit_flags = 0;
+ bool did_zeroing = false;
trace_xfs_setattr(ip);
@@ -784,20 +785,16 @@ xfs_setattr_size(
return error;
/*
- * Now we can make the changes. Before we join the inode to the
- * transaction, take care of the part of the truncation that must be
- * done without the inode lock. This needs to be done before joining
- * the inode to the transaction, because the inode cannot be unlocked
- * once it is a part of the transaction.
+ * File data changes must be complete before we start the transaction to
+ * modify the inode. This needs to be done before joining the inode to
+ * the transaction because the inode cannot be unlocked once it is a
+ * part of the transaction.
+ *
+ * Start with zeroing any data block beyond EOF that we may expose on
+ * file extension.
*/
if (newsize > oldsize) {
- /*
- * Do the first part of growing a file: zero any data in the
- * last block that is beyond the old EOF. We need to do this
- * before the inode is joined to the transaction to modify
- * i_size.
- */
- error = xfs_zero_eof(ip, newsize, oldsize);
+ error = xfs_zero_eof(ip, newsize, oldsize, &did_zeroing);
if (error)
return error;
}
@@ -807,23 +804,18 @@ xfs_setattr_size(
* any previous writes that are beyond the on disk EOF and the new
* EOF that have not been written out need to be written here. If we
* do not write the data out, we expose ourselves to the null files
- * problem.
- *
- * Only flush from the on disk size to the smaller of the in memory
- * file size or the new size as that's the range we really care about
- * here and prevents waiting for other data not within the range we
- * care about here.
+ * problem. Note that this includes any block zeroing we did above;
+ * otherwise those blocks may not be zeroed after a crash.
*/
- if (oldsize != ip->i_d.di_size && newsize > ip->i_d.di_size) {
+ if (newsize > ip->i_d.di_size &&
+ (oldsize != ip->i_d.di_size || did_zeroing)) {
error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
ip->i_d.di_size, newsize);
if (error)
return error;
}
- /*
- * Wait for all direct I/O to complete.
- */
+ /* Now wait for all direct I/O to complete. */
inode_dio_wait(inode);
/*
^ permalink raw reply [flat|nested] 97+ messages in thread* [PATCH 3.19 101/101] kvm: avoid page allocation failure in kvm_set_memory_region()
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 099/101] xfs: ensure truncate forces zeroed blocks to disk Greg Kroah-Hartman
@ 2015-04-17 13:29 ` Greg Kroah-Hartman
2015-04-17 17:34 ` [PATCH 3.19 000/101] 3.19.5-stable review Shuah Khan
2015-04-17 20:03 ` Guenter Roeck
93 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 13:29 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Igor Mammedov, Marcelo Tosatti
3.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Mammedov <imammedo@redhat.com>
commit 744961341d472db6272ed9b42319a90f5a2aa7c4 upstream.
KVM guest can fail to startup with following trace on host:
qemu-system-x86: page allocation failure: order:4, mode:0x40d0
Call Trace:
dump_stack+0x47/0x67
warn_alloc_failed+0xee/0x150
__alloc_pages_direct_compact+0x14a/0x150
__alloc_pages_nodemask+0x776/0xb80
alloc_kmem_pages+0x3a/0x110
kmalloc_order+0x13/0x50
kmemdup+0x1b/0x40
__kvm_set_memory_region+0x24a/0x9f0 [kvm]
kvm_set_ioapic+0x130/0x130 [kvm]
kvm_set_memory_region+0x21/0x40 [kvm]
kvm_vm_ioctl+0x43f/0x750 [kvm]
Failure happens when attempting to allocate pages for
'struct kvm_memslots', however it doesn't have to be
present in physically contiguous (kmalloc-ed) address
space, change allocation to kvm_kvzalloc() so that
it will be vmalloc-ed when its size is more then a page.
