* [PATCH 3.2 018/110] fixing infinite OPEN loop in 4.0 stateid recovery
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 023/110] ath3k: add support of 13d3:3474 AR3012 device Ben Hutchings
` (110 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Trond Myklebust, Olga Kornievskaia
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <kolga@netapp.com>
commit e8d975e73e5fa05f983fbf2723120edcf68e0b38 upstream.
Problem: When an operation like WRITE receives a BAD_STATEID, even though
recovery code clears the RECLAIM_NOGRACE recovery flag before recovering
the open state, because of clearing delegation state for the associated
inode, nfs_inode_find_state_and_recover() gets called and it makes the
same state with RECLAIM_NOGRACE flag again. As a results, when we restart
looking over the open states, we end up in the infinite loop instead of
breaking out in the next test of state flags.
Solution: unset the RECLAIM_NOGRACE set because of
calling of nfs_inode_find_state_and_recover() after returning from calling
recover_open() function.
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/nfs/nfs4state.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1192,6 +1192,8 @@ restart:
}
spin_unlock(&state->state_lock);
nfs4_put_open_state(state);
+ clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
+ &state->flags);
goto restart;
}
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 023/110] ath3k: add support of 13d3:3474 AR3012 device
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 018/110] fixing infinite OPEN loop in 4.0 stateid recovery Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 011/110] drm/radeon: take the mode_config mutex when dealing with hpds (v2) Ben Hutchings
` (109 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Marcel Holtmann, Dmitry Tunin
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <hanipouspilot@gmail.com>
commit 0d0cef6183aec0fb6d0c9f00a09ff51ee086bbe2 upstream.
BugLink: https://bugs.launchpad.net/bugs/1427680
This device requires new firmware files
AthrBT_0x11020100.dfu and ramps_0x11020100_40.dfu added to
/lib/firmware/ar3k/ that are not included in linux-firmware yet.
T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3474 Rev=00.01
C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/bluetooth/ath3k.c | 2 ++
drivers/bluetooth/btusb.c | 1 +
2 files changed, 3 insertions(+)
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -110,6 +110,7 @@ static struct usb_device_id ath3k_table[
{ USB_DEVICE(0x13d3, 0x3408) },
{ USB_DEVICE(0x13d3, 0x3423) },
{ USB_DEVICE(0x13d3, 0x3432) },
+ { USB_DEVICE(0x13d3, 0x3474) },
/* Atheros AR5BBU12 with sflash firmware */
{ USB_DEVICE(0x0489, 0xE02C) },
@@ -166,6 +167,7 @@ static struct usb_device_id ath3k_blist_
{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
/* Atheros AR5BBU22 with sflash firmware */
{ USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -195,6 +195,7 @@ static struct usb_device_id blacklist_ta
{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
/* Atheros AR5BBU12 with sflash firmware */
{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 011/110] drm/radeon: take the mode_config mutex when dealing with hpds (v2)
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 018/110] fixing infinite OPEN loop in 4.0 stateid recovery Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 023/110] ath3k: add support of 13d3:3474 AR3012 device Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 026/110] regulator: core: fix constraints output buffer Ben Hutchings
` (108 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Alex Deucher
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 39fa10f7e21574a70cecf1fed0f9b36535aa68a0 upstream.
Since we are messing with state in the worker.
v2: drop the changes in the mst worker
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpu/drm/radeon/radeon_irq_kms.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -51,10 +51,12 @@ static void radeon_hotplug_work_func(str
struct drm_mode_config *mode_config = &dev->mode_config;
struct drm_connector *connector;
+ mutex_lock(&mode_config->mutex);
if (mode_config->num_connector) {
list_for_each_entry(connector, &mode_config->connector_list, head)
radeon_connector_hotplug(connector);
}
+ mutex_unlock(&mode_config->mutex);
/* Just fire off a uevent and let userspace tell us what to do */
drm_helper_hpd_irq_event(dev);
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 026/110] regulator: core: fix constraints output buffer
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (2 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 011/110] drm/radeon: take the mode_config mutex when dealing with hpds (v2) Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 008/110] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits Ben Hutchings
` (107 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mark Brown, Stefan Wahren
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <stefan.wahren@i2se.com>
commit a7068e3932eee8268c4ce4e080a338ee7b8a27bf upstream.
The buffer for condtraints debug isn't big enough to hold the output
in all cases. So fix this issue by increasing the buffer.
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/regulator/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -726,7 +726,7 @@ static int suspend_prepare(struct regula
static void print_constraints(struct regulator_dev *rdev)
{
struct regulation_constraints *constraints = rdev->constraints;
- char buf[80] = "";
+ char buf[160] = "";
int count = 0;
int ret;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 008/110] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (3 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 026/110] regulator: core: fix constraints output buffer Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 010/110] tty/serial: at91: RS485 mode: 0 is valid for delay_rts_after_send Ben Hutchings
` (106 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mark Brown, Axel Lin, Charles Keepax
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <axel.lin@ingics.com>
commit 12c350050538c7dc779c083b7342bfd20f74949c upstream.
WM8955_K_8_0_MASK bits is controlled by WM8955_PLL_CONTROL_3 rather than
WM8955_PLL_CONTROL_2.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/soc/codecs/wm8955.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/codecs/wm8955.c
+++ b/sound/soc/codecs/wm8955.c
@@ -282,7 +282,7 @@ static int wm8955_configure_clocking(str
snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
WM8955_K_17_9_MASK,
(pll.k >> 9) & WM8955_K_17_9_MASK);
- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
+ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3,
WM8955_K_8_0_MASK,
pll.k & WM8955_K_8_0_MASK);
if (pll.k)
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 010/110] tty/serial: at91: RS485 mode: 0 is valid for delay_rts_after_send
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (4 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 008/110] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 016/110] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset Ben Hutchings
` (105 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Nicolas Ferre, Greg Kroah-Hartman, Sami Pietikäinen
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <nicolas.ferre@atmel.com>
commit 8687634b7908c42eb700e0469e110e02833611d1 upstream.
In RS485 mode, we may want to set the delay_rts_after_send value to 0.
In the datasheet, the 0 value is said to "disable" the Transmitter Timeguard but
this is exactly the expected behavior if we want no delay...
Moreover, if the value was set to non-zero value by device-tree or earlier
ioctl command, it was impossible to change it back to zero.
Reported-by: Sami Pietikäinen <Sami.Pietikainen@wapice.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/tty/serial/atmel_serial.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -229,8 +229,7 @@ void atmel_config_rs485(struct uart_port
if (rs485conf->flags & SER_RS485_ENABLED) {
dev_dbg(port->dev, "Setting UART to RS485\n");
atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
- if ((rs485conf->delay_rts_after_send) > 0)
- UART_PUT_TTGR(port, rs485conf->delay_rts_after_send);
+ UART_PUT_TTGR(port, rs485conf->delay_rts_after_send);
mode |= ATMEL_US_USMODE_RS485;
} else {
dev_dbg(port->dev, "Setting UART to RS232\n");
@@ -305,9 +304,7 @@ static void atmel_set_mctrl(struct uart_
if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
dev_dbg(port->dev, "Setting UART to RS485\n");
- if ((atmel_port->rs485.delay_rts_after_send) > 0)
- UART_PUT_TTGR(port,
- atmel_port->rs485.delay_rts_after_send);
+ UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_after_send);
mode |= ATMEL_US_USMODE_RS485;
} else {
dev_dbg(port->dev, "Setting UART to RS232\n");
@@ -1229,9 +1226,7 @@ static void atmel_set_termios(struct uar
if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
dev_dbg(port->dev, "Setting UART to RS485\n");
- if ((atmel_port->rs485.delay_rts_after_send) > 0)
- UART_PUT_TTGR(port,
- atmel_port->rs485.delay_rts_after_send);
+ UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_after_send);
mode |= ATMEL_US_USMODE_RS485;
} else {
dev_dbg(port->dev, "Setting UART to RS232\n");
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 016/110] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (5 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 010/110] tty/serial: at91: RS485 mode: 0 is valid for delay_rts_after_send Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 027/110] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup Ben Hutchings
` (104 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Greg Kroah-Hartman, Alan Stern, Robert Schlabbach,
Robert Schlabbach
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Robert Schlabbach <Robert.Schlabbach@gmx.net>
commit fb6d1f7df5d25299fd7b3e84b72b8851d3634764 upstream.
Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset.
Dissolve the function hub_port_finish_reset() completely and divide the
actions to be taken into those which need to be done after each reset
attempt and those which need to be done after the full procedure is
complete, and place them in the appropriate places in hub_port_reset().
Also, remove an unneeded forward declaration of hub_port_reset().
Verbose Problem Description:
USB 3.0 devices may be "lost for good" during a hub port reset.
This makes Linux unable to boot from USB 3.0 devices in certain
constellations of host controllers and devices, because the USB device is
lost during initialization, preventing the rootfs from being mounted.
The underlying problem is that in the affected constellations, during the
processing inside hub_port_reset(), the hub link state goes from 0 to
SS.inactive after the initial reset, and back to 0 again only after the
following "warm" reset.
However, hub_port_finish_reset() is called after each reset attempt and
sets the state the connected USB device based on the "preliminary" status
of the hot reset to USB_STATE_NOTATTACHED due to SS.inactive, yet when
the following warm reset is complete and hub_port_finish_reset() is
called again, its call to set the device to USB_STATE_DEFAULT is blocked
by usb_set_device_state() which does not allow taking USB devices out of
USB_STATE_NOTATTACHED state.
Thanks to Alan Stern for guiding me to the proper solution and how to
submit it.
Link: http://lkml.kernel.org/r/trinity-25981484-72a9-4d46-bf17-9c1cf9301a31-1432073240136%20()%203capp-gmx-bs27
Signed-off-by: Robert Schlabbach <robert_s@gmx.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2:
- Adjust context
- s/usb_clear_port_feature/clear_port_feature/]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/core/hub.c | 82 ++++++++++++++++++++------------------------------
1 file changed, 33 insertions(+), 49 deletions(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2157,9 +2157,6 @@ static unsigned hub_is_wusb(struct usb_h
#define HUB_LONG_RESET_TIME 200
#define HUB_RESET_TIMEOUT 800
-static int hub_port_reset(struct usb_hub *hub, int port1,
- struct usb_device *udev, unsigned int delay, bool warm);
-
/* Is a USB 3.0 port in the Inactive or Complinance Mode state?
* Port worm reset is required to recover
*/
@@ -2239,44 +2236,6 @@ delay:
return -EBUSY;
}
-static void hub_port_finish_reset(struct usb_hub *hub, int port1,
- struct usb_device *udev, int *status)
-{
- switch (*status) {
- case 0:
- /* TRSTRCY = 10 ms; plus some extra */
- msleep(10 + 40);
- if (udev) {
- struct usb_hcd *hcd = bus_to_hcd(udev->bus);
-
- update_devnum(udev, 0);
- /* The xHC may think the device is already reset,
- * so ignore the status.
- */
- if (hcd->driver->reset_device)
- hcd->driver->reset_device(hcd, udev);
- }
- /* FALL THROUGH */
- case -ENOTCONN:
- case -ENODEV:
- clear_port_feature(hub->hdev,
- port1, USB_PORT_FEAT_C_RESET);
- if (hub_is_superspeed(hub->hdev)) {
- clear_port_feature(hub->hdev, port1,
- USB_PORT_FEAT_C_BH_PORT_RESET);
- clear_port_feature(hub->hdev, port1,
- USB_PORT_FEAT_C_PORT_LINK_STATE);
- clear_port_feature(hub->hdev, port1,
- USB_PORT_FEAT_C_CONNECTION);
- }
- if (udev)
- usb_set_device_state(udev, *status
- ? USB_STATE_NOTATTACHED
- : USB_STATE_DEFAULT);
- break;
- }
-}
-
/* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */
static int hub_port_reset(struct usb_hub *hub, int port1,
struct usb_device *udev, unsigned int delay, bool warm)
@@ -2299,13 +2258,9 @@ static int hub_port_reset(struct usb_hub
* If the caller hasn't explicitly requested a warm reset,
* double check and see if one is needed.
*/
- status = hub_port_status(hub, port1,
- &portstatus, &portchange);
- if (status < 0)
- goto done;
-
- if (hub_port_warm_reset_required(hub, portstatus))
- warm = true;
+ if (hub_port_status(hub, port1, &portstatus, &portchange) == 0)
+ if (hub_port_warm_reset_required(hub, portstatus))
+ warm = true;
}
/* Reset the port */
@@ -2328,11 +2283,19 @@ static int hub_port_reset(struct usb_hub
/* Check for disconnect or reset */
if (status == 0 || status == -ENOTCONN || status == -ENODEV) {
- hub_port_finish_reset(hub, port1, udev, &status);
+ clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_RESET);
if (!hub_is_superspeed(hub->hdev))
goto done;
+ clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_BH_PORT_RESET);
+ clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_PORT_LINK_STATE);
+ clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_CONNECTION);
+
/*
* If a USB 3.0 device migrates from reset to an error
* state, re-issue the warm reset.
@@ -2366,6 +2329,26 @@ static int hub_port_reset(struct usb_hub
port1);
done:
+ if (status == 0) {
+ /* TRSTRCY = 10 ms; plus some extra */
+ msleep(10 + 40);
+ if (udev) {
+ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+
+ update_devnum(udev, 0);
+ /* The xHC may think the device is already reset,
+ * so ignore the status.
+ */
+ if (hcd->driver->reset_device)
+ hcd->driver->reset_device(hcd, udev);
+
+ usb_set_device_state(udev, USB_STATE_DEFAULT);
+ }
+ } else {
+ if (udev)
+ usb_set_device_state(udev, USB_STATE_NOTATTACHED);
+ }
+
if (!hub_is_superspeed(hub->hdev))
up_read(&ehci_cf_port_reset_rwsem);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 027/110] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (6 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 016/110] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 028/110] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1] Ben Hutchings
` (103 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Lior Amsalem, Vinod Koul, Ofer Heifetz, Maxime Ripard
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Lior Amsalem <alior@marvell.com>
commit 9136291f1dbc1d4d1cacd2840fb35f4f3ce16c46 upstream.
This patch fixes a bug in the XOR driver where the cleanup function can be
called and free descriptors that never been processed by the engine (which
result in data errors).
The cleanup function will free descriptors based on the ownership bit in
the descriptors.
Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine")
Signed-off-by: Lior Amsalem <alior@marvell.com>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Reviewed-by: Ofer Heifetz <oferh@marvell.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/dma/mv_xor.c | 72 +++++++++++++++++++++++++++++++++-------------------
drivers/dma/mv_xor.h | 1 +
2 files changed, 47 insertions(+), 26 deletions(-)
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -386,7 +386,8 @@ static void __mv_xor_slot_cleanup(struct
dma_cookie_t cookie = 0;
int busy = mv_chan_is_busy(mv_chan);
u32 current_desc = mv_chan_get_current_desc(mv_chan);
- int seen_current = 0;
+ int current_cleaned = 0;
+ struct mv_xor_desc *hw_desc;
dev_dbg(mv_chan->device->common.dev, "%s %d\n", __func__, __LINE__);
dev_dbg(mv_chan->device->common.dev, "current_desc %x\n", current_desc);
@@ -398,38 +399,57 @@ static void __mv_xor_slot_cleanup(struct
list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
chain_node) {
- prefetch(_iter);
- prefetch(&_iter->async_tx);
- /* do not advance past the current descriptor loaded into the
- * hardware channel, subsequent descriptors are either in
- * process or have not been submitted
- */
- if (seen_current)
- break;
-
- /* stop the search if we reach the current descriptor and the
- * channel is busy
- */
- if (iter->async_tx.phys == current_desc) {
- seen_current = 1;
- if (busy)
+ /* clean finished descriptors */
+ hw_desc = iter->hw_desc;
+ if (hw_desc->status & XOR_DESC_SUCCESS) {
+ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
+ cookie);
+
+ /* done processing desc, clean slot */
+ mv_xor_clean_slot(iter, mv_chan);
+
+ /* break if we did cleaned the current */
+ if (iter->async_tx.phys == current_desc) {
+ current_cleaned = 1;
break;
+ }
+ } else {
+ if (iter->async_tx.phys == current_desc) {
+ current_cleaned = 0;
+ break;
+ }
}
-
- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
-
- if (mv_xor_clean_slot(iter, mv_chan))
- break;
}
if ((busy == 0) && !list_empty(&mv_chan->chain)) {
- struct mv_xor_desc_slot *chain_head;
- chain_head = list_entry(mv_chan->chain.next,
- struct mv_xor_desc_slot,
- chain_node);
-
- mv_xor_start_new_chain(mv_chan, chain_head);
+ if (current_cleaned) {
+ /*
+ * current descriptor cleaned and removed, run
+ * from list head
+ */
+ iter = list_entry(mv_chan->chain.next,
+ struct mv_xor_desc_slot,
+ chain_node);
+ mv_xor_start_new_chain(mv_chan, iter);
+ } else {
+ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
+ /*
+ * descriptors are still waiting after
+ * current, trigger them
+ */
+ iter = list_entry(iter->chain_node.next,
+ struct mv_xor_desc_slot,
+ chain_node);
+ mv_xor_start_new_chain(mv_chan, iter);
+ } else {
+ /*
+ * some descriptors are still waiting
+ * to be cleaned
+ */
+ tasklet_schedule(&mv_chan->irq_tasklet);
+ }
+ }
}
if (cookie > 0)
--- a/drivers/dma/mv_xor.h
+++ b/drivers/dma/mv_xor.h
@@ -30,6 +30,7 @@
#define XOR_OPERATION_MODE_XOR 0
#define XOR_OPERATION_MODE_MEMCPY 2
#define XOR_OPERATION_MODE_MEMSET 4
+#define XOR_DESC_SUCCESS 0x40000000
#define XOR_CURR_DESC(chan) (chan->mmr_base + 0x210 + (chan->idx * 4))
#define XOR_NEXT_DESC(chan) (chan->mmr_base + 0x200 + (chan->idx * 4))
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 028/110] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1]
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (7 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 027/110] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 001/110] hrtimer: Allow concurrent hrtimer_start() for self restarting timers Ben Hutchings
` (102 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mark Brown, Zidan Wang, Charles Keepax
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Zidan Wang <zidan.wang@freescale.com>
commit a077e81ec61e07a7f86997d045109f06719fbffe upstream.
the enum of "DAC Polarity" should be wm8960_enum[1].
Signed-off-by: Zidan Wang <zidan.wang@freescale.com>
Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/soc/codecs/wm8960.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -186,7 +186,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", W
SOC_ENUM("ADC Polarity", wm8960_enum[0]),
SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0),
-SOC_ENUM("DAC Polarity", wm8960_enum[2]),
+SOC_ENUM("DAC Polarity", wm8960_enum[1]),
SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0,
wm8960_get_deemph, wm8960_put_deemph),
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 001/110] hrtimer: Allow concurrent hrtimer_start() for self restarting timers
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (8 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 028/110] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1] Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 014/110] mtd: dc21285: use raw spinlock functions for nw_gpio_lock Ben Hutchings
` (101 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Peter Zijlstra, Ben Segall, Paul Turner, Roman Gushchin,
Thomas Gleixner
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 5de2755c8c8b3a6b8414870e2c284914a2b42e4d upstream.
Because we drop cpu_base->lock around calling hrtimer::function, it is
possible for hrtimer_start() to come in between and enqueue the timer.
If hrtimer::function then returns HRTIMER_RESTART we'll hit the BUG_ON
because HRTIMER_STATE_ENQUEUED will be set.
Since the above is a perfectly valid scenario, remove the BUG_ON and
make the enqueue_hrtimer() call conditional on the timer not being
enqueued already.
NOTE: in that concurrent scenario its entirely common for both sites
to want to modify the hrtimer, since hrtimers don't provide
serialization themselves be sure to provide some such that the
hrtimer::function and the hrtimer_start() caller don't both try and
fudge the expiration state at the same time.
To that effect, add a WARN when someone tries to forward an already
enqueued timer, the most common way to change the expiry of self
restarting timers. Ideally we'd put the WARN in everything modifying
the expiry but most of that is inlines and we don't need the bloat.
Fixes: 2d44ae4d7135 ("hrtimer: clean up cpu->base locking tricks")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Ben Segall <bsegall@google.com>
Cc: Roman Gushchin <klamm@yandex-team.ru>
Cc: Paul Turner <pjt@google.com>
Link: http://lkml.kernel.org/r/20150415113105.GT5029@twins.programming.kicks-ass.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/hrtimer.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -848,6 +848,9 @@ u64 hrtimer_forward(struct hrtimer *time
if (delta.tv64 < 0)
return 0;
+ if (WARN_ON(timer->state & HRTIMER_STATE_ENQUEUED))
+ return 0;
+
if (interval.tv64 < timer->base->resolution.tv64)
interval.tv64 = timer->base->resolution.tv64;
@@ -1260,11 +1263,14 @@ static void __run_hrtimer(struct hrtimer
* Note: We clear the CALLBACK bit after enqueue_hrtimer and
* we do not reprogramm the event hardware. Happens either in
* hrtimer_start_range_ns() or in hrtimer_interrupt()
+ *
+ * Note: Because we dropped the cpu_base->lock above,
+ * hrtimer_start_range_ns() can have popped in and enqueued the timer
+ * for us already.
*/
- if (restart != HRTIMER_NORESTART) {
- BUG_ON(timer->state != HRTIMER_STATE_CALLBACK);
+ if (restart != HRTIMER_NORESTART &&
+ !(timer->state & HRTIMER_STATE_ENQUEUED))
enqueue_hrtimer(timer, base);
- }
WARN_ON_ONCE(!(timer->state & HRTIMER_STATE_CALLBACK));
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 014/110] mtd: dc21285: use raw spinlock functions for nw_gpio_lock
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (9 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 001/110] hrtimer: Allow concurrent hrtimer_start() for self restarting timers Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 020/110] SUNRPC: Fix a memory leak in the backchannel code Ben Hutchings
` (100 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Brian Norris, Uwe Kleine-König
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
commit e5babdf928e5d0c432a8d4b99f20421ce14d1ab6 upstream.
Since commit bd31b85960a7 (which is in 3.2-rc1) nw_gpio_lock is a raw spinlock
that needs usage of the corresponding raw functions.
This fixes:
drivers/mtd/maps/dc21285.c: In function 'nw_en_write':
drivers/mtd/maps/dc21285.c:41:340: warning: passing argument 1 of 'spinlock_check' from incompatible pointer type
spin_lock_irqsave(&nw_gpio_lock, flags);
In file included from include/linux/seqlock.h:35:0,
from include/linux/time.h:5,
from include/linux/stat.h:18,
from include/linux/module.h:10,
from drivers/mtd/maps/dc21285.c:8:
include/linux/spinlock.h:299:102: note: expected 'struct spinlock_t *' but argument is of type 'struct raw_spinlock_t *'
static inline raw_spinlock_t *spinlock_check(spinlock_t *lock)
^
drivers/mtd/maps/dc21285.c:43:25: warning: passing argument 1 of 'spin_unlock_irqrestore' from incompatible pointer type
spin_unlock_irqrestore(&nw_gpio_lock, flags);
^
In file included from include/linux/seqlock.h:35:0,
from include/linux/time.h:5,
from include/linux/stat.h:18,
from include/linux/module.h:10,
from drivers/mtd/maps/dc21285.c:8:
include/linux/spinlock.h:370:91: note: expected 'struct spinlock_t *' but argument is of type 'struct raw_spinlock_t *'
static inline void spin_unlock_irqrestore(spinlock_t *lock, unsigned long flags)
Fixes: bd31b85960a7 ("locking, ARM: Annotate low level hw locks as raw")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/mtd/maps/dc21285.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/mtd/maps/dc21285.c
+++ b/drivers/mtd/maps/dc21285.c
@@ -38,9 +38,9 @@ static void nw_en_write(void)
* we want to write a bit pattern XXX1 to Xilinx to enable
* the write gate, which will be open for about the next 2ms.
*/
- spin_lock_irqsave(&nw_gpio_lock, flags);
+ raw_spin_lock_irqsave(&nw_gpio_lock, flags);
nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE);
- spin_unlock_irqrestore(&nw_gpio_lock, flags);
+ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags);
/*
* let the ISA bus to catch on...
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 020/110] SUNRPC: Fix a memory leak in the backchannel code
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (10 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 014/110] mtd: dc21285: use raw spinlock functions for nw_gpio_lock Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 003/110] [media] cx24116: fix a buffer overflow when checking userspace params Ben Hutchings
` (99 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Trond Myklebust
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit 88de6af24f2b48b06c514d3c3d0a8f22fafe30bd upstream.
req->rq_private_buf isn't initialised when xprt_setup_backchannel calls
xprt_free_allocation.
Fixes: fb7a0b9addbdb ("nfs41: New backchannel helper routines")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/sunrpc/backchannel_rqst.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -59,7 +59,7 @@ static void xprt_free_allocation(struct
dprintk("RPC: free allocations for req= %p\n", req);
BUG_ON(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
- xbufp = &req->rq_private_buf;
+ xbufp = &req->rq_rcv_buf;
free_page((unsigned long)xbufp->head[0].iov_base);
xbufp = &req->rq_snd_buf;
free_page((unsigned long)xbufp->head[0].iov_base);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 003/110] [media] cx24116: fix a buffer overflow when checking userspace params
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (11 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 020/110] SUNRPC: Fix a memory leak in the backchannel code Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 019/110] NFS: Fix size of NFSACL SETACL operations Ben Hutchings
` (98 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mauro Carvalho Chehab
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
commit 1fa2337a315a2448c5434f41e00d56b01a22283c upstream.
The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up much more values:
drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/dvb/frontends/cx24116.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/media/dvb/frontends/cx24116.c
+++ b/drivers/media/dvb/frontends/cx24116.c
@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struc
struct cx24116_state *state = fe->demodulator_priv;
int i, ret;
+ /* Validate length */
+ if (d->msg_len > sizeof(d->msg))
+ return -EINVAL;
+
/* Dump DiSEqC message */
if (debug) {
printk(KERN_INFO "cx24116: %s(", __func__);
@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struc
printk(") toneburst=%d\n", toneburst);
}
- /* Validate length */
- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS))
- return -EINVAL;
-
/* DiSEqC message */
for (i = 0; i < d->msg_len; i++)
state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 019/110] NFS: Fix size of NFSACL SETACL operations
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (12 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 003/110] [media] cx24116: fix a buffer overflow when checking userspace params Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 025/110] cdc-acm: Add support of ATOL FPrint fiscal printers Ben Hutchings
` (97 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Trond Myklebust, Chuck Lever
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit d683cc49daf7c5afca8cd9654aaa1bf63cdf2ad9 upstream.
When encoding the NFSACL SETACL operation, reserve just the estimated
size of the ACL rather than a fixed maximum. This eliminates needless
zero padding on the wire that the server ignores.
Fixes: ee5dc7732bd5 ('NFS: Fix "kernel BUG at fs/nfs/nfs3xdr.c:1338!"')
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/nfs/nfs3xdr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -1333,7 +1333,7 @@ static void nfs3_xdr_enc_setacl3args(str
if (args->npages != 0)
xdr_write_pages(xdr, args->pages, 0, args->len);
else
- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
+ xdr_reserve_space(xdr, args->len);
error = nfsacl_encode(xdr->buf, base, args->inode,
(args->mask & NFS_ACL) ?
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 025/110] cdc-acm: Add support of ATOL FPrint fiscal printers
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (13 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 019/110] NFS: Fix size of NFSACL SETACL operations Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 022/110] ath3k: Add support of 0489:e076 AR3012 device Ben Hutchings
` (96 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Alexey Sokolov, Greg Kroah-Hartman
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Sokolov <sokolov@7pikes.com>
commit 15bf722e6f6c0b884521a0363204532e849deb7f upstream.
ATOL FPrint fiscal printers require usb_clear_halt to be executed
to work properly. Add quirk to fix the issue.
Signed-off-by: Alexey Sokolov <sokolov@7pikes.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/class/cdc-acm.c | 9 +++++++++
drivers/usb/class/cdc-acm.h | 1 +
2 files changed, 10 insertions(+)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1295,6 +1295,11 @@ skip_countries:
acm_table[minor] = acm;
+ if (quirks & CLEAR_HALT_CONDITIONS) {
+ usb_clear_halt(usb_dev, usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress));
+ usb_clear_halt(usb_dev, usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress));
+ }
+
return 0;
alloc_fail7:
for (i = 0; i < ACM_NW; i++)
@@ -1574,6 +1579,10 @@ static const struct usb_device_id acm_id
.driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
},
+ { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
+ .driver_info = CLEAR_HALT_CONDITIONS,
+ },
+
/* Nokia S60 phones expose two ACM channels. The first is
* a modem and is picked up by the standard AT-command
* information below. The second is 'vendor-specific' but
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -127,3 +127,4 @@ struct acm {
#define NO_CAP_LINE 4
#define NOT_A_MODEM 8
#define NO_DATA_INTERFACE 16
+#define CLEAR_HALT_CONDITIONS BIT(7)
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 022/110] ath3k: Add support of 0489:e076 AR3012 device
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (14 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 025/110] cdc-acm: Add support of ATOL FPrint fiscal printers Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 002/110] [media] s5h1420: fix a buffer overflow when checking userspace params Ben Hutchings
` (95 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Dmitry Tunin, Marcel Holtmann
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <hanipouspilot@gmail.com>
commit 692c062e7c282164fd7cda68077f79dafd176eaf upstream.
BugLink: https://bugs.launchpad.net/bugs/1462614
This device requires new firmware files
AthrBT_0x11020100.dfu and ramps_0x11020100_40.dfu added to
/lib/firmware/ar3k/ that are not included in linux-firmware yet.
T: Bus=03 Lev=01 Prnt=01 Port=09 Cnt=06 Dev#= 7 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0489 ProdID=e076 Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/bluetooth/ath3k.c | 2 ++
drivers/bluetooth/btusb.c | 1 +
2 files changed, 3 insertions(+)
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -78,6 +78,7 @@ static struct usb_device_id ath3k_table[
{ USB_DEVICE(0x0489, 0xe057) },
{ USB_DEVICE(0x0489, 0xe056) },
{ USB_DEVICE(0x0489, 0xe05f) },
+ { USB_DEVICE(0x0489, 0xe076) },
{ USB_DEVICE(0x0489, 0xe078) },
{ USB_DEVICE(0x04c5, 0x1330) },
{ USB_DEVICE(0x04CA, 0x3004) },
@@ -133,6 +134,7 @@ static struct usb_device_id ath3k_blist_
{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -163,6 +163,7 @@ static struct usb_device_id blacklist_ta
{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 002/110] [media] s5h1420: fix a buffer overflow when checking userspace params
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (15 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 022/110] ath3k: Add support of 0489:e076 AR3012 device Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 006/110] ASoC: wm8737: Fixup setting VMID Impedance control register Ben Hutchings
` (94 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mauro Carvalho Chehab
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
commit 12f4543f5d6811f864e6c4952eb27253c7466c02 upstream.
The maximum size for a DiSEqC command is 6, according to the
userspace API. However, the code allows to write up to 7 values:
drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/dvb/frontends/s5h1420.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/dvb/frontends/s5h1420.c
+++ b/drivers/media/dvb/frontends/s5h1420.c
@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (stru
int result = 0;
dprintk("enter %s\n", __func__);
- if (cmd->msg_len > 8)
+ if (cmd->msg_len > sizeof(cmd->msg))
return -EINVAL;
/* setup for DISEQC */
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 006/110] ASoC: wm8737: Fixup setting VMID Impedance control register
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (16 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 002/110] [media] s5h1420: fix a buffer overflow when checking userspace params Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 013/110] rcu: Correctly handle non-empty Tiny RCU callback list with none ready Ben Hutchings
` (93 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mark Brown, Axel Lin
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <axel.lin@ingics.com>
commit 14ba3ec1de043260cecd9e828ea2e3a0ad302893 upstream.
According to the datasheet:
R10 (0Ah) VMID Impedance Control
BIT 3:2 VMIDSEL DEFAULT 00
DESCRIPTION: VMID impedance selection control
00: 75kΩ output
01: 300kΩ output
10: 2.5kΩ output
WM8737_VMIDSEL_MASK is 0xC (VMIDSEL - [3:2]),
so it needs to left shift WM8737_VMIDSEL_SHIFT bits for setting these bits.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/soc/codecs/wm8737.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/sound/soc/codecs/wm8737.c
+++ b/sound/soc/codecs/wm8737.c
@@ -485,7 +485,8 @@ static int wm8737_set_bias_level(struct
/* Fast VMID ramp at 2*2.5k */
snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
- WM8737_VMIDSEL_MASK, 0x4);
+ WM8737_VMIDSEL_MASK,
+ 2 << WM8737_VMIDSEL_SHIFT);
/* Bring VMID up */
snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT,
@@ -499,7 +500,8 @@ static int wm8737_set_bias_level(struct
/* VMID at 2*300k */
snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
- WM8737_VMIDSEL_MASK, 2);
+ WM8737_VMIDSEL_MASK,
+ 1 << WM8737_VMIDSEL_SHIFT);
break;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 013/110] rcu: Correctly handle non-empty Tiny RCU callback list with none ready
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (17 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 006/110] ASoC: wm8737: Fixup setting VMID Impedance control register Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 021/110] ipr: Increase default adapter init stage change timeout Ben Hutchings
` (92 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Paul E. McKenney, Josh Triplett
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
commit 6e91f8cb138625be96070b778d9ba71ce520ea7e upstream.
If, at the time __rcu_process_callbacks() is invoked, there are callbacks
in Tiny RCU's callback list, but none of them are ready to be invoked,
the current list-management code will knit the non-ready callbacks out
of the list. This can result in hangs and possibly worse. This commit
therefore inserts a check for there being no callbacks that can be
invoked immediately.
This bug is unlikely to occur -- you have to get a new callback between
the time rcu_sched_qs() or rcu_bh_qs() was called, but before we get to
__rcu_process_callbacks(). It was detected by the addition of RCU-bh
testing to rcutorture, which in turn was instigated by Iftekhar Ahmed's
mutation testing. Although this bug was made much more likely by
915e8a4fe45e (rcu: Remove fastpath from __rcu_process_callbacks()), this
did not cause the bug, but rather made it much more probable. That
said, it takes more than 40 hours of rcutorture testing, on average,
for this bug to appear, so this fix cannot be considered an emergency.
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reviewed-by: Josh Triplett <josh@joshtriplett.org>
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/rcutiny.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/kernel/rcutiny.c
+++ b/kernel/rcutiny.c
@@ -160,6 +160,11 @@ static void __rcu_process_callbacks(stru
/* Move the ready-to-invoke callbacks to a local list. */
local_irq_save(flags);
+ if (rcp->donetail == &rcp->rcucblist) {
+ /* No callbacks ready, so just leave. */
+ local_irq_restore(flags);
+ return;
+ }
RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, -1));
list = rcp->rcucblist;
rcp->rcucblist = *rcp->donetail;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 021/110] ipr: Increase default adapter init stage change timeout
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (18 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 013/110] rcu: Correctly handle non-empty Tiny RCU callback list with none ready Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 017/110] staging: vt6655: device_rx_srv check sk_buff is NULL Ben Hutchings
` (91 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, James Bottomley, Brian King
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit 45c44b5ff9caa743ed9c2bfd44307c536c9caf1e upstream.
Increase the default init stage change timeout from 15 seconds to 30 seconds.
This resolves issues we have seen with some adapters not transitioning
to the first init stage within 15 seconds, which results in adapter
initialization failures.
