3.10.26-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 3.10.26-stable review
This is the start of the stable review cycle for the 3.10.26 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jan 8 22:38:42 UTC 2014. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.10.26-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.10.26-rc1
Catalin Marinas <[email protected]>
arm64: Use Normal NonCacheable memory for writecombine
Catalin Marinas <[email protected]>
arm64: Do not flush the D-cache for anonymous pages
Catalin Marinas <[email protected]>
arm64: Avoid cache flushing in flush_dcache_page()
Mark Rutland <[email protected]>
clocksource: arch_timer: use virtual counters
Catalin Marinas <[email protected]>
arm64: Remove unused cpu_name ascii in arch/arm64/mm/proc.S
Catalin Marinas <[email protected]>
arm64: dts: Reserve the memory used for secondary CPU release address
AKASHI Takahiro <[email protected]>
arm64: check for number of arguments in syscall_get/set_arguments()
Jiang Liu <[email protected]>
arm64: fix possible invalid FPSIMD initialization state
Feng Kan <[email protected]>
arm64: Change kernel stack size to 16K
Mark Rutland <[email protected]>
arm64: virt: ensure visibility of __boot_cpu_mode
Catalin Marinas <[email protected]>
arm64: Only enable local interrupts after the CPU is marked online
Josh Durgin <[email protected]>
rbd: fix error handling from rbd_snap_name()
Josh Durgin <[email protected]>
rbd: ignore unmapped snapshots that no longer exist
Josh Durgin <[email protected]>
rbd: fix use-after free of rbd_dev->disk
Josh Durgin <[email protected]>
rbd: make rbd_obj_notify_ack() synchronous
Josh Durgin <[email protected]>
rbd: complete notifies before cleaning up osd_client and rbd_dev
Josh Durgin <[email protected]>
libceph: add function to ensure notifies are complete
Josh Durgin <[email protected]>
rbd: fix null dereference in dout
Josh Durgin <[email protected]>
rbd: fix buffer size for writes to images with snapshots
majianpeng <[email protected]>
ceph: allow sync_read/write return partial successed size of read/write.
majianpeng <[email protected]>
ceph: fix bugs about handling short-read for sync read mode.
Dan Carpenter <[email protected]>
libceph: create_singlethread_workqueue() doesn't return ERR_PTRs
Dan Carpenter <[email protected]>
libceph: potential NULL dereference in ceph_osdc_handle_map()
Dan Carpenter <[email protected]>
libceph: fix error handling in handle_reply()
majianpeng <[email protected]>
ceph: Add check returned value on func ceph_calc_ceph_pg.
Dan Carpenter <[email protected]>
ceph: cleanup types in striped_read()
Nathaniel Yazdani <[email protected]>
ceph: fix null pointer dereference
Yan, Zheng <[email protected]>
libceph: call r_unsafe_callback when unsafe reply is received
Sasha Levin <[email protected]>
ceph: avoid accessing invalid memory
majianpeng <[email protected]>
ceph: Free mdsc if alloc mdsc->mdsmap failed.
Sage Weil <[email protected]>
rbd: fix a couple warnings
Yan, Zheng <[email protected]>
libceph: fix truncate size calculation
Yan, Zheng <[email protected]>
libceph: fix safe completion
Alex Elder <[email protected]>
rbd: protect against concurrent unmaps
Alex Elder <[email protected]>
rbd: set removing flag while holding list lock
Alex Elder <[email protected]>
rbd: flush dcache after zeroing page data
Alex Elder <[email protected]>
libceph: add lingering request reference when registered
Emil Goode <[email protected]>
ceph: improve error handling in ceph_mdsmap_decode
Dinh Nguyen <[email protected]>
clocksource: dw_apb_timer_of: Fix read_sched_clock
Paul Moore <[email protected]>
selinux: process labeled IPsec TCP SYN-ACK packets properly in selinux_ip_postroute()
Paul Moore <[email protected]>
selinux: look for IPsec labels on both inbound and outbound packets
Geert Uytterhoeven <[email protected]>
sh: always link in helper functions extracted from libgcc
Stephen Boyd <[email protected]>
gpio: msm: Fix irq mask/unmask by writing bits instead of numbers
Roger Quadros <[email protected]>
gpio: twl4030: Fix regression for twl gpio LED output
Theodore Ts'o <[email protected]>
jbd2: don't BUG but return ENOSPC if a handle runs out of space
Martin Schwidefsky <[email protected]>
s390/3270: fix allocation of tty3270_screen structure
Vladimir Davydov <[email protected]>
memcg: fix memcg_size() calculation
Steven Whitehouse <[email protected]>
GFS2: Fix incorrect invalidation for DIO/buffered I/O
Steven Whitehouse <[email protected]>
GFS2: don't hold s_umount over blkdev_put
Dmitry Torokhov <[email protected]>
Input: allocate absinfo data when setting ABS capability
Naoya Horiguchi <[email protected]>
mm/memory-failure.c: transfer page count from head page to tail page after split thp
Rik van Riel <[email protected]>
mm: fix use-after-free in sys_remap_file_pages
Jianguo Wu <[email protected]>
mm/hugetlb: check for pte NULL pointer in __page_check_address()
Joonsoo Kim <[email protected]>
mm/compaction: respect ignore_skip_hint in update_pageblock_skip
Joonsoo Kim <[email protected]>
mm/mempolicy: correct putback method for isolate pages if failed
Mel Gorman <[email protected]>
mm: numa: guarantee that tlb_flush_pending updates are visible before page table updates
Rik van Riel <[email protected]>
mm: fix TLB flush race between migration, and change_protection_range
Oleg Nesterov <[email protected]>
sched: fix the theoretical signal_wake_up() vs schedule() race
Mel Gorman <[email protected]>
mm: numa: avoid unnecessary work on the failure path
Mel Gorman <[email protected]>
mm: numa: ensure anon_vma is locked to prevent parallel THP splits
Mel Gorman <[email protected]>
mm: clear pmd_numa before invalidating
Rob Herring <[email protected]>
Revert "of/address: Handle #address-cells > 2 specially"
Rafael J. Wysocki <[email protected]>
intel_pstate: Fail initialization if P-state information is missing
Larry Finger <[email protected]>
rtlwifi: pci: Fix oops on driver unload
Johannes Berg <[email protected]>
radiotap: fix bitmap-end-finding buffer overrun
Tejun Heo <[email protected]>
libata, freezer: avoid block device removal while system is frozen
Robin H. Johnson <[email protected]>
libata: disable a disk via libata.force params
Vincent Pelletier <[email protected]>
libata: Add atapi_dmadir force flag
Michele Baldessari <[email protected]>
libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus SpinPoint M8
Josh Boyer <[email protected]>
cpupower: Fix segfault due to incorrect getopt_long arugments
Anton Blanchard <[email protected]>
powerpc: Align p_end
Michael Neuling <[email protected]>
powerpc: Fix bad stack check in exception entry
Jan Kiszka <[email protected]>
KVM: x86: Fix APIC map calculation after re-enabling
Mathy Vanhoef <[email protected]>
ath9k_htc: properly set MAC address and BSSID mask
Sujith Manoharan <[email protected]>
ath9k: Fix interrupt handling for the AR9002 family
Peter Korsgaard <[email protected]>
dm9601: work around tx fifo sync issue on dm962x
Peter Korsgaard <[email protected]>
dm9601: fix reception of full size ethernet frames on dm9620/dm9621a
Ard Biesheuvel <[email protected]>
auxvec.h: account for AT_HWCAP2 in AT_VECTOR_SIZE_BASE
Nithin Sujir <[email protected]>
tg3: Expand 4g_overflow_test workaround to skb fragments of any size.
Li Wang <[email protected]>
ceph: Avoid data inconsistency due to d-cache aliasing in readpage()
Alex Deucher <[email protected]>
drm/radeon: 0x9649 is SUMO2 not SUMO
Christian König <[email protected]>
drm/radeon: fix UVD 256MB check
Chris Wilson <[email protected]>
drm/i915: Use the correct GMCH_CTRL register for Sandybridge+
Alex Deucher <[email protected]>
drm/radeon: fix asic gfx values for scrapper asics
Daniel Vetter <[email protected]>
drm/i915: don't update the dri1 breadcrumb with modesetting
Chris Wilson <[email protected]>
drm/i915: Hold mutex across i915_gem_release
Ville Syrjälä <[email protected]>
drm/i915: Take modeset locks around intel_modeset_setup_hw_state()
Alex Deucher <[email protected]>
drm/radeon: add missing display tiling setup for oland
Alex Deucher <[email protected]>
drm/radeon: Fix sideport problems on certain RS690 boards
Rafał Miłecki <[email protected]>
drm/edid: add quirk for BPC in Samsung NP700G7A-S01PL notebook
Dan Williams <[email protected]>
net_dma: mark broken
Stefan Richter <[email protected]>
firewire: sbp2: bring back WRITE SAME support
Kirill Tkhai <[email protected]>
sched/rt: Fix rq's cpupri leak while enqueue/dequeue child RT entities
Mel Gorman <[email protected]>
sched: numa: skip inaccessible VMAs
Lukas Czerner <[email protected]>
ext4: fix FITRIM in no journal mode
Theodore Ts'o <[email protected]>
ext4: add explicit casts when masking cluster sizes
Jan Kara <[email protected]>
ext4: fix deadlock when writing in ENOSPC conditions
Jan Kara <[email protected]>
ext4: Do not reserve clusters when fs doesn't support extents
Eryu Guan <[email protected]>
ext4: check for overlapping extents in ext4_valid_extent_entries()
Junho Ryu <[email protected]>
ext4: fix use-after-free in ext4_mb_new_blocks
Theodore Ts'o <[email protected]>
ext4: call ext4_error_inode() if jbd2_journal_dirty_metadata() fails
Len Brown <[email protected]>
x86 idle: Repair large-server 50-watt idle-power regression
Suman Anna <[email protected]>
ARM: OMAP2+: hwmod_data: fix missing OMAP_INTC_START in irq data
Catalin Marinas <[email protected]>
arm64: spinlock: retry trylock operation if strex fails on free lock
Will Deacon <[email protected]>
arm64: ptrace: avoid using HW_BREAKPOINT_EMPTY for disabled events
Miao Xie <[email protected]>
ftrace: Initialize the ftrace profiler for each possible cpu
Nicholas Bellinger <[email protected]>
target/file: Update hw_max_sectors based on current block_size
Nicholas Bellinger <[email protected]>
iscsi-target: Fix-up all zero data-length CDBs with R/W_BIT set
Wei Yongjun <[email protected]>
iser-target: fix error return code in isert_create_device_ib_res()
Oleg Nesterov <[email protected]>
selinux: selinux_setprocattr()->ptrace_parent() needs rcu_read_lock()
Chad Hanson <[email protected]>
selinux: fix broken peer recv check
Bjørn Mork <[email protected]>
usb: cdc-wdm: manage_power should always set needs_remote_wakeup
Marc Kleine-Budde <[email protected]>
can: peak_usb: fix mem leak in pcan_usb_pro_init()
Dmitry Kunilov <[email protected]>
usb: serial: zte_ev: move support for ZTE AC2726 from zte_ev back to option
Mika Westerberg <[email protected]>
serial: 8250_dw: add new ACPI IDs
Jonathan Cameron <[email protected]>
iio:adc:ad7887 Fix channel reported endianness from cpu to big endian
Jonathan Cameron <[email protected]>
iio:imu:adis16400 fix pressure channel scan type
David Henningsson <[email protected]>
ALSA: hda - Add enable_msi=0 workaround for four HP machines
JongHo Kim <[email protected]>
ALSA: Add SNDRV_PCM_STATE_PAUSED case in wait_for_avail function
Charles Keepax <[email protected]>
ASoC: wm5110: Correct HPOUT3 DAPM route typo
Charles Keepax <[email protected]>
ASoC: wm_adsp: Add small delay while polling DSP RAM start
Bo Shen <[email protected]>
ASoC: wm8904: fix DSP mode B configuration
Stephen Warren <[email protected]>
ASoC: tegra: fix uninitialized variables in set_fmt
Ian Abbott <[email protected]>
staging: comedi: 8255_pci: fix for newer PCI-DIO48H
Geert Uytterhoeven <[email protected]>
TTY: pmac_zilog, check existence of ports in pmz_console_init()
pingfan liu <[email protected]>
powerpc: kvm: fix rare but potential deadlock scene
Yan, Zheng <[email protected]>
ceph: wake up 'safe' waiters when unregistering request
Yan, Zheng <[email protected]>
ceph: cleanup aborted requests when re-sending requests.
Johan Hovold <[email protected]>
USB: serial: fix race in generic write
-------------
Diffstat:
Documentation/kernel-parameters.txt | 4 + Makefile | 4 +- arch/arm/include/asm/arch_timer.h | 9 -- arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c | 4 +- arch/arm/mach-omap2/omap_hwmod_3xxx_data.c | 6 +- arch/arm64/boot/dts/foundation-v8.dts | 2 + arch/arm64/include/asm/arch_timer.h | 10 -- arch/arm64/include/asm/pgtable.h | 2 +- arch/arm64/include/asm/spinlock.h | 3 +- arch/arm64/include/asm/syscall.h | 6 + arch/arm64/include/asm/thread_info.h | 4 +- arch/arm64/include/asm/virt.h | 13 ++ arch/arm64/kernel/entry.S | 2 +- arch/arm64/kernel/fpsimd.c | 2 + arch/arm64/kernel/ptrace.c | 38 +++-- arch/arm64/kernel/smp.c | 15 +- arch/arm64/mm/flush.c | 30 +--- arch/arm64/mm/mmu.c | 1 - arch/arm64/mm/proc.S | 4 - arch/powerpc/include/asm/exception-64s.h | 2 +- arch/powerpc/kernel/head_64.S | 1 + arch/powerpc/kvm/book3s_64_mmu_hv.c | 6 +- arch/powerpc/kvm/book3s_hv_rm_mmu.c | 4 + arch/sh/lib/Makefile | 2 +- arch/sparc/include/asm/pgtable_64.h | 4 +- arch/x86/include/asm/pgtable.h | 11 +- arch/x86/include/asm/spinlock.h | 4 - arch/x86/kernel/cpu/intel.c | 3 +- arch/x86/kvm/lapic.c | 8 +- drivers/ata/libata-core.c | 7 +- drivers/ata/libata-scsi.c | 21 +++ drivers/block/rbd.c | 158 +++++++++++++-------- drivers/clocksource/arm_arch_timer.c | 23 +-- drivers/clocksource/dw_apb_timer_of.c | 2 +- drivers/cpufreq/intel_pstate.c | 5 + drivers/dma/Kconfig | 1 + drivers/firewire/sbp2.c | 1 - drivers/gpio/gpio-msm-v2.c | 4 +- drivers/gpio/gpio-twl4030.c | 15 +- drivers/gpu/drm/drm_edid.c | 8 ++ drivers/gpu/drm/i915/i915_dma.c | 10 ++ drivers/gpu/drm/i915/i915_gem_context.c | 2 - drivers/gpu/drm/i915/intel_display.c | 7 +- drivers/gpu/drm/radeon/atombios_crtc.c | 4 +- drivers/gpu/drm/radeon/ni.c | 20 ++- drivers/gpu/drm/radeon/radeon_uvd.c | 2 +- drivers/gpu/drm/radeon/rs690.c | 10 ++ drivers/idle/intel_idle.c | 3 + drivers/iio/adc/ad7887.c | 16 ++- drivers/iio/imu/adis16400_core.c | 7 +- drivers/infiniband/ulp/isert/ib_isert.c | 16 ++- drivers/input/input.c | 4 + drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 3 + drivers/net/ethernet/broadcom/tg3.c | 2 +- drivers/net/usb/dm9601.c | 34 +++-- drivers/net/wireless/ath/ath9k/ar9002_mac.c | 52 +++++-- drivers/net/wireless/ath/ath9k/htc_drv_main.c | 25 ++-- drivers/net/wireless/ath/ath9k/main.c | 5 +- drivers/net/wireless/rtlwifi/pci.c | 4 +- drivers/of/address.c | 8 -- drivers/s390/char/tty3270.c | 2 +- drivers/staging/comedi/drivers/8255_pci.c | 15 +- drivers/target/iscsi/iscsi_target.c | 26 ++-- drivers/target/target_core_device.c | 5 + drivers/target/target_core_file.c | 8 +- drivers/target/target_core_file.h | 5 +- drivers/tty/serial/8250/8250_dw.c | 2 + drivers/tty/serial/pmac_zilog.c | 3 + drivers/usb/class/cdc-wdm.c | 8 +- drivers/usb/serial/generic.c | 9 +- drivers/usb/serial/option.c | 2 + drivers/usb/serial/zte_ev.c | 3 +- fs/ceph/addr.c | 8 +- fs/ceph/file.c | 47 +++--- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 15 +- fs/ceph/mdsmap.c | 4 +- fs/ceph/super.c | 2 +- fs/ext4/ext4.h | 10 ++ fs/ext4/ext4_jbd2.c | 9 ++ fs/ext4/extents.c | 43 ++++-- fs/ext4/inode.c | 12 -- fs/ext4/mballoc.c | 21 +-- fs/ext4/super.c | 17 ++- fs/gfs2/aops.c | 30 ++++ fs/gfs2/ops_fstype.c | 12 +- fs/jbd2/transaction.c | 6 +- include/asm-generic/pgtable.h | 2 +- include/clocksource/arm_arch_timer.h | 2 +- include/drm/drm_pciids.h | 2 +- include/linux/auxvec.h | 2 +- include/linux/ceph/osd_client.h | 3 +- include/linux/libata.h | 1 + include/linux/mm_types.h | 49 +++++++ include/linux/spinlock.h | 14 +- include/target/target_core_base.h | 1 + kernel/fork.c | 1 + kernel/freezer.c | 6 + kernel/sched/core.c | 14 +- kernel/sched/fair.c | 7 + kernel/sched/rt.c | 14 ++ kernel/trace/ftrace.c | 2 +- mm/compaction.c | 4 + mm/fremap.c | 8 +- mm/huge_memory.c | 14 ++ mm/memcontrol.c | 2 +- mm/memory-failure.c | 10 ++ mm/mempolicy.c | 2 +- mm/migrate.c | 4 +- mm/mprotect.c | 2 + mm/pgtable-generic.c | 8 +- mm/rmap.c | 4 + net/ceph/osd_client.c | 82 ++++++----- net/wireless/radiotap.c | 4 + security/selinux/hooks.c | 53 +++++-- security/selinux/include/xfrm.h | 9 +- security/selinux/xfrm.c | 53 +++++-- sound/core/pcm_lib.c | 2 + sound/pci/hda/hda_intel.c | 4 + sound/soc/codecs/wm5110.c | 2 +- sound/soc/codecs/wm8904.c | 2 +- sound/soc/codecs/wm_adsp.c | 10 +- sound/soc/tegra/tegra20_i2s.c | 6 +- sound/soc/tegra/tegra20_spdif.c | 10 +- sound/soc/tegra/tegra30_i2s.c | 6 +- tools/power/cpupower/utils/cpupower-set.c | 6 +- 126 files changed, 986 insertions(+), 456 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/129 USB: serial: fix race in generic write
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6f6485463aada1ec6a0f3db6a03eb8e393d6bb55 upstream.