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/kvm_main.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -466,7 +466,7 @@ static struct kvm *kvm_create_vm(unsigne
BUILD_BUG_ON(KVM_MEM_SLOTS_NUM > SHRT_MAX);
r = -ENOMEM;
- kvm->memslots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
+ kvm->memslots = kvm_kvzalloc(sizeof(struct kvm_memslots));
if (!kvm->memslots)
goto out_err_no_srcu;
@@ -517,7 +517,7 @@ out_err_no_srcu:
out_err_no_disable:
for (i = 0; i < KVM_NR_BUSES; i++)
kfree(kvm->buses[i]);
- kfree(kvm->memslots);
+ kvfree(kvm->memslots);
kvm_arch_free_vm(kvm);
return ERR_PTR(r);
}
@@ -573,7 +573,7 @@ static void kvm_free_physmem(struct kvm
kvm_for_each_memslot(memslot, slots)
kvm_free_physmem_slot(kvm, memslot, NULL);
- kfree(kvm->memslots);
+ kvfree(kvm->memslots);
}
static void kvm_destroy_devices(struct kvm *kvm)
@@ -865,10 +865,10 @@ int __kvm_set_memory_region(struct kvm *
goto out_free;
}
- slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),
- GFP_KERNEL);
+ slots = kvm_kvzalloc(sizeof(struct kvm_memslots));
if (!slots)
goto out_free;
+ memcpy(slots, kvm->memslots, sizeof(struct kvm_memslots));
if ((change == KVM_MR_DELETE) || (change == KVM_MR_MOVE)) {
slot = id_to_memslot(slots, mem->slot);
@@ -911,7 +911,7 @@ int __kvm_set_memory_region(struct kvm *
kvm_arch_commit_memory_region(kvm, mem, &old, change);
kvm_free_physmem_slot(kvm, &old, &new);
- kfree(old_memslots);
+ kvfree(old_memslots);
/*
* IOMMU mapping: New slots need to be mapped. Old slots need to be
@@ -930,7 +930,7 @@ int __kvm_set_memory_region(struct kvm *
return 0;
out_slots:
- kfree(slots);
+ kvfree(slots);
out_free:
kvm_free_physmem_slot(kvm, &new, &old);
out:
^ permalink raw reply [flat|nested] 97+ messages in thread* Re: [PATCH 3.19 000/101] 3.19.5-stable review
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2015-04-17 13:29 ` [PATCH 3.19 101/101] kvm: avoid page allocation failure in kvm_set_memory_region() Greg Kroah-Hartman
@ 2015-04-17 17:34 ` Shuah Khan
2015-04-17 19:43 ` Greg Kroah-Hartman
2015-04-17 20:03 ` Guenter Roeck
93 siblings, 1 reply; 97+ messages in thread
From: Shuah Khan @ 2015-04-17 17:34 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel; +Cc: torvalds, akpm, linux, shuah.kh, stable
On 04/17/2015 07:27 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.19.5 release.
> There are 101 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Apr 19 13:24:43 UTC 2015.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.19.5-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Complied and booted on my test system. No dmesg regressions.
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978
^ permalink raw reply [flat|nested] 97+ messages in thread* Re: [PATCH 3.19 000/101] 3.19.5-stable review
2015-04-17 17:34 ` [PATCH 3.19 000/101] 3.19.5-stable review Shuah Khan
@ 2015-04-17 19:43 ` Greg Kroah-Hartman
0 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-17 19:43 UTC (permalink / raw)
To: Shuah Khan; +Cc: linux-kernel, torvalds, akpm, linux, shuah.kh, stable
On Fri, Apr 17, 2015 at 11:34:53AM -0600, Shuah Khan wrote:
> On 04/17/2015 07:27 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.19.5 release.
> > There are 101 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sun Apr 19 13:24:43 UTC 2015.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.19.5-rc1.gz
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
>
> Complied and booted on my test system. No dmesg regressions.
Thanks for testing all three of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 97+ messages in thread
* Re: [PATCH 3.19 000/101] 3.19.5-stable review
2015-04-17 13:27 [PATCH 3.19 000/101] 3.19.5-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2015-04-17 17:34 ` [PATCH 3.19 000/101] 3.19.5-stable review Shuah Khan
@ 2015-04-17 20:03 ` Guenter Roeck
2015-04-18 18:59 ` Greg Kroah-Hartman
93 siblings, 1 reply; 97+ messages in thread
From: Guenter Roeck @ 2015-04-17 20:03 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-kernel, torvalds, akpm, shuah.kh, stable
On Fri, Apr 17, 2015 at 03:27:48PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.19.5 release.
> There are 101 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Apr 19 13:24:43 UTC 2015.
> Anything received after that time might be too late.
>
Build results:
total: 123 pass: 123 fail: 0
Qemu test results:
total: 30 pass: 30 fail: 0
Details are available at http://server.roeck-us.net:8010/builders.
Guenter
^ permalink raw reply [flat|nested] 97+ messages in thread* Re: [PATCH 3.19 000/101] 3.19.5-stable review
2015-04-17 20:03 ` Guenter Roeck
@ 2015-04-18 18:59 ` Greg Kroah-Hartman
0 siblings, 0 replies; 97+ messages in thread
From: Greg Kroah-Hartman @ 2015-04-18 18:59 UTC (permalink / raw)
To: Guenter Roeck; +Cc: linux-kernel, torvalds, akpm, shuah.kh, stable
On Fri, Apr 17, 2015 at 01:03:42PM -0700, Guenter Roeck wrote:
> On Fri, Apr 17, 2015 at 03:27:48PM +0200, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.19.5 release.
> > There are 101 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sun Apr 19 13:24:43 UTC 2015.
> > Anything received after that time might be too late.
> >
> Build results:
> total: 123 pass: 123 fail: 0
> Qemu test results:
> total: 30 pass: 30 fail: 0
>
> Details are available at http://server.roeck-us.net:8010/builders.
At least this one is good. Thanks for the results and for testing.
greg k-h
^ permalink raw reply [flat|nested] 97+ messages in thread