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/scsi/ipr.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -251,7 +251,7 @@
#define IPR_RUNTIME_RESET 0x40000000
#define IPR_IPL_INIT_MIN_STAGE_TIME 5
-#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15
+#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30
#define IPR_IPL_INIT_STAGE_UNKNOWN 0x0
#define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000
#define IPR_IPL_INIT_STAGE_MASK 0xff000000
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 017/110] staging: vt6655: device_rx_srv check sk_buff is NULL
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (19 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 021/110] ipr: Increase default adapter init stage change timeout Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 015/110] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe Ben Hutchings
` (90 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Malcolm Priestley, Greg Kroah-Hartman
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <tvboxspy@gmail.com>
commit b5eeed8cb6097c8ea660b6598d36fdbb94065a22 upstream.
There is a small chance that pRD->pRDInfo->skb could go NULL
while the interrupt is processing.
Put NULL check on loop to break out.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context, indentation]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/vt6655/device_main.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -1602,6 +1602,10 @@ static int device_rx_srv(PSDevice pDevic
// DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "pDevice->pCurrRD = %x, works = %d\n", pRD, works);
if (works++>15)
break;
+
+ if (!pRD->pRDInfo->skb)
+ break;
+
if (device_receive_frame(pDevice, pRD)) {
if (!device_alloc_rx_buf(pDevice,pRD)) {
DBG_PRT(MSG_LEVEL_ERR, KERN_ERR
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 015/110] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (20 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 017/110] staging: vt6655: device_rx_srv check sk_buff is NULL Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 004/110] mtd: fix: avoid race condition when accessing mtd->usecount Ben Hutchings
` (89 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Larry Finger, Greg Kroah-Hartman, Haggai Eran
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Haggai Eran <haggai.eran@gmail.com>
commit cab462140f8a183e3cca0b51c8b59ef715cb6148 upstream.
With an RTL8191SU USB adaptor, sometimes the hints for a fragmented
packet are set, but the packet length is too large. Allocate enough
space to prevent memory corruption and a resulting kernel panic [1].
[1] http://www.spinics.net/lists/linux-wireless/msg136546.html
Signed-off-by: Haggai Eran <haggai.eran@gmail.com>
ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/rtl8712/rtl8712_recv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/staging/rtl8712/rtl8712_recv.c
+++ b/drivers/staging/rtl8712/rtl8712_recv.c
@@ -1076,7 +1076,8 @@ static int recvbuf2recvframe(struct _ada
/* for first fragment packet, driver need allocate 1536 +
* drvinfo_sz + RXDESC_SIZE to defrag packet. */
if ((mf == 1) && (frag == 0))
- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
+ /*1658+6=1664, 1664 is 128 alignment.*/
+ alloc_sz = max_t(u16, tmp_len, 1658);
else
alloc_sz = tmp_len;
/* 2 is for IP header 4 bytes alignment in QoS packet case.
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 004/110] mtd: fix: avoid race condition when accessing mtd->usecount
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (21 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 015/110] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 012/110] usb: dwc3: gadget: return error if command sent to DEPCMD register fails Ben Hutchings
` (88 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Alexander Sverdlin, Brian Norris, Giuseppe Cantavenera,
Zhang Xingcai
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <computersforpeace@gmail.com>
commit 073db4a51ee43ccb827f54a4261c0583b028d5ab upstream.
On A MIPS 32-cores machine a BUG_ON was triggered because some acesses to
mtd->usecount were done without taking mtd_table_mutex.
kernel: Call Trace:
kernel: [<ffffffff80401818>] __put_mtd_device+0x20/0x50
kernel: [<ffffffff804086f4>] blktrans_release+0x8c/0xd8
kernel: [<ffffffff802577e0>] __blkdev_put+0x1a8/0x200
kernel: [<ffffffff802579a4>] blkdev_close+0x1c/0x30
kernel: [<ffffffff8022006c>] __fput+0xac/0x250
kernel: [<ffffffff80171208>] task_work_run+0xd8/0x120
kernel: [<ffffffff8012c23c>] work_notifysig+0x10/0x18
kernel:
kernel:
Code: 2442ffff ac8202d8 000217fe <00020336> dc820128 10400003
00000000 0040f809 00000000
kernel: ---[ end trace 080fbb4579b47a73 ]---
Fixed by taking the mutex in blktrans_open and blktrans_release.
Note that this locking is already suggested in
include/linux/mtd/blktrans.h:
struct mtd_blktrans_ops {
...
/* Called with mtd_table_mutex held; no race with add/remove */
int (*open)(struct mtd_blktrans_dev *dev);
void (*release)(struct mtd_blktrans_dev *dev);
...
};
But we weren't following it.
Originally reported by (and patched by) Zhang and Giuseppe,
independently. Improved and rewritten.
Reported-by: Zhang Xingcai <zhangxingcai@huawei.com>
Reported-by: Giuseppe Cantavenera <giuseppe.cantavenera.ext@nokia.com>
Tested-by: Giuseppe Cantavenera <giuseppe.cantavenera.ext@nokia.com>
Acked-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/mtd/mtd_blkdevs.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -214,6 +214,7 @@ static int blktrans_open(struct block_de
return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/
mutex_lock(&dev->lock);
+ mutex_lock(&mtd_table_mutex);
if (dev->open)
goto unlock;
@@ -236,6 +237,7 @@ static int blktrans_open(struct block_de
unlock:
dev->open++;
+ mutex_unlock(&mtd_table_mutex);
mutex_unlock(&dev->lock);
blktrans_dev_put(dev);
return ret;
@@ -246,6 +248,7 @@ error_release:
error_put:
module_put(dev->tr->owner);
kref_put(&dev->ref, blktrans_dev_release);
+ mutex_unlock(&mtd_table_mutex);
mutex_unlock(&dev->lock);
blktrans_dev_put(dev);
return ret;
@@ -260,6 +263,7 @@ static int blktrans_release(struct gendi
return ret;
mutex_lock(&dev->lock);
+ mutex_lock(&mtd_table_mutex);
if (--dev->open)
goto unlock;
@@ -272,6 +276,7 @@ static int blktrans_release(struct gendi
__put_mtd_device(dev->mtd);
}
unlock:
+ mutex_unlock(&mtd_table_mutex);
mutex_unlock(&dev->lock);
blktrans_dev_put(dev);
return ret;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 012/110] usb: dwc3: gadget: return error if command sent to DEPCMD register fails
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (22 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 004/110] mtd: fix: avoid race condition when accessing mtd->usecount Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 024/110] ath9k: fix DMA stop sequence for AR9003+ Ben Hutchings
` (87 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Subbaraya Sundeep Bhatta, Subbaraya Sundeep Bhatta,
Felipe Balbi
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>
commit 76e838c9f7765f9a6205b4d558d75a66104bc60d upstream.
We need to return error to caller if command is not sent to
controller succesfully.
Signed-off-by: Subbaraya Sundeep Bhatta <sbhatta@xilinx.com>
Fixes: 72246da40f37 (usb: Introduce DesignWare USB3 DRD Driver)
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/dwc3/gadget.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -171,6 +171,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3
if (!(reg & DWC3_DEPCMD_CMDACT)) {
dev_vdbg(dwc->dev, "Command Complete --> %d\n",
DWC3_DEPCMD_STATUS(reg));
+ if (DWC3_DEPCMD_STATUS(reg))
+ return -EINVAL;
return 0;
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 024/110] ath9k: fix DMA stop sequence for AR9003+
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (23 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 012/110] usb: dwc3: gadget: return error if command sent to DEPCMD register fails Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 007/110] ASoC: wm8903: Fix define for WM8903_VMID_RES_250K Ben Hutchings
` (86 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Felix Fietkau, Kalle Valo
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@openwrt.org>
commit 300f77c08ded96d33f492aaa02549103852f0c12 upstream.
AR93xx and newer needs to stop rx before tx to avoid getting the DMA
engine or MAC into a stuck state.
This should reduce/fix the occurence of "Failed to stop Tx DMA" logspam.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
[bwh: Backported to 3.2:
- Also move initialisation of ret to match upstream
- ath_drain_all_txq() takes a second parameter]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/wireless/ath/ath9k/main.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -235,7 +235,7 @@ static bool ath_prepare_reset(struct ath
{
struct ath_hw *ah = sc->sc_ah;
struct ath_common *common = ath9k_hw_common(ah);
- bool ret;
+ bool ret = true;
ieee80211_stop_queues(sc->hw);
@@ -245,10 +245,13 @@ static bool ath_prepare_reset(struct ath
ath9k_debug_samp_bb_mac(sc);
ath9k_hw_disable_interrupts(ah);
- ret = ath_drain_all_txq(sc, retry_tx);
-
- if (!ath_stoprecv(sc))
- ret = false;
+ if (AR_SREV_9300_20_OR_LATER(ah)) {
+ ret &= ath_stoprecv(sc);
+ ret &= ath_drain_all_txq(sc, retry_tx);
+ } else {
+ ret &= ath_drain_all_txq(sc, retry_tx);
+ ret &= ath_stoprecv(sc);
+ }
if (!flush) {
if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 007/110] ASoC: wm8903: Fix define for WM8903_VMID_RES_250K
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (24 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 024/110] ath9k: fix DMA stop sequence for AR9003+ Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 005/110] crypto: talitos - avoid memleak in talitos_alg_alloc() Ben Hutchings
` (85 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mark Brown, Axel Lin
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <axel.lin@ingics.com>
commit ebb6ad73e645b8f2d098dd3c41d2ff0da4146a02 upstream.
VMID Control 0 BIT[2:1] is VMID Divider Enable and Select
00 = VMID disabled (for OFF mode)
01 = 2 x 50kΩ divider (for normal operation)
10 = 2 x 250kΩ divider (for low power standby)
11 = 2 x 5kΩ divider (for fast start-up)
So WM8903_VMID_RES_250K should be 2 << 1, which is 4.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/soc/codecs/wm8903.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/codecs/wm8903.h
+++ b/sound/soc/codecs/wm8903.h
@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_
#define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */
#define WM8903_VMID_RES_50K 2
-#define WM8903_VMID_RES_250K 3
+#define WM8903_VMID_RES_250K 4
#define WM8903_VMID_RES_5K 6
/*
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 005/110] crypto: talitos - avoid memleak in talitos_alg_alloc()
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (25 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 007/110] ASoC: wm8903: Fix define for WM8903_VMID_RES_250K Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 029/110] ext4: fix race between truncate and __ext4_journalled_writepage() Ben Hutchings
` (84 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Horia Geant?, Herbert Xu
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Horia Geant? <horia.geanta@freescale.com>
commit 5fa7dadc898567ce14d6d6d427e7bd8ce6eb5d39 upstream.
Fixes: 1d11911a8c57 ("crypto: talitos - fix warning: 'alg' may be used uninitialized in this function")
Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/crypto/talitos.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -2384,6 +2384,7 @@ static struct talitos_crypto_alg *talito
break;
default:
dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type);
+ kfree(t_alg);
return ERR_PTR(-EINVAL);
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 029/110] ext4: fix race between truncate and __ext4_journalled_writepage()
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (26 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 005/110] crypto: talitos - avoid memleak in talitos_alg_alloc() Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 009/110] pktgen: adjust spacing in proc file interface output Ben Hutchings
` (83 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Theodore Ts'o
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit bdf96838aea6a265f2ae6cbcfb12a778c84a0b8e upstream.
The commit cf108bca465d: "ext4: Invert the locking order of page_lock
and transaction start" caused __ext4_journalled_writepage() to drop
the page lock before the page was written back, as part of changing
the locking order to jbd2_journal_start -> page_lock. However, this
introduced a potential race if there was a truncate racing with the
data=journalled writeback mode.
Fix this by grabbing the page lock after starting the journal handle,
and then checking to see if page had gotten truncated out from under
us.
This fixes a number of different warnings or BUG_ON's when running
xfstests generic/086 in data=journalled mode, including:
jbd2_journal_dirty_metadata: vdc-8: bad jh for block 115643: transaction (ee3fe7
c0, 164), jh->b_transaction ( (null), 0), jh->b_next_transaction ( (null), 0), jlist 0
- and -
kernel BUG at /usr/projects/linux/ext4/fs/jbd2/transaction.c:2200!
...
Call Trace:
[<c02b2ded>] ? __ext4_journalled_invalidatepage+0x117/0x117
[<c02b2de5>] __ext4_journalled_invalidatepage+0x10f/0x117
[<c02b2ded>] ? __ext4_journalled_invalidatepage+0x117/0x117
[<c027d883>] ? lock_buffer+0x36/0x36
[<c02b2dfa>] ext4_journalled_invalidatepage+0xd/0x22
[<c0229139>] do_invalidatepage+0x22/0x26
[<c0229198>] truncate_inode_page+0x5b/0x85
[<c022934b>] truncate_inode_pages_range+0x156/0x38c
[<c0229592>] truncate_inode_pages+0x11/0x15
[<c022962d>] truncate_pagecache+0x55/0x71
[<c02b913b>] ext4_setattr+0x4a9/0x560
[<c01ca542>] ? current_kernel_time+0x10/0x44
[<c026c4d8>] notify_change+0x1c7/0x2be
[<c0256a00>] do_truncate+0x65/0x85
[<c0226f31>] ? file_ra_state_init+0x12/0x29
- and -
WARNING: CPU: 1 PID: 1331 at /usr/projects/linux/ext4/fs/jbd2/transaction.c:1396
irty_metadata+0x14a/0x1ae()
...
Call Trace:
[<c01b879f>] ? console_unlock+0x3a1/0x3ce
[<c082cbb4>] dump_stack+0x48/0x60
[<c0178b65>] warn_slowpath_common+0x89/0xa0
[<c02ef2cf>] ? jbd2_journal_dirty_metadata+0x14a/0x1ae
[<c0178bef>] warn_slowpath_null+0x14/0x18
[<c02ef2cf>] jbd2_journal_dirty_metadata+0x14a/0x1ae
[<c02d8615>] __ext4_handle_dirty_metadata+0xd4/0x19d
[<c02b2f44>] write_end_fn+0x40/0x53
[<c02b4a16>] ext4_walk_page_buffers+0x4e/0x6a
[<c02b59e7>] ext4_writepage+0x354/0x3b8
[<c02b2f04>] ? mpage_release_unused_pages+0xd4/0xd4
[<c02b1b21>] ? wait_on_buffer+0x2c/0x2c
[<c02b5a4b>] ? ext4_writepage+0x3b8/0x3b8
[<c02b5a5b>] __writepage+0x10/0x2e
[<c0225956>] write_cache_pages+0x22d/0x32c
[<c02b5a4b>] ? ext4_writepage+0x3b8/0x3b8
[<c02b6ee8>] ext4_writepages+0x102/0x607
[<c019adfe>] ? sched_clock_local+0x10/0x10e
[<c01a8a7c>] ? __lock_is_held+0x2e/0x44
[<c01a8ad5>] ? lock_is_held+0x43/0x51
[<c0226dff>] do_writepages+0x1c/0x29
[<c0276bed>] __writeback_single_inode+0xc3/0x545
[<c0277c07>] writeback_sb_inodes+0x21f/0x36d
...
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ext4/inode.c | 23 +++++++++++++++++++----
1 file changed, 19 insertions(+), 4 deletions(-)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1849,18 +1849,31 @@ static int __ext4_journalled_writepage(s
page_bufs = page_buffers(page);
BUG_ON(!page_bufs);
walk_page_buffers(handle, page_bufs, 0, len, NULL, bget_one);
- /* As soon as we unlock the page, it can go away, but we have
- * references to buffers so we are safe */
+ /*
+ * We need to release the page lock before we start the
+ * journal, so grab a reference so the page won't disappear
+ * out from under us.
+ */
+ get_page(page);
unlock_page(page);
handle = ext4_journal_start(inode, ext4_writepage_trans_blocks(inode));
if (IS_ERR(handle)) {
ret = PTR_ERR(handle);
- goto out;
+ put_page(page);
+ goto out_no_pagelock;
}
-
BUG_ON(!ext4_handle_valid(handle));
+ lock_page(page);
+ put_page(page);
+ if (page->mapping != mapping) {
+ /* The page got truncated from under us */
+ ext4_journal_stop(handle);
+ ret = 0;
+ goto out;
+ }
+
ret = walk_page_buffers(handle, page_bufs, 0, len, NULL,
do_journal_get_write_access);
@@ -1876,6 +1889,8 @@ static int __ext4_journalled_writepage(s
walk_page_buffers(handle, page_bufs, 0, len, NULL, bput_one);
ext4_set_inode_state(inode, EXT4_STATE_JDATA);
out:
+ unlock_page(page);
+out_no_pagelock:
return ret;
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 009/110] pktgen: adjust spacing in proc file interface output
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (27 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 029/110] ext4: fix race between truncate and __ext4_journalled_writepage() Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 043/110] watchdog: omap: assert the counter being stopped before reprogramming Ben Hutchings
` (82 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jesper Dangaard Brouer, David S. Miller
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jesper Dangaard Brouer <brouer@redhat.com>
commit d079abd181950a44cdf31daafd1662388a6c4d2e upstream.
Too many spaces were introduced in commit 63adc6fb8ac0 ("pktgen: cleanup
checkpatch warnings"), thus misaligning "src_min:" to other columns.
Fixes: 63adc6fb8ac0 ("pktgen: cleanup checkpatch warnings")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/core/pktgen.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -568,7 +568,7 @@ static int pktgen_if_show(struct seq_fil
" dst_min: %s dst_max: %s\n",
pkt_dev->dst_min, pkt_dev->dst_max);
seq_printf(seq,
- " src_min: %s src_max: %s\n",
+ " src_min: %s src_max: %s\n",
pkt_dev->src_min, pkt_dev->src_max);
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 043/110] watchdog: omap: assert the counter being stopped before reprogramming
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (28 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 009/110] pktgen: adjust spacing in proc file interface output Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 074/110] drm: add a check for x/y in drm_mode_setcrtc Ben Hutchings
` (81 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Guenter Roeck, Wim Van Sebroeck, Uwe Kleine-König
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
commit 530c11d432727c697629ad5f9d00ee8e2864d453 upstream.
The omap watchdog has the annoying behaviour that writes to most
registers don't have any effect when the watchdog is already running.
Quoting the AM335x reference manual:
To modify the timer counter value (the WDT_WCRR register),
prescaler ratio (the WDT_WCLR[4:2] PTV bit field), delay
configuration value (the WDT_WDLY[31:0] DLY_VALUE bit field), or
the load value (the WDT_WLDR[31:0] TIMER_LOAD bit field), the
watchdog timer must be disabled by using the start/stop sequence
(the WDT_WSPR register).
Currently the timer is stopped in the .probe callback but still there
are possibilities that yield to a situation where omap_wdt_start is
entered with the timer running (e.g. when /dev/watchdog is closed
without stopping and then reopened). In such a case programming the
timeout silently fails!
To circumvent this stop the timer before reprogramming.
Assuming one of the first things the watchdog user does is setting the
timeout explicitly nothing too bad should happen because this explicit
setting works fine.
Fixes: 7768a13c252a ("[PATCH] OMAP: Add Watchdog driver support")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/watchdog/omap_wdt.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/watchdog/omap_wdt.c
+++ b/drivers/watchdog/omap_wdt.c
@@ -150,6 +150,13 @@ static int omap_wdt_open(struct inode *i
pm_runtime_get_sync(wdev->dev);
+ /*
+ * Make sure the watchdog is disabled. This is unfortunately required
+ * because writing to various registers with the watchdog running has no
+ * effect.
+ */
+ omap_wdt_disable(wdev);
+
/* initialize prescaler */
while (__raw_readl(base + OMAP_WATCHDOG_WPS) & 0x01)
cpu_relax();
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 074/110] drm: add a check for x/y in drm_mode_setcrtc
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (29 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 043/110] watchdog: omap: assert the counter being stopped before reprogramming Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 086/110] libata: force disable trim for SuperSSpeed S238 Ben Hutchings
` (80 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Zhao Junwang, Daniel Vetter
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Junwang <zhjwpku@gmail.com>
commit 01447e9f04ba1c49a9534ae6a5a6f26c2bb05226 upstream.
legacy setcrtc ioctl does take a 32 bit value which might indeed
overflow
the checks of crtc_req->x > INT_MAX and crtc_req->y > INT_MAX aren't
needed any more with this
v2: -polish the annotation according to Daniel's comment
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Zhao Junwang <zhjwpku@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpu/drm/drm_crtc.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1505,8 +1505,11 @@ int drm_mode_setcrtc(struct drm_device *
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EINVAL;
- /* For some reason crtc x/y offsets are signed internally. */
- if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
+ /*
+ * Universal plane src offsets are only 16.16, prevent havoc for
+ * drivers using universal plane code internally.
+ */
+ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
return -ERANGE;
mutex_lock(&dev->mode_config.mutex);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 086/110] libata: force disable trim for SuperSSpeed S238
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (30 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 074/110] drm: add a check for x/y in drm_mode_setcrtc Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 099/110] xhci: do not report PLC when link is in internal resume state Ben Hutchings
` (79 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Tejun Heo, Arne Fitzenreiter
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arne Fitzenreiter <arne_f@ipfire.org>
commit cda57b1b05cf7b8b99ab4b732bea0b05b6c015cc upstream.
This device loses blocks, often the partition table area, on trim.
Disable TRIM.
http://pcengines.ch/msata16a.htm
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/ata/libata-core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4155,6 +4155,9 @@ static const struct ata_blacklist_entry
{ "PIONEER DVD-RW DVR-212D", NULL, ATA_HORKAGE_NOSETXFER },
{ "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER },
+ /* devices that don't properly handle TRIM commands */
+ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, },
+
/*
* Some WD SATA-I drives spin up and down erratically when the link
* is put into the slumber mode. We don't have full list of the
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 099/110] xhci: do not report PLC when link is in internal resume state
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (31 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 086/110] libata: force disable trim for SuperSSpeed S238 Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 037/110] nfs: increase size of EXCHANGE_ID name string buffer Ben Hutchings
` (78 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Zhuang Jin Can, Greg Kroah-Hartman, Mathias Nyman
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Zhuang Jin Can <jin.can.zhuang@intel.com>
commit aca3a0489ac019b58cf32794d5362bb284cb9b94 upstream.
Port link change with port in resume state should not be
reported to usbcore, as this is an internal state to be
handled by xhci driver. Reporting PLC to usbcore may
cause usbcore clearing PLC first and port change event irq
won't be generated.
Signed-off-by: Zhuang Jin Can <jin.can.zhuang@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2:
- Adjust indentation
- s/raw_port_status/temp/]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci-hub.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -595,7 +595,14 @@ int xhci_hub_control(struct usb_hcd *hcd
status |= USB_PORT_STAT_C_RESET << 16;
/* USB3.0 only */
if (hcd->speed == HCD_USB3) {
- if ((temp & PORT_PLC))
+ /* Port link change with port in resume state should not be
+ * reported to usbcore, as this is an internal state to be
+ * handled by xhci driver. Reporting PLC to usbcore may
+ * cause usbcore clearing PLC first and port change event
+ * irq won't be generated.
+ */
+ if ((temp & PORT_PLC) &&
+ (temp & PORT_PLS_MASK) != XDEV_RESUME)
status |= USB_PORT_STAT_C_LINK_STATE << 16;
if ((temp & PORT_WRC))
status |= USB_PORT_STAT_C_BH_RESET << 16;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 037/110] nfs: increase size of EXCHANGE_ID name string buffer
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (32 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 099/110] xhci: do not report PLC when link is in internal resume state Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 083/110] ata: pmp: add quirk for Marvell 4140 SATA PMP Ben Hutchings
` (77 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Michael Skralivetsky, Jeff Layton, Jeff Layton,
Trond Myklebust
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@poochiereds.net>
commit 764ad8ba8cd4c6f836fca9378f8c5121aece0842 upstream.
The current buffer is much too small if you have a relatively long
hostname. Bring it up to the size of the one that SETCLIENTID has.
Reported-by: Michael Skralivetsky <michael.skralivetsky@primarydata.com>
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/linux/nfs_xdr.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1056,7 +1056,7 @@ struct nfs_impl_id4 {
struct nfstime4 date;
};
-#define NFS4_EXCHANGE_ID_LEN (48)
+#define NFS4_EXCHANGE_ID_LEN (127)
struct nfs41_exchange_id_args {
struct nfs_client *client;
nfs4_verifier *verifier;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 083/110] ata: pmp: add quirk for Marvell 4140 SATA PMP
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (33 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 037/110] nfs: increase size of EXCHANGE_ID name string buffer Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 087/110] libata: increase the timeout when setting transfer mode Ben Hutchings
` (76 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Tejun Heo, Nadav Haklai, Lior Amsalem, Thomas Petazzoni
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Lior Amsalem <alior@marvell.com>
commit 945b47441d83d2392ac9f984e0267ad521f24268 upstream.
This commit adds the necessary quirk to make the Marvell 4140 SATA PMP
work properly. This PMP doesn't like SRST on port number 4 (the host
port) so this commit marks this port as not supporting SRST.
Signed-off-by: Lior Amsalem <alior@marvell.com>
Reviewed-by: Nadav Haklai <nadavh@marvell.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/ata/libata-pmp.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_p
ATA_LFLAG_NO_SRST |
ATA_LFLAG_ASSUME_ATA;
}
+ } else if (vendor == 0x11ab && devid == 0x4140) {
+ /* Marvell 4140 quirks */
+ ata_for_each_link(link, ap, EDGE) {
+ /* port 4 is for SEMB device and it doesn't like SRST */
+ if (link->pmp == 4)
+ link->flags |= ATA_LFLAG_DISABLED;
+ }
}
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 087/110] libata: increase the timeout when setting transfer mode
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (34 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 083/110] ata: pmp: add quirk for Marvell 4140 SATA PMP Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 091/110] drm/radeon: Don't flush the GART TLB if rdev->gart.ptr == NULL Ben Hutchings
` (75 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mikulas Patocka, Tejun Heo
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit d531be2ca2f27cca5f041b6a140504999144a617 upstream.
I have a ST4000DM000 disk. If Linux is booted while the disk is spun down,
the command that sets transfer mode causes the disk to spin up. The
spin-up takes longer than the default 5s timeout, so the command fails and
timeout is reported.
Fix this by increasing the timeout to 15s, which is enough for the disk to
spin up.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/ata/libata-core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4462,7 +4462,8 @@ static unsigned int ata_dev_set_xfermode
else /* In the ancient relic department - skip all of this */
return 0;
- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
+ /* On some disks, this command causes spin-up, so we need longer timeout */
+ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
DPRINTK("EXIT, err_mask=%x\n", err_mask);
return err_mask;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 091/110] drm/radeon: Don't flush the GART TLB if rdev->gart.ptr == NULL
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (35 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 087/110] libata: increase the timeout when setting transfer mode Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 108/110] drm/radeon/combios: add some validation of lvds values Ben Hutchings
` (74 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Alex Deucher, Christian König, Michel Dänzer
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michel Dänzer <michel.daenzer@amd.com>
commit 233709d2cd6bbaaeda0aeb8d11f6ca7f98563b39 upstream.
This can be the case when the GPU is powered off, e.g. via vgaswitcheroo
or runpm. When the GPU is powered up again, radeon_gart_table_vram_pin
flushes the TLB after setting rdev->gart.ptr to non-NULL.
Fixes panic on powering off R7xx GPUs.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=61529
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpu/drm/radeon/radeon_gart.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -171,8 +171,10 @@ void radeon_gart_unbind(struct radeon_de
}
}
}
- mb();
- radeon_gart_tlb_flush(rdev);
+ if (rdev->gart.ptr) {
+ mb();
+ radeon_gart_tlb_flush(rdev);
+ }
}
int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
@@ -217,8 +219,10 @@ int radeon_gart_bind(struct radeon_devic
}
}
}
- mb();
- radeon_gart_tlb_flush(rdev);
+ if (rdev->gart.ptr) {
+ mb();
+ radeon_gart_tlb_flush(rdev);
+ }
return 0;
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 108/110] drm/radeon/combios: add some validation of lvds values
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (36 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 091/110] drm/radeon: Don't flush the GART TLB if rdev->gart.ptr == NULL Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 088/110] datagram: Factor out sk queue referencing Ben Hutchings
` (73 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Alex Deucher
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 0a90a0cff9f429f886f423967ae053150dce9259 upstream.
Fixes a broken hsync start value uncovered by:
abc0b1447d4974963548777a5ba4a4457c82c426
(drm: Perform basic sanity checks on probed modes)
The driver handled the bad hsync start elsewhere, but
the above commit prevented it from getting added.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=91401
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpu/drm/radeon/radeon_combios.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -1259,10 +1259,15 @@ struct radeon_encoder_lvds *radeon_combi
if ((RBIOS16(tmp) == lvds->native_mode.hdisplay) &&
(RBIOS16(tmp + 2) == lvds->native_mode.vdisplay)) {
+ u32 hss = (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8;
+
+ if (hss > lvds->native_mode.hdisplay)
+ hss = (10 - 1) * 8;
+
lvds->native_mode.htotal = lvds->native_mode.hdisplay +
(RBIOS16(tmp + 17) - RBIOS16(tmp + 19)) * 8;
lvds->native_mode.hsync_start = lvds->native_mode.hdisplay +
- (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8;
+ hss;
lvds->native_mode.hsync_end = lvds->native_mode.hsync_start +
(RBIOS8(tmp + 23) * 8);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 088/110] datagram: Factor out sk queue referencing
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (37 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 108/110] drm/radeon/combios: add some validation of lvds values Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 048/110] mm: kmemleak: allow safe memory scanning during kmemleak disabling Ben Hutchings
` (72 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Pavel Emelyanov, David S. Miller, Eric Dumazet
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Emelyanov <xemul@parallels.com>
commit 4934b0329f7150dcb5f90506860e2db32274c755 upstream.
This makes lines shorter and simplifies further patching.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Prerequisite of "net: Clone skb before setting peeked flag"]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/core/datagram.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -180,18 +180,19 @@ struct sk_buff *__skb_recv_datagram(stru
* However, this function was correct in any case. 8)
*/
unsigned long cpu_flags;
+ struct sk_buff_head *queue = &sk->sk_receive_queue;
- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
- skb = skb_peek(&sk->sk_receive_queue);
+ spin_lock_irqsave(&queue->lock, cpu_flags);
+ skb = skb_peek(queue);
if (skb) {
*peeked = skb->peeked;
if (flags & MSG_PEEK) {
skb->peeked = 1;
atomic_inc(&skb->users);
} else
- __skb_unlink(skb, &sk->sk_receive_queue);
+ __skb_unlink(skb, queue);
}
- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
+ spin_unlock_irqrestore(&queue->lock, cpu_flags);
if (skb)
return skb;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 048/110] mm: kmemleak: allow safe memory scanning during kmemleak disabling
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (38 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 088/110] datagram: Factor out sk queue referencing Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 104/110] iscsi-target: Fix use-after-free during TPG session shutdown Ben Hutchings
` (71 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Linus Torvalds, Catalin Marinas, Vignesh Radhakrishnan
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <catalin.marinas@arm.com>
commit c5f3b1a51a591c18c8b33983908e7fdda6ae417e upstream.
The kmemleak scanning thread can run for minutes. Callbacks like
kmemleak_free() are allowed during this time, the race being taken care
of by the object->lock spinlock. Such lock also prevents a memory block
from being freed or unmapped while it is being scanned by blocking the
kmemleak_free() -> ... -> __delete_object() function until the lock is
released in scan_object().
When a kmemleak error occurs (e.g. it fails to allocate its metadata),
kmemleak_enabled is set and __delete_object() is no longer called on
freed objects. If kmemleak_scan is running at the same time,
kmemleak_free() no longer waits for the object scanning to complete,
allowing the corresponding memory block to be freed or unmapped (in the
case of vfree()). This leads to kmemleak_scan potentially triggering a
page fault.
This patch separates the kmemleak_free() enabling/disabling from the
overall kmemleak_enabled nob so that we can defer the disabling of the
object freeing tracking until the scanning thread completed. The
kmemleak_free_part() is deliberately ignored by this patch since this is
only called during boot before the scanning thread started.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>
Tested-by: Vignesh Radhakrishnan <vigneshr@codeaurora.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2:
- Adjust context
- Drop changes to kmemleak_free_percpu()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/kmemleak.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -192,6 +192,8 @@ static struct kmem_cache *scan_area_cach
/* set if tracing memory operations is enabled */
static atomic_t kmemleak_enabled = ATOMIC_INIT(0);
+/* same as above but only for the kmemleak_free() callback */
+static int kmemleak_free_enabled;
/* set in the late_initcall if there were no errors */
static atomic_t kmemleak_initialized = ATOMIC_INIT(0);
/* enables or disables early logging of the memory operations */
@@ -885,7 +887,7 @@ void __ref kmemleak_free(const void *ptr
{
pr_debug("%s(0x%p)\n", __func__, ptr);
- if (atomic_read(&kmemleak_enabled) && ptr && !IS_ERR(ptr))
+ if (kmemleak_free_enabled && ptr && !IS_ERR(ptr))
delete_object_full((unsigned long)ptr);
else if (atomic_read(&kmemleak_early_log))
log_early(KMEMLEAK_FREE, ptr, 0, 0);
@@ -1614,6 +1616,13 @@ static void kmemleak_do_cleanup(struct w
mutex_lock(&scan_mutex);
stop_scan_thread();
+ /*
+ * Once the scan thread has stopped, it is safe to no longer track
+ * object freeing. Ordering of the scan thread stopping and the memory
+ * accesses below is guaranteed by the kthread_stop() function.
+ */
+ kmemleak_free_enabled = 0;
+
rcu_read_lock();
list_for_each_entry_rcu(object, &object_list, object_list)
delete_object_full(object->pointer);
@@ -1640,6 +1649,8 @@ static void kmemleak_disable(void)
/* check whether it is too early for a kernel thread */
if (atomic_read(&kmemleak_initialized))
schedule_work(&cleanup_work);
+ else
+ kmemleak_free_enabled = 0;
pr_info("Kernel memory leak detector disabled\n");
}
@@ -1688,6 +1699,7 @@ void __init kmemleak_init(void)
if (!atomic_read(&kmemleak_error)) {
atomic_set(&kmemleak_enabled, 1);
atomic_set(&kmemleak_early_log, 0);
+ kmemleak_free_enabled = 1;
}
local_irq_restore(flags);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 104/110] iscsi-target: Fix use-after-free during TPG session shutdown
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (39 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 048/110] mm: kmemleak: allow safe memory scanning during kmemleak disabling Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 041/110] iio: DAC: ad5624r_spi: fix bit shift of output data value Ben Hutchings
` (70 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Sunilkumar Nadumuttlu, Nicholas Bellinger
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 417c20a9bdd1e876384127cf096d8ae8b559066c upstream.
This patch fixes a use-after-free bug in iscsit_release_sessions_for_tpg()
where se_portal_group->session_lock was incorrectly released/re-acquired
while walking the active se_portal_group->tpg_sess_list.
The can result in a NULL pointer dereference when iscsit_close_session()
shutdown happens in the normal path asynchronously to this code, causing
a bogus dereference of an already freed list entry to occur.
To address this bug, walk the session list checking for the same state
as before, but move entries to a local list to avoid dropping the lock
while walking the active list.
As before, signal using iscsi_session->session_restatement=1 for those
list entries to be released locally by iscsit_free_session() code.