Fix race in generic write implementation, which could lead to temporarily degraded throughput.
The current generic write implementation introduced by commit 27c7acf22047 ("USB: serial: reimplement generic fifo-based writes") has always had this bug, although it's fairly hard to trigger and the consequences are not likely to be noticed.
Specifically, a write() on one CPU while the completion handler is running on another could result in only one of the two write urbs being utilised to empty the remainder of the write fifo (unless there is a second write() that doesn't race during that time).
--- drivers/usb/serial/generic.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/usb/serial/generic.c +1 -8
@@ -176,14 +176,7 @@ retry:return result; } -/* Try sending off another urb, unless in irq context (in which case -* there will be no free urb). */ -if (!in_irq ()) - goto retry; - -clear_bit_unlock (USB_SERIAL_WRITE_BUSY , &port->flags); - -return 0 ; + goto retry;/* try sending off another urb */ }/**
Greg Kroah-Hartman
maintainerPATCH 2/129 ceph: cleanup aborted requests when re-sending requests.
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Yan, Zheng" <[email protected]>
commit eb1b8af33c2e42a9a57fc0a7588f4a7b255d2e79 upstream.
Aborted requests usually get cleared when the reply is received. If MDS crashes, no reply will be received. So we need to cleanup aborted requests when re-sending requests.
--- fs/ceph/mds_client.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/ceph/mds_client.c +4 -1
@@ -1840,8 +1840,11 @@ static int __do_request(struct ceph_mds_int mds =-1 ;int err = -EAGAIN ; -if (req->r_err || req->r_got_result) +if (req->r_err || req->r_got_result) { +if (req->r_aborted) +__unregister_request (mdsc, req); goto out; + }if (req->r_timeout &&time_after_eq (jiffies, req->r_started + req->r_timeout)) {
Greg Kroah-Hartman
maintainerPATCH 3/129 ceph: wake up safe waiters when unregistering request
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Yan, Zheng" <[email protected]>
commit fc55d2c9448b34218ca58733a6f51fbede09575b upstream.
We also need to wake up 'safe' waiters if error occurs or request aborted. Otherwise sync(2)/fsync(2) may hang forever.
--- fs/ceph/mds_client.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ceph/mds_client.c +2 -1
@@ -639,6 +639,8 @@ static void __unregister_request(struct req->r_unsafe_dir =NULL ; } +complete_all (&req->r_safe_completion); +ceph_mdsc_put_request (req); }
@@ -2154,7 +2156,6 @@ static void handle_reply(struct ceph_mdsif (head->safe) { req->r_got_safe = true;__unregister_request (mdsc, req); -complete_all (&req->r_safe_completion);if (req->r_got_unsafe) {/*
Greg Kroah-Hartman
maintainerPATCH 4/129 powerpc: kvm: fix rare but potential deadlock scene
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: pingfan liu <[email protected]>
commit 91648ec09c1ef69c4d840ab6dab391bfb452d554 upstream.
Since kvmppc_hv_find_lock_hpte() is called from both virtmode and realmode, so it can trigger the deadlock.
Suppose the following scene:
Two physical cpuM, cpuN, two VM instances A, B, each VM has a group of vcpus.
If on cpuM, vcpu_A_1 holds bitlock X (HPTE_V_HVLOCK), then is switched out, and on cpuN, vcpu_A_2 try to lock X in realmode, then cpuN will be caught in realmode for a long time.
What makes things even worse if the following happens,
On cpuM, bitlockX is hold, on cpuN, Y is hold. vcpu_B_2 try to lock Y on cpuM in realmode vcpu_A_2 try to lock X on cpuN in realmode
Oops! deadlock happens
--- arch/powerpc/kvm/book3s_64_mmu_hv.c | 6 +++++- arch/powerpc/kvm/book3s_hv_rm_mmu.c | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-)
arch/powerpc/kvm/book3s_64_mmu_hv.c +5 -1
@@ -473,11 +473,14 @@ static int kvmppc_mmu_book3s_64_hv_xlate slb_v = vcpu->kvm->arch.vrma_slb_v; } +preempt_disable ();/* Find the HPTE in the hash table */ index =kvmppc_hv_find_lock_hpte (kvm, eaddr, slb_v,HPTE_V_VALID |HPTE_V_ABSENT ); -if (index <0 ) +if (index <0 ) { +preempt_enable ();return -ENOENT ; + } hptep = (unsigned long *)(kvm->arch.hpt_virt + (index <<4 )); v = hptep[0 ] & ~HPTE_V_HVLOCK ; gr = kvm->arch.revmap[index].guest_rpte;
@@ -485,6 +488,7 @@ static int kvmppc_mmu_book3s_64_hv_xlate/* Unlock the HPTE */ asmvolatile ("lwsync" : : :"memory" ); hptep[0 ] = v; +preempt_enable (); gpte->eaddr = eaddr; gpte->vpage = ((v &HPTE_V_AVPN ) <<4 ) | ((eaddr >>12 ) &0xfff );
arch/powerpc/kvm/book3s_hv_rm_mmu.c +4 -0
@@ -724,6 +724,10 @@ static int slb_base_page_shift[4] = { 20, /* 1M, unsupported */ }; +/* When called from virtmode, this func should be protected by +* preempt_disable(), otherwise, the holding of HPTE_V_HVLOCK +* can trigger deadlock issue. +*/ long kvmppc_hv_find_lock_hpte (struct kvm *kvm,gva_t eaddr,unsigned long slb_v,unsigned long valid) {
Greg Kroah-Hartman
maintainerPATCH 5/129 TTY: pmac_zilog, check existence of ports in pmz_console_init()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
commit dc1dc2f8a5dd863bf2e79f338fc3ae29e99c683a upstream.
When booting a multi-platform m68k kernel on a non-Mac with "console=ttyS0" on the kernel command line, it crashes with:
Unable to handle kernel NULL pointer dereference at virtual address (null) Oops: 00000000 PC: [<0013ad28>] __pmz_startup+0x32/0x2a0 ... Call Trace: [<002c5d3e>] pmz_console_setup+0x64/0xe4
The normal tty driver doesn't crash, because init_pmz() checks pmz_ports_count again after calling pmz_probe().
In the serial console initialization path, pmz_console_init() doesn't do this, causing the driver to crash later.
Add a check for pmz_ports_count to fix this.
--- drivers/tty/serial/pmac_zilog.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/tty/serial/pmac_zilog.c +3 -0
@@ -2051,6 +2051,9 @@ static int __init pmz_console_init(void)/* Probe ports */ pmz_probe (); +if (pmz_ports_count ==0 ) +return -ENODEV ; +/* TODO: Autoprobe console based on OF */ /* pmz_console.index = i; */ register_console (&pmz_console);
Greg Kroah-Hartman
maintainerPATCH 6/129 staging: comedi: 8255_pci: fix for newer PCI-DIO48H
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 0283f7a100882684ad32b768f9f1ad81658a0b92 upstream.
At some point, Measurement Computing / ComputerBoards redesigned the PCI-DIO48H to use a PLX PCI interface chip instead of an AMCC chip. This meant they had to put their hardware registers in the PCI BAR 2 region instead of PCI BAR 1. Unfortunately, they kept the same PCI device ID for the new design. This means the driver recognizes the newer cards, but doesn't work (and is likely to screw up the local configuration registers of the PLX chip) because it's using the wrong region.
Since the PCI subvendor and subdevice IDs were both zero on the old design, but are the same as the vendor and device on the new design, we can tell the old design and new design apart easily enough. Split the existing entry for the PCI-DIO48H in pci_8255_boards[] into two new entries, referenced by different entries in the PCI device ID table pci_8255_pci_table[]. Use the same board name for both entries.
--- drivers/staging/comedi/drivers/8255_pci.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/staging/comedi/drivers/8255_pci.c +12 -3
@@ -66,7 +66,8 @@ enum pci_8255_boardid {BOARD_ADLINK_PCI7296 ,BOARD_CB_PCIDIO24 ,BOARD_CB_PCIDIO24H , -BOARD_CB_PCIDIO48H , +BOARD_CB_PCIDIO48H_OLD , +BOARD_CB_PCIDIO48H_NEW ,BOARD_CB_PCIDIO96H ,BOARD_NI_PCIDIO96 , BOARD_NI_PCIDIO96B,
@@ -109,11 +110,16 @@ static const struct pci_8255_boardinfo p .dio_badr = 2, .n_8255 = 1, }, - [BOARD_CB_PCIDIO48H] = { + [BOARD_CB_PCIDIO48H_OLD] = { .name = "cb_pci-dio48h", .dio_badr = 1, .n_8255 = 2, }, + [BOARD_CB_PCIDIO48H_NEW] = { + .name = "cb_pci-dio48h", + .dio_badr = 2, + .n_8255 = 2, + }, [BOARD_CB_PCIDIO96H] = { .name = "cb_pci-dio96h", .dio_badr = 2,
@@ -270,7 +276,10 @@ static DEFINE_PCI_DEVICE_TABLE(pci_8255_ { PCI_VDEVICE(ADLINK, 0x7296), BOARD_ADLINK_PCI7296 }, { PCI_VDEVICE(CB, 0x0028), BOARD_CB_PCIDIO24 }, { PCI_VDEVICE(CB, 0x0014), BOARD_CB_PCIDIO24H }, - { PCI_VDEVICE(CB, 0x000b), BOARD_CB_PCIDIO48H }, + { PCI_DEVICE_SUB(PCI_VENDOR_ID_CB, 0x000b, 0x0000, 0x0000), + .driver_data = BOARD_CB_PCIDIO48H_OLD }, + { PCI_DEVICE_SUB(PCI_VENDOR_ID_CB, 0x000b, PCI_VENDOR_ID_CB, 0x000b), + .driver_data = BOARD_CB_PCIDIO48H_NEW }, { PCI_VDEVICE(CB, 0x0017), BOARD_CB_PCIDIO96H }, { PCI_VDEVICE(NI, 0x0160), BOARD_NI_PCIDIO96 }, { PCI_VDEVICE(NI, 0x1630), BOARD_NI_PCIDIO96B },
Greg Kroah-Hartman
maintainerPATCH 7/129 ASoC: tegra: fix uninitialized variables in set_fmt
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Warren <[email protected]>
commit 241bf43321a10815225f477bba96a42285a2da73 upstream.
In tegra*_i2s_set_fmt(), in the (fmt == SND_SOC_DAIFMT_CBM_CFM) case, "val" is never assigned to, but left uninitialized. The other case does initialized it. Fix this by initializing val at the start of the function, and only ever ORing into it.
Update the handling of "mask" so it works the same way for consistency.
Update tegra20_spdif.c to use the same code-style for consistency, even though it doesn't happen to suffer from the same problem at present.
--- sound/soc/tegra/tegra20_i2s.c | 6 +++--- sound/soc/tegra/tegra20_spdif.c | 10 +++++----- sound/soc/tegra/tegra30_i2s.c | 6 +++--- 3 files changed, 11 insertions(+), 11 deletions(-)
sound/soc/tegra/tegra20_i2s.c +3 -3
@@ -74,7 +74,7 @@ static int tegra20_i2s_set_fmt(struct sn unsigned int fmt) {struct tegra20_i2s *i2s =snd_soc_dai_get_drvdata (dai); -unsigned int mask, val; +unsigned int mask =0 , val =0 ;switch (fmt &SND_SOC_DAIFMT_INV_MASK ) {case SND_SOC_DAIFMT_NB_NF :
@@ -83,10 +83,10 @@ static int tegra20_i2s_set_fmt(struct snreturn -EINVAL ; } - mask =TEGRA20_I2S_CTRL_MASTER_ENABLE ; + mask |=TEGRA20_I2S_CTRL_MASTER_ENABLE ;switch (fmt &SND_SOC_DAIFMT_MASTER_MASK ) {case SND_SOC_DAIFMT_CBS_CFS : - val =TEGRA20_I2S_CTRL_MASTER_ENABLE ; + val |=TEGRA20_I2S_CTRL_MASTER_ENABLE ;break ;case SND_SOC_DAIFMT_CBM_CFM :break ;
sound/soc/tegra/tegra20_spdif.c +5 -5
@@ -67,15 +67,15 @@ static int tegra20_spdif_hw_params(struc {struct device *dev = dai->dev;struct tegra20_spdif *spdif =snd_soc_dai_get_drvdata (dai); -unsigned int mask, val; +unsigned int mask =0 , val =0 ;int ret, spdifclock; - mask =TEGRA20_SPDIF_CTRL_PACK | -TEGRA20_SPDIF_CTRL_BIT_MODE_MASK ; + mask |=TEGRA20_SPDIF_CTRL_PACK | +TEGRA20_SPDIF_CTRL_BIT_MODE_MASK ;switch (params_format (params)) {case SNDRV_PCM_FORMAT_S16_LE : - val =TEGRA20_SPDIF_CTRL_PACK | -TEGRA20_SPDIF_CTRL_BIT_MODE_16BIT ; + val |=TEGRA20_SPDIF_CTRL_PACK | +TEGRA20_SPDIF_CTRL_BIT_MODE_16BIT ;break ;default :return -EINVAL ;
sound/soc/tegra/tegra30_i2s.c +3 -3
@@ -117,7 +117,7 @@ static int tegra30_i2s_set_fmt(struct sn unsigned int fmt) {struct tegra30_i2s *i2s =snd_soc_dai_get_drvdata (dai); -unsigned int mask, val; +unsigned int mask =0 , val =0 ;switch (fmt &SND_SOC_DAIFMT_INV_MASK ) {case SND_SOC_DAIFMT_NB_NF :
@@ -126,10 +126,10 @@ static int tegra30_i2s_set_fmt(struct snreturn -EINVAL ; } - mask =TEGRA30_I2S_CTRL_MASTER_ENABLE ; + mask |=TEGRA30_I2S_CTRL_MASTER_ENABLE ;switch (fmt &SND_SOC_DAIFMT_MASTER_MASK ) {case SND_SOC_DAIFMT_CBS_CFS : - val =TEGRA30_I2S_CTRL_MASTER_ENABLE ; + val |=TEGRA30_I2S_CTRL_MASTER_ENABLE ;break ;case SND_SOC_DAIFMT_CBM_CFM :break ;
Greg Kroah-Hartman
maintainerPATCH 8/129 ASoC: wm8904: fix DSP mode B configuration
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bo Shen <[email protected]>
commit f0199bc5e3a3ec13f9bc938556517ec430b36437 upstream.
When wm8904 work in DSP mode B, we still need to configure it to work in DSP mode. Or else, it will work in Right Justified mode.
--- sound/soc/codecs/wm8904.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wm8904.c +1 -1
@@ -1449,7 +1449,7 @@ static int wm8904_set_fmt(struct snd_socswitch (fmt &SND_SOC_DAIFMT_FORMAT_MASK ) {case SND_SOC_DAIFMT_DSP_B : - aif1 |=WM8904_AIF_LRCLK_INV ; + aif1 |=0x3 |WM8904_AIF_LRCLK_INV ;case SND_SOC_DAIFMT_DSP_A : aif1 |=0x3 ;break ;
Greg Kroah-Hartman
maintainerPATCH 9/129 ASoC: wm_adsp: Add small delay while polling DSP RAM start
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
commit 939fd1e8d9deff206f12bd9d4e54aa7a4bd0ffd6 upstream.
Some devices are getting very close to the limit whilst polling the RAM start, this patch adds a small delay to this loop to give a longer startup timeout.
--- sound/soc/codecs/wm_adsp.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
sound/soc/codecs/wm_adsp.c +7 -3
@@ -1073,13 +1073,17 @@ static int wm_adsp2_ena(struct wm_adsp *return ret;/* Wait for the RAM to start, should be near instantaneous */ - count =0 ; -do { +for (count =0 ; count <10 ; ++count) { ret =regmap_read (dsp->regmap, dsp->base +ADSP2_STATUS1 , &val);if (ret !=0 )return ret; - }while (!(val &ADSP2_RAM_RDY ) && ++count <10 ); + +if (val &ADSP2_RAM_RDY ) +break ; + +msleep (1 ); + }if (!(val &ADSP2_RAM_RDY )) {adsp_err (dsp,"Failed to start DSP RAM\n" );
Greg Kroah-Hartman
maintainerPATCH 10/129 ASoC: wm5110: Correct HPOUT3 DAPM route typo
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
commit 280484e708a3cc38fe6807718caa460e744c0b20 upstream.
--- sound/soc/codecs/wm5110.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wm5110.c +1 -1
@@ -897,7 +897,7 @@ static const struct snd_soc_dapm_route w { "HPOUT2R", NULL, "OUT2R" }, { "HPOUT3L", NULL, "OUT3L" }, - { "HPOUT3R", NULL, "OUT3L" }, + { "HPOUT3R", NULL, "OUT3R" }, { "SPKOUTLN", NULL, "OUT4L" }, { "SPKOUTLP", NULL, "OUT4L" },
Greg Kroah-Hartman
maintainerPATCH 11/129 ALSA: Add SNDRV_PCM_STATE_PAUSED case in wait_for_avail function
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: JongHo Kim <[email protected]>
commit ed697e1aaf7237b1a62af39f64463b05c262808d upstream.
When the process is sleeping at the SNDRV_PCM_STATE_PAUSED state from the wait_for_avail function, the sleep process will be woken by timeout(10 seconds). Even if the sleep process wake up by timeout, by this patch, the process will continue with sleep and wait for the other state.
--- sound/core/pcm_lib.c | 2 ++ 1 file changed, 2 insertions(+)
sound/core/pcm_lib.c +2 -0
@@ -1936,6 +1936,8 @@ static int wait_for_avail(struct snd_pcmcase SNDRV_PCM_STATE_DISCONNECTED : err = -EBADFD ; goto _endloop; +case SNDRV_PCM_STATE_PAUSED : +continue ; }if (!tout) { snd_printd("%s write error (DMA or IRQ trouble?)\n",
Greg Kroah-Hartman
maintainerPATCH 12/129 ALSA: hda - Add enable_msi=0 workaround for four HP machines
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Henningsson <[email protected]>
commit 693e0cb052c607e2d41edf9e9f1fa99ff8c266c1 upstream.
While enabling these machines, we found we would sometimes lose an interrupt if we change hardware volume during playback, and that disabling msi fixed this issue. (Losing the interrupt caused underruns and crackling audio, as the one second timeout is usually bigger than the period size.)
The machines were all machines from HP, running AMD Hudson controller, and Realtek ALC282 codec.
--- sound/pci/hda/hda_intel.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/pci/hda/hda_intel.c +4 -0
@@ -3332,6 +3332,10 @@ static void check_probe_mask(struct azx* white/black-list for enable_msi */ static struct snd_pci_quirk msi_black_list[] = { +SND_PCI_QUIRK (0x103c ,0x2191 ,"HP" ,0 ),/* AMD Hudson */ +SND_PCI_QUIRK (0x103c ,0x2192 ,"HP" ,0 ),/* AMD Hudson */ +SND_PCI_QUIRK (0x103c ,0x21f7 ,"HP" ,0 ),/* AMD Hudson */ +SND_PCI_QUIRK (0x103c ,0x21fa ,"HP" ,0 ),/* AMD Hudson */ SND_PCI_QUIRK (0x1043 ,0x81f2 ,"ASUS" ,0 ),/* Athlon64 X2 + nvidia */ SND_PCI_QUIRK (0x1043 ,0x81f6 ,"ASUS" ,0 ),/* nvidia */ SND_PCI_QUIRK (0x1043 ,0x822d ,"ASUS" ,0 ),/* Athlon64 X2 + nvidia MCP55 */
Greg Kroah-Hartman
maintainerPATCH 13/129 iio:imu:adis16400 fix pressure channel scan type
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
commit 3425c0f7ac61f2fcfb7f2728e9b7ba7e27aec429 upstream.
A single channel in this driver was using the IIO_ST macro. This does not provide a parameter for setting the endianness of the channel. Thus this channel will have been reported as whatever is the native endianness of the cpu rather than big endian. This means it would be incorrect on little endian platforms.
--- drivers/iio/imu/adis16400_core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/iio/imu/adis16400_core.c +6 -1
@@ -651,7 +651,12 @@ static const struct iio_chan_spec adis16 .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = ADIS16448_BARO_OUT, .scan_index = ADIS16400_SCAN_BARO, - .scan_type =IIO_ST ('s' ,16 ,16 ,0 ), + .scan_type = { + .sign = 's', + .realbits = 16, + .storagebits = 16, + .endianness =IIO_BE , + }, },ADIS16400_TEMP_CHAN (ADIS16448_TEMP_OUT ,12 ),IIO_CHAN_SOFT_TIMESTAMP (11 )
Greg Kroah-Hartman
maintainerPATCH 14/129 iio:adc:ad7887 Fix channel reported endianness from cpu to big endian
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cameron <[email protected]>
commit e39d99059ad7f75d7ae2d3c59055d3c476cdb0d9 upstream.
Note this also sets the endianness to big endian whereas it would previously have defaulted to the cpu endian. Hence technically this is a bug fix on LE platforms.
--- drivers/iio/adc/ad7887.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/iio/adc/ad7887.c +14 -2
@@ -211,7 +211,13 @@ static const struct ad7887_chip_info ad7 .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = 1, .scan_index = 1, - .scan_type = IIO_ST('u', 12, 16, 0), + .scan_type = { + .sign = 'u', + .realbits = 12, + .storagebits = 16, + .shift = 0, + .endianness =IIO_BE , + }, }, .channel[1] = { .type = IIO_VOLTAGE,
@@ -221,7 +227,13 @@ static const struct ad7887_chip_info ad7 .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), .address = 0, .scan_index = 0, - .scan_type = IIO_ST('u', 12, 16, 0), + .scan_type = { + .sign = 'u', + .realbits = 12, + .storagebits = 16, + .shift = 0, + .endianness =IIO_BE , + }, }, .channel[2] = IIO_CHAN_SOFT_TIMESTAMP(2), .int_vref_mv = 2500,
Greg Kroah-Hartman
maintainerPATCH 15/129 serial: 8250_dw: add new ACPI IDs
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
commit d24c195f90cb1adb178d26d84c722d4b9e551e05 upstream.
Newer Intel PCHs with LPSS have the same Designware controllers than Haswell but ACPI IDs are different. Add these IDs to the driver list.
--- drivers/tty/serial/8250/8250_dw.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/serial/8250/8250_dw.c +2 -0
@@ -369,6 +369,8 @@ MODULE_DEVICE_TABLE(of, dw8250_of_match)static const struct acpi_device_id dw8250_acpi_match[] = { {"INT33C4" ,0 }, {"INT33C5" ,0 }, + {"INT3434" ,0 }, + {"INT3435" ,0 }, {"80860F0A" ,0 }, { }, };
Greg Kroah-Hartman
maintainerPATCH 16/129 usb: serial: zte_ev: move support for ZTE AC2726 from zte_ev back to option
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kunilov <[email protected]>
commit 52d0dc7597c89b2ab779f3dcb9b9bf0800dd9218 upstream.
ZTE AC2726 EVDO modem drops ppp connection every minute when driven by zte_ev but works fine when driven by option. Move the support for AC2726 back to option driver.
--- drivers/usb/serial/option.c | 2 ++ drivers/usb/serial/zte_ev.c | 3 +-- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/usb/serial/option.c +2 -0
@@ -251,6 +251,7 @@ static void option_instat_callback(struc#define ZTE_PRODUCT_MF628 0x0015#define ZTE_PRODUCT_MF626 0x0031#define ZTE_PRODUCT_MC2718 0xffe8 +#define ZTE_PRODUCT_AC2726 0xfff1#define BENQ_VENDOR_ID 0x04a5#define BENQ_PRODUCT_H10 0x4068
@@ -1453,6 +1454,7 @@ static const struct usb_device_id option { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) }, { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
drivers/usb/serial/zte_ev.c +1 -2
@@ -281,8 +281,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x19d2, 0xfffd) }, { USB_DEVICE(0x19d2, 0xfffc) }, { USB_DEVICE(0x19d2, 0xfffb) }, -/* AC2726, AC8710_V3 */ - { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xfff1, 0xff, 0xff, 0xff) }, +/* AC8710_V3 */ { USB_DEVICE(0x19d2, 0xfff6) }, { USB_DEVICE(0x19d2, 0xfff7) }, { USB_DEVICE(0x19d2, 0xfff8) },
Greg Kroah-Hartman
maintainerPATCH 17/129 can: peak_usb: fix mem leak in pcan_usb_pro_init()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 20fb4eb96fb0350d28fc4d7cbfd5506711079592 upstream.
This patch fixes a memory leak in pcan_usb_pro_init(). In patch
f14e224 net: can: peak_usb: Do not do dma on the stack
the struct pcan_usb_pro_fwinfo *fi and struct pcan_usb_pro_blinfo *bi were converted from stack to dynamic allocation va kmalloc(). However the corresponding kfree() was not introduced.
This patch adds the missing kfree().
--- drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/can/usb/peak_usb/pcan_usb_pro.c +3 -0
@@ -927,6 +927,9 @@ static int pcan_usb_pro_init(struct peak/* set LED in default state (end of init phase) */ pcan_usb_pro_set_led (dev,0 ,1 ); +kfree (bi); +kfree (fi); +return 0 ; err_out:
Greg Kroah-Hartman
maintainerPATCH 19/129 selinux: fix broken peer recv check
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chad Hanson <[email protected]>
commit 46d01d63221c3508421dd72ff9c879f61053cffc upstream.
Fix a broken networking check. Return an error if peer recv fails. If secmark is active and the packet recv succeeds the peer recv error is ignored.
--- security/selinux/hooks.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
security/selinux/hooks.c +3 -1
@@ -4228,8 +4228,10 @@ static int selinux_socket_sock_rcv_skb(s } err =avc_has_perm (sk_sid, peer_sid,SECCLASS_PEER ,PEER__RECV , &ad); -if (err) +if (err) {selinux_netlbl_err (skb, err,0 ); +return err; + } }if (secmark_active) {
Greg Kroah-Hartman
maintainerPATCH 20/129 selinux: selinux_setprocattr()->ptrace_parent() needs rcu_read_lock()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit c0c1439541f5305b57a83d599af32b74182933fe upstream.
selinux_setprocattr() does ptrace_parent(p) under task_lock(p), but task_struct->alloc_lock doesn't pin ->parent or ->ptrace, this looks confusing and triggers the "suspicious RCU usage" warning because ptrace_parent() does rcu_dereference_check().
And in theory this is wrong, spin_lock()->preempt_disable() doesn't necessarily imply rcu_read_lock() we need to access the ->parent.
--- security/selinux/hooks.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
security/selinux/hooks.c +2 -2
@@ -5454,11 +5454,11 @@ static int selinux_setprocattr(struct ta/* Check for ptracing, and update the task SID if ok. Otherwise, leave SID unchanged and fail. */ ptsid =0 ; -task_lock (p); +rcu_read_lock (); tracer =ptrace_parent (p);if (tracer) ptsid =task_sid (tracer); -task_unlock (p); +rcu_read_unlock ();if (tracer) { error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
Greg Kroah-Hartman
maintainerPATCH 21/129 iser-target: fix error return code in isert_create_device_ib_res()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yongjun <[email protected]>
commit 94a7111043d99819cd0a72d9b3174c7054adb2a0 upstream.
Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/infiniband/ulp/isert/ib_isert.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/infiniband/ulp/isert/ib_isert.c +12 -4
@@ -242,21 +242,29 @@ isert_create_device_ib_res(struct isert_ isert_cq_event_callback, (void *)&cq_desc[i], ISER_MAX_RX_CQ_LEN, i); -if (IS_ERR (device->dev_rx_cq[i])) +if (IS_ERR (device->dev_rx_cq[i])) { + ret =PTR_ERR (device->dev_rx_cq[i]); + device->dev_rx_cq[i] =NULL ; goto out_cq; + } device->dev_tx_cq[i] =ib_create_cq (device->ib_device, isert_cq_tx_callback, isert_cq_event_callback, (void *)&cq_desc[i],ISER_MAX_TX_CQ_LEN , i); -if (IS_ERR (device->dev_tx_cq[i])) +if (IS_ERR (device->dev_tx_cq[i])) { + ret =PTR_ERR (device->dev_tx_cq[i]); + device->dev_tx_cq[i] =NULL ; goto out_cq; + } -if (ib_req_notify_cq (device->dev_rx_cq[i],IB_CQ_NEXT_COMP )) + ret =ib_req_notify_cq (device->dev_rx_cq[i],IB_CQ_NEXT_COMP ); +if (ret) goto out_cq; -if (ib_req_notify_cq (device->dev_tx_cq[i],IB_CQ_NEXT_COMP )) + ret =ib_req_notify_cq (device->dev_tx_cq[i],IB_CQ_NEXT_COMP ); +if (ret) goto out_cq; }
Greg Kroah-Hartman
maintainerPATCH 22/129 iscsi-target: Fix-up all zero data-length CDBs with R/W_BIT set
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 4454b66cb67f14c33cd70ddcf0ff4985b26324b7 upstream.
This patch changes special case handling for ISCSI_OP_SCSI_CMD where an initiator sends a zero length Expected Data Transfer Length (EDTL), but still sets the WRITE and/or READ flag bits when no payload transfer is requested.
Many, many moons ago two special cases where added for an ancient version of ESX that has long since been fixed, so instead of adding a new special case for the reported bug with a Broadcom 57800 NIC, go ahead and always strip off the incorrect WRITE + READ flag bits.
Also, avoid sending a reject here, as RFC-3720 does mandate this case be handled without protocol error.
--- drivers/target/iscsi/iscsi_target.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-)
drivers/target/iscsi/iscsi_target.c +12 -14
@@ -838,24 +838,22 @@ int iscsit_setup_scsi_cmd(struct iscsi_cif (((hdr->flags &ISCSI_FLAG_CMD_READ ) || (hdr->flags &ISCSI_FLAG_CMD_WRITE )) && !hdr->data_length) {/* -* Vmware ESX v3.0 uses a modified Cisco Initiator (v3.4.2) -* that adds support for RESERVE/RELEASE. There is a bug -* add with this new functionality that sets R/W bits when -* neither CDB carries any READ or WRITE datapayloads. +* From RFC-3720 Section 10.3.1: +* +* "Either or both of R and W MAY be 1 when either the +* Expected Data Transfer Length and/or Bidirectional Read +* Expected Data Transfer Length are 0" +* +* For this case, go ahead and clear the unnecssary bits +* to avoid any confusion with ->data_direction. */ -if ((hdr->cdb[0 ] ==0x16 ) || (hdr->cdb[0 ] ==0x17 )) { - hdr->flags &= ~ISCSI_FLAG_CMD_READ ; - hdr->flags &= ~ISCSI_FLAG_CMD_WRITE ; - goto done; - } + hdr->flags &= ~ISCSI_FLAG_CMD_READ ; + hdr->flags &= ~ISCSI_FLAG_CMD_WRITE ; -pr_err ("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE" +pr_warn ("ISCSI_FLAG_CMD_READ or ISCSI_FLAG_CMD_WRITE" " set when Expected Data Transfer Length is 0 for" -" CDB: 0x%02x. Bad iSCSI Initiator.\n" , hdr->cdb[0 ]); -return iscsit_add_reject_cmd (cmd, -ISCSI_REASON_BOOKMARK_INVALID , buf); +" CDB: 0x%02x, Fixing up flags\n" , hdr->cdb[0 ]); } -done:if (!(hdr->flags &ISCSI_FLAG_CMD_READ ) && !(hdr->flags &ISCSI_FLAG_CMD_WRITE ) && (hdr->data_length !=0 )) {
Greg Kroah-Hartman
maintainerPATCH 23/129 target/file: Update hw_max_sectors based on current block_size
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 95cadace8f3959282e76ebf8b382bd0930807d2c upstream.
This patch allows FILEIO to update hw_max_sectors based on the current max_bytes_per_io. This is required because vfs_[writev,readv]() can accept a maximum of 2048 iovecs per call, so the enforced hw_max_sectors really needs to be calculated based on block_size.
This addresses a >= v3.5 bug where block_size=512 was rejecting > 1M sized I/O requests, because FD_MAX_SECTORS was hardcoded to 2048 for the block_size=4096 case.
(v2: Use max_bytes_per_io instead of ->update_hw_max_sectors)
--- drivers/target/target_core_device.c | 5 +++++ drivers/target/target_core_file.c | 8 ++++---- drivers/target/target_core_file.h | 5 ++++- include/target/target_core_base.h | 1 + 4 files changed, 14 insertions(+), 5 deletions(-)
drivers/target/target_core_device.c +5 -0
@@ -1078,6 +1078,11 @@ int se_dev_set_block_size(struct se_devi dev->dev_attrib.block_size = block_size;pr_debug ("dev[%p]: SE Device block_size changed to %u\n" , dev, block_size); + +if (dev->dev_attrib.max_bytes_per_io) + dev->dev_attrib.hw_max_sectors = + dev->dev_attrib.max_bytes_per_io / block_size; +return 0 ; }
drivers/target/target_core_file.c +4 -4
@@ -66,9 +66,8 @@ static int fd_attach_hba(struct se_hba *pr_debug ("CORE_HBA[%d] - TCM FILEIO HBA Driver %s on Generic" " Target Core Stack %s\n" , hba->hba_id,FD_VERSION ,TARGET_CORE_MOD_VERSION ); -pr_debug ("CORE_HBA[%d] - Attached FILEIO HBA: %u to Generic" -" MaxSectors: %u\n" , - hba->hba_id, fd_host->fd_host_id,FD_MAX_SECTORS ); +pr_debug ("CORE_HBA[%d] - Attached FILEIO HBA: %u to Generic\n" , + hba->hba_id, fd_host->fd_host_id);return 0 ; }
@@ -220,7 +219,8 @@ static int fd_configure_device(struct se } dev->dev_attrib.hw_block_size = fd_dev->fd_block_size; - dev->dev_attrib.hw_max_sectors =FD_MAX_SECTORS ; + dev->dev_attrib.max_bytes_per_io =FD_MAX_BYTES ; + dev->dev_attrib.hw_max_sectors =FD_MAX_BYTES / fd_dev->fd_block_size; dev->dev_attrib.hw_queue_depth =FD_MAX_DEVICE_QUEUE_DEPTH ;if (fd_dev->fbd_flags &FDBD_HAS_BUFFERED_IO_WCE ) {
drivers/target/target_core_file.h +4 -1
@@ -7,7 +7,10 @@#define FD_DEVICE_QUEUE_DEPTH 32#define FD_MAX_DEVICE_QUEUE_DEPTH 128#define FD_BLOCKSIZE 512 -#define FD_MAX_SECTORS 2048 +/* +* Limited by the number of iovecs (2048) per vfs_[writev,readv] call +*/ +#define FD_MAX_BYTES 8388608#define RRF_EMULATE_CDB 0x01#define RRF_GOT_LBA 0x02
include/target/target_core_base.h +1 -0
@@ -614,6 +614,7 @@ struct se_dev_attrib {u32 unmap_granularity;u32 unmap_granularity_alignment;u32 max_write_same_len; +u32 max_bytes_per_io;struct se_device *da_dev;struct config_group da_group; };
Greg Kroah-Hartman
maintainerPATCH 24/129 ftrace: Initialize the ftrace profiler for each possible cpu
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miao Xie <[email protected]>
commit c4602c1c818bd6626178d6d3fcc152d9f2f48ac0 upstream.