Reported-by: Sunilkumar Nadumuttlu <sjn@datera.io>
Cc: Sunilkumar Nadumuttlu <sjn@datera.io>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/target/iscsi/iscsi_target.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4509,6 +4509,7 @@ int iscsit_release_sessions_for_tpg(stru
struct iscsi_session *sess;
struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
struct se_session *se_sess, *se_sess_tmp;
+ LIST_HEAD(free_list);
int session_count = 0;
spin_lock_bh(&se_tpg->session_lock);
@@ -4530,14 +4531,17 @@ int iscsit_release_sessions_for_tpg(stru
}
atomic_set(&sess->session_reinstatement, 1);
spin_unlock(&sess->conn_lock);
- spin_unlock_bh(&se_tpg->session_lock);
- iscsit_free_session(sess);
- spin_lock_bh(&se_tpg->session_lock);
+ list_move_tail(&se_sess->sess_list, &free_list);
+ }
+ spin_unlock_bh(&se_tpg->session_lock);
+ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
+ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
+
+ iscsit_free_session(sess);
session_count++;
}
- spin_unlock_bh(&se_tpg->session_lock);
pr_debug("Released %d iSCSI Session(s) from Target Portal"
" Group: %hu\n", session_count, tpg->tpgt);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 041/110] iio: DAC: ad5624r_spi: fix bit shift of output data value
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (40 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 104/110] iscsi-target: Fix use-after-free during TPG session shutdown Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 052/110] __bitmap_parselist: fix bug in empty string handling Ben Hutchings
` (69 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Lars-Peter Clausen, Jonathan Cameron, JM Friedt
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: JM Friedt <jmfriedt@femto-st.fr>
commit adfa969850ae93beca57f7527f0e4dc10cbe1309 upstream.
The value sent on the SPI bus is shifted by an erroneous number of bits.
The shift value was already computed in the iio_chan_spec structure and
hence subtracting this argument to 16 yields an erroneous data position
in the SPI stream.
Signed-off-by: JM Friedt <jmfriedt@femto-st.fr>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/iio/dac/ad5624r_spi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/staging/iio/dac/ad5624r_spi.c
+++ b/drivers/staging/iio/dac/ad5624r_spi.c
@@ -49,7 +49,7 @@ static const struct ad5624r_chip_info ad
};
static int ad5624r_spi_write(struct spi_device *spi,
- u8 cmd, u8 addr, u16 val, u8 len)
+ u8 cmd, u8 addr, u16 val, u8 shift)
{
u32 data;
u8 msg[3];
@@ -62,7 +62,7 @@ static int ad5624r_spi_write(struct spi_
* 14-, 12-bit input code followed by 0, 2, or 4 don't care bits,
* for the AD5664R, AD5644R, and AD5624R, respectively.
*/
- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len));
+ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift);
msg[0] = data >> 16;
msg[1] = data >> 8;
msg[2] = data;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 052/110] __bitmap_parselist: fix bug in empty string handling
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (41 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 041/110] iio: DAC: ad5624r_spi: fix bit shift of output data value Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 054/110] Btrfs: use kmem_cache_free when freeing entry in inode cache Ben Hutchings
` (68 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Rasmus Villemoes, Chris Metcalf, Linus Torvalds
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <cmetcalf@ezchip.com>
commit 2528a8b8f457d7432552d0e2b6f0f4046bb702f4 upstream.
bitmap_parselist("", &mask, nmaskbits) will erroneously set bit zero in
the mask. The same bug is visible in cpumask_parselist() since it is
layered on top of the bitmask code, e.g. if you boot with "isolcpus=",
you will actually end up with cpu zero isolated.
The bug was introduced in commit 4b060420a596 ("bitmap, irq: add
smp_affinity_list interface to /proc/irq") when bitmap_parselist() was
generalized to support userspace as well as kernelspace.
Fixes: 4b060420a596 ("bitmap, irq: add smp_affinity_list interface to /proc/irq")
Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
lib/bitmap.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -601,12 +601,12 @@ static int __bitmap_parselist(const char
unsigned a, b;
int c, old_c, totaldigits;
const char __user __force *ubuf = (const char __user __force *)buf;
- int exp_digit, in_range;
+ int at_start, in_range;
totaldigits = c = 0;
bitmap_zero(maskp, nmaskbits);
do {
- exp_digit = 1;
+ at_start = 1;
in_range = 0;
a = b = 0;
@@ -635,11 +635,10 @@ static int __bitmap_parselist(const char
break;
if (c == '-') {
- if (exp_digit || in_range)
+ if (at_start || in_range)
return -EINVAL;
b = 0;
in_range = 1;
- exp_digit = 1;
continue;
}
@@ -649,16 +648,18 @@ static int __bitmap_parselist(const char
b = b * 10 + (c - '0');
if (!in_range)
a = b;
- exp_digit = 0;
+ at_start = 0;
totaldigits++;
}
if (!(a <= b))
return -EINVAL;
if (b >= nmaskbits)
return -ERANGE;
- while (a <= b) {
- set_bit(a, maskp);
- a++;
+ if (!at_start) {
+ while (a <= b) {
+ set_bit(a, maskp);
+ a++;
+ }
}
} while (buflen && c == ',');
return 0;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 054/110] Btrfs: use kmem_cache_free when freeing entry in inode cache
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (42 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 052/110] __bitmap_parselist: fix bug in empty string handling Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 036/110] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq Ben Hutchings
` (67 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Filipe Manana, Chris Mason, David Sterba
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit c3f4a1685bb87e59c886ee68f7967eae07d4dffa upstream.
The free space entries are allocated using kmem_cache_zalloc(),
through __btrfs_add_free_space(), therefore we should use
kmem_cache_free() and not kfree() to avoid any confusion and
any potential problem. Looking at the kfree() definition at
mm/slab.c it has the following comment:
/*
* (...)
*
* Don't free memory not originally allocated by kmalloc()
* or you will run into trouble.
*/
So better be safe and use kmem_cache_free().
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/btrfs/inode-map.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -269,7 +269,7 @@ void btrfs_unpin_free_ino(struct btrfs_r
__btrfs_add_free_space(ctl, info->offset, count);
free:
rb_erase(&info->offset_index, rbroot);
- kfree(info);
+ kmem_cache_free(btrfs_free_space_cachep, info);
}
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 036/110] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (43 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 054/110] Btrfs: use kmem_cache_free when freeing entry in inode cache Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 033/110] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail() Ben Hutchings
` (66 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Ding Wang, Ulf Hansson
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ding Wang <justin.wang@spreadtrum.com>
commit 29535f7b797df35cc9b6b3bca635591cdd3dd2a8 upstream.
The current handler of MMC_BLK_CMD_ERR in mmc_blk_issue_rw_rq function
may cause new coming request permanent missing when the ongoing
request (previoulsy started) complete end.
The problem scenario is as follows:
(1) Request A is ongoing;
(2) Request B arrived, and finally mmc_blk_issue_rw_rq() is called;
(3) Request A encounters the MMC_BLK_CMD_ERR error;
(4) In the error handling of MMC_BLK_CMD_ERR, suppose mmc_blk_cmd_err()
end request A completed and return zero. Continue the error handling,
suppose mmc_blk_reset() reset device success;
(5) Continue the execution, while loop completed because variable ret
is zero now;
(6) Finally, mmc_blk_issue_rw_rq() return without processing request B.
The process related to the missing request may wait that IO request
complete forever, possibly crashing the application or hanging the system.
Fix this issue by starting new request when reset success.
Signed-off-by: Ding Wang <justin.wang@spreadtrum.com>
Fixes: 67716327eec7 ("mmc: block: add eMMC hardware reset support")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/mmc/card/block.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -1285,9 +1285,11 @@ static int mmc_blk_issue_rw_rq(struct mm
break;
case MMC_BLK_CMD_ERR:
ret = mmc_blk_cmd_err(md, card, brq, req, ret);
- if (!mmc_blk_reset(md, card->host, type))
- break;
- goto cmd_abort;
+ if (mmc_blk_reset(md, card->host, type))
+ goto cmd_abort;
+ if (!ret)
+ goto start_new_req;
+ break;
case MMC_BLK_RETRY:
if (retry++ < 5)
break;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 033/110] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail()
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (44 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 036/110] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 040/110] ext4: call sync_blockdev() before invalidate_bdev() in put_super() Ben Hutchings
` (65 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Theodore Ts'o, Dmitry Monakhov
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Monakhov <dmonakhov@openvz.org>
commit b4f1afcd068f6e533230dfed00782cd8a907f96b upstream.
jbd2_cleanup_journal_tail() can be invoked by jbd2__journal_start()
So allocations should be done with GFP_NOFS
[Full stack trace snipped from 3.10-rh7]
[<ffffffff815c4bd4>] dump_stack+0x19/0x1b
[<ffffffff8105dba1>] warn_slowpath_common+0x61/0x80
[<ffffffff8105dcca>] warn_slowpath_null+0x1a/0x20
[<ffffffff815c2142>] slab_pre_alloc_hook.isra.31.part.32+0x15/0x17
[<ffffffff8119c045>] kmem_cache_alloc+0x55/0x210
[<ffffffff811477f5>] ? mempool_alloc_slab+0x15/0x20
[<ffffffff811477f5>] mempool_alloc_slab+0x15/0x20
[<ffffffff81147939>] mempool_alloc+0x69/0x170
[<ffffffff815cb69e>] ? _raw_spin_unlock_irq+0xe/0x20
[<ffffffff8109160d>] ? finish_task_switch+0x5d/0x150
[<ffffffff811f1a8e>] bio_alloc_bioset+0x1be/0x2e0
[<ffffffff8127ee49>] blkdev_issue_flush+0x99/0x120
[<ffffffffa019a733>] jbd2_cleanup_journal_tail+0x93/0xa0 [jbd2] -->GFP_KERNEL
[<ffffffffa019aca1>] jbd2_log_do_checkpoint+0x221/0x4a0 [jbd2]
[<ffffffffa019afc7>] __jbd2_log_wait_for_space+0xa7/0x1e0 [jbd2]
[<ffffffffa01952d8>] start_this_handle+0x2d8/0x550 [jbd2]
[<ffffffff811b02a9>] ? __memcg_kmem_put_cache+0x29/0x30
[<ffffffff8119c120>] ? kmem_cache_alloc+0x130/0x210
[<ffffffffa019573a>] jbd2__journal_start+0xba/0x190 [jbd2]
[<ffffffff811532ce>] ? lru_cache_add+0xe/0x10
[<ffffffffa01c9549>] ? ext4_da_write_begin+0xf9/0x330 [ext4]
[<ffffffffa01f2c77>] __ext4_journal_start_sb+0x77/0x160 [ext4]
[<ffffffffa01c9549>] ext4_da_write_begin+0xf9/0x330 [ext4]
[<ffffffff811446ec>] generic_file_buffered_write_iter+0x10c/0x270
[<ffffffff81146918>] __generic_file_write_iter+0x178/0x390
[<ffffffff81146c6b>] __generic_file_aio_write+0x8b/0xb0
[<ffffffff81146ced>] generic_file_aio_write+0x5d/0xc0
[<ffffffffa01bf289>] ext4_file_write+0xa9/0x450 [ext4]
[<ffffffff811c31d9>] ? pipe_read+0x379/0x4f0
[<ffffffff811b93f0>] do_sync_write+0x90/0xe0
[<ffffffff811b9b6d>] vfs_write+0xbd/0x1e0
[<ffffffff811ba5b8>] SyS_write+0x58/0xb0
[<ffffffff815d4799>] system_call_fastpath+0x16/0x1b
Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/jbd2/checkpoint.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -497,7 +497,7 @@ int jbd2_cleanup_journal_tail(journal_t
* jbd2_cleanup_journal_tail() doesn't get called all that often.
*/
if (journal->j_flags & JBD2_BARRIER)
- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
__jbd2_update_log_tail(journal, first_tid, blocknr);
return 0;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 040/110] ext4: call sync_blockdev() before invalidate_bdev() in put_super()
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (45 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 033/110] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail() Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 079/110] 9p: don't leave a half-initialized inode sitting around Ben Hutchings
` (64 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Theodore Ts'o
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 89d96a6f8e6491f24fc8f99fd6ae66820e85c6c1 upstream.
Normally all of the buffers will have been forced out to disk before
we call invalidate_bdev(), but there will be some cases, where a file
system operation was aborted due to an ext4_error(), where there may
still be some dirty buffers in the buffer cache for the device. So
try to force them out to memory before calling invalidate_bdev().
This fixes a warning triggered by generic/081:
WARNING: CPU: 1 PID: 3473 at /usr/projects/linux/ext4/fs/block_dev.c:56 __blkdev_put+0xb5/0x16f()
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ext4/super.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -857,6 +857,7 @@ static void ext4_put_super(struct super_
dump_orphan_list(sb, sbi);
J_ASSERT(list_empty(&sbi->s_orphan));
+ sync_blockdev(sb->s_bdev);
invalidate_bdev(sb->s_bdev);
if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
/*
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 079/110] 9p: don't leave a half-initialized inode sitting around
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (46 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 040/110] ext4: call sync_blockdev() before invalidate_bdev() in put_super() Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 103/110] md/raid1: fix test for 'was read error from last working device' Ben Hutchings
` (63 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Al Viro
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 0a73d0a204a4a04a1e110539c5a524ae51f91d6d upstream.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/9p/vfs_inode.c | 3 +--
fs/9p/vfs_inode_dotl.c | 3 +--
2 files changed, 2 insertions(+), 4 deletions(-)
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -527,8 +527,7 @@ static struct inode *v9fs_qid_iget(struc
unlock_new_inode(inode);
return inode;
error:
- unlock_new_inode(inode);
- iput(inode);
+ iget_failed(inode);
return ERR_PTR(retval);
}
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -169,8 +169,7 @@ static struct inode *v9fs_qid_iget_dotl(
unlock_new_inode(inode);
return inode;
error:
- unlock_new_inode(inode);
- iput(inode);
+ iget_failed(inode);
return ERR_PTR(retval);
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 103/110] md/raid1: fix test for 'was read error from last working device'.
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (47 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 079/110] 9p: don't leave a half-initialized inode sitting around Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 058/110] ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4 Ben Hutchings
` (62 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, NeilBrown
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.com>
commit 34cab6f42003cb06f48f86a86652984dec338ae9 upstream.
When we get a read error from the last working device, we don't
try to repair it, and don't fail the device. We simple report a
read error to the caller.
However the current test for 'is this the last working device' is
wrong.
When there is only one fully working device, it assumes that a
non-faulty device is that device. However a spare which is rebuilding
would be non-faulty but so not the only working device.
So change the test from "!Faulty" to "In_sync". If ->degraded says
there is only one fully working device and this device is in_sync,
this must be the one.
This bug has existed since we allowed read_balance to read from
a recovering spare in v3.0
Reported-and-tested-by: Alexander Lyakas <alex.bolshoy@gmail.com>
Fixes: 76073054c95b ("md/raid1: clean up read_balance.")
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/md/raid1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -313,7 +313,7 @@ static void raid1_end_read_request(struc
spin_lock_irqsave(&conf->device_lock, flags);
if (r1_bio->mddev->degraded == conf->raid_disks ||
(r1_bio->mddev->degraded == conf->raid_disks-1 &&
- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
+ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
uptodate = 1;
spin_unlock_irqrestore(&conf->device_lock, flags);
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 058/110] ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (48 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 103/110] md/raid1: fix test for 'was read error from last working device' Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 077/110] net: do not process device backlog during unregistration Ben Hutchings
` (61 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Clemens Ladisch, Albert Huitsing, Dominic Sacré,
Takashi Iwai
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dominic Sacré <dominic.sacre@gmx.de>
commit 0689a86ae814f39af94a9736a0a5426dd82eb107 upstream.
The Steinberg MI2 and MI4 interfaces are compatible with the USB class
audio spec, but the MIDI part of the devices is reported as a vendor
specific interface.
This patch adds entries to quirks-table.h to recognize the MIDI
endpoints. Audio functionality was already working and is unaffected by
this change.
Signed-off-by: Dominic Sacré <dominic.sacre@gmx.de>
Signed-off-by: Albert Huitsing <albert@huitsing.nl>
Acked-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/usb/quirks-table.h | 68 ++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 68 insertions(+)
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -2383,6 +2383,74 @@ YAMAHA_DEVICE(0x7010, "UB99"),
}
},
+/* Steinberg devices */
+{
+ /* Steinberg MI2 */
+ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
+ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+ .ifnum = QUIRK_ANY_INTERFACE,
+ .type = QUIRK_COMPOSITE,
+ .data = & (const struct snd_usb_audio_quirk[]) {
+ {
+ .ifnum = 0,
+ .type = QUIRK_AUDIO_STANDARD_INTERFACE
+ },
+ {
+ .ifnum = 1,
+ .type = QUIRK_AUDIO_STANDARD_INTERFACE
+ },
+ {
+ .ifnum = 2,
+ .type = QUIRK_AUDIO_STANDARD_INTERFACE
+ },
+ {
+ .ifnum = 3,
+ .type = QUIRK_MIDI_FIXED_ENDPOINT,
+ .data = &(const struct snd_usb_midi_endpoint_info) {
+ .out_cables = 0x0001,
+ .in_cables = 0x0001
+ }
+ },
+ {
+ .ifnum = -1
+ }
+ }
+ }
+},
+{
+ /* Steinberg MI4 */
+ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
+ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+ .ifnum = QUIRK_ANY_INTERFACE,
+ .type = QUIRK_COMPOSITE,
+ .data = & (const struct snd_usb_audio_quirk[]) {
+ {
+ .ifnum = 0,
+ .type = QUIRK_AUDIO_STANDARD_INTERFACE
+ },
+ {
+ .ifnum = 1,
+ .type = QUIRK_AUDIO_STANDARD_INTERFACE
+ },
+ {
+ .ifnum = 2,
+ .type = QUIRK_AUDIO_STANDARD_INTERFACE
+ },
+ {
+ .ifnum = 3,
+ .type = QUIRK_MIDI_FIXED_ENDPOINT,
+ .data = &(const struct snd_usb_midi_endpoint_info) {
+ .out_cables = 0x0001,
+ .in_cables = 0x0001
+ }
+ },
+ {
+ .ifnum = -1
+ }
+ }
+ }
+},
+
/* TerraTec devices */
{
USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 077/110] net: do not process device backlog during unregistration
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (49 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 058/110] ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4 Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 064/110] KVM: x86: make vapics_in_nmi_mode atomic Ben Hutchings
` (60 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Eric W. Biederman, David S. Miller, Vittorio Gambaletta,
Julian Anastasov, Stephen Hemminger
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <ja@ssi.bg>
commit e9e4dd3267d0c5234c5c0f47440456b10875dec9 upstream.
commit 381c759d9916 ("ipv4: Avoid crashing in ip_error")
fixes a problem where processed packet comes from device
with destroyed inetdev (dev->ip_ptr). This is not expected
because inetdev_destroy is called in NETDEV_UNREGISTER
phase and packets should not be processed after
dev_close_many() and synchronize_net(). Above fix is still
required because inetdev_destroy can be called for other
reasons. But it shows the real problem: backlog can keep
packets for long time and they do not hold reference to
device. Such packets are then delivered to upper levels
at the same time when device is unregistered.
Calling flush_backlog after NETDEV_UNREGISTER_FINAL still
accounts all packets from backlog but before that some packets
continue to be delivered to upper levels long after the
synchronize_net call which is supposed to wait the last
ones. Also, as Eric pointed out, processed packets, mostly
from other devices, can continue to add new packets to backlog.
Fix the problem by moving flush_backlog early, after the
device driver is stopped and before the synchronize_net() call.
Then use netif_running check to make sure we do not add more
packets to backlog. We have to do it in enqueue_to_backlog
context when the local IRQ is disabled. As result, after the
flush_backlog and synchronize_net sequence all packets
should be accounted.
Thanks to Eric W. Biederman for the test script and his
valuable feedback!
Reported-by: Vittorio Gambaletta <linuxbugs@vittgam.net>
Fixes: 6e583ce5242f ("net: eliminate refcounting in backlog queue")
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/core/dev.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2947,6 +2947,8 @@ static int enqueue_to_backlog(struct sk_
local_irq_save(flags);
rps_lock(sd);
+ if (!netif_running(skb->dev))
+ goto drop;
if (skb_queue_len(&sd->input_pkt_queue) <= netdev_max_backlog) {
if (skb_queue_len(&sd->input_pkt_queue)) {
enqueue:
@@ -2967,6 +2969,7 @@ enqueue:
goto enqueue;
}
+drop:
sd->dropped++;
rps_unlock(sd);
@@ -5305,6 +5308,7 @@ static void rollback_registered_many(str
unlist_netdevice(dev);
dev->reg_state = NETREG_UNREGISTERING;
+ on_each_cpu(flush_backlog, dev, 1);
}
synchronize_net();
@@ -5877,8 +5881,6 @@ void netdev_run_todo(void)
dev->reg_state = NETREG_UNREGISTERED;
- on_each_cpu(flush_backlog, dev, 1);
-
netdev_wait_allrefs(dev);
/* paranoia */
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 064/110] KVM: x86: make vapics_in_nmi_mode atomic
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (50 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 077/110] net: do not process device backlog during unregistration Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 032/110] jbd2: issue cache flush after checkpointing even with internal journal Ben Hutchings
` (59 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Radim Krčmář, Paolo Bonzini
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Radim Krčmář <rkrcmar@redhat.com>
commit 42720138b06301cc8a7ee8a495a6d021c4b6a9bc upstream.
Writes were a bit racy, but hard to turn into a bug at the same time.
(Particularly because modern Linux doesn't use this feature anymore.)
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
[Actually the next patch makes it much, much easier to trigger the race
so I'm including this one for stable@ as well. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/include/asm/kvm_host.h | 2 +-
arch/x86/kvm/i8254.c | 2 +-
arch/x86/kvm/lapic.c | 4 ++--
3 files changed, 4 insertions(+), 4 deletions(-)
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -472,7 +472,7 @@ struct kvm_arch {
struct kvm_pic *vpic;
struct kvm_ioapic *vioapic;
struct kvm_pit *vpit;
- int vapics_in_nmi_mode;
+ atomic_t vapics_in_nmi_mode;
unsigned int tss_addr;
struct page *apic_access_page;
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -318,7 +318,7 @@ static void pit_do_work(struct work_stru
* LVT0 to NMI delivery. Other PIC interrupts are just sent to
* VCPU0, and only if its LVT0 is in EXTINT mode.
*/
- if (kvm->arch.vapics_in_nmi_mode > 0)
+ if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0)
kvm_for_each_vcpu(i, vcpu, kvm)
kvm_apic_nmi_wd_deliver(vcpu);
}
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -757,10 +757,10 @@ static void apic_manage_nmi_watchdog(str
if (!nmi_wd_enabled) {
apic_debug("Receive NMI setting on APIC_LVT0 "
"for cpu %d\n", apic->vcpu->vcpu_id);
- apic->vcpu->kvm->arch.vapics_in_nmi_mode++;
+ atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
}
} else if (nmi_wd_enabled)
- apic->vcpu->kvm->arch.vapics_in_nmi_mode--;
+ atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
}
static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 032/110] jbd2: issue cache flush after checkpointing even with internal journal
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (51 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 064/110] KVM: x86: make vapics_in_nmi_mode atomic Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 053/110] agp/intel: Fix typo in needs_ilk_vtd_wa() Ben Hutchings
` (58 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jan Kara, Theodore Ts'o
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 79feb521a44705262d15cc819a4117a447b11ea7 upstream.
When we reach jbd2_cleanup_journal_tail(), there is no guarantee that
checkpointed buffers are on a stable storage - especially if buffers were
written out by jbd2_log_do_checkpoint(), they are likely to be only in disk's
caches. Thus when we update journal superblock effectively removing old
transaction from journal, this write of superblock can get to stable storage
before those checkpointed buffers which can result in filesystem corruption
after a crash. Thus we must unconditionally issue a cache flush before we
update journal superblock in these cases.
A similar problem can also occur if journal superblock is written only in
disk's caches, other transaction starts reusing space of the transaction
cleaned from the log and power failure happens. Subsequent journal replay would
still try to replay the old transaction but some of it's blocks may be already
overwritten by the new transaction. For this reason we must use WRITE_FUA when
updating log tail and we must first write new log tail to disk and update
in-memory information only after that.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
[bwh: Prerequisite for "jbd2: fix ocfs2 corrupt when updating journal
superblock fails".
Backported to 3.2:
- Adjust context
- Drop changes to jbd2_journal_update_sb_log_tail trace event]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -478,79 +478,28 @@ out:
int jbd2_cleanup_journal_tail(journal_t *journal)
{
- transaction_t * transaction;
tid_t first_tid;
- unsigned long blocknr, freed;
+ unsigned long blocknr;
if (is_journal_aborted(journal))
return 1;
- /* OK, work out the oldest transaction remaining in the log, and
- * the log block it starts at.
- *
- * If the log is now empty, we need to work out which is the
- * next transaction ID we will write, and where it will
- * start. */
-
- write_lock(&journal->j_state_lock);
- spin_lock(&journal->j_list_lock);
- transaction = journal->j_checkpoint_transactions;
- if (transaction) {
- first_tid = transaction->t_tid;
- blocknr = transaction->t_log_start;
- } else if ((transaction = journal->j_committing_transaction) != NULL) {
- first_tid = transaction->t_tid;
- blocknr = transaction->t_log_start;
- } else if ((transaction = journal->j_running_transaction) != NULL) {
- first_tid = transaction->t_tid;
- blocknr = journal->j_head;
- } else {
- first_tid = journal->j_transaction_sequence;
- blocknr = journal->j_head;
- }
- spin_unlock(&journal->j_list_lock);
- J_ASSERT(blocknr != 0);
-
- /* If the oldest pinned transaction is at the tail of the log
- already then there's not much we can do right now. */
- if (journal->j_tail_sequence == first_tid) {
- write_unlock(&journal->j_state_lock);
+ if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
return 1;
- }
-
- /* OK, update the superblock to recover the freed space.
- * Physical blocks come first: have we wrapped beyond the end of
- * the log? */
- freed = blocknr - journal->j_tail;
- if (blocknr < journal->j_tail)
- freed = freed + journal->j_last - journal->j_first;
-
- trace_jbd2_cleanup_journal_tail(journal, first_tid, blocknr, freed);
- jbd_debug(1,
- "Cleaning journal tail from %d to %d (offset %lu), "
- "freeing %lu\n",
- journal->j_tail_sequence, first_tid, blocknr, freed);
-
- journal->j_free += freed;
- journal->j_tail_sequence = first_tid;
- journal->j_tail = blocknr;
- write_unlock(&journal->j_state_lock);
+ J_ASSERT(blocknr != 0);
/*
- * If there is an external journal, we need to make sure that
- * any data blocks that were recently written out --- perhaps
- * by jbd2_log_do_checkpoint() --- are flushed out before we
- * drop the transactions from the external journal. It's
- * unlikely this will be necessary, especially with a
- * appropriately sized journal, but we need this to guarantee
- * correctness. Fortunately jbd2_cleanup_journal_tail()
- * doesn't get called all that often.
+ * We need to make sure that any blocks that were recently written out
+ * --- perhaps by jbd2_log_do_checkpoint() --- are flushed out before
+ * we drop the transactions from the journal. It's unlikely this will
+ * be necessary, especially with an appropriately sized journal, but we
+ * need this to guarantee correctness. Fortunately
+ * jbd2_cleanup_journal_tail() doesn't get called all that often.
*/
- if ((journal->j_fs_dev != journal->j_dev) &&
- (journal->j_flags & JBD2_BARRIER))
+ if (journal->j_flags & JBD2_BARRIER)
blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
- if (!(journal->j_flags & JBD2_ABORT))
- jbd2_journal_update_sb_log_tail(journal);
+
+ __jbd2_update_log_tail(journal, first_tid, blocknr);
return 0;
}
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -340,7 +340,16 @@ void jbd2_journal_commit_transaction(jou
/* Do we need to erase the effects of a prior jbd2_journal_flush? */
if (journal->j_flags & JBD2_FLUSHED) {
jbd_debug(3, "super block updated\n");
- jbd2_journal_update_sb_log_tail(journal);
+ /*
+ * We hold j_checkpoint_mutex so tail cannot change under us.
+ * We don't need any special data guarantees for writing sb
+ * since journal is empty and it is ok for write to be
+ * flushed only with transaction commit.
+ */
+ jbd2_journal_update_sb_log_tail(journal,
+ journal->j_tail_sequence,
+ journal->j_tail,
+ WRITE_SYNC);
} else {
jbd_debug(3, "superblock not updated\n");
}
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -775,6 +775,85 @@ struct journal_head *jbd2_journal_get_de
return jbd2_journal_add_journal_head(bh);
}
+/*
+ * Return tid of the oldest transaction in the journal and block in the journal
+ * where the transaction starts.
+ *
+ * If the journal is now empty, return which will be the next transaction ID
+ * we will write and where will that transaction start.
+ *
+ * The return value is 0 if journal tail cannot be pushed any further, 1 if
+ * it can.
+ */
+int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
+ unsigned long *block)
+{
+ transaction_t *transaction;
+ int ret;
+
+ read_lock(&journal->j_state_lock);
+ spin_lock(&journal->j_list_lock);
+ transaction = journal->j_checkpoint_transactions;
+ if (transaction) {
+ *tid = transaction->t_tid;
+ *block = transaction->t_log_start;
+ } else if ((transaction = journal->j_committing_transaction) != NULL) {
+ *tid = transaction->t_tid;
+ *block = transaction->t_log_start;
+ } else if ((transaction = journal->j_running_transaction) != NULL) {
+ *tid = transaction->t_tid;
+ *block = journal->j_head;
+ } else {
+ *tid = journal->j_transaction_sequence;
+ *block = journal->j_head;
+ }
+ ret = tid_gt(*tid, journal->j_tail_sequence);
+ spin_unlock(&journal->j_list_lock);
+ read_unlock(&journal->j_state_lock);
+
+ return ret;
+}
+
+/*
+ * Update information in journal structure and in on disk journal superblock
+ * about log tail. This function does not check whether information passed in
+ * really pushes log tail further. It's responsibility of the caller to make
+ * sure provided log tail information is valid (e.g. by holding
+ * j_checkpoint_mutex all the time between computing log tail and calling this
+ * function as is the case with jbd2_cleanup_journal_tail()).
+ *
+ * Requires j_checkpoint_mutex
+ */
+void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
+{
+ unsigned long freed;
+
+ BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
+
+ /*
+ * We cannot afford for write to remain in drive's caches since as
+ * soon as we update j_tail, next transaction can start reusing journal
+ * space and if we lose sb update during power failure we'd replay
+ * old transaction with possibly newly overwritten data.
+ */
+ jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
+ write_lock(&journal->j_state_lock);
+ freed = block - journal->j_tail;
+ if (block < journal->j_tail)
+ freed += journal->j_last - journal->j_first;
+
+ trace_jbd2_update_log_tail(journal, tid, block, freed);
+ jbd_debug(1,
+ "Cleaning journal tail from %d to %d (offset %lu), "
+ "freeing %lu\n",
+ journal->j_tail_sequence, tid, block, freed);
+
+ journal->j_free += freed;
+ journal->j_tail_sequence = tid;
+ journal->j_tail = block;
+ write_unlock(&journal->j_state_lock);
+}
+
struct jbd2_stats_proc_session {
journal_t *journal;
struct transaction_stats_s *stats;
@@ -1156,16 +1235,28 @@ static int journal_reset(journal_t *jour
journal->j_errno);
journal->j_flags |= JBD2_FLUSHED;
} else {
- /* Add the dynamic fields and write it to disk. */
- jbd2_journal_update_sb_log_tail(journal);
+ /*
+ * Update log tail information. We use WRITE_FUA since new
+ * transaction will start reusing journal space and so we
+ * must make sure information about current log tail is on
+ * disk before that.
+ */
+ jbd2_journal_update_sb_log_tail(journal,
+ journal->j_tail_sequence,
+ journal->j_tail,
+ WRITE_FUA);
}
return jbd2_journal_start_thread(journal);
}
-static void jbd2_write_superblock(journal_t *journal)
+static void jbd2_write_superblock(journal_t *journal, int write_op)
{
struct buffer_head *bh = journal->j_sb_buffer;
+ int ret;
+ if (!(journal->j_flags & JBD2_BARRIER))
+ write_op &= ~(REQ_FUA | REQ_FLUSH);
+ lock_buffer(bh);
if (buffer_write_io_error(bh)) {
/*
* Oh, dear. A previous attempt to write the journal
@@ -1181,39 +1272,44 @@ static void jbd2_write_superblock(journa
clear_buffer_write_io_error(bh);
set_buffer_uptodate(bh);
}
-
- BUFFER_TRACE(bh, "marking dirty");
- mark_buffer_dirty(bh);
- sync_dirty_buffer(bh);
+ get_bh(bh);
+ bh->b_end_io = end_buffer_write_sync;
+ ret = submit_bh(write_op, bh);
+ wait_on_buffer(bh);
if (buffer_write_io_error(bh)) {
- printk(KERN_ERR "JBD2: I/O error detected "
- "when updating journal superblock for %s.\n",
- journal->j_devname);
clear_buffer_write_io_error(bh);
set_buffer_uptodate(bh);
+ ret = -EIO;
+ }
+ if (ret) {
+ printk(KERN_ERR "JBD2: Error %d detected when updating "
+ "journal superblock for %s.\n", ret,
+ journal->j_devname);
}
}
/**
* jbd2_journal_update_sb_log_tail() - Update log tail in journal sb on disk.
* @journal: The journal to update.
+ * @tail_tid: TID of the new transaction at the tail of the log
+ * @tail_block: The first block of the transaction at the tail of the log
+ * @write_op: With which operation should we write the journal sb
*
* Update a journal's superblock information about log tail and write it to
* disk, waiting for the IO to complete.
*/
-void jbd2_journal_update_sb_log_tail(journal_t *journal)
+void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
+ unsigned long tail_block, int write_op)
{
journal_superblock_t *sb = journal->j_superblock;
- read_lock(&journal->j_state_lock);
- jbd_debug(1, "JBD2: updating superblock (start %ld, seq %d)\n",
- journal->j_tail, journal->j_tail_sequence);
+ jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
+ tail_block, tail_tid);
- sb->s_sequence = cpu_to_be32(journal->j_tail_sequence);
- sb->s_start = cpu_to_be32(journal->j_tail);
- read_unlock(&journal->j_state_lock);
+ sb->s_sequence = cpu_to_be32(tail_tid);
+ sb->s_start = cpu_to_be32(tail_block);
- jbd2_write_superblock(journal);
+ jbd2_write_superblock(journal, write_op);
/* Log is no longer empty */
write_lock(&journal->j_state_lock);
WARN_ON(!sb->s_sequence);
@@ -1240,7 +1336,7 @@ static void jbd2_mark_journal_empty(jour
sb->s_start = cpu_to_be32(0);
read_unlock(&journal->j_state_lock);
- jbd2_write_superblock(journal);
+ jbd2_write_superblock(journal, WRITE_FUA);
/* Log is no longer empty */
write_lock(&journal->j_state_lock);
@@ -1266,7 +1362,7 @@ static void jbd2_journal_update_sb_errno
sb->s_errno = cpu_to_be32(journal->j_errno);
read_unlock(&journal->j_state_lock);
- jbd2_write_superblock(journal);
+ jbd2_write_superblock(journal, WRITE_SYNC);
}
/*
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -21,6 +21,7 @@
#include <linux/jbd2.h>
#include <linux/errno.h>
#include <linux/crc32.h>
+#include <linux/blkdev.h>
#endif
/*
@@ -265,7 +266,9 @@ int jbd2_journal_recover(journal_t *jour
err2 = sync_blockdev(journal->j_fs_dev);
if (!err)
err = err2;
-
+ /* Make sure all replayed data is on permanent storage */
+ if (journal->j_flags & JBD2_BARRIER)
+ blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
return err;
}
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -972,6 +972,9 @@ extern void __journal_clean_data_list(tr
/* Log buffer allocation */
extern struct journal_head * jbd2_journal_get_descriptor_buffer(journal_t *);
int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
+int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
+ unsigned long *block);
+void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
/* Commit management */
extern void jbd2_journal_commit_transaction(journal_t *);
@@ -1083,7 +1086,8 @@ extern int jbd2_journal_destroy (j
extern int jbd2_journal_recover (journal_t *journal);
extern int jbd2_journal_wipe (journal_t *, int);
extern int jbd2_journal_skip_recovery (journal_t *);
-extern void jbd2_journal_update_sb_log_tail (journal_t *);
+extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
+ unsigned long, int);
extern void __jbd2_journal_abort_hard (journal_t *);
extern void jbd2_journal_abort (journal_t *, int);
extern int jbd2_journal_errno (journal_t *);
--- a/include/trace/events/jbd2.h
+++ b/include/trace/events/jbd2.h
@@ -200,7 +200,7 @@ TRACE_EVENT(jbd2_checkpoint_stats,
__entry->forced_to_close, __entry->written, __entry->dropped)
);
-TRACE_EVENT(jbd2_cleanup_journal_tail,
+TRACE_EVENT(jbd2_update_log_tail,
TP_PROTO(journal_t *journal, tid_t first_tid,
unsigned long block_nr, unsigned long freed),
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 053/110] agp/intel: Fix typo in needs_ilk_vtd_wa()
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (52 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 032/110] jbd2: issue cache flush after checkpointing even with internal journal Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 082/110] rds: rds_ib_device.refcount overflow Ben Hutchings
` (57 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Daniel Vetter, Jani Nikula, Chris Wilson, Ting-Wei Lan
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit 8b572a4200828b4e75cc22ed2f494b58d5372d65 upstream.
In needs_ilk_vtd_wa(), we pass in the GPU device but compared it against
the ids for the mobile GPU and the mobile host bridge. That latter is
impossible and so likely was just a typo for the desktop GPU device id
(which is also buggy).
Fixes commit da88a5f7f7d434e2cde1b3e19d952e6d84533662
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date: Wed Feb 13 09:31:53 2013 +0000
drm/i915: Disable WC PTE updates to w/a buggy IOMMU on ILK
Reported-by: Ting-Wei Lan <lantw44@gmail.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91127
References: https://bugzilla.freedesktop.org/show_bug.cgi?id=60391
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/char/agp/intel-gtt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -1195,7 +1195,7 @@ static inline int needs_idle_maps(void)
/* Query intel_iommu to see if we need the workaround. Presumably that
* was loaded first.
*/
- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB ||
+ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG ||
gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) &&
intel_iommu_gfx_mapped)
return 1;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 082/110] rds: rds_ib_device.refcount overflow
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (53 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 053/110] agp/intel: Fix typo in needs_ilk_vtd_wa() Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 092/110] mac80211: clear subdir_stations when removing debugfs Ben Hutchings
` (56 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Haggai Eran, Doug Ledford, Wengang Wang
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Wengang Wang <wen.gang.wang@oracle.com>
commit 4fabb59449aa44a585b3603ffdadd4c5f4d0c033 upstream.
Fixes: 3e0249f9c05c ("RDS/IB: add refcount tracking to struct rds_ib_device")
There lacks a dropping on rds_ib_device.refcount in case rds_ib_alloc_fmr
failed(mr pool running out). this lead to the refcount overflow.
A complain in line 117(see following) is seen. From vmcore:
s_ib_rdma_mr_pool_depleted is 2147485544 and rds_ibdev->refcount is -2147475448.
That is the evidence the mr pool is used up. so rds_ib_alloc_fmr is very likely
to return ERR_PTR(-EAGAIN).
115 void rds_ib_dev_put(struct rds_ib_device *rds_ibdev)
116 {
117 BUG_ON(atomic_read(&rds_ibdev->refcount) <= 0);
118 if (atomic_dec_and_test(&rds_ibdev->refcount))
119 queue_work(rds_wq, &rds_ibdev->free_work);
120 }
fix is to drop refcount when rds_ib_alloc_fmr failed.
Signed-off-by: Wengang Wang <wen.gang.wang@oracle.com>
Reviewed-by: Haggai Eran <haggaie@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/rds/ib_rdma.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *
}
ibmr = rds_ib_alloc_fmr(rds_ibdev);
- if (IS_ERR(ibmr))
+ if (IS_ERR(ibmr)) {
+ rds_ib_dev_put(rds_ibdev);
return ibmr;
+ }
ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
if (ret == 0)
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 092/110] mac80211: clear subdir_stations when removing debugfs
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (54 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 082/110] rds: rds_ib_device.refcount overflow Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 060/110] fs/buffer.c: support buffer cache allocations with gfp modifiers Ben Hutchings
` (55 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Tom Hughes, Johannes Berg
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Tom Hughes <tom@compton.nu>
commit 4479004e6409087d1b4986881dc98c6c15dffb28 upstream.
If we don't do this, and we then fail to recreate the debugfs
directory during a mode change, then we will fail later trying
to add stations to this now bogus directory:
BUG: unable to handle kernel NULL pointer dereference at 0000006c
IP: [<c0a92202>] mutex_lock+0x12/0x30
Call Trace:
[<c0678ab4>] start_creating+0x44/0xc0
[<c0679203>] debugfs_create_dir+0x13/0xf0
[<f8a938ae>] ieee80211_sta_debugfs_add+0x6e/0x490 [mac80211]
Signed-off-by: Tom Hughes <tom@compton.nu>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/mac80211/debugfs_netdev.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -598,6 +598,7 @@ void ieee80211_debugfs_remove_netdev(str
debugfs_remove_recursive(sdata->debugfs.dir);
sdata->debugfs.dir = NULL;
+ sdata->debugfs.subdir_stations = NULL;
}
void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 060/110] fs/buffer.c: support buffer cache allocations with gfp modifiers
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (55 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 092/110] mac80211: clear subdir_stations when removing debugfs Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-27 13:57 ` Luis Henriques
2015-08-10 10:12 ` [PATCH 3.2 046/110] fs: Fix S_NOSEC handling Ben Hutchings
` (54 subsequent siblings)
111 siblings, 1 reply; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Gioh Kim, Jan Kara, Theodore Ts'o
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Gioh Kim <gioh.kim@lge.com>
commit 3b5e6454aaf6b4439b19400d8365e2ec2d24e411 upstream.
A buffer cache is allocated from movable area because it is referred
for a while and released soon. But some filesystems are taking buffer
cache for a long time and it can disturb page migration.
New APIs are introduced to allocate buffer cache with user specific
flag. *_gfp APIs are for user want to set page allocation flag for
page cache allocation. And *_unmovable APIs are for the user wants to
allocate page cache from non-movable area.
Signed-off-by: Gioh Kim <gioh.kim@lge.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
[bwh: Prerequisite for "bufferhead: Add _gfp version for sb_getblk()".
Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1002,7 +1002,7 @@ init_page_buffers(struct page *page, str
*/
static int
grow_dev_page(struct block_device *bdev, sector_t block,
- pgoff_t index, int size, int sizebits)
+ pgoff_t index, int size, int sizebits, gfp_t gfp)
{
struct inode *inode = bdev->bd_inode;
struct page *page;
@@ -1011,7 +1011,7 @@ grow_dev_page(struct block_device *bdev,
int ret = 0; /* Will call free_more_memory() */
page = find_or_create_page(inode->i_mapping, index,
- (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS)|__GFP_MOVABLE);
+ (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS) | gfp);
if (!page)
return ret;
@@ -1059,7 +1059,7 @@ failed:
* that page was dirty, the buffers are set dirty also.
*/
static int
-grow_buffers(struct block_device *bdev, sector_t block, int size)
+grow_buffers(struct block_device *bdev, sector_t block, int size, gfp_t gfp)
{
pgoff_t index;
int sizebits;
@@ -1086,11 +1086,12 @@ grow_buffers(struct block_device *bdev,
}
/* Create a page with the proper size buffers.. */
- return grow_dev_page(bdev, block, index, size, sizebits);
+ return grow_dev_page(bdev, block, index, size, sizebits, gfp);
}
-static struct buffer_head *
-__getblk_slow(struct block_device *bdev, sector_t block, int size)
+struct buffer_head *
+__getblk_slow(struct block_device *bdev, sector_t block,
+ unsigned size, gfp_t gfp)
{
/* Size must be multiple of hard sectorsize */
if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
@@ -1112,13 +1113,14 @@ __getblk_slow(struct block_device *bdev,
if (bh)
return bh;
- ret = grow_buffers(bdev, block, size);
+ ret = grow_buffers(bdev, block, size, gfp);
if (ret < 0)
return NULL;
if (ret == 0)
free_more_memory();
}
}
+EXPORT_SYMBOL(__getblk_slow);
/*
* The relationship between dirty buffers and dirty pages:
@@ -1369,24 +1371,25 @@ __find_get_block(struct block_device *bd
EXPORT_SYMBOL(__find_get_block);
/*
- * __getblk will locate (and, if necessary, create) the buffer_head
+ * __getblk_gfp() will locate (and, if necessary, create) the buffer_head
* which corresponds to the passed block_device, block and size. The
* returned buffer has its reference count incremented.
*
- * __getblk() will lock up the machine if grow_dev_page's try_to_free_buffers()
- * attempt is failing. FIXME, perhaps?
+ * __getblk_gfp() will lock up the machine if grow_dev_page's
+ * try_to_free_buffers() attempt is failing. FIXME, perhaps?
*/
struct buffer_head *
-__getblk(struct block_device *bdev, sector_t block, unsigned size)
+__getblk_gfp(struct block_device *bdev, sector_t block,
+ unsigned size, gfp_t gfp)
{
struct buffer_head *bh = __find_get_block(bdev, block, size);
might_sleep();
if (bh == NULL)
- bh = __getblk_slow(bdev, block, size);
+ bh = __getblk_slow(bdev, block, size, gfp);
return bh;
}
-EXPORT_SYMBOL(__getblk);
+EXPORT_SYMBOL(__getblk_gfp);
/*
* Do async read-ahead on a buffer..
@@ -1402,24 +1405,28 @@ void __breadahead(struct block_device *b
EXPORT_SYMBOL(__breadahead);
/**
- * __bread() - reads a specified block and returns the bh
+ * __bread_gfp() - reads a specified block and returns the bh
* @bdev: the block_device to read from
* @block: number of block
* @size: size (in bytes) to read
- *
+ * @gfp: page allocation flag
+ *
* Reads a specified block, and returns buffer head that contains it.
+ * The page cache can be allocated from non-movable area
+ * not to prevent page migration if you set gfp to zero.
* It returns NULL if the block was unreadable.
*/
struct buffer_head *
-__bread(struct block_device *bdev, sector_t block, unsigned size)
+__bread_gfp(struct block_device *bdev, sector_t block,
+ unsigned size, gfp_t gfp)
{
- struct buffer_head *bh = __getblk(bdev, block, size);
+ struct buffer_head *bh = __getblk_gfp(bdev, block, size, gfp);
if (likely(bh) && !buffer_uptodate(bh))
bh = __bread_slow(bh);
return bh;
}
-EXPORT_SYMBOL(__bread);
+EXPORT_SYMBOL(__bread_gfp);
/*
* invalidate_bh_lrus() is called rarely - but not only at unmount.
--- a/include/linux/buffer_head.h
+++ b/include/linux/buffer_head.h
@@ -166,12 +166,13 @@ void __wait_on_buffer(struct buffer_head
wait_queue_head_t *bh_waitq_head(struct buffer_head *bh);
struct buffer_head *__find_get_block(struct block_device *bdev, sector_t block,
unsigned size);
-struct buffer_head *__getblk(struct block_device *bdev, sector_t block,
- unsigned size);
+struct buffer_head *__getblk_gfp(struct block_device *bdev, sector_t block,
+ unsigned size, gfp_t gfp);
void __brelse(struct buffer_head *);
void __bforget(struct buffer_head *);
void __breadahead(struct block_device *, sector_t block, unsigned int size);
-struct buffer_head *__bread(struct block_device *, sector_t block, unsigned size);
+struct buffer_head *__bread_gfp(struct block_device *,
+ sector_t block, unsigned size, gfp_t gfp);
void invalidate_bh_lrus(void);
struct buffer_head *alloc_buffer_head(gfp_t gfp_flags);
void free_buffer_head(struct buffer_head * bh);
@@ -286,7 +287,13 @@ static inline void bforget(struct buffer
static inline struct buffer_head *
sb_bread(struct super_block *sb, sector_t block)
{
- return __bread(sb->s_bdev, block, sb->s_blocksize);
+ return __bread_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
+}
+
+static inline struct buffer_head *
+sb_bread_unmovable(struct super_block *sb, sector_t block)
+{
+ return __bread_gfp(sb->s_bdev, block, sb->s_blocksize, 0);
}
static inline void
@@ -298,7 +305,7 @@ sb_breadahead(struct super_block *sb, se
static inline struct buffer_head *
sb_getblk(struct super_block *sb, sector_t block)
{
- return __getblk(sb->s_bdev, block, sb->s_blocksize);
+ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
}
static inline struct buffer_head *
@@ -335,6 +342,36 @@ static inline void lock_buffer(struct bu
__lock_buffer(bh);
}
+static inline struct buffer_head *getblk_unmovable(struct block_device *bdev,
+ sector_t block,
+ unsigned size)
+{
+ return __getblk_gfp(bdev, block, size, 0);
+}
+
+static inline struct buffer_head *__getblk(struct block_device *bdev,
+ sector_t block,
+ unsigned size)
+{
+ return __getblk_gfp(bdev, block, size, __GFP_MOVABLE);
+}
+
+/**
+ * __bread() - reads a specified block and returns the bh
+ * @bdev: the block_device to read from
+ * @block: number of block
+ * @size: size (in bytes) to read
+ *
+ * Reads a specified block, and returns buffer head that contains it.
+ * The page cache is allocated from movable area so that it can be migrated.
+ * It returns NULL if the block was unreadable.
+ */
+static inline struct buffer_head *
+__bread(struct block_device *bdev, sector_t block, unsigned size)
+{
+ return __bread_gfp(bdev, block, size, __GFP_MOVABLE);
+}
+
extern int __set_page_dirty_buffers(struct page *page);
#else /* CONFIG_BLOCK */
^ permalink raw reply [flat|nested] 126+ messages in thread* Re: [PATCH 3.2 060/110] fs/buffer.c: support buffer cache allocations with gfp modifiers
2015-08-10 10:12 ` [PATCH 3.2 060/110] fs/buffer.c: support buffer cache allocations with gfp modifiers Ben Hutchings
@ 2015-08-27 13:57 ` Luis Henriques
0 siblings, 0 replies; 126+ messages in thread
From: Luis Henriques @ 2015-08-27 13:57 UTC (permalink / raw)
To: Ben Hutchings
Cc: linux-kernel, stable, akpm, Gioh Kim, Jan Kara, Theodore Ts'o
On Mon, Aug 10, 2015 at 12:12:31PM +0200, Ben Hutchings wrote:
> 3.2.71-rc1 review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Gioh Kim <gioh.kim@lge.com>
>
> commit 3b5e6454aaf6b4439b19400d8365e2ec2d24e411 upstream.
>
> A buffer cache is allocated from movable area because it is referred
> for a while and released soon. But some filesystems are taking buffer
> cache for a long time and it can disturb page migration.
>
> New APIs are introduced to allocate buffer cache with user specific
> flag. *_gfp APIs are for user want to set page allocation flag for
> page cache allocation. And *_unmovable APIs are for the user wants to
> allocate page cache from non-movable area.
>
> Signed-off-by: Gioh Kim <gioh.kim@lge.com>
> Signed-off-by: Theodore Ts'o <tytso@mit.edu>
> Reviewed-by: Jan Kara <jack@suse.cz>
> [bwh: Prerequisite for "bufferhead: Add _gfp version for sb_getblk()".
> Backported to 3.2: adjust context]
Great, I'll queue this and bd7ade3cd9b0 ("bufferhead: Add _gfp version
for sb_getblk()") for the 3.16 as well.
Cheers,
--
Lu�s
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> ---
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -1002,7 +1002,7 @@ init_page_buffers(struct page *page, str
> */
> static int
> grow_dev_page(struct block_device *bdev, sector_t block,
> - pgoff_t index, int size, int sizebits)
> + pgoff_t index, int size, int sizebits, gfp_t gfp)
> {
> struct inode *inode = bdev->bd_inode;
> struct page *page;
> @@ -1011,7 +1011,7 @@ grow_dev_page(struct block_device *bdev,
> int ret = 0; /* Will call free_more_memory() */
>
> page = find_or_create_page(inode->i_mapping, index,
> - (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS)|__GFP_MOVABLE);
> + (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS) | gfp);
> if (!page)
> return ret;
>
> @@ -1059,7 +1059,7 @@ failed:
> * that page was dirty, the buffers are set dirty also.
> */
> static int
> -grow_buffers(struct block_device *bdev, sector_t block, int size)
> +grow_buffers(struct block_device *bdev, sector_t block, int size, gfp_t gfp)
> {
> pgoff_t index;
> int sizebits;
> @@ -1086,11 +1086,12 @@ grow_buffers(struct block_device *bdev,
> }
>
> /* Create a page with the proper size buffers.. */
> - return grow_dev_page(bdev, block, index, size, sizebits);
> + return grow_dev_page(bdev, block, index, size, sizebits, gfp);
> }
>
> -static struct buffer_head *
> -__getblk_slow(struct block_device *bdev, sector_t block, int size)
> +struct buffer_head *
> +__getblk_slow(struct block_device *bdev, sector_t block,
> + unsigned size, gfp_t gfp)
> {
> /* Size must be multiple of hard sectorsize */
> if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
> @@ -1112,13 +1113,14 @@ __getblk_slow(struct block_device *bdev,
> if (bh)
> return bh;
>
> - ret = grow_buffers(bdev, block, size);
> + ret = grow_buffers(bdev, block, size, gfp);
> if (ret < 0)
> return NULL;
> if (ret == 0)
> free_more_memory();
> }
> }
> +EXPORT_SYMBOL(__getblk_slow);
>
> /*
> * The relationship between dirty buffers and dirty pages:
> @@ -1369,24 +1371,25 @@ __find_get_block(struct block_device *bd
> EXPORT_SYMBOL(__find_get_block);
>
> /*
> - * __getblk will locate (and, if necessary, create) the buffer_head
> + * __getblk_gfp() will locate (and, if necessary, create) the buffer_head
> * which corresponds to the passed block_device, block and size. The
> * returned buffer has its reference count incremented.
> *
> - * __getblk() will lock up the machine if grow_dev_page's try_to_free_buffers()
> - * attempt is failing. FIXME, perhaps?
> + * __getblk_gfp() will lock up the machine if grow_dev_page's
> + * try_to_free_buffers() attempt is failing. FIXME, perhaps?
> */
> struct buffer_head *
> -__getblk(struct block_device *bdev, sector_t block, unsigned size)
> +__getblk_gfp(struct block_device *bdev, sector_t block,
> + unsigned size, gfp_t gfp)
> {
> struct buffer_head *bh = __find_get_block(bdev, block, size);
>
> might_sleep();
> if (bh == NULL)
> - bh = __getblk_slow(bdev, block, size);
> + bh = __getblk_slow(bdev, block, size, gfp);
> return bh;
> }
> -EXPORT_SYMBOL(__getblk);
> +EXPORT_SYMBOL(__getblk_gfp);
>
> /*
> * Do async read-ahead on a buffer..
> @@ -1402,24 +1405,28 @@ void __breadahead(struct block_device *b
> EXPORT_SYMBOL(__breadahead);
>
> /**
> - * __bread() - reads a specified block and returns the bh
> + * __bread_gfp() - reads a specified block and returns the bh
> * @bdev: the block_device to read from
> * @block: number of block
> * @size: size (in bytes) to read
> - *
> + * @gfp: page allocation flag
> + *
> * Reads a specified block, and returns buffer head that contains it.
> + * The page cache can be allocated from non-movable area
> + * not to prevent page migration if you set gfp to zero.
> * It returns NULL if the block was unreadable.
> */
> struct buffer_head *
> -__bread(struct block_device *bdev, sector_t block, unsigned size)
> +__bread_gfp(struct block_device *bdev, sector_t block,
> + unsigned size, gfp_t gfp)
> {
> - struct buffer_head *bh = __getblk(bdev, block, size);
> + struct buffer_head *bh = __getblk_gfp(bdev, block, size, gfp);
>
> if (likely(bh) && !buffer_uptodate(bh))
> bh = __bread_slow(bh);
> return bh;
> }
> -EXPORT_SYMBOL(__bread);
> +EXPORT_SYMBOL(__bread_gfp);
>
> /*
> * invalidate_bh_lrus() is called rarely - but not only at unmount.
> --- a/include/linux/buffer_head.h
> +++ b/include/linux/buffer_head.h
> @@ -166,12 +166,13 @@ void __wait_on_buffer(struct buffer_head
> wait_queue_head_t *bh_waitq_head(struct buffer_head *bh);
> struct buffer_head *__find_get_block(struct block_device *bdev, sector_t block,
> unsigned size);
> -struct buffer_head *__getblk(struct block_device *bdev, sector_t block,
> - unsigned size);
> +struct buffer_head *__getblk_gfp(struct block_device *bdev, sector_t block,
> + unsigned size, gfp_t gfp);
> void __brelse(struct buffer_head *);
> void __bforget(struct buffer_head *);
> void __breadahead(struct block_device *, sector_t block, unsigned int size);
> -struct buffer_head *__bread(struct block_device *, sector_t block, unsigned size);
> +struct buffer_head *__bread_gfp(struct block_device *,
> + sector_t block, unsigned size, gfp_t gfp);
> void invalidate_bh_lrus(void);
> struct buffer_head *alloc_buffer_head(gfp_t gfp_flags);
> void free_buffer_head(struct buffer_head * bh);
> @@ -286,7 +287,13 @@ static inline void bforget(struct buffer
> static inline struct buffer_head *
> sb_bread(struct super_block *sb, sector_t block)
> {
> - return __bread(sb->s_bdev, block, sb->s_blocksize);
> + return __bread_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
> +}
> +
> +static inline struct buffer_head *
> +sb_bread_unmovable(struct super_block *sb, sector_t block)
> +{
> + return __bread_gfp(sb->s_bdev, block, sb->s_blocksize, 0);
> }
>
> static inline void
> @@ -298,7 +305,7 @@ sb_breadahead(struct super_block *sb, se
> static inline struct buffer_head *
> sb_getblk(struct super_block *sb, sector_t block)
> {
> - return __getblk(sb->s_bdev, block, sb->s_blocksize);
> + return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
> }
>
> static inline struct buffer_head *
> @@ -335,6 +342,36 @@ static inline void lock_buffer(struct bu
> __lock_buffer(bh);
> }
>
> +static inline struct buffer_head *getblk_unmovable(struct block_device *bdev,
> + sector_t block,
> + unsigned size)
> +{
> + return __getblk_gfp(bdev, block, size, 0);
> +}
> +
> +static inline struct buffer_head *__getblk(struct block_device *bdev,
> + sector_t block,
> + unsigned size)
> +{
> + return __getblk_gfp(bdev, block, size, __GFP_MOVABLE);
> +}
> +
> +/**
> + * __bread() - reads a specified block and returns the bh
> + * @bdev: the block_device to read from
> + * @block: number of block
> + * @size: size (in bytes) to read
> + *
> + * Reads a specified block, and returns buffer head that contains it.
> + * The page cache is allocated from movable area so that it can be migrated.
> + * It returns NULL if the block was unreadable.
> + */
> +static inline struct buffer_head *
> +__bread(struct block_device *bdev, sector_t block, unsigned size)
> +{
> + return __bread_gfp(bdev, block, size, __GFP_MOVABLE);
> +}
> +
> extern int __set_page_dirty_buffers(struct page *page);
>
> #else /* CONFIG_BLOCK */
>
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 126+ messages in thread
* [PATCH 3.2 046/110] fs: Fix S_NOSEC handling
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (56 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 060/110] fs/buffer.c: support buffer cache allocations with gfp modifiers Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 056/110] crush: fix a bug in tree bucket decode Ben Hutchings
` (53 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Al Viro, Jan Kara
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 2426f3910069ed47c0cc58559a6d088af7920201 upstream.
file_remove_suid() could mistakenly set S_NOSEC inode bit when root was
modifying the file. As a result following writes to the file by ordinary
user would avoid clearing suid or sgid bits.
Fix the bug by checking actual mode bits before setting S_NOSEC.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/filemap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2007,8 +2007,8 @@ int file_remove_suid(struct file *file)
error = security_inode_killpriv(dentry);
if (!error && killsuid)
error = __remove_suid(dentry, killsuid);
- if (!error && (inode->i_sb->s_flags & MS_NOSEC))
- inode->i_flags |= S_NOSEC;
+ if (!error)
+ inode_has_no_xattr(inode);
return error;
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 056/110] crush: fix a bug in tree bucket decode
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (57 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 046/110] fs: Fix S_NOSEC handling Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 042/110] ext4: don't retry file block mapping on bigalloc fs with non-extent file Ben Hutchings
` (52 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Josh Durgin, Ilya Dryomov
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <idryomov@gmail.com>
commit 82cd003a77173c91b9acad8033fb7931dac8d751 upstream.
struct crush_bucket_tree::num_nodes is u8, so ceph_decode_8_safe()
should be used. -Wconversion catches this, but I guess it went
unnoticed in all the noise it spews. The actual problem (at least for
common crushmaps) isn't the u32 -> u8 truncation though - it's the
advancement by 4 bytes instead of 1 in the crushmap buffer.
Fixes: http://tracker.ceph.com/issues/2759
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Josh Durgin <jdurgin@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ceph/osdmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -102,7 +102,7 @@ static int crush_decode_tree_bucket(void
{
int j;
dout("crush_decode_tree_bucket %p to %p\n", *p, end);
- ceph_decode_32_safe(p, end, b->num_nodes, bad);
+ ceph_decode_8_safe(p, end, b->num_nodes, bad);
b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
if (b->node_weights == NULL)
return -ENOMEM;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 042/110] ext4: don't retry file block mapping on bigalloc fs with non-extent file
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (58 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 056/110] crush: fix a bug in tree bucket decode Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 098/110] xhci: report U3 when link is in resume state Ben Hutchings
` (51 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Theodore Ts'o, Darrick J. Wong
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Darrick J. Wong" <darrick.wong@oracle.com>
commit 292db1bc6c105d86111e858859456bcb11f90f91 upstream.
ext4 isn't willing to map clusters to a non-extent file. Don't signal
this with an out of space error, since the FS will retry the
allocation (which didn't fail) forever. Instead, return EUCLEAN so
that the operation will fail immediately all the way back to userspace.
(The fix is either to run e2fsck -E bmap2extent, or to chattr +e the file.)
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ext4/indirect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -706,7 +706,7 @@ int ext4_ind_map_blocks(handle_t *handle
EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
EXT4_ERROR_INODE(inode, "Can't allocate blocks for "
"non-extent mapped inodes with bigalloc");
- return -ENOSPC;
+ return -EUCLEAN;
}
goal = ext4_find_goal(inode, map->m_lblk, partial);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 098/110] xhci: report U3 when link is in resume state
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (59 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 042/110] ext4: don't retry file block mapping on bigalloc fs with non-extent file Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 102/110] Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen Ben Hutchings
` (50 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Zhuang Jin Can, Mathias Nyman, Greg Kroah-Hartman
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Zhuang Jin Can <jin.can.zhuang@intel.com>
commit 243292a2ad3dc365849b820a64868927168894ac upstream.
xhci_hub_report_usb3_link_state() returns pls as U0 when the link
is in resume state, and this causes usb core to think the link is in
U0 while actually it's in resume state. When usb core transfers
control request on the link, it fails with TRB error as the link
is not ready for transfer.
To fix the issue, report U3 when the link is in resume state, thus
usb core knows the link it's not ready for transfer.
Signed-off-by: Zhuang Jin Can <jin.can.zhuang@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci-hub.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -449,10 +449,13 @@ static void xhci_hub_report_link_state(s
u32 pls = status_reg & PORT_PLS_MASK;
/* resume state is a xHCI internal state.
- * Do not report it to usb core.
+ * Do not report it to usb core, instead, pretend to be U3,
+ * thus usb core knows it's not ready for transfer
*/
- if (pls == XDEV_RESUME)
+ if (pls == XDEV_RESUME) {
+ *status |= USB_SS_PORT_LS_U3;
return;
+ }
/* When the CAS bit is set then warm reset
* should be performed on port
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 102/110] Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (60 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 098/110] xhci: report U3 when link is in resume state Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 047/110] stmmac: troubleshoot unexpected bits in des0 & des1 Ben Hutchings
` (49 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Jakob Mustafa, Dmitry Torokhov, Bernhard Bender
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Bernhard Bender <bernhard.bender@bytecmed.com>
commit 968491709e5b1aaf429428814fff3d932fa90b60 upstream.
This patch fixes a problem in the usbtouchscreen driver for DMC TSC-30
touch screen. Due to a missing delay between the RESET and SET_RATE
commands, the touch screen may become unresponsive during system startup or
driver loading.
According to the DMC documentation, a delay is needed after the RESET
command to allow the chip to complete its internal initialization. As this
delay is not guaranteed, we had a system where the touch screen
occasionally did not send any touch data. There was no other indication of
the problem.
The patch fixes the problem by adding a 150ms delay between the RESET and
SET_RATE commands.
Suggested-by: Jakob Mustafa <jakob.mustafa@bytecmed.com>
Signed-off-by: Bernhard Bender <bernhard.bender@bytecmed.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/input/touchscreen/usbtouchscreen.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -528,6 +528,9 @@ static int dmc_tsc10_init(struct usbtouc
goto err_out;
}
+ /* TSC-25 data sheet specifies a delay after the RESET command */
+ msleep(150);
+
/* set coordinate output rate */
buf[0] = buf[1] = 0xFF;
ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 047/110] stmmac: troubleshoot unexpected bits in des0 & des1
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (61 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 102/110] Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:23 ` Alexey Brodkin
2015-08-10 10:12 ` [PATCH 3.2 063/110] netfilter: bridge: don't leak skb in error paths Ben Hutchings
` (48 subsequent siblings)
111 siblings, 1 reply; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Alexey Brodkin, David Miller, arc-linux-dev,
Giuseppe Cavallaro, Alexey Brodkin
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
commit f1590670ce069eefeb93916391a67643e6ad1630 upstream.
Current implementation of descriptor init procedure only takes
care about setting/clearing ownership flag in "des0"/"des1"
fields while it is perfectly possible to get unexpected bits
set because of the following factors:
[1] On driver probe underlying memory allocated with
dma_alloc_coherent() might not be zeroed and so
it will be filled with garbage.
[2] During driver operation some bits could be set by SD/MMC
controller (for example error flags etc).
And unexpected and/or randomly set flags in "des0"/"des1"
fields may lead to unpredictable behavior of GMAC DMA block.
This change addresses both items above with:
[1] Use of dma_zalloc_coherent() instead of simple
dma_alloc_coherent() to make sure allocated memory is
zeroed. That shouldn't affect performance because
this allocation only happens once on driver probe.
[2] Do explicit zeroing of both "des0" and "des1" fields
of all buffer descriptors during initialization of
DMA transfer.
And while at it fixed identation of dma_free_coherent()
counterpart as well.
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Cc: arc-linux-dev@synopsys.com
Cc: linux-kernel@vger.kernel.org
Cc: David Miller <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2:
- Adjust context, indentation
- Normal and extended descriptors are allocated in the same place here]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/net/ethernet/stmicro/stmmac/descs.h
+++ b/drivers/net/ethernet/stmicro/stmmac/descs.h
@@ -153,6 +153,8 @@ struct dma_desc {
u32 buffer2_size:13;
u32 reserved4:3;
} etx; /* -- enhanced -- */
+
+ u64 all_flags;
} des01;
unsigned int des2;
unsigned int des3;
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -232,6 +232,7 @@ static void enh_desc_init_rx_desc(struct
{
int i;
for (i = 0; i < ring_size; i++) {
+ p->des01.all_flags = 0;
p->des01.erx.own = 1;
p->des01.erx.buffer1_size = BUF_SIZE_8KiB - 1;
@@ -248,7 +249,7 @@ static void enh_desc_init_tx_desc(struct
int i;
for (i = 0; i < ring_size; i++) {
- p->des01.etx.own = 0;
+ p->des01.all_flags = 0;
ehn_desc_tx_set_on_ring_chain(p, (i == ring_size - 1));
p++;
}
--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
@@ -126,6 +126,7 @@ static void ndesc_init_rx_desc(struct dm
{
int i;
for (i = 0; i < ring_size; i++) {
+ p->des01.all_flags = 0;
p->des01.rx.own = 1;
p->des01.rx.buffer1_size = BUF_SIZE_2KiB - 1;
@@ -141,7 +142,7 @@ static void ndesc_init_tx_desc(struct dm
{
int i;
for (i = 0; i < ring_size; i++) {
- p->des01.tx.own = 0;
+ p->des01.all_flags = 0;
ndesc_tx_set_on_ring_chain(p, (i == (ring_size - 1)));
p++;
}
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -441,19 +441,17 @@ static void init_dma_desc_rings(struct n
priv->rx_skbuff =
kmalloc(sizeof(struct sk_buff *) * rxsize, GFP_KERNEL);
priv->dma_rx =
- (struct dma_desc *)dma_alloc_coherent(priv->device,
- rxsize *
- sizeof(struct dma_desc),
- &priv->dma_rx_phy,
- GFP_KERNEL);
+ (struct dma_desc *)dma_zalloc_coherent(priv->device, rxsize *
+ sizeof(struct dma_desc),
+ &priv->dma_rx_phy,
+ GFP_KERNEL);
priv->tx_skbuff = kmalloc(sizeof(struct sk_buff *) * txsize,
GFP_KERNEL);
priv->dma_tx =
- (struct dma_desc *)dma_alloc_coherent(priv->device,
- txsize *
- sizeof(struct dma_desc),
- &priv->dma_tx_phy,
- GFP_KERNEL);
+ (struct dma_desc *)dma_zalloc_coherent(priv->device, txsize *
+ sizeof(struct dma_desc),
+ &priv->dma_tx_phy,
+ GFP_KERNEL);
if ((priv->dma_rx == NULL) || (priv->dma_tx == NULL)) {
pr_err("%s:ERROR allocating the DMA Tx/Rx desc\n", __func__);
^ permalink raw reply [flat|nested] 126+ messages in thread* Re: [PATCH 3.2 047/110] stmmac: troubleshoot unexpected bits in des0 & des1
2015-08-10 10:12 ` [PATCH 3.2 047/110] stmmac: troubleshoot unexpected bits in des0 & des1 Ben Hutchings
@ 2015-08-10 10:23 ` Alexey Brodkin
2015-08-11 20:19 ` Ben Hutchings
0 siblings, 1 reply; 126+ messages in thread
From: Alexey Brodkin @ 2015-08-10 10:23 UTC (permalink / raw)
To: ben@decadent.org.uk
Cc: davem@davemloft.net, linux-kernel@vger.kernel.org,
arc-linux-dev@synopsys.com, akpm@linux-foundation.org,
peppe.cavallaro@st.com, stable@vger.kernel.org
Hi Ben,
On Mon, 2015-08-10 at 12:12 +0200, Ben Hutchings wrote:
> 3.2.71-rc1 review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
>
> commit f1590670ce069eefeb93916391a67643e6ad1630 upstream.
>
> Current implementation of descriptor init procedure only takes
> care about setting/clearing ownership flag in "des0"/"des1"
> fields while it is perfectly possible to get unexpected bits
> set because of the following factors:
>
> [1] On driver probe underlying memory allocated with
> dma_alloc_coherent() might not be zeroed and so
> it will be filled with garbage.
>
> [2] During driver operation some bits could be set by SD/MMC
> controller (for example error flags etc).
>
> And unexpected and/or randomly set flags in "des0"/"des1"
> fields may lead to unpredictable behavior of GMAC DMA block.