Ftrace currently initializes only the online CPUs. This implementation has two problems:
- If we online a CPU after we enable the function profile, and then run the test, we will lose the trace information on that CPU.
Steps to reproduce:
# echo 0 > /sys/devices/system/cpu/cpu1/online # cd <debugfs>/tracing/ # echo <some function name> >> set_ftrace_filter # echo 1 > function_profile_enabled # echo 1 > /sys/devices/system/cpu/cpu1/online # run test - If we offline a CPU before we enable the function profile, we will not clear the trace information when we enable the function profile. It will trouble the users. Steps to reproduce: # cd <debugfs>/tracing/ # echo <some function name> >> set_ftrace_filter # echo 1 > function_profile_enabled # run test # cat trace_stat/function* # echo 0 > /sys/devices/system/cpu/cpu1/online # echo 0 > function_profile_enabled # echo 1 > function_profile_enabled # cat trace_stat/function* # run test # cat trace_stat/function*
So it is better that we initialize the ftrace profiler for each possible cpu every time we enable the function profile instead of just the online ones.
--- kernel/trace/ftrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/ftrace.c +1 -1
@@ -750,7 +750,7 @@ static int ftrace_profile_init(void)int cpu;int ret =0 ; -for_each_online_cpu (cpu) { +for_each_possible_cpu (cpu) { ret =ftrace_profile_init_cpu (cpu);if (ret)break ;
Greg Kroah-Hartman
maintainerPATCH 25/129 arm64: ptrace: avoid using HW_BREAKPOINT_EMPTY for disabled events
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <[email protected]>
commit cdc27c27843248ae7eb0df5fc261dd004eaa5670 upstream.
Commit 8f34a1da35ae ("arm64: ptrace: use HW_BREAKPOINT_EMPTY type for disabled breakpoints") fixed an issue with GDB trying to zero breakpoint control registers. The problem there is that the arch hw_breakpoint code will attempt to create a (disabled), execute breakpoint of length 0.
This will fail validation and report unexpected failure to GDB. To avoid this, we treated disabled breakpoints as HW_BREAKPOINT_EMPTY, but that seems to have broken with recent kernels, causing watchpoints to be treated as TYPE_INST in the core code and returning ENOSPC for any further breakpoints.
This patch fixes the problem by prioritising the `enable' field of the
breakpoint: if it is cleared, we simply update the perf_event_attr to indicate that the thing is disabled and don't bother changing either the type or the length. This reinforces the behaviour that the breakpoint control register is essentially read-only apart from the enable bit when disabling a breakpoint.
--- arch/arm64/kernel/ptrace.c | 36 +++++++++++++++++------------------- 1 file changed, 17 insertions(+), 19 deletions(-)
arch/arm64/kernel/ptrace.c +17 -19
@@ -236,31 +236,29 @@ static int ptrace_hbp_fill_attr_ctrl(uns {int err, len, type, disabled = !ctrl.enabled; -if (disabled) { - len =0 ; - type =HW_BREAKPOINT_EMPTY ; - }else { - err =arch_bp_generic_fields (ctrl, &len, &type); -if (err) -return err; + attr->disabled = disabled; +if (disabled) +return 0 ; -switch (note_type) { -case NT_ARM_HW_BREAK : -if ((type &HW_BREAKPOINT_X ) != type) -return -EINVAL ; -break ; -case NT_ARM_HW_WATCH : -if ((type &HW_BREAKPOINT_RW ) != type) -return -EINVAL ; -break ; -default : + err =arch_bp_generic_fields (ctrl, &len, &type); +if (err) +return err; + +switch (note_type) { +case NT_ARM_HW_BREAK : +if ((type &HW_BREAKPOINT_X ) != type) +return -EINVAL ; +break ; +case NT_ARM_HW_WATCH : +if ((type &HW_BREAKPOINT_RW ) != type)return -EINVAL ; - } +break ; +default : +return -EINVAL ; } attr->bp_len = len; attr->bp_type = type; - attr->disabled = disabled;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 26/129 arm64: spinlock: retry trylock operation if strex fails on free lock
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <[email protected]>
commit 4ecf7ccb1973fd826456b6ab1e6dfafe9023c753 upstream.
An exclusive store instruction may fail for reasons other than lock contention (e.g. a cache eviction during the critical section) so, in line with other architectures using similar exclusive instructions (alpha, mips, powerpc), retry the trylock operation if the lock appears to be free but the strex reported failure.
--- arch/arm64/include/asm/spinlock.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/include/asm/spinlock.h +2 -1
@@ -59,9 +59,10 @@ static inline int arch_spin_trylock(archunsigned int tmp; asmvolatile ( -" ldaxr %w0, %1\n" +"2: ldaxr %w0, %1\n" " cbnz %w0, 1f\n" " stxr %w0, %w2, %1\n" +" cbnz %w0, 2b\n" "1:\n" :"=&r" (tmp),"+Q" (lock->lock) : "r" (1)
Greg Kroah-Hartman
maintainerPATCH 27/129 ARM: OMAP2+: hwmod_data: fix missing OMAP_INTC_START in irq data
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suman Anna <[email protected]>
commit 6d4c88304794442055eaea1c07f3c7b988b8c924 upstream.
Commit 7d7e1eb (ARM: OMAP2+: Prepare for irqs.h removal) and commit ec2c082 (ARM: OMAP2+: Remove hardcoded IRQs and enable SPARSE_IRQ) updated the way interrupts for OMAP2/3 devices are defined in the HWMOD data structures to being an index plus a fixed offset (defined by OMAP_INTC_START).
Couple of irqs in the OMAP2/3 hwmod data were misconfigured completely as they were missing this OMAP_INTC_START relative offset. Add this offset back to fix the incorrect irq data for the following modules:
OMAP2 - GPMC, RNG
OMAP3 - GPMC, ISP MMU & IVA MMU
--- arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c | 4 ++-- arch/arm/mach-omap2/omap_hwmod_3xxx_data.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-)
arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c +2 -2
@@ -796,7 +796,7 @@ struct omap_hwmod omap2xxx_counter_32k_h/* gpmc */ static struct omap_hwmod_irq_info omap2xxx_gpmc_irqs[] = { - { .irq =20 }, + { .irq =20 +OMAP_INTC_START , }, { .irq =-1 } };
@@ -841,7 +841,7 @@ static struct omap_hwmod_class omap2_rng };static struct omap_hwmod_irq_info omap2_rng_mpu_irqs[] = { - { .irq =52 }, + { .irq =52 +OMAP_INTC_START , }, { .irq =-1 } };
arch/arm/mach-omap2/omap_hwmod_3xxx_data.c +3 -3
@@ -2152,7 +2152,7 @@ static struct omap_hwmod_class omap3xxx_ };static struct omap_hwmod_irq_info omap3xxx_gpmc_irqs[] = { - { .irq =20 }, + { .irq =20 +OMAP_INTC_START , }, { .irq =-1 } };
@@ -2986,7 +2986,7 @@ static struct omap_mmu_dev_attr mmu_isp_static struct omap_hwmod omap3xxx_mmu_isp_hwmod;static struct omap_hwmod_irq_info omap3xxx_mmu_isp_irqs[] = { - { .irq =24 }, + { .irq =24 +OMAP_INTC_START , }, { .irq =-1 } };
@@ -3028,7 +3028,7 @@ static struct omap_mmu_dev_attr mmu_iva_static struct omap_hwmod omap3xxx_mmu_iva_hwmod;static struct omap_hwmod_irq_info omap3xxx_mmu_iva_irqs[] = { - { .irq =28 }, + { .irq =28 +OMAP_INTC_START , }, { .irq =-1 } };
Greg Kroah-Hartman
maintainerPATCH 28/129 x86 idle: Repair large-server 50-watt idle-power regression
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <[email protected]>
commit 40e2d7f9b5dae048789c64672bf3027fbb663ffa upstream.
Linux 3.10 changed the timing of how thread_info->flags is touched:
x86: Use generic idle loop (7d1a941731fabf27e5fb6edbebb79fe856edb4e5)
This caused Intel NHM-EX and WSM-EX servers to experience a large number of immediate MONITOR/MWAIT break wakeups, which caused cpuidle to demote from deep C-states to shallow C-states, which caused these platforms to experience a significant increase in idle power.
Note that this issue was already present before the commit above, however, it wasn't seen often enough to be noticed in power measurements.
Here we extend an errata workaround from the Core2 EX "Dunnington" to extend to NHM-EX and WSM-EX, to prevent these immediate returns from MWAIT, reducing idle power on these platforms.
While only acpi_idle ran on Dunnington, intel_idle may also run on these two newer systems.
As of today, there are no other models that are known to need this tweak.
--- arch/x86/kernel/cpu/intel.c | 3 ++- drivers/idle/intel_idle.c | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/intel.c +2 -1
@@ -387,7 +387,8 @@ static void __cpuinit init_intel(structset_cpu_cap (c,X86_FEATURE_PEBS ); } -if (c->x86 ==6 && c->x86_model ==29 && cpu_has_clflush) +if (c->x86 ==6 && cpu_has_clflush && + (c->x86_model ==29 || c->x86_model ==46 || c->x86_model ==47 ))set_cpu_cap (c,X86_FEATURE_CLFLUSH_MONITOR );#ifdef CONFIG_X86_64
drivers/idle/intel_idle.c +3 -0
@@ -361,6 +361,9 @@ static int intel_idle(struct cpuidle_devif (!current_set_polling_and_test ()) { +if (this_cpu_has (X86_FEATURE_CLFLUSH_MONITOR )) +clflush ((void *)¤t_thread_info ()->flags); +__monitor ((void *)¤t_thread_info ()->flags,0 ,0 );smp_mb ();if (!need_resched ())
Greg Kroah-Hartman
maintainerPATCH 29/129 ext4: call ext4_error_inode() if jbd2_journal_dirty_metadata() fails
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit ae1495b12df1897d4f42842a7aa7276d920f6290 upstream.
While it's true that errors can only happen if there is a bug in jbd2_journal_dirty_metadata(), if a bug does happen, we need to halt the kernel or remount the file system read-only in order to avoid further data loss. The ext4_journal_abort_handle() function doesn't do any of this, and while it's likely that this call (since it doesn't adjust refcounts) will likely result in the file system eventually deadlocking since the current transaction will never be able to close, it's much cleaner to call let ext4's error handling system deal with this situation.
There's a separate bug here which is that if certain jbd2 errors errors occur and file system is mounted errors=continue, the file system will probably eventually end grind to a halt as described above. But things have been this way in a long time, and usually when we have these sorts of errors it's pretty much a disaster --- and that's why the jbd2 layer aggressively retries memory allocations, which is the most likely cause of these jbd2 errors.
--- fs/ext4/ext4_jbd2.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/ext4/ext4_jbd2.c +9 -0
@@ -223,6 +223,15 @@ int __ext4_handle_dirty_metadata(const cif (WARN_ON_ONCE (err)) {ext4_journal_abort_handle (where, line, __func__, bh, handle, err); +ext4_error_inode (inode, where, line, + bh->b_blocknr, +"journal_dirty_metadata failed: " +"handle type %u started at line %u, " +"credits %u/%u, errcode %d" , + handle->h_type, + handle->h_line_no, + handle->h_requested_credits, + handle->h_buffer_credits, err); } }else {if (inode)
Greg Kroah-Hartman
maintainerPATCH 30/129 ext4: fix use-after-free in ext4_mb_new_blocks
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junho Ryu <[email protected]>
commit 4e8d2139802ce4f41936a687f06c560b12115247 upstream.
ext4_mb_put_pa should hold pa->pa_lock before accessing pa->pa_count. While ext4_mb_use_preallocated checks pa->pa_deleted first and then increments pa->count later, ext4_mb_put_pa decrements pa->pa_count before holding pa->pa_lock and then sets pa->pa_deleted.
* Free sequenceext4_mb_put_pa (1): atomic_dec_and_test pa->pa_countext4_mb_put_pa (2): lock pa->pa_lockext4_mb_put_pa (3): check pa->pa_deletedext4_mb_put_pa (4): set pa->pa_deleted=1ext4_mb_put_pa (5): unlock pa->pa_lockext4_mb_put_pa (6): remove pa from a listext4_mb_pa_callback: free pa
* Use sequenceext4_mb_use_preallocated (1): iterate over preallocationext4_mb_use_preallocated (2): lock pa->pa_lockext4_mb_use_preallocated (3): check pa->pa_deletedext4_mb_use_preallocated (4): increase pa->pa_countext4_mb_use_preallocated (5): unlock pa->pa_lockext4_mb_release_context: access pa
* Use-after-free sequence
[initial status] <pa->pa_deleted = 0, pa_count = 1>ext4_mb_use_preallocated (1): iterate over preallocationext4_mb_use_preallocated (2): lock pa->pa_lockext4_mb_use_preallocated (3): check pa->pa_deletedext4_mb_put_pa (1): atomic_dec_and_test pa->pa_count
[pa_count decremented] <pa->pa_deleted = 0, pa_count = 0>ext4_mb_use_preallocated (4): increase pa->pa_count
[pa_count incremented] <pa->pa_deleted = 0, pa_count = 1>ext4_mb_use_preallocated (5): unlock pa->pa_lockext4_mb_put_pa (2): lock pa->pa_lockext4_mb_put_pa (3): check pa->pa_deletedext4_mb_put_pa (4): set pa->pa_deleted=1
[race condition!] <pa->pa_deleted = 1, pa_count = 1>ext4_mb_put_pa (5): unlock pa->pa_lockext4_mb_put_pa (6): remove pa from a listext4_mb_pa_callback: free paext4_mb_release_context: access pa
AddressSanitizer has detected use-after-free in ext4_mb_new_blocks Bug report: http://goo.gl/rG1On3
--- fs/ext4/mballoc.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/ext4/mballoc.c +8 -3
@@ -3423,6 +3423,9 @@ static void ext4_mb_pa_callback(struct r {struct ext4_prealloc_space *pa; pa = container_of(head, struct ext4_prealloc_space, u.pa_rcu); + +BUG_ON (atomic_read (&pa->pa_count)); +BUG_ON (pa->pa_deleted ==0 );kmem_cache_free (ext4_pspace_cachep, pa); }
@@ -3436,11 +3439,13 @@ static void ext4_mb_put_pa(struct ext4_aext4_group_t grp;ext4_fsblk_t grp_blk; -if (!atomic_dec_and_test (&pa->pa_count) || pa->pa_free !=0 ) -return ; -/* in this short window concurrent discard can set pa_deleted */ spin_lock (&pa->pa_lock); +if (!atomic_dec_and_test (&pa->pa_count) || pa->pa_free !=0 ) { +spin_unlock (&pa->pa_lock); +return ; + } +if (pa->pa_deleted ==1 ) {spin_unlock (&pa->pa_lock);return ;
Greg Kroah-Hartman
maintainerPATCH 32/129 ext4: Do not reserve clusters when fs doesnt support extents
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 30fac0f75da24dd5bb43c9e911d2039a984ac815 upstream.
When the filesystem doesn't support extents (like in ext2/3 compatibility modes), there is no need to reserve any clusters. Space estimates for writing are exact, hole punching doesn't need new metadata, and there are no unwritten extents to convert.
This fixes a problem when filesystem still having some free space when accessed with a native ext2/3 driver suddently reports ENOSPC when accessed with ext4 driver.
--- fs/ext4/super.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
fs/ext4/super.c +13 -4
@@ -3213,11 +3213,19 @@ int ext4_calculate_overhead(struct super } -static ext4_fsblk_t ext4_calculate_resv_clusters (struct ext4_sb_info *sbi) +static ext4_fsblk_t ext4_calculate_resv_clusters (struct super_block *sb) {ext4_fsblk_t resv_clusters;/* +* There's no need to reserve anything when we aren't using extents. +* The space estimates are exact, there are no unwritten extents, +* hole punching doesn't need new metadata... This is needed especially +* to keep ext2/3 backward compatibility. +*/ +if (!EXT4_HAS_INCOMPAT_FEATURE (sb,EXT4_FEATURE_INCOMPAT_EXTENTS )) +return 0 ; +/* * By default we reserve 2% or 4096 clusters, whichever is smaller. * This should cover the situations where we can not afford to run * out of space like for example punch hole, or converting
@@ -3225,7 +3233,8 @@ static ext4_fsblk_t ext4_calculate_resv_* allocation would require 1, or 2 blocks, higher numbers are * very rare. */ - resv_clusters =ext4_blocks_count (sbi->s_es) >> sbi->s_cluster_bits; + resv_clusters =ext4_blocks_count (EXT4_SB (sb)->s_es) >> +EXT4_SB (sb)->s_cluster_bits;do_div (resv_clusters,50 ); resv_clusters =min_t (ext4_fsblk_t, resv_clusters,4096 );
@@ -3969,10 +3978,10 @@ no_journal: "available"); } - err =ext4_reserve_clusters (sbi,ext4_calculate_resv_clusters (sbi)); + err =ext4_reserve_clusters (sbi,ext4_calculate_resv_clusters (sb));if (err) {ext4_msg (sb,KERN_ERR ,"failed to reserve %llu clusters for " -"reserved pool" ,ext4_calculate_resv_clusters (sbi)); +"reserved pool" ,ext4_calculate_resv_clusters (sb)); goto failed_mount4a; }
Greg Kroah-Hartman
maintainerPATCH 33/129 ext4: fix deadlock when writing in ENOSPC conditions
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 34cf865d54813aab3497838132fb1bbd293f4054 upstream.