>
> This change addresses both items above with:
>
> [1] Use of dma_zalloc_coherent() instead of simple
> dma_alloc_coherent() to make sure allocated memory is
> zeroed. That shouldn't affect performance because
> this allocation only happens once on driver probe.
>
> [2] Do explicit zeroing of both "des0" and "des1" fields
> of all buffer descriptors during initialization of
> DMA transfer.
>
> And while at it fixed identation of dma_free_coherent()
> counterpart as well.
>
> Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
> Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
> Cc: arc-linux-dev@synopsys.com
> Cc: linux-kernel@vger.kernel.org
> Cc: David Miller <davem@davemloft.net>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> [bwh: Backported to 3.2:
> - Adjust context, indentation
> - Normal and extended descriptors are allocated in the same place here]
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This patch looks good to me.
Moreover that was exactly what I initially done on top of 3.18, see
https://github.com/foss-for-synopsys-dwc-arc-processors/linux/commit/f2105b2ba9b3444568b32caca1ab253b88058fc2
So feel free to add Acked-by and/or Tested-by: Alexey Brodkin <abrodkin@synopsys.com>
-Alexey
^ permalink raw reply [flat|nested] 126+ messages in thread
* Re: [PATCH 3.2 047/110] stmmac: troubleshoot unexpected bits in des0 & des1
2015-08-10 10:23 ` Alexey Brodkin
@ 2015-08-11 20:19 ` Ben Hutchings
0 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-11 20:19 UTC (permalink / raw)
To: Alexey Brodkin
Cc: davem@davemloft.net, linux-kernel@vger.kernel.org,
arc-linux-dev@synopsys.com, akpm@linux-foundation.org,
peppe.cavallaro@st.com, stable@vger.kernel.org
[-- Attachment #1: Type: text/plain, Size: 955 bytes --]
On Mon, 2015-08-10 at 10:23 +0000, Alexey Brodkin wrote:
> Hi Ben,
>
> On Mon, 2015-08-10 at 12:12 +0200, Ben Hutchings wrote:
> > 3.2.71-rc1 review patch. If anyone has any objections, please let
> > me know.
> >
> > ------------------
> >
> > From: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
> >
> > commit f1590670ce069eefeb93916391a67643e6ad1630 upstream.
[...]
> This patch looks good to me.
>
> Moreover that was exactly what I initially done on top of 3.18, see
> https://github.com/foss-for-synopsys-dwc-arc
> -processors/linux/commit/f2105b2ba9b3444568b32caca1ab253b88058fc2
>
> So feel free to add Acked-by and/or Tested-by: Alexey Brodkin <
> abrodkin@synopsys.com>
You didn't say you tested 3.2.71-rc1, so I've added your Acked-by.
Thanks.
Ben.
--
Ben Hutchings
Theory and practice are closer in theory than in practice.
- John Levine, moderator of comp.compilers
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply [flat|nested] 126+ messages in thread
* [PATCH 3.2 063/110] netfilter: bridge: don't leak skb in error paths
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (62 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 047/110] stmmac: troubleshoot unexpected bits in des0 & des1 Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 062/110] ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp Ben Hutchings
` (47 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Pablo Neira Ayuso, Florian Westphal
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit dd302b59bde0149c20df7278c0d36c765e66afbd upstream.
br_nf_dev_queue_xmit must free skb in its error path.
NF_DROP is misleading -- its an okfn, not a netfilter hook.
Fixes: 462fb2af9788a ("bridge : Sanitize skb before it enters the IP stack")
Fixes: efb6de9b4ba00 ("netfilter: bridge: forward IPv6 fragmented packets")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
[bwh: Backported to 3.2:
- Adjust filename
- Drop IPv6 changes]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -822,12 +822,15 @@ static int br_nf_dev_queue_xmit(struct s
!skb_is_gso(skb)) {
if (br_parse_ip_options(skb))
/* Drop invalid packet */
- return NF_DROP;
+ goto drop;
ret = ip_fragment(skb, br_dev_queue_push_xmit);
} else
ret = br_dev_queue_push_xmit(skb);
return ret;
+ drop:
+ kfree_skb(skb);
+ return 0;
}
#else
static int br_nf_dev_queue_xmit(struct sk_buff *skb)
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 062/110] ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (63 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 063/110] netfilter: bridge: don't leak skb in error paths Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 067/110] ext4: replace open coded nofail allocation in ext4_free_blocks() Ben Hutchings
` (46 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Theodore Ts'o, Nikolay Borisov
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Borisov <kernel@kyup.com>
commit c45653c341f5c8a0ce19c8f0ad4678640849cb86 upstream.
Switch ext4 to using sb_getblk_gfp with GFP_NOFS added to fix possible
deadlocks in the page writeback path.
Signed-off-by: Nikolay Borisov <kernel@kyup.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -700,7 +700,8 @@ ext4_ext_find_extent(struct inode *inode
path[ppos].p_depth = i;
path[ppos].p_ext = NULL;
- bh = sb_getblk(inode->i_sb, path[ppos].p_block);
+ bh = sb_getblk_gfp(inode->i_sb, path[ppos].p_block,
+ __GFP_MOVABLE | GFP_NOFS);
if (unlikely(!bh)) {
ret = -ENOMEM;
goto err;
@@ -905,7 +906,7 @@ static int ext4_ext_split(handle_t *hand
err = -EIO;
goto cleanup;
}
- bh = sb_getblk(inode->i_sb, newblock);
+ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS);
if (!bh) {
err = -ENOMEM;
goto cleanup;
@@ -1089,7 +1090,7 @@ static int ext4_ext_grow_indepth(handle_
if (newblock == 0)
return err;
- bh = sb_getblk(inode->i_sb, newblock);
+ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS);
if (!bh)
return -ENOMEM;
lock_buffer(bh);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 067/110] ext4: replace open coded nofail allocation in ext4_free_blocks()
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (64 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 062/110] ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 069/110] dm thin: allocate the cell_sort_array dynamically Ben Hutchings
` (45 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Michal Hocko, Theodore Ts'o
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <mhocko@suse.cz>
commit 7444a072c387a93ebee7066e8aee776954ab0e41 upstream.
ext4_free_blocks is looping around the allocation request and mimics
__GFP_NOFAIL behavior without any allocation fallback strategy. Let's
remove the open coded loop and replace it with __GFP_NOFAIL. Without the
flag the allocator has no way to find out never-fail requirement and
cannot help in any way.
Signed-off-by: Michal Hocko <mhocko@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[bwh: Backported to 3.2:
- Adjust context
- s/ext4_free_data_cachep/ext4_free_ext_cachep/]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ext4/mballoc.c | 16 +++++-----------
1 file changed, 5 insertions(+), 11 deletions(-)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4720,18 +4720,12 @@ do_more:
/*
* blocks being freed are metadata. these blocks shouldn't
* be used until this transaction is committed
+ *
+ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed
+ * to fail.
*/
- retry:
- new_entry = kmem_cache_alloc(ext4_free_ext_cachep, GFP_NOFS);
- if (!new_entry) {
- /*
- * We use a retry loop because
- * ext4_free_blocks() is not allowed to fail.
- */
- cond_resched();
- congestion_wait(BLK_RW_ASYNC, HZ/50);
- goto retry;
- }
+ new_entry = kmem_cache_alloc(ext4_free_ext_cachep,
+ GFP_NOFS|__GFP_NOFAIL);
new_entry->start_cluster = bit;
new_entry->group = block_group;
new_entry->count = count_clusters;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 069/110] dm thin: allocate the cell_sort_array dynamically
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (65 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 067/110] ext4: replace open coded nofail allocation in ext4_free_blocks() Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 034/110] jbd2: fix ocfs2 corrupt when updating journal superblock fails Ben Hutchings
` (44 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mike Snitzer, Joe Thornber
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit a822c83e47d97cdef38c4352e1ef62d9f46cfe98 upstream.
Given the pool's cell_sort_array holds 8192 pointers it triggers an
order 5 allocation via kmalloc. This order 5 allocation is prone to
failure as system memory gets more fragmented over time.
Fix this by allocating the cell_sort_array using vmalloc.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
[bwh: Backported to 3.2: make a similar change in prison_{create,destroy}()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/md/dm-thin.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -13,6 +13,7 @@
#include <linux/init.h>
#include <linux/module.h>
#include <linux/slab.h>
+#include <linux/vmalloc.h>
#define DM_MSG_PREFIX "thin"
@@ -158,9 +159,7 @@ static struct bio_prison *prison_create(
{
unsigned i;
uint32_t nr_buckets = calc_nr_buckets(nr_cells);
- size_t len = sizeof(struct bio_prison) +
- (sizeof(struct hlist_head) * nr_buckets);
- struct bio_prison *prison = kmalloc(len, GFP_KERNEL);
+ struct bio_prison *prison = kmalloc(sizeof(*prison), GFP_KERNEL);
if (!prison)
return NULL;
@@ -173,9 +172,15 @@ static struct bio_prison *prison_create(
return NULL;
}
+ prison->cells = vmalloc(sizeof(*prison->cells) * nr_buckets);
+ if (!prison->cells) {
+ mempool_destroy(prison->cell_pool);
+ kfree(prison);
+ return NULL;
+ }
+
prison->nr_buckets = nr_buckets;
prison->hash_mask = nr_buckets - 1;
- prison->cells = (struct hlist_head *) (prison + 1);
for (i = 0; i < nr_buckets; i++)
INIT_HLIST_HEAD(prison->cells + i);
@@ -184,6 +189,7 @@ static struct bio_prison *prison_create(
static void prison_destroy(struct bio_prison *prison)
{
+ vfree(prison->cells);
mempool_destroy(prison->cell_pool);
kfree(prison);
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 034/110] jbd2: fix ocfs2 corrupt when updating journal superblock fails
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (66 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 069/110] dm thin: allocate the cell_sort_array dynamically Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 110/110] x86/ldt: Make modify_ldt synchronous Ben Hutchings
` (43 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Joseph Qi, Junxiao Bi, Theodore Ts'o, Yiwen Jiang
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@huawei.com>
commit 6f6a6fda294506dfe0e3e0a253bb2d2923f28f0a upstream.
If updating journal superblock fails after journal data has been
flushed, the error is omitted and this will mislead the caller as a
normal case. In ocfs2, the checkpoint will be treated successfully
and the other node can get the lock to update. Since the sb_start is
still pointing to the old log block, it will rewrite the journal data
during journal recovery by the other node. Thus the new updates will
be overwritten and ocfs2 corrupts. So in above case we have to return
the error, and ocfs2_commit_cache will take care of the error and
prevent the other node to do update first. And only after recovering
journal it can do the new updates.
The issue discussion mail can be found at:
https://oss.oracle.com/pipermail/ocfs2-devel/2015-June/010856.html
http://comments.gmane.org/gmane.comp.file-systems.ext4/48841
[ Fixed bug in patch which allowed a non-negative error return from
jbd2_cleanup_journal_tail() to leak out of jbd2_fjournal_flush(); this
was causing xfstests ext4/306 to fail. -- Ted ]
Reported-by: Yiwen Jiang <jiangyiwen@huawei.com>
Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Tested-by: Yiwen Jiang <jiangyiwen@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
[bwh: Backported to 3.2:
- Adjust context
- Don't drop j_checkpoint_mutex where we don't hold it]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -482,7 +482,7 @@ int jbd2_cleanup_journal_tail(journal_t
unsigned long blocknr;
if (is_journal_aborted(journal))
- return 1;
+ return -EIO;
if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
return 1;
@@ -499,8 +499,7 @@ int jbd2_cleanup_journal_tail(journal_t
if (journal->j_flags & JBD2_BARRIER)
blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
- __jbd2_update_log_tail(journal, first_tid, blocknr);
- return 0;
+ return __jbd2_update_log_tail(journal, first_tid, blocknr);
}
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -824,9 +824,10 @@ int jbd2_journal_get_log_tail(journal_t
*
* Requires j_checkpoint_mutex
*/
-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
{
unsigned long freed;
+ int ret;
BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
@@ -836,7 +837,10 @@ void __jbd2_update_log_tail(journal_t *j
* space and if we lose sb update during power failure we'd replay
* old transaction with possibly newly overwritten data.
*/
- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
+ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
+ if (ret)
+ goto out;
+
write_lock(&journal->j_state_lock);
freed = block - journal->j_tail;
if (block < journal->j_tail)
@@ -852,6 +856,9 @@ void __jbd2_update_log_tail(journal_t *j
journal->j_tail_sequence = tid;
journal->j_tail = block;
write_unlock(&journal->j_state_lock);
+
+out:
+ return ret;
}
struct jbd2_stats_proc_session {
@@ -1249,7 +1256,7 @@ static int journal_reset(journal_t *jour
return jbd2_journal_start_thread(journal);
}
-static void jbd2_write_superblock(journal_t *journal, int write_op)
+static int jbd2_write_superblock(journal_t *journal, int write_op)
{
struct buffer_head *bh = journal->j_sb_buffer;
int ret;
@@ -1285,7 +1292,10 @@ static void jbd2_write_superblock(journa
printk(KERN_ERR "JBD2: Error %d detected when updating "
"journal superblock for %s.\n", ret,
journal->j_devname);
+ jbd2_journal_abort(journal, ret);
}
+
+ return ret;
}
/**
@@ -1298,10 +1308,11 @@ static void jbd2_write_superblock(journa
* Update a journal's superblock information about log tail and write it to
* disk, waiting for the IO to complete.
*/
-void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
+int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
unsigned long tail_block, int write_op)
{
journal_superblock_t *sb = journal->j_superblock;
+ int ret;
jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
tail_block, tail_tid);
@@ -1309,12 +1320,17 @@ void jbd2_journal_update_sb_log_tail(jou
sb->s_sequence = cpu_to_be32(tail_tid);
sb->s_start = cpu_to_be32(tail_block);
- jbd2_write_superblock(journal, write_op);
+ ret = jbd2_write_superblock(journal, write_op);
+ if (ret)
+ goto out;
/* Log is no longer empty */
write_lock(&journal->j_state_lock);
WARN_ON(!sb->s_sequence);
journal->j_flags &= ~JBD2_FLUSHED;
write_unlock(&journal->j_state_lock);
+
+out:
+ return ret;
}
/**
@@ -1812,7 +1828,12 @@ int jbd2_journal_flush(journal_t *journa
if (is_journal_aborted(journal))
return -EIO;
- jbd2_cleanup_journal_tail(journal);
+ if (!err) {
+ err = jbd2_cleanup_journal_tail(journal);
+ if (err < 0)
+ goto out;
+ err = 0;
+ }
/* Finally, mark the journal as really needing no recovery.
* This sets s_start==0 in the underlying superblock, which is
@@ -1827,7 +1848,8 @@ int jbd2_journal_flush(journal_t *journa
J_ASSERT(journal->j_head == journal->j_tail);
J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
write_unlock(&journal->j_state_lock);
- return 0;
+out:
+ return err;
}
/**
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -974,7 +974,7 @@ extern struct journal_head * jbd2_journa
int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
unsigned long *block);
-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
/* Commit management */
extern void jbd2_journal_commit_transaction(journal_t *);
@@ -1086,7 +1086,7 @@ extern int jbd2_journal_destroy (j
extern int jbd2_journal_recover (journal_t *journal);
extern int jbd2_journal_wipe (journal_t *, int);
extern int jbd2_journal_skip_recovery (journal_t *);
-extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
+extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
unsigned long, int);
extern void __jbd2_journal_abort_hard (journal_t *);
extern void jbd2_journal_abort (journal_t *, int);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 110/110] x86/ldt: Make modify_ldt synchronous
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (67 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 034/110] jbd2: fix ocfs2 corrupt when updating journal superblock fails Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 16:47 ` Andy Lutomirski
2015-08-10 10:12 ` [PATCH 3.2 093/110] inet: frags: fix defragmented packet's IP header for af_packet Ben Hutchings
` (42 subsequent siblings)
111 siblings, 1 reply; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Thomas Gleixner, Jan Beulich, Linus Torvalds,
Borislav Petkov, Steven Rostedt, Boris Ostrovsky, Ingo Molnar,
Andy Lutomirski, Borislav Petkov, Sasha Levin, Brian Gerst,
Andrew Cooper, Peter Zijlstra, H. Peter Anvin, xen-devel,
Denys Vlasenko, Konrad Rzeszutek Wilk, Andy Lutomirski,
security@kernel.org
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
commit 37868fe113ff2ba814b3b4eb12df214df555f8dc upstream.
modify_ldt() has questionable locking and does not synchronize
threads. Improve it: redesign the locking and synchronize all
threads' LDTs using an IPI on all modifications.
This will dramatically slow down modify_ldt in multithreaded
programs, but there shouldn't be any multithreaded programs that
care about modify_ldt's performance in the first place.
This fixes some fallout from the CVE-2015-5157 fixes.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Borislav Petkov <bp@suse.de>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Jan Beulich <jbeulich@suse.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: security@kernel.org <security@kernel.org>
Cc: xen-devel <xen-devel@lists.xen.org>
Link: http://lkml.kernel.org/r/4c6978476782160600471bd865b318db34c7b628.1438291540.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[bwh: Backported to 3.2:
- Adjust context
- Drop comment changes in switch_mm()
- Drop changes to get_segment_base() in arch/x86/kernel/cpu/perf_event.c
- Open-code lockless_dereference(), smp_store_release(), on_each_cpu_mask()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/arch/x86/include/asm/desc.h
+++ b/arch/x86/include/asm/desc.h
@@ -277,21 +277,6 @@ static inline void clear_LDT(void)
set_ldt(NULL, 0);
}
-/*
- * load one particular LDT into the current CPU
- */
-static inline void load_LDT_nolock(mm_context_t *pc)
-{
- set_ldt(pc->ldt, pc->size);
-}
-
-static inline void load_LDT(mm_context_t *pc)
-{
- preempt_disable();
- load_LDT_nolock(pc);
- preempt_enable();
-}
-
static inline unsigned long get_desc_base(const struct desc_struct *desc)
{
return (unsigned)(desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24));
--- a/arch/x86/include/asm/mmu.h
+++ b/arch/x86/include/asm/mmu.h
@@ -9,8 +9,7 @@
* we put the segment information here.
*/
typedef struct {
- void *ldt;
- int size;
+ struct ldt_struct *ldt;
#ifdef CONFIG_X86_64
/* True if mm supports a task running in 32 bit compatibility mode. */
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -16,6 +16,51 @@ static inline void paravirt_activate_mm(
#endif /* !CONFIG_PARAVIRT */
/*
+ * ldt_structs can be allocated, used, and freed, but they are never
+ * modified while live.
+ */
+struct ldt_struct {
+ /*
+ * Xen requires page-aligned LDTs with special permissions. This is
+ * needed to prevent us from installing evil descriptors such as
+ * call gates. On native, we could merge the ldt_struct and LDT
+ * allocations, but it's not worth trying to optimize.
+ */
+ struct desc_struct *entries;
+ int size;
+};
+
+static inline void load_mm_ldt(struct mm_struct *mm)
+{
+ struct ldt_struct *ldt;
+
+ /* smp_read_barrier_depends synchronizes with barrier in install_ldt */
+ ldt = ACCESS_ONCE(mm->context.ldt);
+ smp_read_barrier_depends();
+
+ /*
+ * Any change to mm->context.ldt is followed by an IPI to all
+ * CPUs with the mm active. The LDT will not be freed until
+ * after the IPI is handled by all such CPUs. This means that,
+ * if the ldt_struct changes before we return, the values we see
+ * will be safe, and the new values will be loaded before we run
+ * any user code.
+ *
+ * NB: don't try to convert this to use RCU without extreme care.
+ * We would still need IRQs off, because we don't want to change
+ * the local LDT after an IPI loaded a newer value than the one
+ * that we can see.
+ */
+
+ if (unlikely(ldt))
+ set_ldt(ldt->entries, ldt->size);
+ else
+ clear_LDT();
+
+ DEBUG_LOCKS_WARN_ON(preemptible());
+}
+
+/*
* Used for LDT copy/destruction.
*/
int init_new_context(struct task_struct *tsk, struct mm_struct *mm);
@@ -52,7 +97,7 @@ static inline void switch_mm(struct mm_s
* load the LDT, if the LDT is different:
*/
if (unlikely(prev->context.ldt != next->context.ldt))
- load_LDT_nolock(&next->context);
+ load_mm_ldt(next);
}
#ifdef CONFIG_SMP
else {
@@ -65,7 +110,7 @@ static inline void switch_mm(struct mm_s
* to make sure to use no freed page tables.
*/
load_cr3(next->pgd);
- load_LDT_nolock(&next->context);
+ load_mm_ldt(next);
}
}
#endif
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1225,7 +1225,7 @@ void __cpuinit cpu_init(void)
load_sp0(t, ¤t->thread);
set_tss_desc(cpu, t);
load_TR_desc();
- load_LDT(&init_mm.context);
+ load_mm_ldt(&init_mm);
clear_all_debug_regs();
dbg_restore_debug_regs();
@@ -1273,7 +1273,7 @@ void __cpuinit cpu_init(void)
load_sp0(t, thread);
set_tss_desc(cpu, t);
load_TR_desc();
- load_LDT(&init_mm.context);
+ load_mm_ldt(&init_mm);
t->x86_tss.io_bitmap_base = offsetof(struct tss_struct, io_bitmap);
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -12,6 +12,7 @@
#include <linux/string.h>
#include <linux/mm.h>
#include <linux/smp.h>
+#include <linux/slab.h>
#include <linux/vmalloc.h>
#include <linux/uaccess.h>
@@ -21,82 +22,87 @@
#include <asm/mmu_context.h>
#include <asm/syscalls.h>
-#ifdef CONFIG_SMP
+/* context.lock is held for us, so we don't need any locking. */
static void flush_ldt(void *current_mm)
{
- if (current->active_mm == current_mm)
- load_LDT(¤t->active_mm->context);
+ mm_context_t *pc;
+
+ if (current->active_mm != current_mm)
+ return;
+
+ pc = ¤t->active_mm->context;
+ set_ldt(pc->ldt->entries, pc->ldt->size);
}
-#endif
-static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
+/* The caller must call finalize_ldt_struct on the result. LDT starts zeroed. */
+static struct ldt_struct *alloc_ldt_struct(int size)
{
- void *oldldt, *newldt;
- int oldsize;
+ struct ldt_struct *new_ldt;
+ int alloc_size;
- if (mincount <= pc->size)
- return 0;
- oldsize = pc->size;
- mincount = (mincount + (PAGE_SIZE / LDT_ENTRY_SIZE - 1)) &
- (~(PAGE_SIZE / LDT_ENTRY_SIZE - 1));
- if (mincount * LDT_ENTRY_SIZE > PAGE_SIZE)
- newldt = vmalloc(mincount * LDT_ENTRY_SIZE);
- else
- newldt = (void *)__get_free_page(GFP_KERNEL);
+ if (size > LDT_ENTRIES)
+ return NULL;
- if (!newldt)
- return -ENOMEM;
+ new_ldt = kmalloc(sizeof(struct ldt_struct), GFP_KERNEL);
+ if (!new_ldt)
+ return NULL;
+
+ BUILD_BUG_ON(LDT_ENTRY_SIZE != sizeof(struct desc_struct));
+ alloc_size = size * LDT_ENTRY_SIZE;
+
+ /*
+ * Xen is very picky: it requires a page-aligned LDT that has no
+ * trailing nonzero bytes in any page that contains LDT descriptors.
+ * Keep it simple: zero the whole allocation and never allocate less
+ * than PAGE_SIZE.
+ */
+ if (alloc_size > PAGE_SIZE)
+ new_ldt->entries = vzalloc(alloc_size);
+ else
+ new_ldt->entries = kzalloc(PAGE_SIZE, GFP_KERNEL);
- if (oldsize)
- memcpy(newldt, pc->ldt, oldsize * LDT_ENTRY_SIZE);
- oldldt = pc->ldt;
- memset(newldt + oldsize * LDT_ENTRY_SIZE, 0,
- (mincount - oldsize) * LDT_ENTRY_SIZE);
-
- paravirt_alloc_ldt(newldt, mincount);
-
-#ifdef CONFIG_X86_64
- /* CHECKME: Do we really need this ? */
- wmb();
-#endif
- pc->ldt = newldt;
- wmb();
- pc->size = mincount;
- wmb();
-
- if (reload) {
-#ifdef CONFIG_SMP
- preempt_disable();
- load_LDT(pc);
- if (!cpumask_equal(mm_cpumask(current->mm),
- cpumask_of(smp_processor_id())))
- smp_call_function(flush_ldt, current->mm, 1);
- preempt_enable();
-#else
- load_LDT(pc);
-#endif
- }
- if (oldsize) {
- paravirt_free_ldt(oldldt, oldsize);
- if (oldsize * LDT_ENTRY_SIZE > PAGE_SIZE)
- vfree(oldldt);
- else
- put_page(virt_to_page(oldldt));
+ if (!new_ldt->entries) {
+ kfree(new_ldt);
+ return NULL;
}
- return 0;
+
+ new_ldt->size = size;
+ return new_ldt;
}
-static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
+/* After calling this, the LDT is immutable. */
+static void finalize_ldt_struct(struct ldt_struct *ldt)
{
- int err = alloc_ldt(new, old->size, 0);
- int i;
+ paravirt_alloc_ldt(ldt->entries, ldt->size);
+}
+
+/* context.lock is held */
+static void install_ldt(struct mm_struct *current_mm,
+ struct ldt_struct *ldt)
+{
+ /* Synchronizes with smp_read_barrier_depends in load_mm_ldt. */
+ barrier();
+ ACCESS_ONCE(current_mm->context.ldt) = ldt;
+
+ /* Activate the LDT for all CPUs using current_mm. */
+ smp_call_function_many(mm_cpumask(current_mm), flush_ldt, current_mm,
+ true);
+ local_irq_disable();
+ flush_ldt(current_mm);
+ local_irq_enable();
+}
- if (err < 0)
- return err;
+static void free_ldt_struct(struct ldt_struct *ldt)
+{
+ if (likely(!ldt))
+ return;
- for (i = 0; i < old->size; i++)
- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
- return 0;
+ paravirt_free_ldt(ldt->entries, ldt->size);
+ if (ldt->size * LDT_ENTRY_SIZE > PAGE_SIZE)
+ vfree(ldt->entries);
+ else
+ kfree(ldt->entries);
+ kfree(ldt);
}
/*
@@ -105,17 +111,37 @@ static inline int copy_ldt(mm_context_t
*/
int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
{
+ struct ldt_struct *new_ldt;
struct mm_struct *old_mm;
int retval = 0;
mutex_init(&mm->context.lock);
- mm->context.size = 0;
old_mm = current->mm;
- if (old_mm && old_mm->context.size > 0) {
- mutex_lock(&old_mm->context.lock);
- retval = copy_ldt(&mm->context, &old_mm->context);
- mutex_unlock(&old_mm->context.lock);
+ if (!old_mm) {
+ mm->context.ldt = NULL;
+ return 0;
+ }
+
+ mutex_lock(&old_mm->context.lock);
+ if (!old_mm->context.ldt) {
+ mm->context.ldt = NULL;
+ goto out_unlock;
}
+
+ new_ldt = alloc_ldt_struct(old_mm->context.ldt->size);
+ if (!new_ldt) {
+ retval = -ENOMEM;
+ goto out_unlock;
+ }
+
+ memcpy(new_ldt->entries, old_mm->context.ldt->entries,
+ new_ldt->size * LDT_ENTRY_SIZE);
+ finalize_ldt_struct(new_ldt);
+
+ mm->context.ldt = new_ldt;
+
+out_unlock:
+ mutex_unlock(&old_mm->context.lock);
return retval;
}
@@ -126,53 +152,47 @@ int init_new_context(struct task_struct
*/
void destroy_context(struct mm_struct *mm)
{
- if (mm->context.size) {
-#ifdef CONFIG_X86_32
- /* CHECKME: Can this ever happen ? */
- if (mm == current->active_mm)
- clear_LDT();
-#endif
- paravirt_free_ldt(mm->context.ldt, mm->context.size);
- if (mm->context.size * LDT_ENTRY_SIZE > PAGE_SIZE)
- vfree(mm->context.ldt);
- else
- put_page(virt_to_page(mm->context.ldt));
- mm->context.size = 0;
- }
+ free_ldt_struct(mm->context.ldt);
+ mm->context.ldt = NULL;
}
static int read_ldt(void __user *ptr, unsigned long bytecount)
{
- int err;
+ int retval;
unsigned long size;
struct mm_struct *mm = current->mm;
- if (!mm->context.size)
- return 0;
+ mutex_lock(&mm->context.lock);
+
+ if (!mm->context.ldt) {
+ retval = 0;
+ goto out_unlock;
+ }
+
if (bytecount > LDT_ENTRY_SIZE * LDT_ENTRIES)
bytecount = LDT_ENTRY_SIZE * LDT_ENTRIES;
- mutex_lock(&mm->context.lock);
- size = mm->context.size * LDT_ENTRY_SIZE;
+ size = mm->context.ldt->size * LDT_ENTRY_SIZE;
if (size > bytecount)
size = bytecount;
- err = 0;
- if (copy_to_user(ptr, mm->context.ldt, size))
- err = -EFAULT;
- mutex_unlock(&mm->context.lock);
- if (err < 0)
- goto error_return;
+ if (copy_to_user(ptr, mm->context.ldt->entries, size)) {
+ retval = -EFAULT;
+ goto out_unlock;
+ }
+
if (size != bytecount) {
- /* zero-fill the rest */
- if (clear_user(ptr + size, bytecount - size) != 0) {
- err = -EFAULT;
- goto error_return;
+ /* Zero-fill the rest and pretend we read bytecount bytes. */
+ if (clear_user(ptr + size, bytecount - size)) {
+ retval = -EFAULT;
+ goto out_unlock;
}
}
- return bytecount;
-error_return:
- return err;
+ retval = bytecount;
+
+out_unlock:
+ mutex_unlock(&mm->context.lock);
+ return retval;
}
static int read_default_ldt(void __user *ptr, unsigned long bytecount)
@@ -196,6 +216,8 @@ static int write_ldt(void __user *ptr, u
struct desc_struct ldt;
int error;
struct user_desc ldt_info;
+ int oldsize, newsize;
+ struct ldt_struct *new_ldt, *old_ldt;
error = -EINVAL;
if (bytecount != sizeof(ldt_info))
@@ -214,34 +236,39 @@ static int write_ldt(void __user *ptr, u
goto out;
}
- mutex_lock(&mm->context.lock);
- if (ldt_info.entry_number >= mm->context.size) {
- error = alloc_ldt(¤t->mm->context,
- ldt_info.entry_number + 1, 1);
- if (error < 0)
- goto out_unlock;
- }
-
- /* Allow LDTs to be cleared by the user. */
- if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
- if (oldmode || LDT_empty(&ldt_info)) {
- memset(&ldt, 0, sizeof(ldt));
- goto install;
+ if ((oldmode && !ldt_info.base_addr && !ldt_info.limit) ||
+ LDT_empty(&ldt_info)) {
+ /* The user wants to clear the entry. */
+ memset(&ldt, 0, sizeof(ldt));
+ } else {
+ if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
+ error = -EINVAL;
+ goto out;
}
+
+ fill_ldt(&ldt, &ldt_info);
+ if (oldmode)
+ ldt.avl = 0;
}
- if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
- error = -EINVAL;
+ mutex_lock(&mm->context.lock);
+
+ old_ldt = mm->context.ldt;
+ oldsize = old_ldt ? old_ldt->size : 0;
+ newsize = max((int)(ldt_info.entry_number + 1), oldsize);
+
+ error = -ENOMEM;
+ new_ldt = alloc_ldt_struct(newsize);
+ if (!new_ldt)
goto out_unlock;
- }
- fill_ldt(&ldt, &ldt_info);
- if (oldmode)
- ldt.avl = 0;
-
- /* Install the new entry ... */
-install:
- write_ldt_entry(mm->context.ldt, ldt_info.entry_number, &ldt);
+ if (old_ldt)
+ memcpy(new_ldt->entries, old_ldt->entries, oldsize * LDT_ENTRY_SIZE);
+ new_ldt->entries[ldt_info.entry_number] = ldt;
+ finalize_ldt_struct(new_ldt);
+
+ install_ldt(mm, new_ldt);
+ free_ldt_struct(old_ldt);
error = 0;
out_unlock:
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -218,11 +218,11 @@ void __show_regs(struct pt_regs *regs, i
void release_thread(struct task_struct *dead_task)
{
if (dead_task->mm) {
- if (dead_task->mm->context.size) {
+ if (dead_task->mm->context.ldt) {
printk("WARNING: dead process %8s still has LDT? <%p/%d>\n",
dead_task->comm,
dead_task->mm->context.ldt,
- dead_task->mm->context.size);
+ dead_task->mm->context.ldt->size);
BUG();
}
}
--- a/arch/x86/kernel/step.c
+++ b/arch/x86/kernel/step.c
@@ -5,6 +5,7 @@
#include <linux/mm.h>
#include <linux/ptrace.h>
#include <asm/desc.h>
+#include <asm/mmu_context.h>
unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *regs)
{
@@ -30,10 +31,11 @@ unsigned long convert_ip_to_linear(struc
seg &= ~7UL;
mutex_lock(&child->mm->context.lock);
- if (unlikely((seg >> 3) >= child->mm->context.size))
+ if (unlikely(!child->mm->context.ldt ||
+ (seg >> 3) >= child->mm->context.ldt->size))
addr = -1L; /* bogus selector, access would fault */
else {
- desc = child->mm->context.ldt + seg;
+ desc = &child->mm->context.ldt->entries[seg];
base = get_desc_base(desc);
/* 16-bit code segment? */
--- a/arch/x86/power/cpu.c
+++ b/arch/x86/power/cpu.c
@@ -21,6 +21,7 @@
#include <asm/xcr.h>
#include <asm/suspend.h>
#include <asm/debugreg.h>
+#include <asm/mmu_context.h>
#ifdef CONFIG_X86_32
static struct saved_context saved_context;
@@ -147,7 +148,7 @@ static void fix_processor_context(void)
syscall_init(); /* This sets MSR_*STAR and related */
#endif
load_TR_desc(); /* This does ltr */
- load_LDT(¤t->active_mm->context); /* This does lldt */
+ load_mm_ldt(current->active_mm); /* This does lldt */
}
/**
^ permalink raw reply [flat|nested] 126+ messages in thread* Re: [PATCH 3.2 110/110] x86/ldt: Make modify_ldt synchronous
2015-08-10 10:12 ` [PATCH 3.2 110/110] x86/ldt: Make modify_ldt synchronous Ben Hutchings
@ 2015-08-10 16:47 ` Andy Lutomirski
2015-08-11 18:23 ` Ben Hutchings
0 siblings, 1 reply; 126+ messages in thread
From: Andy Lutomirski @ 2015-08-10 16:47 UTC (permalink / raw)
To: Ben Hutchings
Cc: linux-kernel@vger.kernel.org, stable, Andrew Morton,
Thomas Gleixner, Jan Beulich, Linus Torvalds, Borislav Petkov,
Steven Rostedt, Boris Ostrovsky, Ingo Molnar, Andy Lutomirski,
Borislav Petkov, Sasha Levin, Brian Gerst, Andrew Cooper,
Peter Zijlstra, H. Peter Anvin, xen-devel, Denys Vlasenko,
Konrad Rzeszutek Wilk, security@kernel.org
On Mon, Aug 10, 2015 at 3:12 AM, Ben Hutchings <ben@decadent.org.uk> wrote:
> 3.2.71-rc1 review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Andy Lutomirski <luto@kernel.org>
>
> commit 37868fe113ff2ba814b3b4eb12df214df555f8dc upstream.
Unfortunately, this patch was slightly buggy. The fixes are:
https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?h=x86/urgent&id=4809146b86c3d41ce588fdb767d021e2a80600dd
https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?h=x86/urgent&id=136d9d83c07c5e30ac49fc83b27e8c4842f108fc
Grr, making major changes like this in the middle of a release cycle
isn't the best.
--Andy
^ permalink raw reply [flat|nested] 126+ messages in thread
* Re: [PATCH 3.2 110/110] x86/ldt: Make modify_ldt synchronous
2015-08-10 16:47 ` Andy Lutomirski
@ 2015-08-11 18:23 ` Ben Hutchings
0 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-11 18:23 UTC (permalink / raw)
To: Andy Lutomirski
Cc: linux-kernel@vger.kernel.org, stable, Andrew Morton,
Thomas Gleixner, Jan Beulich, Linus Torvalds, Borislav Petkov,
Steven Rostedt, Boris Ostrovsky, Ingo Molnar, Andy Lutomirski,
Borislav Petkov, Sasha Levin, Brian Gerst, Andrew Cooper,
Peter Zijlstra, H. Peter Anvin, xen-devel, Denys Vlasenko,
Konrad Rzeszutek Wilk, security@kernel.org
[-- Attachment #1: Type: text/plain, Size: 1011 bytes --]
On Mon, 2015-08-10 at 09:47 -0700, Andy Lutomirski wrote:
> On Mon, Aug 10, 2015 at 3:12 AM, Ben Hutchings <ben@decadent.org.uk> wrote:
> > 3.2.71-rc1 review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Andy Lutomirski <luto@kernel.org>
> >
> > commit 37868fe113ff2ba814b3b4eb12df214df555f8dc upstream.
>
> Unfortunately, this patch was slightly buggy. The fixes are:
>
> https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?h=x86/urgent&id=4809146b86c3d41ce588fdb767d021e2a80600dd
>
> https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?h=x86/urgent&id=136d9d83c07c5e30ac49fc83b27e8c4842f108fc
>
> Grr, making major changes like this in the middle of a release cycle
> isn't the best.
OK, I'll defer this to the next update. Thanks.
Ben.
--
Ben Hutchings
Theory and practice are closer in theory than in practice.
- John Levine, moderator of comp.compilers
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply [flat|nested] 126+ messages in thread
* [PATCH 3.2 093/110] inet: frags: fix defragmented packet's IP header for af_packet
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (68 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 110/110] x86/ldt: Make modify_ldt synchronous Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 065/110] KVM: x86: properly restore LVT0 Ben Hutchings
` (41 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Edward Hyunkoo Jee, David S. Miller, Jerry Chu,
Eric Dumazet, Willem de Bruijn
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Edward Hyunkoo Jee <edjee@google.com>
commit 0848f6428ba3a2e42db124d41ac6f548655735bf upstream.
When ip_frag_queue() computes positions, it assumes that the passed
sk_buff does not contain L2 headers.
However, when PACKET_FANOUT_FLAG_DEFRAG is used, IP reassembly
functions can be called on outgoing packets that contain L2 headers.
Also, IPv4 checksum is not corrected after reassembly.
Fixes: 7736d33f4262 ("packet: Add pre-defragmentation support for ipv4 fanouts.")
Signed-off-by: Edward Hyunkoo Jee <edjee@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Jerry Chu <hkchu@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv4/ip_fragment.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -385,7 +385,7 @@ static int ip_frag_queue(struct ipq *qp,
ihl = ip_hdrlen(skb);
/* Determine the position of this fragment. */
- end = offset + skb->len - ihl;
+ end = offset + skb->len - skb_network_offset(skb) - ihl;
err = -EINVAL;
/* Is this the final fragment? */
@@ -415,7 +415,7 @@ static int ip_frag_queue(struct ipq *qp,
goto err;
err = -ENOMEM;
- if (pskb_pull(skb, ihl) == NULL)
+ if (!pskb_pull(skb, skb_network_offset(skb) + ihl))
goto err;
err = pskb_trim_rcsum(skb, end - offset);
@@ -638,6 +638,8 @@ static int ip_frag_reasm(struct ipq *qp,
iph->frag_off = 0;
iph->tot_len = htons(len);
iph->tos |= ecn;
+ ip_send_check(iph);
+
IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
qp->q.fragments = NULL;
qp->q.fragments_tail = NULL;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 065/110] KVM: x86: properly restore LVT0
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (69 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 093/110] inet: frags: fix defragmented packet's IP header for af_packet Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 066/110] 9p: forgetting to cancel request on interrupted zero-copy RPC Ben Hutchings
` (40 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Paolo Bonzini, Radim Krčmář
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Radim Krčmář <rkrcmar@redhat.com>
commit db1385624c686fe99fe2d1b61a36e1537b915d08 upstream.
Legacy NMI watchdog didn't work after migration/resume, because
vapics_in_nmi_mode was left at 0.
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[bwh: Backported to 3.2:
- Adjust context
- s/kvm_apic_get_reg/apic_get_reg/]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/kvm/lapic.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1253,6 +1253,7 @@ void kvm_apic_post_state_restore(struct
apic_update_ppr(apic);
hrtimer_cancel(&apic->lapic_timer.timer);
+ apic_manage_nmi_watchdog(apic, apic_get_reg(apic, APIC_LVT0));
update_divide_count(apic);
start_apic_timer(apic);
apic->irr_pending = true;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 066/110] 9p: forgetting to cancel request on interrupted zero-copy RPC
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (70 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 065/110] KVM: x86: properly restore LVT0 Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 050/110] tracing/filter: Do not WARN on operand count going below zero Ben Hutchings
` (39 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Al Viro
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit a84b69cb6e0a41e86bc593904faa6def3b957343 upstream.
If we'd already sent a request and decide to abort it, we *must*
issue TFLUSH properly and not just blindly reuse the tag, or
we'll get seriously screwed when response eventually arrives
and we confuse it for response to later request that had reused
the same tag.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/9p/client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -824,7 +824,8 @@ static struct p9_req_t *p9_client_zc_rpc
if (err < 0) {
if (err == -EIO)
c->status = Disconnected;
- goto reterr;
+ if (err != -ERESTARTSYS)
+ goto reterr;
}
if (req->status == REQ_STATUS_ERROR) {
P9_DPRINTK(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 050/110] tracing/filter: Do not WARN on operand count going below zero
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (71 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 066/110] 9p: forgetting to cancel request on interrupted zero-copy RPC Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 061/110] bufferhead: Add _gfp version for sb_getblk() Ben Hutchings
` (38 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Sasha Levin, Vince Weaver, Steven Rostedt (Red Hat)
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit b4875bbe7e68f139bd3383828ae8e994a0df6d28 upstream.
When testing the fix for the trace filter, I could not come up with
a scenario where the operand count goes below zero, so I added a
WARN_ON_ONCE(cnt < 0) to the logic. But there is legitimate case
that it can happen (although the filter would be wrong).
# echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter
That is, a single operation without any operands will hit the path
where the WARN_ON_ONCE() can trigger. Although this is harmless,
and the filter is reported as a error. But instead of spitting out
a warning to the kernel dmesg, just fail nicely and report it via
the proper channels.
Link: http://lkml.kernel.org/r/558C6082.90608@oracle.com
Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/trace/trace_events_filter.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1358,7 +1358,9 @@ static int check_preds(struct filter_par
}
cnt--;
n_normal_preds++;
- WARN_ON_ONCE(cnt < 0);
+ /* all ops should have operands */
+ if (cnt < 0)
+ break;
}
if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 061/110] bufferhead: Add _gfp version for sb_getblk()
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (72 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 050/110] tracing/filter: Do not WARN on operand count going below zero Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 038/110] Bluetooth: ath3k: add support of 04ca:300f AR3012 device Ben Hutchings
` (37 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Nikolay Borisov, Theodore Ts'o
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Borisov <kernel@kyup.com>
commit bd7ade3cd9b0850264306f5c2b79024a417b6396 upstream.
sb_getblk() is used during ext4 (and possibly other FSes) writeback
paths. Sometimes such path require allocating memory and guaranteeing
that such allocation won't block. Currently, however, there is no way
to provide user flags for sb_getblk which could lead to deadlocks.
This patch implements a sb_getblk_gfp with the only difference it can
accept user-provided GFP flags.
Signed-off-by: Nikolay Borisov <kernel@kyup.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/linux/buffer_head.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/include/linux/buffer_head.h
+++ b/include/linux/buffer_head.h
@@ -308,6 +308,13 @@ sb_getblk(struct super_block *sb, sector
return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
}
+
+static inline struct buffer_head *
+sb_getblk_gfp(struct super_block *sb, sector_t block, gfp_t gfp)
+{
+ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, gfp);
+}
+
static inline struct buffer_head *
sb_find_get_block(struct super_block *sb, sector_t block)
{
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 038/110] Bluetooth: ath3k: add support of 04ca:300f AR3012 device
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (73 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 061/110] bufferhead: Add _gfp version for sb_getblk() Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 105/110] niu: don't count tx error twice in case of headroom realloc fails Ben Hutchings
` (36 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Marcel Holtmann, Dmitry Tunin
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <hanipouspilot@gmail.com>
commit ec0810d2ac1c932dad48f45da67e3adc5c5449a1 upstream.
BugLink: https://bugs.launchpad.net/bugs/1449730
T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 3 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=04ca ProdID=300f Rev=00.01
C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/bluetooth/ath3k.c | 2 ++
drivers/bluetooth/btusb.c | 1 +
2 files changed, 3 insertions(+)
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -87,6 +87,7 @@ static struct usb_device_id ath3k_table[
{ USB_DEVICE(0x04CA, 0x3007) },
{ USB_DEVICE(0x04CA, 0x3008) },
{ USB_DEVICE(0x04CA, 0x300b) },
+ { USB_DEVICE(0x04CA, 0x300f) },
{ USB_DEVICE(0x04CA, 0x3010) },
{ USB_DEVICE(0x0930, 0x0219) },
{ USB_DEVICE(0x0930, 0x0220) },
@@ -144,6 +145,7 @@ static struct usb_device_id ath3k_blist_
{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -172,6 +172,7 @@ static struct usb_device_id blacklist_ta
{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 105/110] niu: don't count tx error twice in case of headroom realloc fails
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (74 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 038/110] Bluetooth: ath3k: add support of 04ca:300f AR3012 device Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 057/110] fuse: initialize fc->release before calling it Ben Hutchings
` (35 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jiri Pirko, David S. Miller
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Pirko <jiri@resnulli.us>
commit 42288830494cd51873ca745a7a229023df061226 upstream.
Fixes: a3138df9 ("[NIU]: Add Sun Neptune ethernet driver.")
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/sun/niu.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -6670,10 +6670,8 @@ static netdev_tx_t niu_start_xmit(struct
struct sk_buff *skb_new;
skb_new = skb_realloc_headroom(skb, len);
- if (!skb_new) {
- rp->tx_errors++;
+ if (!skb_new)
goto out_drop;
- }
kfree_skb(skb);
skb = skb_new;
} else
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 057/110] fuse: initialize fc->release before calling it
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (75 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 105/110] niu: don't count tx error twice in case of headroom realloc fails Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 100/110] usb-storage: ignore ZTE MF 823 card reader in mode 0x1225 Ben Hutchings
` (34 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Miklos Szeredi
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@suse.cz>
commit 0ad0b3255a08020eaf50e34ef0d6df5bdf5e09ed upstream.
fc->release is called from fuse_conn_put() which was used in the error
cleanup before fc->release was initialized.
[Jeremiah Mahler <jmmahler@gmail.com>: assign fc->release after calling
fuse_conn_init(fc) instead of before.]
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Fixes: a325f9b92273 ("fuse: update fuse_conn_init() and separate out fuse_conn_kill()")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/fuse/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -993,6 +993,7 @@ static int fuse_fill_super(struct super_
goto err_fput;
fuse_conn_init(fc);
+ fc->release = fuse_free_conn;
fc->dev = sb->s_dev;
fc->sb = sb;
@@ -1007,7 +1008,6 @@ static int fuse_fill_super(struct super_
fc->dont_mask = 1;
sb->s_flags |= MS_POSIXACL;
- fc->release = fuse_free_conn;
fc->flags = d.flags;
fc->user_id = d.user_id;
fc->group_id = d.group_id;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 100/110] usb-storage: ignore ZTE MF 823 card reader in mode 0x1225
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (76 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 057/110] fuse: initialize fc->release before calling it Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 107/110] ALSA: usb-audio: add dB range mapping for some devices Ben Hutchings
` (33 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Oliver Neukum, Lars Melin
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
commit 5fb2c782f451a4fb9c19c076e2c442839faf0f76 upstream.
This device automatically switches itself to another mode (0x1405)
unless the specific access pattern of Windows is followed in its
initial mode. That makes a dirty unmount of the internal storage
devices inevitable if they are mounted. So the card reader of
such a device should be ignored, lest an unclean removal become
inevitable.
This replaces an earlier patch that ignored all LUNs of this device.
That patch was overly broad.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reviewed-by: Lars Melin <larsm17@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/storage/unusual_devs.h | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2019,6 +2019,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_NO_READ_DISC_INFO ),
+/* Reported by Oliver Neukum <oneukum@suse.com>
+ * This device morphes spontaneously into another device if the access
+ * pattern of Windows isn't followed. Thus writable media would be dirty
+ * if the initial instance is used. So the device is limited to its
+ * virtual CD.
+ * And yes, the concept that BCD goes up to 9 is not heeded */
+UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
+ "ZTE,Incorporated",
+ "ZTE WCDMA Technologies MSM",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_SINGLE_LUN ),
+
/* Reported by Sven Geggus <sven-usbst@geggus.net>
* This encrypted pen drive returns bogus data for the initial READ(10).
*/
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 107/110] ALSA: usb-audio: add dB range mapping for some devices
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (77 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 100/110] usb-storage: ignore ZTE MF 823 card reader in mode 0x1225 Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 084/110] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER Ben Hutchings
` (32 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Yao-Wen Mao, Takashi Iwai
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yao-Wen Mao <yaowen@google.com>
commit 2d1cb7f658fb9c3ba8f9dab8aca297d4dfdec835 upstream.
Add the correct dB ranges of Bose Companion 5 and Drangonfly DAC 1.2.
Signed-off-by: Yao-Wen Mao <yaowen@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/usb/mixer_maps.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -312,6 +312,20 @@ static const struct usbmix_name_map scms
{ 0 }
};
+/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
+static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
+static struct usbmix_name_map bose_companion5_map[] = {
+ { 3, NULL, .dB = &bose_companion5_dB },
+ { 0 } /* terminator */
+};
+
+/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
+static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
+static struct usbmix_name_map dragonfly_1_2_map[] = {
+ { 7, NULL, .dB = &dragonfly_1_2_dB },
+ { 0 } /* terminator */
+};
+
/*
* Control map entries
*/
@@ -394,6 +408,16 @@ static struct usbmix_ctl_map usbmix_ctl_
.id = USB_ID(0x25c4, 0x0003),
.map = scms_usb3318_map,
},
+ {
+ /* Bose Companion 5 */
+ .id = USB_ID(0x05a7, 0x1020),
+ .map = bose_companion5_map,
+ },
+ {
+ /* Dragonfly DAC 1.2 */
+ .id = USB_ID(0x21b4, 0x0081),
+ .map = dragonfly_1_2_map,
+ },
{ 0 } /* terminator */
};
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 084/110] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (78 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 107/110] ALSA: usb-audio: add dB range mapping for some devices Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 109/110] x86/xen: Probe target addresses in set_aliased_prot() before the hypercall Ben Hutchings
` (31 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Aleksei Mamlin, Tejun Heo
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Aleksei Mamlin <mamlinav@gmail.com>
commit 08c85d2a599d967ede38a847f5594447b6100642 upstream.
Enabling AA on HP 250GB SATA disk VB0250EAVER causes errors:
[ 3.788362] ata3.00: failed to enable AA (error_mask=0x1)
[ 3.789243] ata3.00: failed to enable AA (error_mask=0x1)
Add the ATA_HORKAGE_BROKEN_FPDMA_AA for this specific harddisk.
tj: Collected FPDMA_AA entries and updated comment.
Signed-off-by: Aleksei Mamlin <mamlinav@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/ata/libata-core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4107,9 +4107,10 @@ static const struct ata_blacklist_entry
{ "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ |
ATA_HORKAGE_FIRMWARE_WARN },
- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
+ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */
{ "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
{ "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA },
/* Blacklist entries taken from Silicon Image 3124/3132
Windows driver .inf file - also several Linux problem reports */
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 109/110] x86/xen: Probe target addresses in set_aliased_prot() before the hypercall
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (79 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 084/110] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 072/110] s390/sclp: clear upper register halves in _sclp_print_early Ben Hutchings
` (30 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Thomas Gleixner, Jan Beulich, Linus Torvalds,
Borislav Petkov, Steven Rostedt, Boris Ostrovsky, Ingo Molnar,
Andy Lutomirski, Sasha Levin, David Vrabel, Brian Gerst,
Andrew Cooper, H. Peter Anvin, Peter Zijlstra, xen-devel,
Denys Vlasenko, Konrad Rzeszutek Wilk, Andy Lutomirski,
security@kernel.org
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
commit aa1acff356bbedfd03b544051f5b371746735d89 upstream.
The update_va_mapping hypercall can fail if the VA isn't present
in the guest's page tables. Under certain loads, this can
result in an OOPS when the target address is in unpopulated vmap
space.
While we're at it, add comments to help explain what's going on.
This isn't a great long-term fix. This code should probably be
changed to use something like set_memory_ro.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: David Vrabel <dvrabel@cantab.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Jan Beulich <jbeulich@suse.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: security@kernel.org <security@kernel.org>
Cc: xen-devel <xen-devel@lists.xen.org>
Link: http://lkml.kernel.org/r/0b0e55b995cda11e7829f140b833ef932fcabe3a.1438291540.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/xen/enlighten.c | 40 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 40 insertions(+)
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -321,6 +321,7 @@ static void set_aliased_prot(void *v, pg
pte_t pte;
unsigned long pfn;
struct page *page;
+ unsigned char dummy;
ptep = lookup_address((unsigned long)v, &level);
BUG_ON(ptep == NULL);
@@ -330,6 +331,32 @@ static void set_aliased_prot(void *v, pg
pte = pfn_pte(pfn, prot);
+ /*
+ * Careful: update_va_mapping() will fail if the virtual address
+ * we're poking isn't populated in the page tables. We don't
+ * need to worry about the direct map (that's always in the page
+ * tables), but we need to be careful about vmap space. In
+ * particular, the top level page table can lazily propagate
+ * entries between processes, so if we've switched mms since we
+ * vmapped the target in the first place, we might not have the
+ * top-level page table entry populated.
+ *
+ * We disable preemption because we want the same mm active when
+ * we probe the target and when we issue the hypercall. We'll
+ * have the same nominal mm, but if we're a kernel thread, lazy
+ * mm dropping could change our pgd.
+ *
+ * Out of an abundance of caution, this uses __get_user() to fault
+ * in the target address just in case there's some obscure case
+ * in which the target address isn't readable.
+ */
+
+ preempt_disable();
+
+ pagefault_disable(); /* Avoid warnings due to being atomic. */
+ __get_user(dummy, (unsigned char __user __force *)v);
+ pagefault_enable();
+
if (HYPERVISOR_update_va_mapping((unsigned long)v, pte, 0))
BUG();
@@ -341,6 +368,8 @@ static void set_aliased_prot(void *v, pg
BUG();
} else
kmap_flush_unused();
+
+ preempt_enable();
}
static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries)
@@ -348,6 +377,17 @@ static void xen_alloc_ldt(struct desc_st
const unsigned entries_per_page = PAGE_SIZE / LDT_ENTRY_SIZE;
int i;
+ /*
+ * We need to mark the all aliases of the LDT pages RO. We
+ * don't need to call vm_flush_aliases(), though, since that's
+ * only responsible for flushing aliases out the TLBs, not the
+ * page tables, and Xen will flush the TLB for us if needed.
+ *
+ * To avoid confusing future readers: none of this is necessary
+ * to load the LDT. The hypervisor only checks this when the
+ * LDT is faulted in due to subsequent descriptor access.
+ */
+
for(i = 0; i < entries; i += entries_per_page)
set_aliased_prot(ldt + i, PAGE_KERNEL_RO);
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 072/110] s390/sclp: clear upper register halves in _sclp_print_early
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (80 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 109/110] x86/xen: Probe target addresses in set_aliased_prot() before the hypercall Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 045/110] bridge: multicast: restore router configuration on port link down/up Ben Hutchings
` (29 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Martin Schwidefsky
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <schwidefsky@de.ibm.com>
commit f9c87a6f46d508eae0d9ae640be98d50f237f827 upstream.
If the kernel is compiled with gcc 5.1 and the XZ compression option
the decompress_kernel function calls _sclp_print_early in 64-bit mode
while the content of the upper register half of %r6 is non-zero.
This causes a specification exception on the servc instruction in
_sclp_servc.
The _sclp_print_early function saves and restores the upper registers
halves but it fails to clear them for the 31-bit code of the mini sclp
driver.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/s390/kernel/sclp.S | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/s390/kernel/sclp.S
+++ b/arch/s390/kernel/sclp.S
@@ -270,6 +270,8 @@ ENTRY(_sclp_print_early)
jno .Lesa2
ahi %r15,-80
stmh %r6,%r15,96(%r15) # store upper register halves
+ basr %r13,0
+ lmh %r0,%r15,.Lzeroes-.(%r13) # clear upper register halves
.Lesa2:
#endif
lr %r10,%r2 # save string pointer
@@ -293,6 +295,8 @@ ENTRY(_sclp_print_early)
#endif
lm %r6,%r15,120(%r15) # restore registers
br %r14
+.Lzeroes:
+ .fill 64,4,0
.LwritedataS4:
.long 0x00760005 # SCLP command for write data
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 045/110] bridge: multicast: restore router configuration on port link down/up
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (81 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 072/110] s390/sclp: clear upper register halves in _sclp_print_early Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 097/110] xhci: Calculate old endpoints correctly on device reset Ben Hutchings
` (28 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Herbert Xu, David S. Miller, Nikolay Aleksandrov,
Satish Ashok
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Satish Ashok <sashok@cumulusnetworks.com>
commit 754bc547f0a79f7568b5b81c7fc0a8d044a6571a upstream.
When a port goes through a link down/up the multicast router configuration
is not restored.
Signed-off-by: Satish Ashok <sashok@cumulusnetworks.com>
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Fixes: 0909e11758bd ("bridge: Add multicast_router sysfs entries")
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/bridge/br_multicast.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -36,6 +36,9 @@
#define mlock_dereference(X, br) \
rcu_dereference_protected(X, lockdep_is_held(&br->multicast_lock))
+static void br_multicast_add_router(struct net_bridge *br,
+ struct net_bridge_port *port);
+
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
static inline int ipv6_is_transient_multicast(const struct in6_addr *addr)
{
@@ -842,6 +845,8 @@ void br_multicast_enable_port(struct net
goto out;
__br_multicast_enable_port(port);
+ if (port->multicast_router == 2 && hlist_unhashed(&port->rlist))
+ br_multicast_add_router(br, port);
out:
spin_unlock(&br->multicast_lock);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 097/110] xhci: Calculate old endpoints correctly on device reset
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (82 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 045/110] bridge: multicast: restore router configuration on port link down/up Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 094/110] usb: dwc3: Reset the transfer resource index on SET_INTERFACE Ben Hutchings
` (27 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Greg Kroah-Hartman, Mathias Nyman, Brian Campbell
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Brian Campbell <bacam@z273.org.uk>
commit 326124a027abc9a7f43f72dc94f6f0f7a55b02b3 upstream.
When resetting a device the number of active TTs may need to be
corrected by xhci_update_tt_active_eps, but the number of old active
endpoints supplied to it was always zero, so the number of TTs and the
bandwidth reserved for them was not updated, and could rise
unnecessarily.
This affected systems using Intel's Patherpoint chipset, which rely on
software bandwidth checking. For example, a Lenovo X230 would lose the
ability to use ports on the docking station after enough suspend/resume
cycles because the bandwidth calculated would rise with every cycle when
a suitable device is attached.
The correct number of active endpoints is calculated in the same way as
in xhci_reserve_bandwidth.
Signed-off-by: Brian Campbell <bacam@z273.org.uk>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3361,6 +3361,9 @@ int xhci_discover_or_reset_device(struct
return -EINVAL;
}
+ if (virt_dev->tt_info)
+ old_active_eps = virt_dev->tt_info->active_eps;
+
if (virt_dev->udev != udev) {
/* If the virt_dev and the udev does not match, this virt_dev
* may belong to another udev.
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 094/110] usb: dwc3: Reset the transfer resource index on SET_INTERFACE
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (83 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 097/110] xhci: Calculate old endpoints correctly on device reset Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 078/110] net: call rcu_read_lock early in process_backlog Ben Hutchings
` (26 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, John Youn, Huang Rui, John Youn, Felipe Balbi,
Subbaraya Sundeep Bhatta
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: John Youn <John.Youn@synopsys.com>
commit aebda618718157a69c0dc0adb978d69bc2b8723c upstream.
This fixes an issue introduced in commit b23c843992b6 (usb: dwc3:
gadget: fix DEPSTARTCFG for non-EP0 EPs) that made sure we would
only use DEPSTARTCFG once per SetConfig.
The trick is that we should use one DEPSTARTCFG per SetConfig *OR*
SetInterface. SetInterface was completely missed from the original
patch.
This problem became aparent after commit 76e838c9f776 (usb: dwc3:
gadget: return error if command sent to DEPCMD register fails)
added checking of the return status of device endpoint commands.
'Set Endpoint Transfer Resource' command was caught failing
occasionally. This is because the Transfer Resource
Index was not getting reset during a SET_INTERFACE request.
Finally, to fix the issue, was we have to do is make sure that
our start_config_issued flag gets reset whenever we receive a
SetInterface request.
To verify the problem (and its fix), all we have to do is run
test 9 from testusb with 'testusb -t 9 -s 2048 -a -c 5000'.
Tested-by: Huang Rui <ray.huang@amd.com>
Tested-by: Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>
Fixes: b23c843992b6 (usb: dwc3: gadget: fix DEPSTARTCFG for non-EP0 EPs)
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
[bwh: Backported to 3.2: use dev_vdbg() instead of dwc3_trace()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/dwc3/ep0.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -498,6 +498,10 @@ static int dwc3_ep0_std_request(struct d
dev_vdbg(dwc->dev, "USB_REQ_SET_CONFIGURATION\n");
ret = dwc3_ep0_set_config(dwc, ctrl);
break;
+ case USB_REQ_SET_INTERFACE:
+ dev_vdbg(dwc->dev ,"USB_REQ_SET_INTERFACE");
+ dwc->start_config_issued = false;
+ /* Fall through */
default:
dev_vdbg(dwc->dev, "Forwarding to gadget driver\n");
ret = dwc3_ep0_delegate_req(dwc, ctrl);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 078/110] net: call rcu_read_lock early in process_backlog
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (84 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 094/110] usb: dwc3: Reset the transfer resource index on SET_INTERFACE Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 070/110] USB: cp210x: add ID for Aruba Networks controllers Ben Hutchings
` (25 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Stephen Hemminger, Julian Anastasov, David S. Miller,
Eric W. Biederman
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <ja@ssi.bg>
commit 2c17d27c36dcce2b6bf689f41a46b9e909877c21 upstream.
Incoming packet should be either in backlog queue or
in RCU read-side section. Otherwise, the final sequence of
flush_backlog() and synchronize_net() may miss packets
that can run without device reference:
CPU 1 CPU 2
skb->dev: no reference
process_backlog:__skb_dequeue
process_backlog:local_irq_enable
on_each_cpu for
flush_backlog => IPI(hardirq): flush_backlog
- packet not found in backlog
CPU delayed ...
synchronize_net
- no ongoing RCU
read-side sections
netdev_run_todo,
rcu_barrier: no
ongoing callbacks
__netif_receive_skb_core:rcu_read_lock
- too late
free dev
process packet for freed dev
Fixes: 6e583ce5242f ("net: eliminate refcounting in backlog queue")
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2:
- Adjust context
- No need to rename the label in __netif_receive_skb()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3261,8 +3261,6 @@ static int __netif_receive_skb(struct sk
pt_prev = NULL;
- rcu_read_lock();
-
another_round:
__this_cpu_inc(softnet_data.processed);
@@ -3357,7 +3355,6 @@ ncls:
}
out:
- rcu_read_unlock();
return ret;
}
@@ -3378,34 +3375,31 @@ out:
*/
int netif_receive_skb(struct sk_buff *skb)
{
+ int ret;
+
if (netdev_tstamp_prequeue)
net_timestamp_check(skb);
if (skb_defer_rx_timestamp(skb))
return NET_RX_SUCCESS;
+ rcu_read_lock();
+
#ifdef CONFIG_RPS
{
struct rps_dev_flow voidflow, *rflow = &voidflow;
- int cpu, ret;
-
- rcu_read_lock();
-
- cpu = get_rps_cpu(skb->dev, skb, &rflow);
+ int cpu = get_rps_cpu(skb->dev, skb, &rflow);
if (cpu >= 0) {
ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail);
rcu_read_unlock();
- } else {
- rcu_read_unlock();
- ret = __netif_receive_skb(skb);
+ return ret;
}
-
- return ret;
}
-#else
- return __netif_receive_skb(skb);
#endif
+ ret = __netif_receive_skb(skb);
+ rcu_read_unlock();
+ return ret;
}
EXPORT_SYMBOL(netif_receive_skb);
@@ -3796,8 +3790,10 @@ static int process_backlog(struct napi_s
unsigned int qlen;
while ((skb = __skb_dequeue(&sd->process_queue))) {
+ rcu_read_lock();
local_irq_enable();
__netif_receive_skb(skb);
+ rcu_read_unlock();
local_irq_disable();
input_queue_head_incr(sd);
if (++work >= quota) {
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 070/110] USB: cp210x: add ID for Aruba Networks controllers
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (85 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 078/110] net: call rcu_read_lock early in process_backlog Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 068/110] dm btree remove: fix bug in redistribute3 Ben Hutchings
` (24 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Peter Sanford, Johan Hovold
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Peter Sanford <peter@sanford.io>
commit f98a7aa81eeeadcad25665c3501c236d531d4382 upstream.
Add the USB serial console device ID for Aruba Networks 7xxx series
controllers which have a USB port for their serial console.
Signed-off-by: Peter Sanford <peter@sanford.io>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/cp210x.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -193,6 +193,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
{ USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
{ USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
+ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
{ USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
{ USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
{ USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 068/110] dm btree remove: fix bug in redistribute3
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (86 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 070/110] USB: cp210x: add ID for Aruba Networks controllers Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 085/110] libata: add ATA_HORKAGE_NOTRIM Ben Hutchings
` (23 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Dennis Yang, Joe Thornber, Mike Snitzer
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Yang <shinrairis@gmail.com>
commit 4c7e309340ff85072e96f529582d159002c36734 upstream.
redistribute3() shares entries out across 3 nodes. Some entries were
being moved the wrong way, breaking the ordering. This manifested as a
BUG() in dm-btree-remove.c:shift() when entries were removed from the
btree.
For additional context see:
https://www.redhat.com/archives/dm-devel/2015-May/msg00113.html
Signed-off-by: Dennis Yang <shinrairis@gmail.com>
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/md/persistent-data/dm-btree-remove.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btre
if (s < 0 && nr_center < -s) {
/* not enough in central node */
- shift(left, center, nr_center);
- s = nr_center - target;
+ shift(left, center, -nr_center);
+ s += nr_center;
shift(left, right, s);
nr_right += s;
} else
@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btre
if (s > 0 && nr_center < s) {
/* not enough in central node */
shift(center, right, nr_center);
- s = target - nr_center;
+ s -= nr_center;
shift(left, right, s);
nr_left -= s;
} else
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 085/110] libata: add ATA_HORKAGE_NOTRIM
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (87 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 068/110] dm btree remove: fix bug in redistribute3 Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 051/110] tracing/filter: Do not allow infix to exceed end of string Ben Hutchings
` (22 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Tejun Heo, Arne Fitzenreiter
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arne Fitzenreiter <arne_f@ipfire.org>
commit 71d126fd28de2d4d9b7b2088dbccd7ca62fad6e0 upstream.
Some devices lose data on TRIM whether queued or not. This patch adds
a horkage to disable TRIM.
tj: Collapsed unnecessary if() nesting.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
[bwh: Backported to 3.2:
- Adjust context
- Drop change to show_ata_dev_trim()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/ata/libata-scsi.c | 3 ++-
drivers/ata/libata-transport.c | 2 ++
include/linux/libata.h | 2 ++
3 files changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2473,7 +2473,8 @@ static unsigned int ata_scsiop_read_cap(
rbuf[14] = (lowest_aligned >> 8) & 0x3f;
rbuf[15] = lowest_aligned;
- if (ata_id_has_trim(args->id)) {
+ if (ata_id_has_trim(args->id) &&
+ !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
rbuf[14] |= 0x80; /* TPE */
if (ata_id_has_zero_after_trim(args->id))
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -403,6 +403,8 @@ enum {
ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17), /* Set max sects to 65535 */
ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */
ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */
+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
+
/* DMA mask for user DMA control: User visible values; DO NOT
renumber */
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 051/110] tracing/filter: Do not allow infix to exceed end of string
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (88 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 085/110] libata: add ATA_HORKAGE_NOTRIM Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 081/110] Btrfs: fix file corruption after cloning inline extents Ben Hutchings
` (21 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Steven Rostedt (Red Hat)
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 6b88f44e161b9ee2a803e5b2b1fbcf4e20e8b980 upstream.
While debugging a WARN_ON() for filtering, I found that it is possible
for the filter string to be referenced after its end. With the filter:
# echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter
The filter_parse() function can call infix_get_op() which calls
infix_advance() that updates the infix filter pointers for the cnt
and tail without checking if the filter is already at the end, which
will put the cnt to zero and the tail beyond the end. The loop then calls
infix_next() that has
ps->infix.cnt--;
return ps->infix.string[ps->infix.tail++];
The cnt will now be below zero, and the tail that is returned is
already passed the end of the filter string. So far the allocation
of the filter string usually has some buffer that is zeroed out, but
if the filter string is of the exact size of the allocated buffer
there's no guarantee that the charater after the nul terminating
character will be zero.
Luckily, only root can write to the filter.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/trace/trace_events_filter.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1027,6 +1027,9 @@ static void parse_init(struct filter_par
static char infix_next(struct filter_parse_state *ps)
{
+ if (!ps->infix.cnt)
+ return 0;
+
ps->infix.cnt--;
return ps->infix.string[ps->infix.tail++];
@@ -1042,6 +1045,9 @@ static char infix_peek(struct filter_par
static void infix_advance(struct filter_parse_state *ps)
{
+ if (!ps->infix.cnt)
+ return;
+
ps->infix.cnt--;
ps->infix.tail++;
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 081/110] Btrfs: fix file corruption after cloning inline extents
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (89 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 051/110] tracing/filter: Do not allow infix to exceed end of string Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 055/110] Btrfs: fix race between caching kthread and returning inode to inode cache Ben Hutchings
` (20 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Filipe Manana
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit ed958762644b404654a6f5d23e869f496fe127c6 upstream.
Using the clone ioctl (or extent_same ioctl, which calls the same extent
cloning function as well) we end up allowing copy an inline extent from
the source file into a non-zero offset of the destination file. This is
something not expected and that the btrfs code is not prepared to deal
with - all inline extents must be at a file offset equals to 0.