Akira-san has been reporting rare deadlocks of his machine when running xfstests test 269 on ext4 filesystem. The problem turned out to be in ext4_da_reserve_metadata() and ext4_da_reserve_space() which called ext4_should_retry_alloc() while holding i_data_sem. Since ext4_should_retry_alloc() can force a transaction commit, this is a lock ordering violation and leads to deadlocks.
Fix the problem by just removing the retry loops. These functions should just report ENOSPC to the caller (e.g. ext4_da_write_begin()) and that function must take care of retrying after dropping all necessary locks.
--- fs/ext4/inode.c | 12 ------------ 1 file changed, 12 deletions(-)
fs/ext4/inode.c +0 -12
@@ -1263,7 +1263,6 @@ static int ext4_journalled_write_end(str*/ static int ext4_da_reserve_metadata (struct inode *inode,ext4_lblk_t lblock) { -int retries =0 ;struct ext4_sb_info *sbi =EXT4_SB (inode->i_sb);struct ext4_inode_info *ei =EXT4_I (inode);unsigned int md_needed;
@@ -1275,7 +1274,6 @@ static int ext4_da_reserve_metadata(stru* in order to allocate nrblocks * worse case is one extent per block */ -repeat:spin_lock (&ei->i_block_reservation_lock);/* * ext4_calc_metadata_amount() has side effects, which we have
@@ -1295,10 +1293,6 @@ repeat: ei->i_da_metadata_calc_len = save_len; ei->i_da_metadata_calc_last_lblock = save_last_lblock;spin_unlock (&ei->i_block_reservation_lock); -if (ext4_should_retry_alloc (inode->i_sb, &retries)) { -cond_resched (); - goto repeat; - }return -ENOSPC ; } ei->i_reserved_meta_blocks += md_needed;
@@ -1312,7 +1306,6 @@ repeat:*/ static int ext4_da_reserve_space (struct inode *inode,ext4_lblk_t lblock) { -int retries =0 ;struct ext4_sb_info *sbi =EXT4_SB (inode->i_sb);struct ext4_inode_info *ei =EXT4_I (inode);unsigned int md_needed;
@@ -1334,7 +1327,6 @@ static int ext4_da_reserve_space(struct* in order to allocate nrblocks * worse case is one extent per block */ -repeat:spin_lock (&ei->i_block_reservation_lock);/* * ext4_calc_metadata_amount() has side effects, which we have
@@ -1354,10 +1346,6 @@ repeat: ei->i_da_metadata_calc_len = save_len; ei->i_da_metadata_calc_last_lblock = save_last_lblock;spin_unlock (&ei->i_block_reservation_lock); -if (ext4_should_retry_alloc (inode->i_sb, &retries)) { -cond_resched (); - goto repeat; - }dquot_release_reservation_block (inode,EXT4_C2B (sbi,1 ));return -ENOSPC ; }
Greg Kroah-Hartman
maintainerPATCH 34/129 ext4: add explicit casts when masking cluster sizes
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit f5a44db5d2d677dfbf12deee461f85e9ec633961 upstream.
The missing casts can cause the high 64-bits of the physical blocks to be lost. Set up new macros which allows us to make sure the right thing happen, even if at some point we end up supporting larger logical block numbers.
Thanks to the Emese Revfy and the PaX security team for reporting this issue.
--- fs/ext4/ext4.h | 10 ++++++++++ fs/ext4/extents.c | 24 +++++++++++------------- fs/ext4/mballoc.c | 6 +++--- 3 files changed, 24 insertions(+), 16 deletions(-)
fs/ext4/ext4.h +10 -0
@@ -280,6 +280,16 @@ struct ext4_io_submit {/* Translate # of blks to # of clusters */ #define EXT4_NUM_B2C (sbi, blks) (((blks) + (sbi)->s_cluster_ratio - 1) >> \ (sbi)->s_cluster_bits) +/* Mask out the low bits to get the starting block of the cluster */ +#define EXT4_PBLK_CMASK (s, pblk) ((pblk) & \ + ~((ext4_fsblk_t) (s)->s_cluster_ratio - 1)) +#define EXT4_LBLK_CMASK (s, lblk) ((lblk) & \ + ~((ext4_lblk_t) (s)->s_cluster_ratio - 1)) +/* Get the cluster offset */ +#define EXT4_PBLK_COFF (s, pblk) ((pblk) & \ + ((ext4_fsblk_t) (s)->s_cluster_ratio - 1)) +#define EXT4_LBLK_COFF (s, lblk) ((lblk) & \ + ((ext4_lblk_t) (s)->s_cluster_ratio - 1))/* * Structure of a blocks group descriptor
fs/ext4/extents.c +11 -13
@@ -1772,8 +1772,7 @@ static unsigned int ext4_ext_check_overl depth =ext_depth (inode);if (!path[depth].p_ext) goto out; - b2 =le32_to_cpu (path[depth].p_ext->ee_block); - b2 &= ~(sbi->s_cluster_ratio -1 ); + b2 =EXT4_LBLK_CMASK (sbi,le32_to_cpu (path[depth].p_ext->ee_block));/* * get the next allocated block if the extent in the path
@@ -1783,7 +1782,7 @@ static unsigned int ext4_ext_check_overl b2 =ext4_ext_next_allocated_block (path);if (b2 ==EXT_MAX_BLOCKS ) goto out; - b2 &= ~(sbi->s_cluster_ratio -1 ); + b2 =EXT4_LBLK_CMASK (sbi, b2); }/* check for wrap through zero on extent logical start block*/
@@ -2444,7 +2443,7 @@ static int ext4_remove_blocks(handle_t ** truncate operation has removed all of the blocks in * the cluster. */ -if (pblk & (sbi->s_cluster_ratio -1 ) && +if (EXT4_PBLK_COFF (sbi, pblk) && (ee_len == num)) *partial_cluster =EXT4_B2C (sbi, pblk);else
@@ -3675,7 +3674,7 @@ int ext4_find_delalloc_cluster(struct in {struct ext4_sb_info *sbi =EXT4_SB (inode->i_sb);ext4_lblk_t lblk_start, lblk_end; - lblk_start = lblk & (~(sbi->s_cluster_ratio -1 )); + lblk_start =EXT4_LBLK_CMASK (sbi, lblk); lblk_end = lblk_start + sbi->s_cluster_ratio -1 ;return ext4_find_delalloc_range (inode, lblk_start, lblk_end);
@@ -3734,9 +3733,9 @@ get_reserved_cluster_alloc(struct inodetrace_ext4_get_reserved_cluster_alloc (inode, lblk_start, num_blks);/* Check towards left side */ - c_offset = lblk_start & (sbi->s_cluster_ratio -1 ); + c_offset =EXT4_LBLK_COFF (sbi, lblk_start);if (c_offset) { - lblk_from = lblk_start & (~(sbi->s_cluster_ratio -1 )); + lblk_from =EXT4_LBLK_CMASK (sbi, lblk_start); lblk_to = lblk_from + c_offset -1 ;if (ext4_find_delalloc_range (inode, lblk_from, lblk_to))
@@ -3744,7 +3743,7 @@ get_reserved_cluster_alloc(struct inode }/* Now check towards right. */ - c_offset = (lblk_start + num_blks) & (sbi->s_cluster_ratio -1 ); + c_offset =EXT4_LBLK_COFF (sbi, lblk_start + num_blks);if (allocated_clusters && c_offset) { lblk_from = lblk_start + num_blks; lblk_to = lblk_from + (sbi->s_cluster_ratio - c_offset) -1 ;
@@ -3952,7 +3951,7 @@ static int get_implied_cluster_alloc(str struct ext4_ext_path *path) {struct ext4_sb_info *sbi =EXT4_SB (sb); -ext4_lblk_t c_offset = map->m_lblk & (sbi->s_cluster_ratio-1 ); +ext4_lblk_t c_offset =EXT4_LBLK_COFF (sbi, map->m_lblk);ext4_lblk_t ex_cluster_start, ex_cluster_end;ext4_lblk_t rr_cluster_start;ext4_lblk_t ee_block =le32_to_cpu (ex->ee_block);
@@ -3970,8 +3969,7 @@ static int get_implied_cluster_alloc(str (rr_cluster_start == ex_cluster_start)) {if (rr_cluster_start == ex_cluster_end) ee_start += ee_len -1 ; - map->m_pblk = (ee_start & ~(sbi->s_cluster_ratio -1 )) + - c_offset; + map->m_pblk =EXT4_PBLK_CMASK (sbi, ee_start) + c_offset; map->m_len =min (map->m_len, (unsigned ) sbi->s_cluster_ratio - c_offset);/*
@@ -4125,7 +4123,7 @@ int ext4_ext_map_blocks(handle_t *handle*/ map->m_flags &= ~EXT4_MAP_FROM_CLUSTER ; newex.ee_block =cpu_to_le32 (map->m_lblk); - cluster_offset = map->m_lblk & (sbi->s_cluster_ratio-1 ); + cluster_offset =EXT4_LBLK_CMASK (sbi, map->m_lblk);/* * If we are doing bigalloc, check to see if the extent returned
@@ -4193,7 +4191,7 @@ int ext4_ext_map_blocks(handle_t *handle* needed so that future calls to get_implied_cluster_alloc() * work correctly. */ - offset = map->m_lblk & (sbi->s_cluster_ratio -1 ); + offset =EXT4_LBLK_COFF (sbi, map->m_lblk); ar.len =EXT4_NUM_B2C (sbi, offset+allocated); ar.goal -= offset; ar.logical -= offset;
fs/ext4/mballoc.c +3 -3
@@ -4107,7 +4107,7 @@ ext4_mb_initialize_context(struct ext4_aext4_get_group_no_and_offset (sb, goal, &group, &block);/* set up allocation goals */ - ac->ac_b_ex.fe_logical = ar->logical & ~(sbi->s_cluster_ratio -1 ); + ac->ac_b_ex.fe_logical =EXT4_LBLK_CMASK (sbi, ar->logical); ac->ac_status =AC_STATUS_CONTINUE ; ac->ac_sb = sb; ac->ac_inode = ar->inode;
@@ -4644,7 +4644,7 @@ void ext4_free_blocks(handle_t *handle,* blocks at the beginning or the end unless we are explicitly * requested to avoid doing so. */ - overflow = block & (sbi->s_cluster_ratio -1 ); + overflow =EXT4_PBLK_COFF (sbi, block);if (overflow) {if (flags &EXT4_FREE_BLOCKS_NOFREE_FIRST_CLUSTER ) { overflow = sbi->s_cluster_ratio - overflow;
@@ -4658,7 +4658,7 @@ void ext4_free_blocks(handle_t *handle, count += overflow; } } - overflow = count & (sbi->s_cluster_ratio -1 ); + overflow =EXT4_LBLK_COFF (sbi, count);if (overflow) {if (flags &EXT4_FREE_BLOCKS_NOFREE_LAST_CLUSTER ) {if (count > overflow)
Greg Kroah-Hartman
maintainerPATCH 36/129 sched: numa: skip inaccessible VMAs
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <[email protected]>
commit 3c67f474558748b604e247d92b55dfe89654c81d upstream.
Inaccessible VMA should not be trapping NUMA hint faults. Skip them.
--- kernel/sched/fair.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/sched/fair.c +7 -0
@@ -936,6 +936,13 @@ void task_numa_work(struct callback_headif (vma->vm_end - vma->vm_start <HPAGE_SIZE )continue ; +/* +* Skip inaccessible VMAs to avoid any confusion between +* PROT_NONE and NUMA hinting ptes +*/ +if (!(vma->vm_flags & (VM_READ |VM_EXEC |VM_WRITE ))) +continue ; + do { start = max(start, vma->vm_start); end = ALIGN(start + (pages << PAGE_SHIFT), HPAGE_SIZE);
Greg Kroah-Hartman
maintainerPATCH 37/129 sched/rt: Fix rqs cpupri leak while enqueue/dequeue child RT entities
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill Tkhai <[email protected]>
commit 757dfcaa41844595964f1220f1d33182dae49976 upstream.
This patch touches the RT group scheduling case.
Functions inc_rt_prio_smp() and dec_rt_prio_smp() change (global) rq's priority, while rt_rq passed to them may be not the top-level rt_rq. This is wrong, because changing of priority on a child level does not guarantee that the priority is the highest all over the rq. So, this leak makes RT balancing unusable.
The short example: the task having the highest priority among all rq's RT tasks (no one other task has the same priority) are waking on a throttle rt_rq. The rq's cpupri is set to the task's priority equivalent, but real rq->rt.highest_prio.curr is less.
The patch below fixes the problem.
--- kernel/sched/rt.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
kernel/sched/rt.c +14 -0
@@ -964,6 +964,13 @@ inc_rt_prio_smp(struct rt_rq *rt_rq, int {struct rq *rq =rq_of_rt_rq (rt_rq); +#ifdef CONFIG_RT_GROUP_SCHED +/* +* Change rq's cpupri only if rt_rq is the top queue. +*/ +if (&rq->rt != rt_rq) +return ; +#endif if (rq->online && prio < prev_prio)cpupri_set (&rq->rd->cpupri, rq->cpu, prio); }
@@ -973,6 +980,13 @@ dec_rt_prio_smp(struct rt_rq *rt_rq, int {struct rq *rq =rq_of_rt_rq (rt_rq); +#ifdef CONFIG_RT_GROUP_SCHED +/* +* Change rq's cpupri only if rt_rq is the top queue. +*/ +if (&rq->rt != rt_rq) +return ; +#endif if (rq->online && rt_rq->highest_prio.curr != prev_prio)cpupri_set (&rq->rd->cpupri, rq->cpu, rt_rq->highest_prio.curr); }
Greg Kroah-Hartman
maintainerPATCH 38/129 firewire: sbp2: bring back WRITE SAME support
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Richter <[email protected]>
commit ce027ed98fd176710fb14be9d6015697b62436f0 upstream.
Commit 54b2b50c20a6 "[SCSI] Disable WRITE SAME for RAID and virtual host adapter drivers" disabled WRITE SAME support for all SBP-2 attached targets. But as described in the changelog of commit b0ea5f19d3d8 "firewire: sbp2: allow WRITE SAME and REPORT SUPPORTED OPERATION CODES", it is not required to blacklist WRITE SAME.
Bring the feature back by reverting the sbp2.c hunk of commit 54b2b50c20a6.
--- drivers/firewire/sbp2.c | 1 - 1 file changed, 1 deletion(-)
drivers/firewire/sbp2.c +0 -1
@@ -1626,7 +1626,6 @@ static struct scsi_host_template scsi_dr .cmd_per_lun = 1, .can_queue = 1, .sdev_attrs = sbp2_scsi_sysfs_attrs, - .no_write_same = 1, };MODULE_AUTHOR ("Kristian Hoegsberg <[email protected]>" );
Greg Kroah-Hartman
maintainerPATCH 39/129 net_dma: mark broken
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <[email protected]>
commit 77873803363c9e831fc1d1e6895c084279090c22 upstream.
net_dma can cause data to be copied to a stale mapping if a copy-on-write fault occurs during dma. The application sees missing data.
The following trace is triggered by modifying the kernel to WARN if it ever triggers copy-on-write on a page that is undergoing dma:
WARNING: CPU: 24 PID: 2529 at lib/dma-debug.c:485 debug_dma_assert_idle+0xd2/0x120() ioatdma 0000:00:04.0: DMA-API: cpu touching an active dma mapped page [pfn=0x16bcd9] Modules linked in: iTCO_wdt iTCO_vendor_support ioatdma lpc_ich pcspkr dca CPU: 24 PID: 2529 Comm: linbug Tainted: G W 3.13.0-rc1+ #353 00000000000001e5 ffff88016f45f688 ffffffff81751041 ffff88017ab0ef70 ffff88016f45f6d8 ffff88016f45f6c8 ffffffff8104ed9c ffffffff810f3646 ffff8801768f4840 0000000000000282 ffff88016f6cca10 00007fa2bb699349 Call Trace: [<ffffffff81751041>] dump_stack+0x46/0x58 [<ffffffff8104ed9c>] warn_slowpath_common+0x8c/0xc0 [<ffffffff810f3646>] ? ftrace_pid_func+0x26/0x30 [<ffffffff8104ee86>] warn_slowpath_fmt+0x46/0x50 [<ffffffff8139c062>] debug_dma_assert_idle+0xd2/0x120 [<ffffffff81154a40>] do_wp_page+0xd0/0x790 [<ffffffff811582ac>] handle_mm_fault+0x51c/0xde0 [<ffffffff813830b9>] ? copy_user_enhanced_fast_string+0x9/0x20 [<ffffffff8175fc2c>] __do_page_fault+0x19c/0x530 [<ffffffff8175c196>] ? _raw_spin_lock_bh+0x16/0x40 [<ffffffff810f3539>] ? trace_clock_local+0x9/0x10 [<ffffffff810fa1f4>] ? rb_reserve_next_event+0x64/0x310 [<ffffffffa0014c00>] ? ioat2_dma_prep_memcpy_lock+0x60/0x130 [ioatdma] [<ffffffff8175ffce>] do_page_fault+0xe/0x10 [<ffffffff8175c862>] page_fault+0x22/0x30 [<ffffffff81643991>] ? __kfree_skb+0x51/0xd0 [<ffffffff813830b9>] ? copy_user_enhanced_fast_string+0x9/0x20 [<ffffffff81388ea2>] ? memcpy_toiovec+0x52/0xa0 [<ffffffff8164770f>] skb_copy_datagram_iovec+0x5f/0x2a0 [<ffffffff8169d0f4>] tcp_rcv_established+0x674/0x7f0 [<ffffffff816a68c5>] tcp_v4_do_rcv+0x2e5/0x4a0 [..] ---[ end trace e30e3b01191b7617 ]--- Mapped at: [<ffffffff8139c169>] debug_dma_map_page+0xb9/0x160 [<ffffffff8142bf47>] dma_async_memcpy_pg_to_pg+0x127/0x210 [<ffffffff8142cce9>] dma_memcpy_pg_to_iovec+0x119/0x1f0 [<ffffffff81669d3c>] dma_skb_copy_datagram_iovec+0x11c/0x2b0 [<ffffffff8169d1ca>] tcp_rcv_established+0x74a/0x7f0:
...the problem is that the receive path falls back to cpu-copy in several locations and this trace is just one of the areas. A few options were considered to fix this:
1/ sync all dma whenever a cpu copy branch is taken
2/ modify the page fault handler to hold off while dma is in-flight
Option 1 adds yet more cpu overhead to an "offload" that struggles to compete with cpu-copy. Option 2 adds checks for behavior that is already documented as broken when using get_user_pages(). At a minimum a debug mode is warranted to catch and flag these violations of the dma-api vs get_user_pages().
Thanks to David for his reproducer.
--- drivers/dma/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/dma/Kconfig +1 -0
@@ -333,6 +333,7 @@ config NET_DMA bool "Network: TCP receive copy offload" depends on DMA_ENGINE && NET default (INTEL_IOATDMA || FSL_DMA) + depends on BROKEN help This enables the use of DMA engines in the network stack to offload receive copy-to-user operations, freeing CPU cycles.
Greg Kroah-Hartman
maintainerPATCH 41/129 drm/radeon: Fix sideport problems on certain RS690 boards
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 8333f0fe133be420ce3fcddfd568c3a559ab274e upstream.
Some RS690 boards with 64MB of sideport memory show up as having 128MB sideport + 256MB of UMA. In this case, just skip the sideport memory and use UMA. This fixes rendering corruption and should improve performance.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=35457
--- drivers/gpu/drm/radeon/rs690.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/gpu/drm/radeon/rs690.c +10 -0
@@ -162,6 +162,16 @@ static void rs690_mc_init(struct radeon_ base =RREG32_MC (R_000100_MCCFG_FB_LOCATION ); base =G_000100_MC_FB_START (base) <<16 ; rdev->mc.igp_sideport_enabled =radeon_atombios_sideport_present (rdev); +/* Some boards seem to be configured for 128MB of sideport memory, +* but really only have 64MB. Just skip the sideport and use +* UMA memory. +*/ +if (rdev->mc.igp_sideport_enabled && + (rdev->mc.real_vram_size == (384 *1024 *1024 ))) { + base +=128 *1024 *1024 ; + rdev->mc.real_vram_size -=128 *1024 *1024 ; + rdev->mc.mc_vram_size = rdev->mc.real_vram_size; + }/* Use K8 direct mapping for fast fb access. */ rdev->fastfb_working = false;
Greg Kroah-Hartman
maintainerPATCH 42/129 drm/radeon: add missing display tiling setup for oland
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 227ae10f17a5f2fd1307b7e582b603ef7bbb7e97 upstream.
Fixes improperly set up display params for 2D tiling on oland.
--- drivers/gpu/drm/radeon/atombios_crtc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/atombios_crtc.c +3 -1
@@ -1176,7 +1176,9 @@ static int dce4_crtc_do_set_base(structif ((rdev->family ==CHIP_TAHITI ) || (rdev->family ==CHIP_PITCAIRN )) fb_format |=SI_GRPH_PIPE_CONFIG (SI_ADDR_SURF_P8_32x32_8x16); -else if (rdev->family ==CHIP_VERDE ) +else if ((rdev->family ==CHIP_VERDE ) || + (rdev->family ==CHIP_OLAND ) || + (rdev->family ==CHIP_HAINAN ))/* for completeness. HAINAN has no display hw */ fb_format |=SI_GRPH_PIPE_CONFIG (SI_ADDR_SURF_P4_8x16);switch (radeon_crtc->crtc_id) {
Greg Kroah-Hartman
maintainerPATCH 44/129 drm/i915: Hold mutex across i915_gem_release
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <[email protected]>
commit 0d1430a3f4b7cfd8779b78740a4182321f3ca7f3 upstream.
Inorder to serialise the closing of the file descriptor and its subsequent release of client requests with i915_gem_free_request(), we need to hold the struct_mutex in i915_gem_release(). Failing to do so has the potential to trigger an OOPS, later with a use-after-free.
Testcase: igt/gem_close_race
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70874
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=71029
--- drivers/gpu/drm/i915/i915_dma.c | 2 ++ drivers/gpu/drm/i915/i915_gem_context.c | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/i915_dma.c +2 -0
@@ -1847,8 +1847,10 @@ void i915_driver_lastclose(struct drm_devoid i915_driver_preclose (struct drm_device * dev,struct drm_file *file_priv) { +mutex_lock (&dev->struct_mutex);i915_gem_context_close (dev, file_priv);i915_gem_release (dev, file_priv); +mutex_unlock (&dev->struct_mutex); }void i915_driver_postclose (struct drm_device *dev,struct drm_file *file)
drivers/gpu/drm/i915/i915_gem_context.c +0 -2
@@ -291,10 +291,8 @@ void i915_gem_context_close(struct drm_d {struct drm_i915_file_private *file_priv = file->driver_priv; -mutex_lock (&dev->struct_mutex);idr_for_each (&file_priv->context_idr, context_idr_cleanup,NULL );idr_destroy (&file_priv->context_idr); -mutex_unlock (&dev->struct_mutex); } static struct i915_hw_context *
Greg Kroah-Hartman
maintainerPATCH 45/129 drm/i915: dont update the dri1 breadcrumb with modesetting
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <[email protected]>
commit 6c719faca2aceca72f1bf5b1645c1734ed3e9447 upstream.
The update is horribly racy since it doesn't protect at all against concurrent closing of the master fd. And it can't really since that requires us to grab a mutex.
Instead of jumping through hoops and offloading this to a worker thread just block this bit of code for the modesetting driver.
Note that the race is fairly easy to hit since we call the breadcrumb function for any interrupt. So the vblank interrupt (which usually keeps going for a bit) is enough. But even if we'd block this and only update the breadcrumb for user interrupts from the CS we could hit this race with kms/gem userspace: If a non-master is waiting somewhere (and hence has interrupts enabled) and the master closes its fd (probably due to crashing).
v2: Add a code comment to explain why fixing this for real isn't really worth it. Also improve the commit message a bit.
v3: Fix the spelling in the comment.
--- drivers/gpu/drm/i915/i915_dma.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/i915/i915_dma.c +8 -0
@@ -84,6 +84,14 @@ void i915_update_dri1_breadcrumb(structdrm_i915_private_t *dev_priv = dev->dev_private;struct drm_i915_master_private *master_priv; +/* +* The dri breadcrumb update races against the drm master disappearing. +* Instead of trying to fix this (this is by far not the only ums issue) +* just don't do the update in kms mode. +*/ +if (drm_core_check_feature (dev,DRIVER_MODESET )) +return ; +if (dev->primary->master) { master_priv = dev->primary->master->driver_priv;if (master_priv->sarea_priv)
Greg Kroah-Hartman
maintainerPATCH 46/129 drm/radeon: fix asic gfx values for scrapper asics
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit e2f6c88fb903e123edfd1106b0b8310d5117f774 upstream.
Fixes gfx corruption on certain TN/RL parts.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=60389
--- drivers/gpu/drm/radeon/ni.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
drivers/gpu/drm/radeon/ni.c +16 -4
@@ -753,6 +753,10 @@ static void cayman_gpu_init(struct radeo (rdev->pdev->device == 0x999C)) { rdev->config.cayman.max_simds_per_se =6 ; rdev->config.cayman.max_backends_per_se =2 ; + rdev->config.cayman.max_hw_contexts =8 ; + rdev->config.cayman.sx_max_export_size =256 ; + rdev->config.cayman.sx_max_export_pos_size =64 ; + rdev->config.cayman.sx_max_export_smx_size =192 ; } else if ((rdev->pdev->device == 0x9903) || (rdev->pdev->device == 0x9904) || (rdev->pdev->device == 0x990A) ||
@@ -763,6 +767,10 @@ static void cayman_gpu_init(struct radeo (rdev->pdev->device == 0x999D)) { rdev->config.cayman.max_simds_per_se =4 ; rdev->config.cayman.max_backends_per_se =2 ; + rdev->config.cayman.max_hw_contexts =8 ; + rdev->config.cayman.sx_max_export_size =256 ; + rdev->config.cayman.sx_max_export_pos_size =64 ; + rdev->config.cayman.sx_max_export_smx_size =192 ; } else if ((rdev->pdev->device == 0x9919) || (rdev->pdev->device == 0x9990) || (rdev->pdev->device == 0x9991) ||
@@ -773,9 +781,17 @@ static void cayman_gpu_init(struct radeo (rdev->pdev->device == 0x99A0)) { rdev->config.cayman.max_simds_per_se =3 ; rdev->config.cayman.max_backends_per_se =1 ; + rdev->config.cayman.max_hw_contexts =4 ; + rdev->config.cayman.sx_max_export_size =128 ; + rdev->config.cayman.sx_max_export_pos_size =32 ; + rdev->config.cayman.sx_max_export_smx_size =96 ; } else { rdev->config.cayman.max_simds_per_se =2 ; rdev->config.cayman.max_backends_per_se =1 ; + rdev->config.cayman.max_hw_contexts =4 ; + rdev->config.cayman.sx_max_export_size =128 ; + rdev->config.cayman.sx_max_export_pos_size =32 ; + rdev->config.cayman.sx_max_export_smx_size =96 ; } rdev->config.cayman.max_texture_channel_caches =2 ; rdev->config.cayman.max_gprs =256 ;
@@ -783,10 +799,6 @@ static void cayman_gpu_init(struct radeo rdev->config.cayman.max_gs_threads =32 ; rdev->config.cayman.max_stack_entries =512 ; rdev->config.cayman.sx_num_of_sets =8 ; - rdev->config.cayman.sx_max_export_size =256 ; - rdev->config.cayman.sx_max_export_pos_size =64 ; - rdev->config.cayman.sx_max_export_smx_size =192 ; - rdev->config.cayman.max_hw_contexts =8 ; rdev->config.cayman.sq_num_cf_insts =2 ; rdev->config.cayman.sc_prim_fifo_size =0x40 ;
Greg Kroah-Hartman
maintainerPATCH 49/129 drm/radeon: 0x9649 is SUMO2 not SUMO
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit d00adcc8ae9e22eca9d8af5f66c59ad9a74c90ec upstream.
Fixes rendering corruption due to incorrect
gfx configuration.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=63599
--- include/drm/drm_pciids.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/drm/drm_pciids.h +1 -1
@@ -559,7 +559,7 @@ {0x1002, 0x9645, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO2|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x9647, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\ {0x1002, 0x9648, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\ - {0x1002, 0x9649, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\ + {0x1002, 0x9649, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO2|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\ {0x1002, 0x964a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x964b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ {0x1002, 0x964c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
Greg Kroah-Hartman
maintainerPATCH 50/129 ceph: Avoid data inconsistency due to d-cache aliasing in readpage()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Wang <[email protected]>
commit 56f91aad69444d650237295f68c195b74d888d95 upstream.
If the length of data to be read in readpage() is exactly PAGE_CACHE_SIZE, the original code does not flush d-cache for data consistency after finishing reading. This patches fixes this.
--- fs/ceph/addr.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/ceph/addr.c +6 -2
@@ -213,9 +213,13 @@ static int readpage_nounlock(struct fileif (err <0 ) {SetPageError (page); goto out; - }else if (err <PAGE_CACHE_SIZE ) { + }else { +if (err <PAGE_CACHE_SIZE ) {/* zero fill remainder of page */ -zero_user_segment (page, err,PAGE_CACHE_SIZE ); +zero_user_segment (page, err,PAGE_CACHE_SIZE ); + }else { +flush_dcache_page (page); + } }SetPageUptodate (page);
Greg Kroah-Hartman
maintainerPATCH 51/129 tg3: Expand 4g_overflow_test workaround to skb fragments of any size.
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nithin Sujir <[email protected]>
commit 375679104ab3ccfd18dcbd7ba503734fb9a2c63a upstream.
The current driver assumes that an skb fragment can only be upto jumbo size. Presumably this was a fast-path optimization. This assumption is no longer true as fragments can be upto 32k.
v2: Remove unnecessary parantheses per Eric Dumazet.
--- drivers/net/ethernet/broadcom/tg3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/tg3.c +1 -1
@@ -7482,7 +7482,7 @@ static inline int tg3_4g_overflow_test(d {u32 base = (u32 ) mapping &0xffffffff ; -return (base >0xffffdcc0 ) && (base + len +8 < base); +return base + len +8 < base; }/* Test for TSO DMA buffers that cross into regions which are within MSS bytes
Greg Kroah-Hartman
maintainerPATCH 52/129 auxvec.h: account for AT_HWCAP2 in AT_VECTOR_SIZE_BASE
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit f60900f2609e893c7f8d0bccc7ada4947dac4cd5 upstream.
Commit 2171364d1a92 ("powerpc: Add HWCAP2 aux entry") introduced a new AT_ auxv entry type AT_HWCAP2 but failed to update AT_VECTOR_SIZE_BASE accordingly.
--- include/linux/auxvec.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/auxvec.h +1 -1
@@ -3,6 +3,6 @@#include <uapi/linux/auxvec.h> -#define AT_VECTOR_SIZE_BASE 19/* NEW_AUX_ENT entries in auxiliary table */ +#define AT_VECTOR_SIZE_BASE 20/* NEW_AUX_ENT entries in auxiliary table */ /* number of "#define AT_.*" above, minus {AT_NULL, AT_IGNORE, AT_NOTELF} */ #endif /* _LINUX_AUXVEC_H */
Greg Kroah-Hartman
maintainerPATCH 53/129 dm9601: fix reception of full size ethernet frames on dm9620/dm9621a
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Korsgaard <[email protected]>
commit 407900cfb54bdb2cfa228010b6697305f66b2948 upstream.
dm9620/dm9621a require room for 4 byte padding even in dm9601 (3 byte header) mode.
--- drivers/net/usb/dm9601.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/usb/dm9601.c +6 -1
@@ -364,7 +364,12 @@ static int dm9601_bind(struct usbnet *de dev->net->ethtool_ops = &dm9601_ethtool_ops; dev->net->hard_header_len +=DM_TX_OVERHEAD ; dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; - dev->rx_urb_size = dev->net->mtu +ETH_HLEN +DM_RX_OVERHEAD ; + +/* dm9620/21a require room for 4 byte padding, even in dm9601 +* mode, so we need +1 to be able to receive full size +* ethernet frames. +*/ + dev->rx_urb_size = dev->net->mtu +ETH_HLEN +DM_RX_OVERHEAD +1 ; dev->mii.dev = dev->net; dev->mii.mdio_read = dm9601_mdio_read;
Greg Kroah-Hartman
maintainerPATCH 54/129 dm9601: work around tx fifo sync issue on dm962x
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Korsgaard <[email protected]>
commit 4263c86dca5198da6bd3ad826d0b2304fbe25776 upstream.
Certain dm962x revisions contain an bug, where if a USB bulk transfer retry (E.G. if bulk crc mismatch) happens right after a transfer with odd or maxpacket length, the internal tx hardware fifo gets out of sync causing the interface to stop working.
Work around it by adding up to 3 bytes of padding to ensure this situation cannot trigger.
This workaround also means we never pass multiple-of-maxpacket size skb's to usbnet, so the length adjustment to handle usbnet's padding of those can be removed.
--- drivers/net/usb/dm9601.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-)
drivers/net/usb/dm9601.c +19 -8
@@ -473,7 +473,7 @@ static int dm9601_rx_fixup(struct usbnetstatic struct sk_buff *dm9601_tx_fixup (struct usbnet *dev,struct sk_buff *skb,gfp_t flags) { -int len; +int len, pad;/* format: b1: packet length low
@@ -481,12 +481,23 @@ static struct sk_buff *dm9601_tx_fixup(sb3..n: packet data */ - len = skb->len; + len = skb->len +DM_TX_OVERHEAD ; -if (skb_headroom (skb) <DM_TX_OVERHEAD ) { +/* workaround for dm962x errata with tx fifo getting out of +* sync if a USB bulk transfer retry happens right after a +* packet with odd / maxpacket length by adding up to 3 bytes +* padding. +*/ +while ((len &1 ) || !(len % dev->maxpacket)) + len++; + + len -=DM_TX_OVERHEAD ;/* hw header doesn't count as part of length */ + pad = len - skb->len; + +if (skb_headroom (skb) <DM_TX_OVERHEAD ||skb_tailroom (skb) < pad) {struct sk_buff *skb2; - skb2 =skb_copy_expand (skb,DM_TX_OVERHEAD ,0 , flags); + skb2 =skb_copy_expand (skb,DM_TX_OVERHEAD , pad, flags);dev_kfree_skb_any (skb); skb = skb2;if (!skb)
@@ -495,10 +506,10 @@ static struct sk_buff *dm9601_tx_fixup(s__skb_push (skb,DM_TX_OVERHEAD ); -/* usbnet adds padding if length is a multiple of packet size -if so, adjust length value in header */ -if ((skb->len % dev->maxpacket) ==0 ) - len++; +if (pad) { +memset (skb->data + skb->len,0 , pad); +__skb_put (skb, pad); + } skb->data[0 ] = len; skb->data[1 ] = len >>8 ;
Greg Kroah-Hartman
maintainerPATCH 55/129 ath9k: Fix interrupt handling for the AR9002 family
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sujith Manoharan <[email protected]>
commit 73f0b56a1ff64e7fb6c3a62088804bab93bcedc2 upstream.
This patch adds a driver workaround for a HW issue.
A race condition in the HW results in missing interrupts, which can be avoided by a read/write with the ISR register. All chips in the AR9002 series are affected by this bug - AR9003 and above do not have this problem.