For example, the following excerpt of a test case for fstests triggers
a crash/BUG_ON() on a write operation after an inline extent is cloned
into a non-zero offset:
_scratch_mkfs >>$seqres.full 2>&1
_scratch_mount
# Create our test files. File foo has the same 2K of data at offset 4K
# as file bar has at its offset 0.
$XFS_IO_PROG -f -s -c "pwrite -S 0xaa 0 4K" \
-c "pwrite -S 0xbb 4k 2K" \
-c "pwrite -S 0xcc 8K 4K" \
$SCRATCH_MNT/foo | _filter_xfs_io
# File bar consists of a single inline extent (2K size).
$XFS_IO_PROG -f -s -c "pwrite -S 0xbb 0 2K" \
$SCRATCH_MNT/bar | _filter_xfs_io
# Now call the clone ioctl to clone the extent of file bar into file
# foo at its offset 4K. This made file foo have an inline extent at
# offset 4K, something which the btrfs code can not deal with in future
# IO operations because all inline extents are supposed to start at an
# offset of 0, resulting in all sorts of chaos.
# So here we validate that clone ioctl returns an EOPNOTSUPP, which is
# what it returns for other cases dealing with inlined extents.
$CLONER_PROG -s 0 -d $((4 * 1024)) -l $((2 * 1024)) \
$SCRATCH_MNT/bar $SCRATCH_MNT/foo
# Because of the inline extent at offset 4K, the following write made
# the kernel crash with a BUG_ON().
$XFS_IO_PROG -c "pwrite -S 0xdd 6K 2K" $SCRATCH_MNT/foo | _filter_xfs_io
status=0
exit
The stack trace of the BUG_ON() triggered by the last write is:
[152154.035903] ------------[ cut here ]------------
[152154.036424] kernel BUG at mm/page-writeback.c:2286!
[152154.036424] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[152154.036424] Modules linked in: btrfs dm_flakey dm_mod crc32c_generic xor raid6_pq nfsd auth_rpcgss oid_registry nfs_acl nfs lockd grace fscache sunrpc loop fuse parport_pc acpi_cpu$
[152154.036424] CPU: 2 PID: 17873 Comm: xfs_io Tainted: G W 4.1.0-rc6-btrfs-next-11+ #2
[152154.036424] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014
[152154.036424] task: ffff880429f70990 ti: ffff880429efc000 task.ti: ffff880429efc000
[152154.036424] RIP: 0010:[<ffffffff8111a9d5>] [<ffffffff8111a9d5>] clear_page_dirty_for_io+0x1e/0x90
[152154.036424] RSP: 0018:ffff880429effc68 EFLAGS: 00010246
[152154.036424] RAX: 0200000000000806 RBX: ffffea0006a6d8f0 RCX: 0000000000000001
[152154.036424] RDX: 0000000000000000 RSI: ffffffff81155d1b RDI: ffffea0006a6d8f0
[152154.036424] RBP: ffff880429effc78 R08: ffff8801ce389fe0 R09: 0000000000000001
[152154.036424] R10: 0000000000002000 R11: ffffffffffffffff R12: ffff8800200dce68
[152154.036424] R13: 0000000000000000 R14: ffff8800200dcc88 R15: ffff8803d5736d80
[152154.036424] FS: 00007fbf119f6700(0000) GS:ffff88043d280000(0000) knlGS:0000000000000000
[152154.036424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[152154.036424] CR2: 0000000001bdc000 CR3: 00000003aa555000 CR4: 00000000000006e0
[152154.036424] Stack:
[152154.036424] ffff8803d5736d80 0000000000000001 ffff880429effcd8 ffffffffa04e97c1
[152154.036424] ffff880429effd68 ffff880429effd60 0000000000000001 ffff8800200dc9c8
[152154.036424] 0000000000000001 ffff8800200dcc88 0000000000000000 0000000000001000
[152154.036424] Call Trace:
[152154.036424] [<ffffffffa04e97c1>] lock_and_cleanup_extent_if_need+0x147/0x18d [btrfs]
[152154.036424] [<ffffffffa04ea82c>] __btrfs_buffered_write+0x245/0x4c8 [btrfs]
[152154.036424] [<ffffffffa04ed14b>] ? btrfs_file_write_iter+0x150/0x3e0 [btrfs]
[152154.036424] [<ffffffffa04ed15a>] ? btrfs_file_write_iter+0x15f/0x3e0 [btrfs]
[152154.036424] [<ffffffffa04ed2c7>] btrfs_file_write_iter+0x2cc/0x3e0 [btrfs]
[152154.036424] [<ffffffff81165a4a>] __vfs_write+0x7c/0xa5
[152154.036424] [<ffffffff81165f89>] vfs_write+0xa0/0xe4
[152154.036424] [<ffffffff81166855>] SyS_pwrite64+0x64/0x82
[152154.036424] [<ffffffff81465197>] system_call_fastpath+0x12/0x6f
[152154.036424] Code: 48 89 c7 e8 0f ff ff ff 5b 41 5c 5d c3 0f 1f 44 00 00 55 48 89 e5 41 54 53 48 89 fb e8 ae ef 00 00 49 89 c4 48 8b 03 a8 01 75 02 <0f> 0b 4d 85 e4 74 59 49 8b 3c 2$
[152154.036424] RIP [<ffffffff8111a9d5>] clear_page_dirty_for_io+0x1e/0x90
[152154.036424] RSP <ffff880429effc68>
[152154.242621] ---[ end trace e3d3376b23a57041 ]---
Fix this by returning the error EOPNOTSUPP if an attempt to copy an
inline extent into a non-zero offset happens, just like what is done for
other scenarios that would require copying/splitting inline extents,
which were introduced by the following commits:
00fdf13a2e9f ("Btrfs: fix a crash of clone with inline extents's split")
3f9e3df8da3c ("btrfs: replace error code from btrfs_drop_extents")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
[bwh: Backported to 3.2: test new_key.offset as last_dest_end isn't defined
in this function]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/btrfs/ioctl.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2448,6 +2448,20 @@ static noinline long btrfs_ioctl_clone(s
new_key.offset += skip;
}
+ /*
+ * Don't copy an inline extent into an offset
+ * greater than zero. Having an inline extent
+ * at such an offset results in chaos as btrfs
+ * isn't prepared for such cases. Just skip
+ * this case for the same reasons as commented
+ * at btrfs_ioctl_clone().
+ */
+ if (new_key.offset > 0) {
+ ret = -EOPNOTSUPP;
+ btrfs_end_transaction(trans, root);
+ goto out;
+ }
+
if (key.offset + datal > off+len)
trim = key.offset + datal - (off+len);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 055/110] Btrfs: fix race between caching kthread and returning inode to inode cache
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (90 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 081/110] Btrfs: fix file corruption after cloning inline extents Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 049/110] dell-laptop: Fix allocating & freeing SMI buffer page Ben Hutchings
` (19 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Chris Mason, Filipe Manana
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit ae9d8f17118551bedd797406a6768b87c2146234 upstream.
While the inode cache caching kthread is calling btrfs_unpin_free_ino(),
we could have a concurrent call to btrfs_return_ino() that adds a new
entry to the root's free space cache of pinned inodes. This concurrent
call does not acquire the fs_info->commit_root_sem before adding a new
entry if the caching state is BTRFS_CACHE_FINISHED, which is a problem
because the caching kthread calls btrfs_unpin_free_ino() after setting
the caching state to BTRFS_CACHE_FINISHED and therefore races with
the task calling btrfs_return_ino(), which is adding a new entry, while
the former (caching kthread) is navigating the cache's rbtree, removing
and freeing nodes from the cache's rbtree without acquiring the spinlock
that protects the rbtree.
This race resulted in memory corruption due to double free of struct
btrfs_free_space objects because both tasks can end up doing freeing the
same objects. Note that adding a new entry can result in merging it with
other entries in the cache, in which case those entries are freed.
This is particularly important as btrfs_free_space structures are also
used for the block group free space caches.
This memory corruption can be detected by a debugging kernel, which
reports it with the following trace:
[132408.501148] slab error in verify_redzone_free(): cache `btrfs_free_space': double free detected
[132408.505075] CPU: 15 PID: 12248 Comm: btrfs-ino-cache Tainted: G W 4.1.0-rc5-btrfs-next-10+ #1
[132408.505075] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014
[132408.505075] ffff880023e7d320 ffff880163d73cd8 ffffffff8145eec7 ffffffff81095dce
[132408.505075] ffff880009735d40 ffff880163d73ce8 ffffffff81154e1e ffff880163d73d68
[132408.505075] ffffffff81155733 ffffffffa054a95a ffff8801b6099f00 ffffffffa0505b5f
[132408.505075] Call Trace:
[132408.505075] [<ffffffff8145eec7>] dump_stack+0x4f/0x7b
[132408.505075] [<ffffffff81095dce>] ? console_unlock+0x356/0x3a2
[132408.505075] [<ffffffff81154e1e>] __slab_error.isra.28+0x25/0x36
[132408.505075] [<ffffffff81155733>] __cache_free+0xe2/0x4b6
[132408.505075] [<ffffffffa054a95a>] ? __btrfs_add_free_space+0x2f0/0x343 [btrfs]
[132408.505075] [<ffffffffa0505b5f>] ? btrfs_unpin_free_ino+0x8e/0x99 [btrfs]
[132408.505075] [<ffffffff810f3b30>] ? time_hardirqs_off+0x15/0x28
[132408.505075] [<ffffffff81084d42>] ? trace_hardirqs_off+0xd/0xf
[132408.505075] [<ffffffff811563a1>] ? kfree+0xb6/0x14e
[132408.505075] [<ffffffff811563d0>] kfree+0xe5/0x14e
[132408.505075] [<ffffffffa0505b5f>] btrfs_unpin_free_ino+0x8e/0x99 [btrfs]
[132408.505075] [<ffffffffa0505e08>] caching_kthread+0x29e/0x2d9 [btrfs]
[132408.505075] [<ffffffffa0505b6a>] ? btrfs_unpin_free_ino+0x99/0x99 [btrfs]
[132408.505075] [<ffffffff8106698f>] kthread+0xef/0xf7
[132408.505075] [<ffffffff810f3b08>] ? time_hardirqs_on+0x15/0x28
[132408.505075] [<ffffffff810668a0>] ? __kthread_parkme+0xad/0xad
[132408.505075] [<ffffffff814653d2>] ret_from_fork+0x42/0x70
[132408.505075] [<ffffffff810668a0>] ? __kthread_parkme+0xad/0xad
[132408.505075] ffff880023e7d320: redzone 1:0x9f911029d74e35b, redzone 2:0x9f911029d74e35b.
[132409.501654] slab: double free detected in cache 'btrfs_free_space', objp ffff880023e7d320
[132409.503355] ------------[ cut here ]------------
[132409.504241] kernel BUG at mm/slab.c:2571!
Therefore fix this by having btrfs_unpin_free_ino() acquire the lock
that protects the rbtree while doing the searches and removing entries.
Fixes: 1c70d8fb4dfa ("Btrfs: fix inode caching vs tree log")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/btrfs/inode-map.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -244,6 +244,7 @@ void btrfs_unpin_free_ino(struct btrfs_r
{
struct btrfs_free_space_ctl *ctl = root->free_ino_ctl;
struct rb_root *rbroot = &root->free_ino_pinned->free_space_offset;
+ spinlock_t *rbroot_lock = &root->free_ino_pinned->tree_lock;
struct btrfs_free_space *info;
struct rb_node *n;
u64 count;
@@ -252,23 +253,29 @@ void btrfs_unpin_free_ino(struct btrfs_r
return;
while (1) {
+ bool add_to_ctl = true;
+
+ spin_lock(rbroot_lock);
n = rb_first(rbroot);
- if (!n)
+ if (!n) {
+ spin_unlock(rbroot_lock);
break;
+ }
info = rb_entry(n, struct btrfs_free_space, offset_index);
BUG_ON(info->bitmap);
if (info->offset > root->cache_progress)
- goto free;
+ add_to_ctl = false;
else if (info->offset + info->bytes > root->cache_progress)
count = root->cache_progress - info->offset + 1;
else
count = info->bytes;
- __btrfs_add_free_space(ctl, info->offset, count);
-free:
rb_erase(&info->offset_index, rbroot);
+ spin_unlock(rbroot_lock);
+ if (add_to_ctl)
+ __btrfs_add_free_space(ctl, info->offset, count);
kmem_cache_free(btrfs_free_space_cachep, info);
}
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 049/110] dell-laptop: Fix allocating & freeing SMI buffer page
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (91 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 055/110] Btrfs: fix race between caching kthread and returning inode to inode cache Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 035/110] ideapad: fix software rfkill setting Ben Hutchings
` (18 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Michal Hocko, Pali Rohár, Darren Hart
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <pali.rohar@gmail.com>
commit b8830a4e71b15d0364ac8e6c55301eea73f211da upstream.
This commit fix kernel crash when probing for rfkill devices in dell-laptop
driver failed. Function free_page() was incorrectly used on struct page *
instead of virtual address of SMI buffer.
This commit also simplify allocating page for SMI buffer by using
__get_free_page() function instead of sequential call of functions
alloc_page() and page_address().
Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Acked-by: Michal Hocko <mhocko@suse.cz>
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/platform/x86/dell-laptop.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -215,7 +215,6 @@ static struct dmi_system_id __devinitdat
};
static struct calling_interface_buffer *buffer;
-static struct page *bufferpage;
static DEFINE_MUTEX(buffer_mutex);
static int hwswitch_state;
@@ -715,11 +714,10 @@ static int __init dell_init(void)
* Allocate buffer below 4GB for SMI data--only 32-bit physical addr
* is passed to SMI handler.
*/
- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32);
+ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32);
- if (!bufferpage)
+ if (!buffer)
goto fail_buffer;
- buffer = page_address(bufferpage);
ret = dell_setup_rfkill();
@@ -788,7 +786,7 @@ fail_backlight:
fail_filter:
dell_cleanup_rfkill();
fail_rfkill:
- free_page((unsigned long)bufferpage);
+ free_page((unsigned long)buffer);
fail_buffer:
platform_device_del(platform_device);
fail_platform_device2:
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 035/110] ideapad: fix software rfkill setting
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (92 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 049/110] dell-laptop: Fix allocating & freeing SMI buffer page Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 090/110] NET: AX.25: Stop heartbeat timer on disconnect Ben Hutchings
` (17 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Darren Hart, Arnd Bergmann
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 4b200b4604bec3388426159f1656109d19fadf6e upstream.
This fixes a several year old regression that I found while trying
to get the Yoga 3 11 to work. The ideapad_rfk_set function is meant
to send a command to the embedded controller through ACPI, but
as of c1f73658ed, it sends the index of the rfkill device instead
of the command, and ignores the opcode field.
This changes it back to the original behavior, which indeed
flips the rfkill state as seen in the debugfs interface.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: c1f73658ed ("ideapad: pass ideapad_priv as argument (part 2)")
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
[bwh: Backported to 3.2: device private data is just the device index, not a
pointer]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/platform/x86/ideapad-laptop.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -407,7 +407,8 @@ const struct ideapad_rfk_data ideapad_rf
static int ideapad_rfk_set(void *data, bool blocked)
{
- unsigned long opcode = (unsigned long)data;
+ unsigned long dev = (unsigned long)data;
+ int opcode = ideapad_rfk_data[dev].opcode;
return write_ec_cmd(ideapad_handle, opcode, !blocked);
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 090/110] NET: AX.25: Stop heartbeat timer on disconnect.
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (93 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 035/110] ideapad: fix software rfkill setting Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 11:52 ` Richard Stearn
2015-08-10 10:12 ` [PATCH 3.2 031/110] jbd2: split updating of journal superblock and marking journal empty Ben Hutchings
` (16 subsequent siblings)
111 siblings, 1 reply; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Ralf Baechle, David S. Miller, Richard Stearn
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Richard Stearn <richard@rns-stearn.demon.co.uk>
commit da278622bf04f8ddb14519a2b8214e108ef26101 upstream.
This may result in a kernel panic. The bug has always existed but
somehow we've run out of luck now and it bites.
Signed-off-by: Richard Stearn <richard@rns-stearn.demon.co.uk>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ax25/ax25_subr.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -265,6 +265,7 @@ void ax25_disconnect(ax25_cb *ax25, int
{
ax25_clear_queues(ax25);
+ ax25_stop_heartbeat(ax25);
ax25_stop_t1timer(ax25);
ax25_stop_t2timer(ax25);
ax25_stop_t3timer(ax25);
^ permalink raw reply [flat|nested] 126+ messages in thread* Re: [PATCH 3.2 090/110] NET: AX.25: Stop heartbeat timer on disconnect.
2015-08-10 10:12 ` [PATCH 3.2 090/110] NET: AX.25: Stop heartbeat timer on disconnect Ben Hutchings
@ 2015-08-10 11:52 ` Richard Stearn
2015-08-11 20:13 ` Ben Hutchings
0 siblings, 1 reply; 126+ messages in thread
From: Richard Stearn @ 2015-08-10 11:52 UTC (permalink / raw)
To: Ben Hutchings; +Cc: linux-kernel, stable, akpm, Ralf Baechle, David S. Miller
Ben Hutchings wrote:
> 3.2.71-rc1 review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Richard Stearn <richard@rns-stearn.demon.co.uk>
>
> commit da278622bf04f8ddb14519a2b8214e108ef26101 upstream.
>
> This may result in a kernel panic. The bug has always existed but
> somehow we've run out of luck now and it bites.
>
> Signed-off-by: Richard Stearn <richard@rns-stearn.demon.co.uk>
> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> ---
> net/ax25/ax25_subr.c | 1 +
> 1 file changed, 1 insertion(+)
>
> --- a/net/ax25/ax25_subr.c
> +++ b/net/ax25/ax25_subr.c
> @@ -265,6 +265,7 @@ void ax25_disconnect(ax25_cb *ax25, int
> {
> ax25_clear_queues(ax25);
>
> + ax25_stop_heartbeat(ax25);
> ax25_stop_t1timer(ax25);
> ax25_stop_t2timer(ax25);
> ax25_stop_t3timer(ax25);
This patch should _not_ be applied.
Breaks other parts of the driver.
Investigations on-going.
--
Regards
Richard
^ permalink raw reply [flat|nested] 126+ messages in thread* Re: [PATCH 3.2 090/110] NET: AX.25: Stop heartbeat timer on disconnect.
2015-08-10 11:52 ` Richard Stearn
@ 2015-08-11 20:13 ` Ben Hutchings
0 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-11 20:13 UTC (permalink / raw)
To: Richard Stearn; +Cc: linux-kernel, stable, akpm, Ralf Baechle, David S. Miller
[-- Attachment #1: Type: text/plain, Size: 1437 bytes --]
On Mon, 2015-08-10 at 12:52 +0100, Richard Stearn wrote:
> Ben Hutchings wrote:
> > 3.2.71-rc1 review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Richard Stearn <richard@rns-stearn.demon.co.uk>
> >
> > commit da278622bf04f8ddb14519a2b8214e108ef26101 upstream.
> >
> > This may result in a kernel panic. The bug has always existed but
> > somehow we've run out of luck now and it bites.
> >
> > Signed-off-by: Richard Stearn <richard@rns-stearn.demon.co.uk>
> > Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
> > Signed-off-by: David S. Miller <davem@davemloft.net>
> > Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> > ---
> > net/ax25/ax25_subr.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > --- a/net/ax25/ax25_subr.c
> > +++ b/net/ax25/ax25_subr.c
> > @@ -265,6 +265,7 @@ void ax25_disconnect(ax25_cb *ax25, int
> > {
> > > > > > ax25_clear_queues(ax25);
> >
> > +> > > > ax25_stop_heartbeat(ax25);
> > > > > > ax25_stop_t1timer(ax25);
> > > > > > ax25_stop_t2timer(ax25);
> > > > > > ax25_stop_t3timer(ax25);
>
> This patch should _not_ be applied.
> Breaks other parts of the driver.
> Investigations on-going.
OK, I'll drop it for now.
Ben.
--
Ben Hutchings
Theory and practice are closer in theory than in practice.
- John Levine, moderator of comp.compilers
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply [flat|nested] 126+ messages in thread
* [PATCH 3.2 031/110] jbd2: split updating of journal superblock and marking journal empty
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (94 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 090/110] NET: AX.25: Stop heartbeat timer on disconnect Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 030/110] Disable write buffering on Toshiba ToPIC95 Ben Hutchings
` (15 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Theodore Ts'o, Jan Kara
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 24bcc89c7e7c64982e6192b4952a0a92379fc341 upstream.
There are three case of updating journal superblock. In the first case, we want
to mark journal as empty (setting s_sequence to 0), in the second case we want
to update log tail, in the third case we want to update s_errno. Split these
cases into separate functions. It makes the code slightly more straightforward
and later patches will make the distinction even more important.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
[bwh: Prerequisite for "jbd2: fix ocfs2 corrupt when updating journal
superblock fails".
Backported to 3.2: drop changes to trace events.]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -550,7 +550,7 @@ int jbd2_cleanup_journal_tail(journal_t
(journal->j_flags & JBD2_BARRIER))
blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
if (!(journal->j_flags & JBD2_ABORT))
- jbd2_journal_update_superblock(journal, 1);
+ jbd2_journal_update_sb_log_tail(journal);
return 0;
}
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -340,7 +340,7 @@ void jbd2_journal_commit_transaction(jou
/* Do we need to erase the effects of a prior jbd2_journal_flush? */
if (journal->j_flags & JBD2_FLUSHED) {
jbd_debug(3, "super block updated\n");
- jbd2_journal_update_superblock(journal, 1);
+ jbd2_journal_update_sb_log_tail(journal);
} else {
jbd_debug(3, "superblock not updated\n");
}
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1143,39 +1143,28 @@ static int journal_reset(journal_t *jour
journal->j_max_transaction_buffers = journal->j_maxlen / 4;
- /* Add the dynamic fields and write it to disk. */
- jbd2_journal_update_superblock(journal, 1);
- return jbd2_journal_start_thread(journal);
-}
-
-/**
- * void jbd2_journal_update_superblock() - Update journal sb on disk.
- * @journal: The journal to update.
- * @wait: Set to '0' if you don't want to wait for IO completion.
- *
- * Update a journal's dynamic superblock fields and write it to disk,
- * optionally waiting for the IO to complete.
- */
-void jbd2_journal_update_superblock(journal_t *journal, int wait)
-{
- journal_superblock_t *sb = journal->j_superblock;
- struct buffer_head *bh = journal->j_sb_buffer;
-
/*
* As a special case, if the on-disk copy is already marked as needing
- * no recovery (s_start == 0) and there are no outstanding transactions
- * in the filesystem, then we can safely defer the superblock update
- * until the next commit by setting JBD2_FLUSHED. This avoids
+ * no recovery (s_start == 0), then we can safely defer the superblock
+ * update until the next commit by setting JBD2_FLUSHED. This avoids
* attempting a write to a potential-readonly device.
*/
- if (sb->s_start == 0 && journal->j_tail_sequence ==
- journal->j_transaction_sequence) {
+ if (sb->s_start == 0) {
jbd_debug(1, "JBD2: Skipping superblock update on recovered sb "
"(start %ld, seq %d, errno %d)\n",
journal->j_tail, journal->j_tail_sequence,
journal->j_errno);
- goto out;
+ journal->j_flags |= JBD2_FLUSHED;
+ } else {
+ /* Add the dynamic fields and write it to disk. */
+ jbd2_journal_update_sb_log_tail(journal);
}
+ return jbd2_journal_start_thread(journal);
+}
+
+static void jbd2_write_superblock(journal_t *journal)
+{
+ struct buffer_head *bh = journal->j_sb_buffer;
if (buffer_write_io_error(bh)) {
/*
@@ -1193,47 +1182,97 @@ void jbd2_journal_update_superblock(jour
set_buffer_uptodate(bh);
}
+ BUFFER_TRACE(bh, "marking dirty");
+ mark_buffer_dirty(bh);
+ sync_dirty_buffer(bh);
+ if (buffer_write_io_error(bh)) {
+ printk(KERN_ERR "JBD2: I/O error detected "
+ "when updating journal superblock for %s.\n",
+ journal->j_devname);
+ clear_buffer_write_io_error(bh);
+ set_buffer_uptodate(bh);
+ }
+}
+
+/**
+ * jbd2_journal_update_sb_log_tail() - Update log tail in journal sb on disk.
+ * @journal: The journal to update.
+ *
+ * Update a journal's superblock information about log tail and write it to
+ * disk, waiting for the IO to complete.
+ */
+void jbd2_journal_update_sb_log_tail(journal_t *journal)
+{
+ journal_superblock_t *sb = journal->j_superblock;
+
read_lock(&journal->j_state_lock);
- jbd_debug(1, "JBD2: updating superblock (start %ld, seq %d, errno %d)\n",
- journal->j_tail, journal->j_tail_sequence, journal->j_errno);
+ jbd_debug(1, "JBD2: updating superblock (start %ld, seq %d)\n",
+ journal->j_tail, journal->j_tail_sequence);
sb->s_sequence = cpu_to_be32(journal->j_tail_sequence);
sb->s_start = cpu_to_be32(journal->j_tail);
- sb->s_errno = cpu_to_be32(journal->j_errno);
read_unlock(&journal->j_state_lock);
- BUFFER_TRACE(bh, "marking dirty");
- mark_buffer_dirty(bh);
- if (wait) {
- sync_dirty_buffer(bh);
- if (buffer_write_io_error(bh)) {
- printk(KERN_ERR "JBD2: I/O error detected "
- "when updating journal superblock for %s.\n",
- journal->j_devname);
- clear_buffer_write_io_error(bh);
- set_buffer_uptodate(bh);
- }
- } else
- write_dirty_buffer(bh, WRITE);
+ jbd2_write_superblock(journal);
+ /* Log is no longer empty */
+ write_lock(&journal->j_state_lock);
+ WARN_ON(!sb->s_sequence);
+ journal->j_flags &= ~JBD2_FLUSHED;
+ write_unlock(&journal->j_state_lock);
+}
-out:
- /* If we have just flushed the log (by marking s_start==0), then
- * any future commit will have to be careful to update the
- * superblock again to re-record the true start of the log. */
+/**
+ * jbd2_mark_journal_empty() - Mark on disk journal as empty.
+ * @journal: The journal to update.
+ *
+ * Update a journal's dynamic superblock fields to show that journal is empty.
+ * Write updated superblock to disk waiting for IO to complete.
+ */
+static void jbd2_mark_journal_empty(journal_t *journal)
+{
+ journal_superblock_t *sb = journal->j_superblock;
+ read_lock(&journal->j_state_lock);
+ jbd_debug(1, "JBD2: Marking journal as empty (seq %d)\n",
+ journal->j_tail_sequence);
+
+ sb->s_sequence = cpu_to_be32(journal->j_tail_sequence);
+ sb->s_start = cpu_to_be32(0);
+ read_unlock(&journal->j_state_lock);
+
+ jbd2_write_superblock(journal);
+
+ /* Log is no longer empty */
write_lock(&journal->j_state_lock);
- if (sb->s_start)
- journal->j_flags &= ~JBD2_FLUSHED;
- else
- journal->j_flags |= JBD2_FLUSHED;
+ journal->j_flags |= JBD2_FLUSHED;
write_unlock(&journal->j_state_lock);
}
+
+/**
+ * jbd2_journal_update_sb_errno() - Update error in the journal.
+ * @journal: The journal to update.
+ *
+ * Update a journal's errno. Write updated superblock to disk waiting for IO
+ * to complete.
+ */
+static void jbd2_journal_update_sb_errno(journal_t *journal)
+{
+ journal_superblock_t *sb = journal->j_superblock;
+
+ read_lock(&journal->j_state_lock);
+ jbd_debug(1, "JBD2: updating superblock error (errno %d)\n",
+ journal->j_errno);
+ sb->s_errno = cpu_to_be32(journal->j_errno);
+ read_unlock(&journal->j_state_lock);
+
+ jbd2_write_superblock(journal);
+}
+
/*
* Read the superblock for a given journal, performing initial
* validation of the format.
*/
-
static int journal_get_superblock(journal_t *journal)
{
struct buffer_head *bh;
@@ -1426,15 +1465,10 @@ int jbd2_journal_destroy(journal_t *jour
spin_unlock(&journal->j_list_lock);
if (journal->j_sb_buffer) {
- if (!is_journal_aborted(journal)) {
- /* We can now mark the journal as empty. */
- journal->j_tail = 0;
- journal->j_tail_sequence =
- ++journal->j_transaction_sequence;
- jbd2_journal_update_superblock(journal, 1);
- } else {
+ if (!is_journal_aborted(journal))
+ jbd2_mark_journal_empty(journal);
+ else
err = -EIO;
- }
brelse(journal->j_sb_buffer);
}
@@ -1648,7 +1682,6 @@ int jbd2_journal_flush(journal_t *journa
{
int err = 0;
transaction_t *transaction = NULL;
- unsigned long old_tail;
write_lock(&journal->j_state_lock);
@@ -1690,14 +1723,8 @@ int jbd2_journal_flush(journal_t *journa
* the magic code for a fully-recovered superblock. Any future
* commits of data to the journal will restore the current
* s_start value. */
+ jbd2_mark_journal_empty(journal);
write_lock(&journal->j_state_lock);
- old_tail = journal->j_tail;
- journal->j_tail = 0;
- write_unlock(&journal->j_state_lock);
- jbd2_journal_update_superblock(journal, 1);
- write_lock(&journal->j_state_lock);
- journal->j_tail = old_tail;
-
J_ASSERT(!journal->j_running_transaction);
J_ASSERT(!journal->j_committing_transaction);
J_ASSERT(!journal->j_checkpoint_transactions);
@@ -1738,7 +1765,7 @@ int jbd2_journal_wipe(journal_t *journal
err = jbd2_journal_skip_recovery(journal);
if (write)
- jbd2_journal_update_superblock(journal, 1);
+ jbd2_mark_journal_empty(journal);
no_recovery:
return err;
@@ -1788,7 +1815,7 @@ static void __journal_abort_soft (journa
__jbd2_journal_abort_hard(journal);
if (errno)
- jbd2_journal_update_superblock(journal, 1);
+ jbd2_journal_update_sb_errno(journal);
}
/**
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -1083,7 +1083,7 @@ extern int jbd2_journal_destroy (j
extern int jbd2_journal_recover (journal_t *journal);
extern int jbd2_journal_wipe (journal_t *, int);
extern int jbd2_journal_skip_recovery (journal_t *);
-extern void jbd2_journal_update_superblock (journal_t *, int);
+extern void jbd2_journal_update_sb_log_tail (journal_t *);
extern void __jbd2_journal_abort_hard (journal_t *);
extern void jbd2_journal_abort (journal_t *, int);
extern int jbd2_journal_errno (journal_t *);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 030/110] Disable write buffering on Toshiba ToPIC95
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (95 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 031/110] jbd2: split updating of journal superblock and marking journal empty Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 095/110] netfilter: nf_conntrack: Support expectations in different zones Ben Hutchings
` (14 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Dominik Brodowski, Ryan Underwood
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Underwood <nemesis@icequake.net>
commit 2fb22a8042fe96b4220843f79241c116d90922c4 upstream.
Disable write buffering on the Toshiba ToPIC95 if it is enabled by
somebody (it is not supposed to be a power-on default according to
the datasheet). On the ToPIC95, practically no 32-bit Cardbus card
will work under heavy load without locking up the whole system if
this is left enabled. I tried about a dozen. It does not affect
16-bit cards. This is similar to the O2 bugs in early controller
revisions it seems.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=55961
Signed-off-by: Ryan C. Underwood <nemesis@icequake.net>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/pcmcia/topic.h | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/pcmcia/topic.h
+++ b/drivers/pcmcia/topic.h
@@ -104,6 +104,9 @@
#define TOPIC_EXCA_IF_CONTROL 0x3e /* 8 bit */
#define TOPIC_EXCA_IFC_33V_ENA 0x01
+#define TOPIC_PCI_CFG_PPBCN 0x3e /* 16-bit */
+#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400
+
static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff)
{
struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket);
@@ -138,6 +141,7 @@ static int topic97_override(struct yenta
static int topic95_override(struct yenta_socket *socket)
{
u8 fctrl;
+ u16 ppbcn;
/* enable 3.3V support for 16bit cards */
fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL);
@@ -146,6 +150,18 @@ static int topic95_override(struct yenta
/* tell yenta to use exca registers to power 16bit cards */
socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF;
+ /* Disable write buffers to prevent lockups under load with numerous
+ Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the
+ net. This is not a power-on default according to the datasheet
+ but some BIOSes seem to set it. */
+ if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0
+ && socket->dev->revision <= 7
+ && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) {
+ ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN;
+ pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn);
+ dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n");
+ }
+
return 0;
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 095/110] netfilter: nf_conntrack: Support expectations in different zones
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (96 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 030/110] Disable write buffering on Toshiba ToPIC95 Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 073/110] drm: Check crtc x and y coordinates Ben Hutchings
` (13 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Pablo Neira Ayuso, Joe Stringer
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Joe Stringer <joestringer@nicira.com>
commit 4b31814d20cbe5cd4ccf18089751e77a04afe4f2 upstream.
When zones were originally introduced, the expectation functions were
all extended to perform lookup using the zone. However, insertion was
not modified to check the zone. This means that two expectations which
are intended to apply for different connections that have the same tuple
but exist in different zones cannot both be tracked.
Fixes: 5d0aa2ccd4 (netfilter: nf_conntrack: add support for "conntrack zones")
Signed-off-by: Joe Stringer <joestringer@nicira.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/netfilter/nf_conntrack_expect.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -205,7 +205,8 @@ static inline int expect_clash(const str
a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
}
- return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
+ return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
+ nf_ct_zone(a->master) == nf_ct_zone(b->master);
}
static inline int expect_matches(const struct nf_conntrack_expect *a,
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 073/110] drm: Check crtc x and y coordinates
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (97 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 095/110] netfilter: nf_conntrack: Support expectations in different zones Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 071/110] dm btree: silence lockdep lock inversion in dm_btree_del() Ben Hutchings
` (12 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Alex Deucher, Ville Syrjälä, Dave Airlie
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <ville.syrjala@linux.intel.com>
commit 1d97e9154821d52a5ebc226176d4839c7b86b116 upstream.
The crtc x/y panning coordinates are stored as signed integers
internally. The user provides them as unsigned, so we should check
that the user provided values actually fit in the internal datatypes.
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpu/drm/drm_crtc.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1505,6 +1505,10 @@ int drm_mode_setcrtc(struct drm_device *
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EINVAL;
+ /* For some reason crtc x/y offsets are signed internally. */
+ if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
+ return -ERANGE;
+
mutex_lock(&dev->mode_config.mutex);
obj = drm_mode_object_find(dev, crtc_req->crtc_id,
DRM_MODE_OBJECT_CRTC);
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 071/110] dm btree: silence lockdep lock inversion in dm_btree_del()
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (98 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 073/110] drm: Check crtc x and y coordinates Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 076/110] mm: avoid setting up anonymous pages into file mapping Ben Hutchings
` (11 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mike Snitzer, Joe Thornber
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit 1c7518794a3647eb345d59ee52844e8a40405198 upstream.
Allocate memory using GFP_NOIO when deleting a btree. dm_btree_del()
can be called via an ioctl and we don't want to recurse into the FS or
block layer.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/md/persistent-data/dm-btree.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -236,7 +236,7 @@ int dm_btree_del(struct dm_btree_info *i
int r;
struct del_stack *s;
- s = kmalloc(sizeof(*s), GFP_KERNEL);
+ s = kmalloc(sizeof(*s), GFP_NOIO);
if (!s)
return -ENOMEM;
s->tm = info->tm;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 076/110] mm: avoid setting up anonymous pages into file mapping
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (99 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 071/110] dm btree: silence lockdep lock inversion in dm_btree_del() Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 089/110] net: Clone skb before setting peeked flag Ben Hutchings
` (10 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Willy Tarreau, Linus Torvalds, Kirill A. Shutemov,
Oleg Nesterov
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
commit 6b7339f4c31ad69c8e9c0b2859276e22cf72176d upstream.