--- drivers/net/wireless/ath/ath9k/ar9002_mac.c | 52 +++++++++++++++++++++++----- 1 file changed, 43 insertions(+), 9 deletions(-)
drivers/net/wireless/ath/ath9k/ar9002_mac.c +43 -9
@@ -76,9 +76,16 @@ static bool ar9002_hw_get_isr(struct ath mask2 |=ATH9K_INT_CST ;if (isr2 &AR_ISR_S2_TSFOOR ) mask2 |=ATH9K_INT_TSFOOR ; + +if (!(pCap->hw_caps &ATH9K_HW_CAP_RAC_SUPPORTED )) { +REG_WRITE (ah,AR_ISR_S2 , isr2); + isr &= ~AR_ISR_BCNMISC ; + } } - isr =REG_READ (ah,AR_ISR_RAC ); +if (pCap->hw_caps &ATH9K_HW_CAP_RAC_SUPPORTED ) + isr =REG_READ (ah,AR_ISR_RAC ); +if (isr ==0xffffffff ) { *masked =0 ;return false;
@@ -97,11 +104,23 @@ static bool ar9002_hw_get_isr(struct ath *masked |=ATH9K_INT_TX ; - s0_s =REG_READ (ah,AR_ISR_S0_S ); +if (pCap->hw_caps &ATH9K_HW_CAP_RAC_SUPPORTED ) { + s0_s =REG_READ (ah,AR_ISR_S0_S ); + s1_s =REG_READ (ah,AR_ISR_S1_S ); + }else { + s0_s =REG_READ (ah,AR_ISR_S0 ); +REG_WRITE (ah,AR_ISR_S0 , s0_s); + s1_s =REG_READ (ah,AR_ISR_S1 ); +REG_WRITE (ah,AR_ISR_S1 , s1_s); + + isr &= ~(AR_ISR_TXOK | +AR_ISR_TXDESC | +AR_ISR_TXERR | +AR_ISR_TXEOL ); + } + ah->intr_txqs |=MS (s0_s,AR_ISR_S0_QCU_TXOK ); ah->intr_txqs |=MS (s0_s,AR_ISR_S0_QCU_TXDESC ); - - s1_s =REG_READ (ah,AR_ISR_S1_S ); ah->intr_txqs |=MS (s1_s,AR_ISR_S1_QCU_TXERR ); ah->intr_txqs |=MS (s1_s,AR_ISR_S1_QCU_TXEOL ); }
@@ -114,13 +133,15 @@ static bool ar9002_hw_get_isr(struct ath *masked |= mask2; } -if (AR_SREV_9100 (ah)) -return true; - -if (isr &AR_ISR_GENTMR ) { +if (!AR_SREV_9100 (ah) && (isr &AR_ISR_GENTMR )) {u32 s5_s; - s5_s =REG_READ (ah,AR_ISR_S5_S ); +if (pCap->hw_caps &ATH9K_HW_CAP_RAC_SUPPORTED ) { + s5_s =REG_READ (ah,AR_ISR_S5_S ); + }else { + s5_s =REG_READ (ah,AR_ISR_S5 ); + } + ah->intr_gen_timer_trigger =MS (s5_s,AR_ISR_S5_GENTIMER_TRIG );
@@ -133,8 +154,21 @@ static bool ar9002_hw_get_isr(struct athif ((s5_s &AR_ISR_S5_TIM_TIMER ) && !(pCap->hw_caps &ATH9K_HW_CAP_AUTOSLEEP )) *masked |=ATH9K_INT_TIM_TIMER ; + +if (!(pCap->hw_caps &ATH9K_HW_CAP_RAC_SUPPORTED )) { +REG_WRITE (ah,AR_ISR_S5 , s5_s); + isr &= ~AR_ISR_GENTMR ; + } + } + +if (!(pCap->hw_caps &ATH9K_HW_CAP_RAC_SUPPORTED )) { +REG_WRITE (ah,AR_ISR , isr); +REG_READ (ah,AR_ISR ); } +if (AR_SREV_9100 (ah)) +return true; +if (sync_cause) {ath9k_debug_sync_cause (common, sync_cause); fatal_int =
Greg Kroah-Hartman
maintainerPATCH 56/129 ath9k_htc: properly set MAC address and BSSID mask
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathy Vanhoef <[email protected]>
commit 657eb17d87852c42b55c4b06d5425baa08b2ddb3 upstream.
Pick the MAC address of the first virtual interface as the new hardware MAC address. Set BSSID mask according to this MAC address. This fixes CVE-2013-4579.
--- drivers/net/wireless/ath/ath9k/htc_drv_main.c | 25 +++++++++++++++++-------- drivers/net/wireless/ath/ath9k/main.c | 5 +++-- 2 files changed, 20 insertions(+), 10 deletions(-)
drivers/net/wireless/ath/ath9k/htc_drv_main.c +17 -8
@@ -145,21 +145,26 @@ static void ath9k_htc_bssid_iter(void *dstruct ath9k_vif_iter_data *iter_data = data;int i; -for (i =0 ; i <ETH_ALEN ; i++) - iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]); +if (iter_data->hw_macaddr !=NULL ) { +for (i =0 ; i <ETH_ALEN ; i++) + iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]); + }else { + iter_data->hw_macaddr = mac; + } } -static void ath9k_htc_set_bssid_mask (struct ath9k_htc_priv *priv, +static void ath9k_htc_set_mac_bssid_mask (struct ath9k_htc_priv *priv,struct ieee80211_vif *vif) {struct ath_common *common =ath9k_hw_common (priv->ah);struct ath9k_vif_iter_data iter_data;/* -* Use the hardware MAC address as reference, the hardware uses it -* together with the BSSID mask when matching addresses. +* Pick the MAC address of the first interface as the new hardware +* MAC address. The hardware will use it together with the BSSID mask +* when matching addresses. */ - iter_data.hw_macaddr = common->macaddr; + iter_data.hw_macaddr =NULL ;memset (&iter_data.mask,0xff ,ETH_ALEN );if (vif)
@@ -171,6 +176,10 @@ static void ath9k_htc_set_bssid_mask(str ath9k_htc_bssid_iter, &iter_data);memcpy (common->bssidmask, iter_data.mask,ETH_ALEN ); + +if (iter_data.hw_macaddr) +memcpy (common->macaddr, iter_data.hw_macaddr,ETH_ALEN ); +ath_hw_setbssidmask (common); }
@@ -1076,7 +1085,7 @@ static int ath9k_htc_add_interface(struc goto out; } -ath9k_htc_set_bssid_mask (priv, vif); +ath9k_htc_set_mac_bssid_mask (priv, vif); priv->vif_slot |= (1 << avp->index); priv->nvifs++;
@@ -1139,7 +1148,7 @@ static void ath9k_htc_remove_interface(sath9k_htc_set_opmode (priv); -ath9k_htc_set_bssid_mask (priv, vif); +ath9k_htc_set_mac_bssid_mask (priv, vif);/* * Stop ANI only if there are no associated station interfaces.
drivers/net/wireless/ath/ath9k/main.c +3 -2
@@ -889,8 +889,9 @@ void ath9k_calculate_iter_data(struct iestruct ath_common *common =ath9k_hw_common (ah);/* -* Use the hardware MAC address as reference, the hardware uses it -* together with the BSSID mask when matching addresses. +* Pick the MAC address of the first interface as the new hardware +* MAC address. The hardware will use it together with the BSSID mask +* when matching addresses. */ memset (iter_data,0 ,sizeof (*iter_data));memset (&iter_data->mask,0xff ,ETH_ALEN );
Greg Kroah-Hartman
maintainerPATCH 57/129 KVM: x86: Fix APIC map calculation after re-enabling
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <[email protected]>
commit e66d2ae7c67bd9ac982a3d1890564de7f7eabf4b upstream.
Update arch.apic_base before triggering recalculate_apic_map. Otherwise the recalculation will work against the previous state of the APIC and will fail to build the correct map when an APIC is hardware-enabled again.
This fixes a regression of 1e08ec4a13.
--- arch/x86/kvm/lapic.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/x86/kvm/lapic.c +4 -4
@@ -1364,6 +1364,10 @@ void kvm_lapic_set_base(struct kvm_vcpureturn ; } +if (!kvm_vcpu_is_bsp (apic->vcpu)) + value &= ~MSR_IA32_APICBASE_BSP ; + vcpu->arch.apic_base = value; +/* update jump label if enable bit changes */ if ((vcpu->arch.apic_base ^ value) &MSR_IA32_APICBASE_ENABLE ) {if (value &MSR_IA32_APICBASE_ENABLE )
@@ -1373,10 +1377,6 @@ void kvm_lapic_set_base(struct kvm_vcpurecalculate_apic_map (vcpu->kvm); } -if (!kvm_vcpu_is_bsp (apic->vcpu)) - value &= ~MSR_IA32_APICBASE_BSP ; - - vcpu->arch.apic_base = value;if ((old_value ^ value) &X2APIC_ENABLE ) {if (value &X2APIC_ENABLE ) {u32 id =kvm_apic_id (apic);
Greg Kroah-Hartman
maintainerPATCH 58/129 powerpc: Fix bad stack check in exception entry
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit 90ff5d688e61f49f23545ffab6228bd7e87e6dc7 upstream.
In EXCEPTION_PROLOG_COMMON() we check to see if the stack pointer (r1) is valid when coming from the kernel. If it's not valid, we die but with a nice oops message.
Currently we allocate a stack frame (subtract INT_FRAME_SIZE) before we check to see if the stack pointer is negative. Unfortunately, this won't detect a bad stack where r1 is less than INT_FRAME_SIZE.
This patch fixes the check to compare the modified r1 with -INT_FRAME_SIZE. With this, bad kernel stack pointers (including NULL pointers) are correctly detected again.
Kudos to Paulus for finding this.
--- arch/powerpc/include/asm/exception-64s.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/include/asm/exception-64s.h +1 -1
@@ -264,7 +264,7 @@ do_kvm_##n: \subi r1,r1,INT_FRAME_SIZE ;/* alloc frame on kernel stack */ \ beq-1f ; \ld r1,PACAKSAVE (r13 );/* kernel stack to use */ \ -1: cmpdi cr1,r1,0; /* check if r1 is in userspace */ \ +1: cmpdi cr1,r1,-INT_FRAME_SIZE; /* check if r1 is in userspace */ \ blt+ cr1,3f ;/* abort if it is */ \li r1,(n);/* will be reloaded later */ \sth r1,PACA_TRAP_SAVE (r13 ); \
Greg Kroah-Hartman
maintainerPATCH 59/129 powerpc: Align p_end
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit 286e4f90a72c0b0621dde0294af6ed4b0baddabb upstream.
p_end is an 8 byte value embedded in the text section. This means it is only 4 byte aligned when it should be 8 byte aligned. Fix this by adding an explicit alignment.
This fixes an issue where POWER7 little endian builds with CONFIG_RELOCATABLE=y fail to boot.
--- arch/powerpc/kernel/head_64.S | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/kernel/head_64.S +1 -0
@@ -467,6 +467,7 @@ _STATIC(__after_prom_start) mtctr r8 bctr +.balign 8 p_end: .llong _end - _stext 4: /* Now copy the rest of the kernel up to _end */
Greg Kroah-Hartman
maintainerPATCH 60/129 cpupower: Fix segfault due to incorrect getopt_long arugments
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Boyer <[email protected]>
commit f447ef4a56dee4b68a91460bcdfe06b5011085f2 upstream.
If a user calls 'cpupower set --perf-bias 15', the process will end with a SIGSEGV in libc because cpupower-set passes a NULL optarg to the atoi call. This is because the getopt_long structure currently has all of the options as having an optional_argument when they really have a required argument. We change the structure to use required_argument to match the short options and it resolves the issue.
This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1000439
--- tools/power/cpupower/utils/cpupower-set.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/power/cpupower/utils/cpupower-set.c +3 -3
@@ -18,9 +18,9 @@#include "helpers/bitmask.h" static struct option set_opts[] = { - { .name ="perf-bias" , .has_arg = optional_argument, .flag =NULL , .val ='b' }, - { .name ="sched-mc" , .has_arg = optional_argument, .flag =NULL , .val ='m' }, - { .name ="sched-smt" , .has_arg = optional_argument, .flag =NULL , .val ='s' }, + { .name ="perf-bias" , .has_arg = required_argument, .flag =NULL , .val ='b' }, + { .name ="sched-mc" , .has_arg = required_argument, .flag =NULL , .val ='m' }, + { .name ="sched-smt" , .has_arg = required_argument, .flag =NULL , .val ='s' }, { }, };
Greg Kroah-Hartman
maintainerPATCH 61/129 libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus SpinPoint M8
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michele Baldessari <[email protected]>
commit 87809942d3fa60bafb7a58d0bdb1c79e90a6821d upstream.
We've received multiple reports in Fedora via (BZ 907193) that the Seagate Momentus SpinPoint M8 errors out when enabling AA:
[ 2.555905] ata2.00: failed to enable AA (error_mask=0x1) [ 2.568482] ata2.00: failed to enable AA (error_mask=0x1)
Add the ATA_HORKAGE_BROKEN_FPDMA_AA for this specific harddisk.
--- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/ata/libata-core.c +3 -0
@@ -4140,6 +4140,9 @@ static const struct ata_blacklist_entry {"ST3320[68]13AS" ,"SD1[5-9]" ,ATA_HORKAGE_NONCQ | ATA_HORKAGE_FIRMWARE_WARN }, +/* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */ + { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, +/* Blacklist entries taken from Silicon Image 3124/3132 Windows driver .inf file - also several Linux problem reports */ { "HTS541060G9SA00", "MB3OC60D", ATA_HORKAGE_NONCQ, },
Greg Kroah-Hartman
maintainerPATCH 62/129 libata: Add atapi_dmadir force flag
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Pelletier <[email protected]>
commit 966fbe193f47c68e70a80ec9991098e88e7959cb upstream.
Some device require DMADIR to be enabled, but are not detected as such by atapi_id_dmadir. One such example is "Asus Serillel 2" SATA-host-to-PATA-device bridge: the bridge itself requires DMADIR, even if the bridged device does not.
As atapi_dmadir module parameter can cause problems with some devices (as per Tejun Heo's memory), enabling it globally may not be possible depending on the hardware.
This patch adds atapi_dmadir in the form of a "force" horkage value, allowing global, per-bus and per-device control.
--- Documentation/kernel-parameters.txt | 2 ++ drivers/ata/libata-core.c | 3 ++- include/linux/libata.h | 1 + 3 files changed, 5 insertions(+), 1 deletion(-)
Documentation/kernel-parameters.txt +2 -0
@@ -1456,6 +1456,8 @@ bytes respectively. Such letter suffixes * dump_id: dump IDENTIFY data. + * atapi_dmadir: Enable ATAPI DMADIR bridge support + If there are multiple matching configurations changing the same attribute, the last one is used.
drivers/ata/libata-core.c +2 -1
@@ -2401,7 +2401,7 @@ int ata_dev_configure(struct ata_device cdb_intr_string =", CDB intr" ; } -if (atapi_dmadir ||atapi_id_dmadir (dev->id)) { +if (atapi_dmadir || (dev->horkage &ATA_HORKAGE_ATAPI_DMADIR ) ||atapi_id_dmadir (dev->id)) { dev->flags |=ATA_DFLAG_DMADIR ; dma_dir_string =", DMADIR" ; }
@@ -6506,6 +6506,7 @@ static int __init ata_parse_force_one(ch { "nosrst", .lflags = ATA_LFLAG_NO_SRST }, { "norst", .lflags = ATA_LFLAG_NO_HRST | ATA_LFLAG_NO_SRST }, { "rstonce", .lflags = ATA_LFLAG_RST_ONCE }, + { "atapi_dmadir", .horkage_on = ATA_HORKAGE_ATAPI_DMADIR }, };char *start = *cur, *p = *cur;char *id, *val, *endp;
include/linux/libata.h +1 -0
@@ -399,6 +399,7 @@ enum {ATA_HORKAGE_BROKEN_FPDMA_AA = (1 <<15 ),/* skip AA */ ATA_HORKAGE_DUMP_ID = (1 <<16 ),/* dump IDENTIFY data */ ATA_HORKAGE_MAX_SEC_LBA48 = (1 <<17 ),/* Set max sects to 65535 */ + ATA_HORKAGE_ATAPI_DMADIR = (1 << 18), /* device requires dmadir *//* DMA mask for user DMA control: User visible values; DO NOT renumber */
Greg Kroah-Hartman
maintainerPATCH 63/129 libata: disable a disk via libata.force params
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Robin H. Johnson" <[email protected]>
commit b8bd6dc36186fe99afa7b73e9e2d9a98ad5c4865 upstream.
A user on StackExchange had a failing SSD that's soldered directly onto the motherboard of his system. The BIOS does not give any option to disable it at all, so he can't just hide it from the OS via the BIOS.
The old IDE layer had hdX=noprobe override for situations like this, but that was never ported to the libata layer.
This patch implements a disable flag for libata.force.
Example use:
libata.force=2.0:disable
[v2 of the patch, removed the nodisable flag per Tejun Heo]
--- Documentation/kernel-parameters.txt | 2 ++ drivers/ata/libata-core.c | 1 + 2 files changed, 3 insertions(+)
Documentation/kernel-parameters.txt +2 -0
@@ -1458,6 +1458,8 @@ bytes respectively. Such letter suffixes * atapi_dmadir: Enable ATAPI DMADIR bridge support + * disable: Disable this device. + If there are multiple matching configurations changing the same attribute, the last one is used.
drivers/ata/libata-core.c +1 -0
@@ -6507,6 +6507,7 @@ static int __init ata_parse_force_one(ch { "norst", .lflags = ATA_LFLAG_NO_HRST | ATA_LFLAG_NO_SRST }, { "rstonce", .lflags = ATA_LFLAG_RST_ONCE }, { "atapi_dmadir", .horkage_on = ATA_HORKAGE_ATAPI_DMADIR }, + { "disable", .horkage_on = ATA_HORKAGE_DISABLE }, };char *start = *cur, *p = *cur;char *id, *val, *endp;
Greg Kroah-Hartman
maintainerPATCH 65/129 radiotap: fix bitmap-end-finding buffer overrun
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
commit bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575 upstream.
Evan Huus found (by fuzzing in wireshark) that the radiotap iterator code can access beyond the length of the buffer if the first bitmap claims an extension but then there's no data at all. Fix this.