Reading page fault handler code I've noticed that under right
circumstances kernel would map anonymous pages into file mappings: if
the VMA doesn't have vm_ops->fault() and the VMA wasn't fully populated
on ->mmap(), kernel would handle page fault to not populated pte with
do_anonymous_page().
Let's change page fault handler to use do_anonymous_page() only on
anonymous VMA (->vm_ops == NULL) and make sure that the VMA is not
shared.
For file mappings without vm_ops->fault() or shred VMA without vm_ops,
page fault on pte_none() entry would lead to SIGBUS.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/memory.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3153,6 +3153,10 @@ static int do_anonymous_page(struct mm_s
pte_unmap(page_table);
+ /* File mapping without ->vm_ops ? */
+ if (vma->vm_flags & VM_SHARED)
+ return VM_FAULT_SIGBUS;
+
/* Check if we need to add a guard page to the stack */
if (check_stack_guard_page(vma, address) < 0)
return VM_FAULT_SIGSEGV;
@@ -3412,6 +3416,9 @@ static int do_linear_fault(struct mm_str
- vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
pte_unmap(page_table);
+ /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
+ if (!vma->vm_ops->fault)
+ return VM_FAULT_SIGBUS;
return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte);
}
@@ -3470,11 +3477,9 @@ int handle_pte_fault(struct mm_struct *m
entry = *pte;
if (!pte_present(entry)) {
if (pte_none(entry)) {
- if (vma->vm_ops) {
- if (likely(vma->vm_ops->fault))
- return do_linear_fault(mm, vma, address,
+ if (vma->vm_ops)
+ return do_linear_fault(mm, vma, address,
pte, pmd, flags, entry);
- }
return do_anonymous_page(mm, vma, address,
pte, pmd, flags);
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 089/110] net: Clone skb before setting peeked flag
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (100 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 076/110] mm: avoid setting up anonymous pages into file mapping Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 11:37 ` Konstantin Khlebnikov
2015-08-10 10:12 ` [PATCH 3.2 101/110] tile: use free_bootmem_late() for initrd Ben Hutchings
` (9 subsequent siblings)
111 siblings, 1 reply; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Konstantin Khlebnikov, David S. Miller, Herbert Xu
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec upstream.
Shared skbs must not be modified and this is crucial for broadcast
and/or multicast paths where we use it as an optimisation to avoid
unnecessary cloning.
The function skb_recv_datagram breaks this rule by setting peeked
without cloning the skb first. This causes funky races which leads
to double-free.
This patch fixes this by cloning the skb and replacing the skb
in the list when setting skb->peeked.
Fixes: a59322be07c9 ("[UDP]: Only increment counter on first peek/recv")
Reported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/core/datagram.c | 41 ++++++++++++++++++++++++++++++++++++++---
1 file changed, 38 insertions(+), 3 deletions(-)
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -128,6 +128,35 @@ out_noerr:
goto out;
}
+static int skb_set_peeked(struct sk_buff *skb)
+{
+ struct sk_buff *nskb;
+
+ if (skb->peeked)
+ return 0;
+
+ /* We have to unshare an skb before modifying it. */
+ if (!skb_shared(skb))
+ goto done;
+
+ nskb = skb_clone(skb, GFP_ATOMIC);
+ if (!nskb)
+ return -ENOMEM;
+
+ skb->prev->next = nskb;
+ skb->next->prev = nskb;
+ nskb->prev = skb->prev;
+ nskb->next = skb->next;
+
+ consume_skb(skb);
+ skb = nskb;
+
+done:
+ skb->peeked = 1;
+
+ return 0;
+}
+
/**
* __skb_recv_datagram - Receive a datagram skbuff
* @sk: socket
@@ -160,7 +189,9 @@ out_noerr:
struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
int *peeked, int *err)
{
+ struct sk_buff_head *queue = &sk->sk_receive_queue;
struct sk_buff *skb;
+ unsigned long cpu_flags;
long timeo;
/*
* Caller is allowed not to check sk->sk_err before skb_recv_datagram()
@@ -179,15 +210,16 @@ struct sk_buff *__skb_recv_datagram(stru
* Look at current nfs client by the way...
* However, this function was correct in any case. 8)
*/
- unsigned long cpu_flags;
- struct sk_buff_head *queue = &sk->sk_receive_queue;
-
spin_lock_irqsave(&queue->lock, cpu_flags);
skb = skb_peek(queue);
if (skb) {
*peeked = skb->peeked;
if (flags & MSG_PEEK) {
- skb->peeked = 1;
+
+ error = skb_set_peeked(skb);
+ if (error)
+ goto unlock_err;
+
atomic_inc(&skb->users);
} else
__skb_unlink(skb, queue);
@@ -206,6 +238,8 @@ struct sk_buff *__skb_recv_datagram(stru
return NULL;
+unlock_err:
+ spin_unlock_irqrestore(&queue->lock, cpu_flags);
no_packet:
*err = error;
return NULL;
^ permalink raw reply [flat|nested] 126+ messages in thread* Re: [PATCH 3.2 089/110] net: Clone skb before setting peeked flag
2015-08-10 10:12 ` [PATCH 3.2 089/110] net: Clone skb before setting peeked flag Ben Hutchings
@ 2015-08-10 11:37 ` Konstantin Khlebnikov
2015-08-10 18:15 ` David Miller
2015-08-11 18:24 ` Ben Hutchings
0 siblings, 2 replies; 126+ messages in thread
From: Konstantin Khlebnikov @ 2015-08-10 11:37 UTC (permalink / raw)
To: Ben Hutchings, linux-kernel, stable; +Cc: akpm, David S. Miller, Herbert Xu
On 10.08.2015 13:12, Ben Hutchings wrote:
> 3.2.71-rc1 review patch. If anyone has any objections, please let me know.
Here is important fix: https://patchwork.ozlabs.org/patch/503374/
"net: Fix skb_set_peeked use-after-free". not in upstream yet.
>
> ------------------
>
> From: Herbert Xu <herbert@gondor.apana.org.au>
>
> commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec upstream.
>
> Shared skbs must not be modified and this is crucial for broadcast
> and/or multicast paths where we use it as an optimisation to avoid
> unnecessary cloning.
>
> The function skb_recv_datagram breaks this rule by setting peeked
> without cloning the skb first. This causes funky races which leads
> to double-free.
>
> This patch fixes this by cloning the skb and replacing the skb
> in the list when setting skb->peeked.
>
> Fixes: a59322be07c9 ("[UDP]: Only increment counter on first peek/recv")
> Reported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> [bwh: Backported to 3.2: adjust context]
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> ---
> net/core/datagram.c | 41 ++++++++++++++++++++++++++++++++++++++---
> 1 file changed, 38 insertions(+), 3 deletions(-)
>
> --- a/net/core/datagram.c
> +++ b/net/core/datagram.c
> @@ -128,6 +128,35 @@ out_noerr:
> goto out;
> }
>
> +static int skb_set_peeked(struct sk_buff *skb)
> +{
> + struct sk_buff *nskb;
> +
> + if (skb->peeked)
> + return 0;
> +
> + /* We have to unshare an skb before modifying it. */
> + if (!skb_shared(skb))
> + goto done;
> +
> + nskb = skb_clone(skb, GFP_ATOMIC);
> + if (!nskb)
> + return -ENOMEM;
> +
> + skb->prev->next = nskb;
> + skb->next->prev = nskb;
> + nskb->prev = skb->prev;
> + nskb->next = skb->next;
> +
> + consume_skb(skb);
> + skb = nskb;
> +
> +done:
> + skb->peeked = 1;
> +
> + return 0;
> +}
> +
> /**
> * __skb_recv_datagram - Receive a datagram skbuff
> * @sk: socket
> @@ -160,7 +189,9 @@ out_noerr:
> struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
> int *peeked, int *err)
> {
> + struct sk_buff_head *queue = &sk->sk_receive_queue;
> struct sk_buff *skb;
> + unsigned long cpu_flags;
> long timeo;
> /*
> * Caller is allowed not to check sk->sk_err before skb_recv_datagram()
> @@ -179,15 +210,16 @@ struct sk_buff *__skb_recv_datagram(stru
> * Look at current nfs client by the way...
> * However, this function was correct in any case. 8)
> */
> - unsigned long cpu_flags;
> - struct sk_buff_head *queue = &sk->sk_receive_queue;
> -
> spin_lock_irqsave(&queue->lock, cpu_flags);
> skb = skb_peek(queue);
> if (skb) {
> *peeked = skb->peeked;
> if (flags & MSG_PEEK) {
> - skb->peeked = 1;
> +
> + error = skb_set_peeked(skb);
> + if (error)
> + goto unlock_err;
> +
> atomic_inc(&skb->users);
> } else
> __skb_unlink(skb, queue);
> @@ -206,6 +238,8 @@ struct sk_buff *__skb_recv_datagram(stru
>
> return NULL;
>
> +unlock_err:
> + spin_unlock_irqrestore(&queue->lock, cpu_flags);
> no_packet:
> *err = error;
> return NULL;
>
--
Konstantin
^ permalink raw reply [flat|nested] 126+ messages in thread* Re: [PATCH 3.2 089/110] net: Clone skb before setting peeked flag
2015-08-10 11:37 ` Konstantin Khlebnikov
@ 2015-08-10 18:15 ` David Miller
2015-08-11 18:24 ` Ben Hutchings
1 sibling, 0 replies; 126+ messages in thread
From: David Miller @ 2015-08-10 18:15 UTC (permalink / raw)
To: khlebnikov; +Cc: ben, linux-kernel, stable, akpm, herbert
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Date: Mon, 10 Aug 2015 14:37:05 +0300
> On 10.08.2015 13:12, Ben Hutchings wrote:
>> 3.2.71-rc1 review patch. If anyone has any objections, please let me
>> know.
>
> Here is important fix: https://patchwork.ozlabs.org/patch/503374/
> "net: Fix skb_set_peeked use-after-free". not in upstream yet.
It is in my -stable queue and will be submitted to the stable trees
when I deem it appropriate. I wanted the fix to sit and soak in
Linus's tree before just throwing it to the stable folks.
^ permalink raw reply [flat|nested] 126+ messages in thread
* Re: [PATCH 3.2 089/110] net: Clone skb before setting peeked flag
2015-08-10 11:37 ` Konstantin Khlebnikov
2015-08-10 18:15 ` David Miller
@ 2015-08-11 18:24 ` Ben Hutchings
1 sibling, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-11 18:24 UTC (permalink / raw)
To: Konstantin Khlebnikov, linux-kernel, stable
Cc: akpm, David S. Miller, Herbert Xu
[-- Attachment #1: Type: text/plain, Size: 568 bytes --]
On Mon, 2015-08-10 at 14:37 +0300, Konstantin Khlebnikov wrote:
> On 10.08.2015 13:12, Ben Hutchings wrote:
> > 3.2.71-rc1 review patch. If anyone has any objections, please let
> > me know.
>
> Here is important fix: https://patchwork.ozlabs.org/patch/503374/
> "net: Fix skb_set_peeked use-after-free". not in upstream yet.
[...]
Thanks, I'll defer this and wait for that to show up.
Ben.
--
Ben Hutchings
Theory and practice are closer in theory than in practice.
- John Levine, moderator of comp.compilers
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply [flat|nested] 126+ messages in thread
* [PATCH 3.2 101/110] tile: use free_bootmem_late() for initrd
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (101 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 089/110] net: Clone skb before setting peeked flag Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 106/110] vhost: actually track log eventfd file Ben Hutchings
` (8 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Chris Metcalf
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <cmetcalf@ezchip.com>
commit 3f81d2447b37ac697b3c600039f2c6b628c06e21 upstream.
We were previously using free_bootmem() and just getting lucky
that nothing too bad happened.
Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/tile/kernel/setup.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -973,7 +973,7 @@ static void __init load_hv_initrd(void)
void __init free_initrd_mem(unsigned long begin, unsigned long end)
{
- free_bootmem(__pa(begin), end - begin);
+ free_bootmem_late(__pa(begin), end - begin);
}
#else
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 106/110] vhost: actually track log eventfd file
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (102 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 101/110] tile: use free_bootmem_late() for initrd Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 075/110] rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver Ben Hutchings
` (7 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Michael S. Tsirkin, Marc-André Lureau
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Marc-André Lureau <marcandre.lureau@redhat.com>
commit 7932c0bd7740f4cd2aa168d3ce0199e7af7d72d5 upstream.
While reviewing vhost log code, I found out that log_file is never
set. Note: I haven't tested the change (QEMU doesn't use LOG_FD yet).
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/vhost/vhost.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -883,6 +883,7 @@ long vhost_dev_ioctl(struct vhost_dev *d
}
if (eventfp != d->log_file) {
filep = d->log_file;
+ d->log_file = eventfp;
ctx = d->log_ctx;
d->log_ctx = eventfp ?
eventfd_ctx_fileget(eventfp) : NULL;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 075/110] rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (103 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 106/110] vhost: actually track log eventfd file Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 096/110] usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function Ben Hutchings
` (6 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Jason Gunthorpe, Sucheta Chakraborty, Daniel Borkmann,
Nicolas Dichtel, Chris Wright, Rony Efraim, David S. Miller,
Greg Rose, Thomas Graf, Vlad Zolotarov, Jeff Kirsher
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
commit 4f7d2cdfdde71ffe962399b7020c674050329423 upstream.
Jason Gunthorpe reported that since commit c02db8c6290b ("rtnetlink: make
SR-IOV VF interface symmetric"), we don't verify IFLA_VF_INFO attributes
anymore with respect to their policy, that is, ifla_vfinfo_policy[].
Before, they were part of ifla_policy[], but they have been nested since
placed under IFLA_VFINFO_LIST, that contains the attribute IFLA_VF_INFO,
which is another nested attribute for the actual VF attributes such as
IFLA_VF_MAC, IFLA_VF_VLAN, etc.
Despite the policy being split out from ifla_policy[] in this commit,
it's never applied anywhere. nla_for_each_nested() only does basic nla_ok()
testing for struct nlattr, but it doesn't know about the data context and
their requirements.
Fix, on top of Jason's initial work, does 1) parsing of the attributes
with the right policy, and 2) using the resulting parsed attribute table
from 1) instead of the nla_for_each_nested() loop (just like we used to
do when still part of ifla_policy[]).
Reference: http://thread.gmane.org/gmane.linux.network/368913
Fixes: c02db8c6290b ("rtnetlink: make SR-IOV VF interface symmetric")
Reported-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Cc: Greg Rose <gregory.v.rose@intel.com>
Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Cc: Rony Efraim <ronye@mellanox.com>
Cc: Vlad Zolotarov <vladz@cloudius-systems.com>
Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Cc: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Vlad Zolotarov <vladz@cloudius-systems.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2:
- Drop unsupported attributes
- Use ndo_set_vf_tx_rate operation, not ndo_set_vf_rate]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/core/rtnetlink.c | 187 ++++++++++++++++++++++++++-------------------------
1 file changed, 96 insertions(+), 91 deletions(-)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1147,10 +1147,6 @@ static const struct nla_policy ifla_info
[IFLA_INFO_DATA] = { .type = NLA_NESTED },
};
-static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
- [IFLA_VF_INFO] = { .type = NLA_NESTED },
-};
-
static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
[IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) },
[IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) },
@@ -1224,58 +1220,53 @@ static int validate_linkmsg(struct net_d
return 0;
}
-static int do_setvfinfo(struct net_device *dev, struct nlattr *attr)
+static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
{
- int rem, err = -EINVAL;
- struct nlattr *vf;
const struct net_device_ops *ops = dev->netdev_ops;
+ int err = -EINVAL;
- nla_for_each_nested(vf, attr, rem) {
- switch (nla_type(vf)) {
- case IFLA_VF_MAC: {
- struct ifla_vf_mac *ivm;
- ivm = nla_data(vf);
- err = -EOPNOTSUPP;
- if (ops->ndo_set_vf_mac)
- err = ops->ndo_set_vf_mac(dev, ivm->vf,
- ivm->mac);
- break;
- }
- case IFLA_VF_VLAN: {
- struct ifla_vf_vlan *ivv;
- ivv = nla_data(vf);
- err = -EOPNOTSUPP;
- if (ops->ndo_set_vf_vlan)
- err = ops->ndo_set_vf_vlan(dev, ivv->vf,
- ivv->vlan,
- ivv->qos);
- break;
- }
- case IFLA_VF_TX_RATE: {
- struct ifla_vf_tx_rate *ivt;
- ivt = nla_data(vf);
- err = -EOPNOTSUPP;
- if (ops->ndo_set_vf_tx_rate)
- err = ops->ndo_set_vf_tx_rate(dev, ivt->vf,
- ivt->rate);
- break;
- }
- case IFLA_VF_SPOOFCHK: {
- struct ifla_vf_spoofchk *ivs;
- ivs = nla_data(vf);
- err = -EOPNOTSUPP;
- if (ops->ndo_set_vf_spoofchk)
- err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
- ivs->setting);
- break;
- }
- default:
- err = -EINVAL;
- break;
- }
- if (err)
- break;
+ if (tb[IFLA_VF_MAC]) {
+ struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]);
+ err = -EOPNOTSUPP;
+ if (ops->ndo_set_vf_mac)
+ err = ops->ndo_set_vf_mac(dev, ivm->vf,
+ ivm->mac);
+ if (err < 0)
+ return err;
}
+
+ if (tb[IFLA_VF_VLAN]) {
+ struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]);
+
+ err = -EOPNOTSUPP;
+ if (ops->ndo_set_vf_vlan)
+ err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan,
+ ivv->qos);
+ if (err < 0)
+ return err;
+ }
+
+ if (tb[IFLA_VF_TX_RATE]) {
+ struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]);
+
+ if (ops->ndo_set_vf_tx_rate)
+ err = ops->ndo_set_vf_tx_rate(dev, ivt->vf,
+ ivt->rate);
+ if (err < 0)
+ return err;
+ }
+
+ if (tb[IFLA_VF_SPOOFCHK]) {
+ struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]);
+
+ err = -EOPNOTSUPP;
+ if (ops->ndo_set_vf_spoofchk)
+ err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
+ ivs->setting);
+ if (err < 0)
+ return err;
+ }
+
return err;
}
@@ -1458,14 +1449,21 @@ static int do_setlink(struct net_device
}
if (tb[IFLA_VFINFO_LIST]) {
+ struct nlattr *vfinfo[IFLA_VF_MAX + 1];
struct nlattr *attr;
int rem;
+
nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) {
- if (nla_type(attr) != IFLA_VF_INFO) {
+ if (nla_type(attr) != IFLA_VF_INFO ||
+ nla_len(attr) < NLA_HDRLEN) {
err = -EINVAL;
goto errout;
}
- err = do_setvfinfo(dev, attr);
+ err = nla_parse_nested(vfinfo, IFLA_VF_MAX, attr,
+ ifla_vf_policy);
+ if (err < 0)
+ goto errout;
+ err = do_setvfinfo(dev, vfinfo);
if (err < 0)
goto errout;
modified = 1;
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 096/110] usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (104 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 075/110] rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 044/110] NET: ROSE: Don't dereference NULL neighbour pointer Ben Hutchings
` (5 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, AMAN DEEP, Greg Kroah-Hartman, Mathias Nyman
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: AMAN DEEP <aman.deep@samsung.com>
commit 3496810663922617d4b706ef2780c279252ddd6a upstream.
virt_dev->num_cached_rings counts on freed ring and is not updated
correctly. In xhci_free_or_cache_endpoint_ring() function, the free ring
is added into cache and then num_rings_cache is incremented as below:
virt_dev->ring_cache[rings_cached] =
virt_dev->eps[ep_index].ring;
virt_dev->num_rings_cached++;
here, free ring pointer is added to a current index and then
index is incremented.
So current index always points to empty location in the ring cache.
For getting available free ring, current index should be decremented
first and then corresponding ring buffer value should be taken from ring
cache.
But In function xhci_endpoint_init(), the num_rings_cached index is
accessed before decrement.
virt_dev->eps[ep_index].new_ring =
virt_dev->ring_cache[virt_dev->num_rings_cached];
virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
virt_dev->num_rings_cached--;
This is bug in manipulating the index of ring cache.
And it should be as below:
virt_dev->num_rings_cached--;
virt_dev->eps[ep_index].new_ring =
virt_dev->ring_cache[virt_dev->num_rings_cached];
virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
Signed-off-by: Aman Deep <aman.deep@samsung.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci-mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1330,10 +1330,10 @@ int xhci_endpoint_init(struct xhci_hcd *
/* Attempt to use the ring cache */
if (virt_dev->num_rings_cached == 0)
return -ENOMEM;
+ virt_dev->num_rings_cached--;
virt_dev->eps[ep_index].new_ring =
virt_dev->ring_cache[virt_dev->num_rings_cached];
virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
- virt_dev->num_rings_cached--;
xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
usb_endpoint_xfer_isoc(&ep->desc) ? true : false);
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 044/110] NET: ROSE: Don't dereference NULL neighbour pointer.
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (105 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 096/110] usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 039/110] Bluetooth: ath3k: Add support of 04ca:300d AR3012 device Ben Hutchings
` (4 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Ralf Baechle, David S. Miller, Bernard Pidoux
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ralf Baechle <ralf@linux-mips.org>
commit d496f7842aada20c61e6044b3395383fa972872c upstream.
A ROSE socket doesn't necessarily always have a neighbour pointer so check
if the neighbour pointer is valid before dereferencing it.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Tested-by: Bernard Pidoux <f6bvp@free.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/rose/af_rose.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -195,7 +195,8 @@ static void rose_kill_by_device(struct n
if (rose->device == dev) {
rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
- rose->neighbour->use--;
+ if (rose->neighbour)
+ rose->neighbour->use--;
rose->device = NULL;
}
}
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 039/110] Bluetooth: ath3k: Add support of 04ca:300d AR3012 device
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (106 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 044/110] NET: ROSE: Don't dereference NULL neighbour pointer Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 22:01 ` Dmitry Tunin
2015-08-10 10:12 ` [PATCH 3.2 080/110] s390/process: fix sfpc inline assembly Ben Hutchings
` (3 subsequent siblings)
111 siblings, 1 reply; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Dmitry Tunin, Marcel Holtmann
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Tunin <hanipouspilot@gmail.com>
commit 7e730c7f3d1f39c25cf5f7cf70c0ff4c28d7bec7 upstream.
BugLink: https://bugs.launchpad.net/bugs/1394368
This device requires new firmware files
AthrBT_0x11020100.dfu and ramps_0x11020100_40.dfu added to
/lib/firmware/ar3k/ that are not included in linux-firmware yet.
T: Bus=02 Lev=01 Prnt=01 Port=04 Cnt=03 Dev#= 5 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=04ca ProdID=300d Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/bluetooth/ath3k.c | 2 ++
drivers/bluetooth/btusb.c | 1 +
2 files changed, 3 insertions(+)
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -87,6 +87,7 @@ static struct usb_device_id ath3k_table[
{ USB_DEVICE(0x04CA, 0x3007) },
{ USB_DEVICE(0x04CA, 0x3008) },
{ USB_DEVICE(0x04CA, 0x300b) },
+ { USB_DEVICE(0x04CA, 0x300d) },
{ USB_DEVICE(0x04CA, 0x300f) },
{ USB_DEVICE(0x04CA, 0x3010) },
{ USB_DEVICE(0x0930, 0x0219) },
@@ -145,6 +146,7 @@ static struct usb_device_id ath3k_blist_
{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -172,6 +172,7 @@ static struct usb_device_id blacklist_ta
{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
^ permalink raw reply [flat|nested] 126+ messages in thread* Re: [PATCH 3.2 039/110] Bluetooth: ath3k: Add support of 04ca:300d AR3012 device
2015-08-10 10:12 ` [PATCH 3.2 039/110] Bluetooth: ath3k: Add support of 04ca:300d AR3012 device Ben Hutchings
@ 2015-08-10 22:01 ` Dmitry Tunin
0 siblings, 0 replies; 126+ messages in thread
From: Dmitry Tunin @ 2015-08-10 22:01 UTC (permalink / raw)
To: Ben Hutchings; +Cc: linux-kernel, stable@vger.kernel.org, akpm, Marcel Holtmann
This patch causes a regression on some Acer Aspire laptops.
See last comments in https://bugs.launchpad.net/bugs/1394368
2015-08-10 13:12 GMT+03:00 Ben Hutchings <ben@decadent.org.uk>:
> 3.2.71-rc1 review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Dmitry Tunin <hanipouspilot@gmail.com>
>
> commit 7e730c7f3d1f39c25cf5f7cf70c0ff4c28d7bec7 upstream.
>
> BugLink: https://bugs.launchpad.net/bugs/1394368
>
> This device requires new firmware files
> AthrBT_0x11020100.dfu and ramps_0x11020100_40.dfu added to
> /lib/firmware/ar3k/ that are not included in linux-firmware yet.
>
> T: Bus=02 Lev=01 Prnt=01 Port=04 Cnt=03 Dev#= 5 Spd=12 MxCh= 0
> D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
> P: Vendor=04ca ProdID=300d Rev= 0.01
> C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
> I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
> E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
> E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
> I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
> I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
> I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
> I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
> I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
> I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
> E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
> E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
>
> Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> ---
> drivers/bluetooth/ath3k.c | 2 ++
> drivers/bluetooth/btusb.c | 1 +
> 2 files changed, 3 insertions(+)
>
> --- a/drivers/bluetooth/ath3k.c
> +++ b/drivers/bluetooth/ath3k.c
> @@ -87,6 +87,7 @@ static struct usb_device_id ath3k_table[
> { USB_DEVICE(0x04CA, 0x3007) },
> { USB_DEVICE(0x04CA, 0x3008) },
> { USB_DEVICE(0x04CA, 0x300b) },
> + { USB_DEVICE(0x04CA, 0x300d) },
> { USB_DEVICE(0x04CA, 0x300f) },
> { USB_DEVICE(0x04CA, 0x3010) },
> { USB_DEVICE(0x0930, 0x0219) },
> @@ -145,6 +146,7 @@ static struct usb_device_id ath3k_blist_
> { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
> { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
> { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
> + { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
> { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
> { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
> { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -172,6 +172,7 @@ static struct usb_device_id blacklist_ta
> { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
> { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
> { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
> + { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
> { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
> { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
> { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
>
^ permalink raw reply [flat|nested] 126+ messages in thread
* [PATCH 3.2 080/110] s390/process: fix sfpc inline assembly
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (107 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 039/110] Bluetooth: ath3k: Add support of 04ca:300d AR3012 device Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 10:12 ` [PATCH 3.2 059/110] ACPICA: Tables: Fix an issue that FACS initialization is performed twice Ben Hutchings
` (2 subsequent siblings)
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Heiko Carstens, Martin Schwidefsky
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <heiko.carstens@de.ibm.com>
commit e47994dd44bcb4a77b4152bd0eada585934703c0 upstream.
The sfpc inline assembly within execve_tail() may incorrectly set bits
28-31 of the sfpc instruction to a value which is not zero.
These bits however are currently unused and therefore should be zero
so we won't get surprised if these bits will be used in the future.
Therefore remove the second operand from the inline assembly.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/s390/kernel/process.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -250,7 +250,7 @@ asmlinkage void execve_tail(void)
{
current->thread.fp_regs.fpc = 0;
if (MACHINE_HAS_IEEE)
- asm volatile("sfpc %0,%0" : : "d" (0));
+ asm volatile("sfpc %0" : : "d" (0));
}
/*
^ permalink raw reply [flat|nested] 126+ messages in thread* [PATCH 3.2 059/110] ACPICA: Tables: Fix an issue that FACS initialization is performed twice
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (108 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 080/110] s390/process: fix sfpc inline assembly Ben Hutchings
@ 2015-08-10 10:12 ` Ben Hutchings
2015-08-10 16:10 ` [PATCH 3.2 000/110] 3.2.71-rc1 review Guenter Roeck
2015-08-11 19:21 ` Jonathan Toppins
111 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-10 10:12 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Lv Zheng, Rafael J. Wysocki, Bob Moore
3.2.71-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Lv Zheng <lv.zheng@intel.com>
commit c04be18448355441a0c424362df65b6422e27bda upstream.
ACPICA commit 90f5332a15e9d9ba83831ca700b2b9f708274658
This patch adds a new FACS initialization flag for acpi_tb_initialize().
acpi_enable_subsystem() might be invoked several times in OS bootup process,
and we don't want FACS initialization to be invoked twice. Lv Zheng.
Link: https://github.com/acpica/acpica/commit/90f5332a
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/acpi/acpica/utxface.c | 10 ++++++----
include/acpi/actypes.h | 1 +
2 files changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/acpi/acpica/utxface.c
+++ b/drivers/acpi/acpica/utxface.c
@@ -163,10 +163,12 @@ acpi_status acpi_enable_subsystem(u32 fl
* Obtain a permanent mapping for the FACS. This is required for the
* Global Lock and the Firmware Waking Vector
*/
- status = acpi_tb_initialize_facs();
- if (ACPI_FAILURE(status)) {
- ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
- return_ACPI_STATUS(status);
+ if (!(flags & ACPI_NO_FACS_INIT)) {
+ status = acpi_tb_initialize_facs();
+ if (ACPI_FAILURE(status)) {
+ ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
+ return_ACPI_STATUS(status);
+ }
}
/*
--- a/include/acpi/actypes.h
+++ b/include/acpi/actypes.h
@@ -495,6 +495,7 @@ typedef u64 acpi_integer;
#define ACPI_NO_ACPI_ENABLE 0x10
#define ACPI_NO_DEVICE_INIT 0x20
#define ACPI_NO_OBJECT_INIT 0x40
+#define ACPI_NO_FACS_INIT 0x80
/*
* Initialization state
^ permalink raw reply [flat|nested] 126+ messages in thread* Re: [PATCH 3.2 000/110] 3.2.71-rc1 review
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (109 preceding siblings ...)
2015-08-10 10:12 ` [PATCH 3.2 059/110] ACPICA: Tables: Fix an issue that FACS initialization is performed twice Ben Hutchings
@ 2015-08-10 16:10 ` Guenter Roeck
2015-08-11 20:34 ` Ben Hutchings
2015-08-11 19:21 ` Jonathan Toppins
111 siblings, 1 reply; 126+ messages in thread
From: Guenter Roeck @ 2015-08-10 16:10 UTC (permalink / raw)
To: Ben Hutchings, linux-kernel, stable; +Cc: torvalds, Phil Jensen, akpm
On 08/10/2015 03:12 AM, Ben Hutchings wrote:
> This is the start of the stable review cycle for the 3.2.71 release.
> There are 110 patches in this series, which will be posted as responses
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Aug 12 11:00:00 UTC 2015.
> Anything received after that time might be too late.
>
Build results:
total: 93 pass: 93 fail: 0
Qemu test results:
total: 44 pass: 44 fail: 0
Details are available at http://server.roeck-us.net:8010/builders.
Guenter
^ permalink raw reply [flat|nested] 126+ messages in thread* Re: [PATCH 3.2 000/110] 3.2.71-rc1 review
2015-08-10 16:10 ` [PATCH 3.2 000/110] 3.2.71-rc1 review Guenter Roeck
@ 2015-08-11 20:34 ` Ben Hutchings
0 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-11 20:34 UTC (permalink / raw)
To: Guenter Roeck, linux-kernel, stable; +Cc: torvalds, Phil Jensen, akpm
[-- Attachment #1: Type: text/plain, Size: 860 bytes --]
On Mon, 2015-08-10 at 09:10 -0700, Guenter Roeck wrote:
> On 08/10/2015 03:12 AM, Ben Hutchings wrote:
> > This is the start of the stable review cycle for the 3.2.71 release.
> > There are 110 patches in this series, which will be posted as responses
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed Aug 12 11:00:00 UTC 2015.
> > Anything received after that time might be too late.
> >
>
> Build results:
> > total: 93 pass: 93 fail: 0
> Qemu test results:
> > total: 44 pass: 44 fail: 0
>
> Details are available at http://server.roeck-us.net:8010/builders.
Thanks for checking.
Ben.
--
Ben Hutchings
Theory and practice are closer in theory than in practice.
- John Levine, moderator of comp.compilers
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply [flat|nested] 126+ messages in thread
* Re: [PATCH 3.2 000/110] 3.2.71-rc1 review
2015-08-10 10:12 [PATCH 3.2 000/110] 3.2.71-rc1 review Ben Hutchings
` (110 preceding siblings ...)
2015-08-10 16:10 ` [PATCH 3.2 000/110] 3.2.71-rc1 review Guenter Roeck
@ 2015-08-11 19:21 ` Jonathan Toppins
2015-08-11 19:29 ` Ben Hutchings
111 siblings, 1 reply; 126+ messages in thread
From: Jonathan Toppins @ 2015-08-11 19:21 UTC (permalink / raw)
To: Ben Hutchings, linux-kernel, stable
Cc: torvalds, Guenter Roeck, Phil Jensen, akpm
On 08/10/2015 06:12 AM, Ben Hutchings wrote:
> This is the start of the stable review cycle for the 3.2.71 release.
> There are 110 patches in this series, which will be posted as responses
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Aug 12 11:00:00 UTC 2015.
> Anything received after that time might be too late.
>
> A combined patch relative to 3.2.70 will be posted as an additional
> response to this. A shortlog and diffstat can be found below.
>
Was thinking I would see upstream commit
b6878d9e03043695dbf3fa1caa6dfc09db225b16, overlooked?
Has been backported by at least Debian in their 3.2 kernel, version
3.2.68-1+deb7u3, to fix CVE-2015-5697.
Maybe this upstream commit is too new and so it will show up in a later
3.2 stable version?
Thanks,
-Jon
^ permalink raw reply [flat|nested] 126+ messages in thread* Re: [PATCH 3.2 000/110] 3.2.71-rc1 review
2015-08-11 19:21 ` Jonathan Toppins
@ 2015-08-11 19:29 ` Ben Hutchings
0 siblings, 0 replies; 126+ messages in thread
From: Ben Hutchings @ 2015-08-11 19:29 UTC (permalink / raw)
To: Jonathan Toppins, linux-kernel, stable
Cc: torvalds, Guenter Roeck, Phil Jensen, akpm
[-- Attachment #1: Type: text/plain, Size: 1259 bytes --]
On Tue, 2015-08-11 at 15:21 -0400, Jonathan Toppins wrote:
> On 08/10/2015 06:12 AM, Ben Hutchings wrote:
> > This is the start of the stable review cycle for the 3.2.71 release.
> > There are 110 patches in this series, which will be posted as responses
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed Aug 12 11:00:00 UTC 2015.
> > Anything received after that time might be too late.
> >
> > A combined patch relative to 3.2.70 will be posted as an additional
> > response to this. A shortlog and diffstat can be found below.
> >
>
> Was thinking I would see upstream commit
> b6878d9e03043695dbf3fa1caa6dfc09db225b16, overlooked?
>
> Has been backported by at least Debian in their 3.2 kernel, version
> 3.2.68-1+deb7u3, to fix CVE-2015-5697.
Funnily enough, I am aware of that. :-)
> Maybe this upstream commit is too new and so it will show up in a later
> 3.2 stable version?
Yes, it is too new (only released in 4.2-rc6, and I looked for fixes up
to 4.2-rc5).
Ben.
--
Ben Hutchings
Theory and practice are closer in theory than in practice.
- John Levine, moderator of comp.compilers
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply [flat|nested] 126+ messages in thread