--- net/wireless/radiotap.c | 4 ++++ 1 file changed, 4 insertions(+)
net/wireless/radiotap.c +4 -0
@@ -124,6 +124,10 @@ int ieee80211_radiotap_iterator_init(/* find payload start allowing for extended bitmap(s) */ if (iterator->_bitmap_shifter & (1 <<IEEE80211_RADIOTAP_EXT )) { +if ((unsigned long )iterator->_arg - + (unsigned long )iterator->_rtheader +sizeof (uint32_t ) > + (unsigned long )iterator->_max_length) +return -EINVAL ;while (get_unaligned_le32 (iterator->_arg) & (1 <<IEEE80211_RADIOTAP_EXT )) { iterator->_arg +=sizeof (uint32_t );
Greg Kroah-Hartman
maintainerPATCH 66/129 rtlwifi: pci: Fix oops on driver unload
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <[email protected]>
commit 9278db6279e28d4d433bc8a848e10b4ece8793ed upstream.
On Fedora systems, unloading rtl8192ce causes an oops. This patch fixes the problem reported at https://bugzilla.redhat.com/show_bug.cgi?id=852761.
--- drivers/net/wireless/rtlwifi/pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/rtlwifi/pci.c +3 -1
@@ -734,6 +734,8 @@ static void _rtl_pci_rx_interrupt(struct };int index = rtlpci->rx_ring[rx_queue_idx].idx; +if (rtlpci->driver_is_goingto_unload) +return ;/*RX NORMAL PKT */ while (count--) {/*rx descriptor */
@@ -1630,6 +1632,7 @@ static void rtl_pci_stop(struct ieee8021*/ set_hal_stop (rtlhal); + rtlpci->driver_is_goingto_unload = true; rtlpriv->cfg->ops->disable_interrupt (hw);cancel_work_sync (&rtlpriv->works.lps_change_work);
@@ -1647,7 +1650,6 @@ static void rtl_pci_stop(struct ieee8021 ppsc->rfchange_inprogress = true;spin_unlock_irqrestore (&rtlpriv->locks.rf_ps_lock, flags); - rtlpci->driver_is_goingto_unload = true; rtlpriv->cfg->ops->hw_disable (hw);/* some things are not needed if firmware not available */ if (!rtlpriv->max_fw_size)
Greg Kroah-Hartman
maintainerPATCH 67/129 intel_pstate: Fail initialization if P-state information is missing
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <[email protected]>
commit 98a947abdd54e5de909bebadfced1696ccad30cf upstream.
If pstate.current_pstate is 0 after the initial intel_pstate_get_cpu_pstates(), this means that we were unable to obtain any useful P-state information and there is no reason to continue, so free memory and return an error in that case.
This fixes the following divide error occuring in a nested KVM guest:
Intel P-state driver initializing.
Intel pstate controlling: cpu 0
cpufreq: __cpufreq_add_dev: ->get() failed
divide error: 0000 [#1] SMP
Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.13.0-0.rc4.git5.1.fc21.x86_64 #1 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 task: ffff88001ea20000 ti: ffff88001e9bc000 task.ti: ffff88001e9bc000 RIP: 0010:[<ffffffff815c551d>] [<ffffffff815c551d>] intel_pstate_timer_func+0x11d/0x2b0 RSP: 0000:ffff88001ee03e18 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88001a454348 RCX: 0000000000006100 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88001ee03e38 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88001ea20000 R11: 0000000000000000 R12: 00000c0a1ea20000 R13: 1ea200001ea20000 R14: ffffffff815c5400 R15: ffff88001a454348 FS: 0000000000000000(0000) GS:ffff88001ee00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000000 CR3: 0000000001c0c000 CR4: 00000000000006f0 Stack: fffffffb1a454390 ffffffff821a4500 ffff88001a454390 0000000000000100 ffff88001ee03ea8 ffffffff81083e9a ffffffff81083e15 ffffffff82d5ed40 ffffffff8258cc60 0000000000000000 ffffffff81ac39de 0000000000000000 Call Trace: <IRQ> [<ffffffff81083e9a>] call_timer_fn+0x8a/0x310 [<ffffffff81083e15>] ? call_timer_fn+0x5/0x310 [<ffffffff815c5400>] ? pid_param_set+0x130/0x130 [<ffffffff81084354>] run_timer_softirq+0x234/0x380 [<ffffffff8107aee4>] __do_softirq+0x104/0x430 [<ffffffff8107b5fd>] irq_exit+0xcd/0xe0 [<ffffffff81770645>] smp_apic_timer_interrupt+0x45/0x60 [<ffffffff8176efb2>] apic_timer_interrupt+0x72/0x80 <EOI> [<ffffffff810e15cd>] ? vprintk_emit+0x1dd/0x5e0 [<ffffffff81757719>] printk+0x67/0x69 [<ffffffff815c1493>] __cpufreq_add_dev.isra.13+0x883/0x8d0 [<ffffffff815c14f0>] cpufreq_add_dev+0x10/0x20 [<ffffffff814a14d1>] subsys_interface_register+0xb1/0xf0 [<ffffffff815bf5cf>] cpufreq_register_driver+0x9f/0x210 [<ffffffff81fb19af>] intel_pstate_init+0x27d/0x3be [<ffffffff81761e3e>] ? mutex_unlock+0xe/0x10 [<ffffffff81fb1732>] ? cpufreq_gov_dbs_init+0x12/0x12 [<ffffffff8100214a>] do_one_initcall+0xfa/0x1b0 [<ffffffff8109dbf5>] ? parse_args+0x225/0x3f0 [<ffffffff81f64193>] kernel_init_freeable+0x1fc/0x287 [<ffffffff81f638d0>] ? do_early_param+0x88/0x88 [<ffffffff8174b530>] ? rest_init+0x150/0x150 [<ffffffff8174b53e>] kernel_init+0xe/0x130 [<ffffffff8176e27c>] ret_from_fork+0x7c/0xb0 [<ffffffff8174b530>] ? rest_init+0x150/0x150 Code: c1 e0 05 48 63 bc 03 10 01 00 00 48 63 83 d0 00 00 00 48 63 d6 48 c1 e2 08 c1 e1 08 4c 63 c2 48 c1 e0 08 48 98 48 c1 e0 08 48 99 <49> f7 f8 48 98 48 0f af f8 48 c1 ff 08 29 f9 89 ca c1 fa 1f 89 RIP [<ffffffff815c551d>] intel_pstate_timer_func+0x11d/0x2b0 RSP <ffff88001ee03e18> ---[ end trace f166110ed22cc37a ]--- Kernel panic - not syncing: Fatal exception in interrupt
--- drivers/cpufreq/intel_pstate.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/cpufreq/intel_pstate.c +5 -0
@@ -543,6 +543,11 @@ static int intel_pstate_init_cpu(unsigne cpu = all_cpu_data[cpunum];intel_pstate_get_cpu_pstates (cpu); +if (!cpu->pstate.current_pstate) { + all_cpu_data[cpunum] =NULL ; +kfree (cpu); +return -ENODATA ; + } cpu->cpu = cpunum; cpu->pstate_policy =
Greg Kroah-Hartman
maintainerPATCH 68/129 Revert "of/address: Handle #address-cells > 2 specially"
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
commit 13fcca8f25f4e9ce7f55da9cd353bb743236e212 upstream.
This reverts commit e38c0a1fbc5803cbacdaac0557c70ac8ca5152e7.
Nikita Yushchenko reports:
While trying to make freescale p2020ds and mpc8572ds boards working with mainline kernel, I faced that commit e38c0a1f (Handle
Both these boards have uli1575 chip. Corresponding part in device tree is something like
uli1575@0 {
reg = <0x0 0x0 0x0 0x0 0x0>;
#size-cells = <2>;
#address-cells = <3>;
ranges = <0x2000000 0x0 0x80000000
0x2000000 0x0 0x80000000
0x0 0x20000000
0x1000000 0x0 0x0
0x1000000 0x0 0x0
0x0 0x10000>;
isa@1e {...
I.e. it has #address-cells = <3>
With commit e38c0a1f reverted, devices under uli1575 are registered correctly, e.g. for rtc
OF: ** translation for device /pcie@ffe09000/pcie@0/uli1575@0/isa@1e/rtc@70 **
OF: bus is isa (na=2, ns=1) on /pcie@ffe09000/pcie@0/uli1575@0/isa@1e
OF: translating address: 00000001 00000070
OF: parent bus is default (na=3, ns=2) on /pcie@ffe09000/pcie@0/uli1575@0
OF: walking ranges...
OF: ISA map, cp=0, s=1000, da=70
OF: parent translation for: 01000000 00000000 00000000
OF: with offset: 70
OF: one level translation: 00000000 00000000 00000070
OF: parent bus is pci (na=3, ns=2) on /pcie@ffe09000/pcie@0
OF: walking ranges...
OF: default map, cp=a0000000, s=20000000, da=70
OF: default map, cp=0, s=10000, da=70
OF: parent translation for: 01000000 00000000 00000000
OF: with offset: 70
OF: one level translation: 01000000 00000000 00000070
OF: parent bus is pci (na=3, ns=2) on /pcie@ffe09000
OF: walking ranges...
OF: PCI map, cp=0, s=10000, da=70
OF: parent translation for: 01000000 00000000 00000000
OF: with offset: 70
OF: one level translation: 01000000 00000000 00000070
OF: parent bus is default (na=2, ns=2) on /
OF: walking ranges...
OF: PCI map, cp=0, s=10000, da=70
OF: parent translation for: 00000000 ffc10000
OF: with offset: 70
OF: one level translation: 00000000 ffc10070
OF: reached root node
With commit e38c0a1f in place, address translation fails:
OF: ** translation for device /pcie@ffe09000/pcie@0/uli1575@0/isa@1e/rtc@70 **
OF: bus is isa (na=2, ns=1) on /pcie@ffe09000/pcie@0/uli1575@0/isa@1e
OF: translating address: 00000001 00000070
OF: parent bus is default (na=3, ns=2) on /pcie@ffe09000/pcie@0/uli1575@0
OF: walking ranges...
OF: ISA map, cp=0, s=1000, da=70
OF: parent translation for: 01000000 00000000 00000000
OF: with offset: 70
OF: one level translation: 00000000 00000000 00000070
OF: parent bus is pci (na=3, ns=2) on /pcie@ffe09000/pcie@0
OF: walking ranges...
OF: default map, cp=a0000000, s=20000000, da=70
OF: default map, cp=0, s=10000, da=70
OF: not found !
Thierry Reding confirmed this commit was not needed after all:
"We ended up merging a different address representation for Tegra PCIe and I've confirmed that reverting this commit doesn't cause any obvious regressions. I think all other drivers in drivers/pci/host ended up copying what we did on Tegra, so I wouldn't expect any other breakage either."
There doesn't appear to be a simple way to support both behaviours, so reverting this as nothing should be depending on the new behaviour.
--- drivers/of/address.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/of/address.c +0 -8
@@ -69,14 +69,6 @@ static u64 of_bus_default_map(__be32 *ad (unsigned long long )cp, (unsigned long long )s, (unsigned long long)da); -/* -* If the number of address cells is larger than 2 we assume the -* mapping doesn't specify a physical address. Rather, the address -* specifies an identifier that must match exactly. -*/ -if (na >2 &&memcmp (range, addr, na *4 ) !=0 ) -return OF_BAD_ADDR ; -if (da < cp || da >= (cp + s))return OF_BAD_ADDR ;return da - cp;
Greg Kroah-Hartman
maintainerPATCH 69/129 mm: clear pmd_numa before invalidating
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <[email protected]>
commit 67f87463d3a3362424efcbe8b40e4772fd34fc61 upstream.
On x86, PMD entries are similar to _PAGE_PROTNONE protection and are handled as NUMA hinting faults. The following two page table protection bits are what defines them
_PAGE_NUMA:set _PAGE_PRESENT:clear
A PMD is considered present if any of the _PAGE_PRESENT, _PAGE_PROTNONE, _PAGE_PSE or _PAGE_NUMA bits are set. If pmdp_invalidate encounters a pmd_numa, it clears the present bit leaving _PAGE_NUMA which will be considered not present by the CPU but present by pmd_present. The existing caller of pmdp_invalidate should handle it but it's an inconsistent state for a PMD. This patch keeps the state consistent when calling pmdp_invalidate.
--- mm/pgtable-generic.c | 3 +++ 1 file changed, 3 insertions(+)
mm/pgtable-generic.c +3 -0
@@ -166,6 +166,9 @@ pgtable_t pgtable_trans_huge_withdraw(stvoid pmdp_invalidate (struct vm_area_struct *vma,unsigned long address,pmd_t *pmdp) { +pmd_t entry = *pmdp; +if (pmd_numa (entry)) + entry =pmd_mknonnuma (entry);set_pmd_at (vma->vm_mm, address, pmdp,pmd_mknotpresent (*pmdp));flush_tlb_range (vma, address, address +HPAGE_PMD_SIZE ); }
Greg Kroah-Hartman
maintainerPATCH 70/129 mm: numa: ensure anon_vma is locked to prevent parallel THP splits
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <[email protected]>
commit c3a489cac38d43ea6dc4ac240473b44b46deecf7 upstream.
The anon_vma lock prevents parallel THP splits and any associated complexity that arises when handling splits during THP migration. This patch checks if the lock was successfully acquired and bails from THP migration if it failed for any reason.
--- mm/huge_memory.c | 7 +++++++ 1 file changed, 7 insertions(+)
mm/huge_memory.c +7 -0
@@ -1344,6 +1344,13 @@ int do_huge_pmd_numa_page(struct mm_stru goto out_unlock; } +/* Bail if we fail to protect against THP splits for any reason */ +if (unlikely (!anon_vma)) { +put_page (page); + page_nid =-1 ; + goto clear_pmdnuma; + } +/* * Migrate the THP to the requested node, returns with page unlocked * and pmd_numa cleared.
Greg Kroah-Hartman
maintainerPATCH 71/129 mm: numa: avoid unnecessary work on the failure path
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <[email protected]>
commit eb4489f69f224356193364dc2762aa009738ca7f upstream.
If a PMD changes during a THP migration then migration aborts but the failure path is doing more work than is necessary.
--- mm/migrate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
mm/migrate.c +3 -1
@@ -1715,7 +1715,8 @@ int migrate_misplaced_transhuge_page(strputback_lru_page (page);mod_zone_page_state (page_zone (page),NR_ISOLATED_ANON + page_lru, -HPAGE_PMD_NR ); - goto out_fail; + + goto out_unlock; }/*
@@ -1765,6 +1766,7 @@ out_dropref:set_pmd_at (mm, haddr, pmd, entry);update_mmu_cache_pmd (vma, address, &entry); +out_unlock:unlock_page (page);put_page (page);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 72/129 sched: fix the theoretical signal_wake_up() vs schedule() race
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit e0acd0a68ec7dbf6b7a81a87a867ebd7ac9b76c4 upstream.
This is only theoretical, but after try_to_wake_up(p) was changed to check p->state under p->pi_lock the code like
__set_current_state(TASK_INTERRUPTIBLE); schedule();
can miss a signal. This is the special case of wait-for-condition, it relies on try_to_wake_up/schedule interaction and thus it does not need mb() between __set_current_state() and if(signal_pending).
However, this __set_current_state() can move into the critical section protected by rq->lock, now that try_to_wake_up() takes another lock we need to ensure that it can't be reordered with "if (signal_pending(current))" check inside that section.
The patch is actually one-liner, it simply adds smp_wmb() before spin_lock_irq(rq->lock). This is what try_to_wake_up() already does by the same reason.
We turn this wmb() into the new helper, smp_mb__before_spinlock(), for better documentation and to allow the architectures to change the default implementation.
While at it, kill smp_mb__after_lock(), it has no callers.
Perhaps we can also add smp_mb__before/after_spinunlock() for prepare_to_wait().
--- arch/x86/include/asm/spinlock.h | 4 ---- include/linux/spinlock.h | 14 +++++++++++--- kernel/sched/core.c | 14 +++++++++++++- 3 files changed, 24 insertions(+), 8 deletions(-)
arch/x86/include/asm/spinlock.h +0 -4
@@ -233,8 +233,4 @@ static inline void arch_write_unlock(arc#define arch_read_relax (lock) cpu_relax()#define arch_write_relax (lock) cpu_relax() -/* The {read|write|spin}_lock() on x86 are full memory barriers. */ -static inline void smp_mb__after_lock (void ) { } -#define ARCH_HAS_SMP_MB_AFTER_LOCK -#endif /* _ASM_X86_SPINLOCK_H */
include/linux/spinlock.h +11 -3
@@ -117,9 +117,17 @@ do { \#endif /*arch_spin_is_contended*/ #endif -/* The lock does not imply full memory barrier. */ -#ifndef ARCH_HAS_SMP_MB_AFTER_LOCK -static inline void smp_mb__after_lock (void ) {smp_mb (); } +/* +* Despite its name it doesn't necessarily has to be a full barrier. +* It should only guarantee that a STORE before the critical section +* can not be reordered with a LOAD inside this section. +* spin_lock() is the one-way barrier, this LOAD can not escape out +* of the region. So the default implementation simply ensures that +* a STORE can not move into the critical section, smp_wmb() should +* serialize it with another STORE done by spin_lock(). +*/ +#ifndef smp_mb__before_spinlock +#define smp_mb__before_spinlock () smp_wmb()#endif /**
kernel/sched/core.c +13 -1
@@ -1487,7 +1487,13 @@ try_to_wake_up(struct task_struct *p, ununsigned long flags;int cpu, success =0 ; -smp_wmb (); +/* +* If we are going to wake up a thread waiting for CONDITION we +* need to ensure that CONDITION=1 done by the caller can not be +* reordered with p->state check below. This pairs with mb() in +* set_current_state() the waiting thread does. +*/ +smp_mb__before_spinlock ();raw_spin_lock_irqsave (&p->pi_lock, flags);if (!(p->state & state)) goto out;
@@ -2966,6 +2972,12 @@ need_resched:if (sched_feat (HRTICK ))hrtick_clear (rq); +/* +* Make sure that signal_pending_state()->signal_pending() below +* can't be reordered with __set_current_state(TASK_INTERRUPTIBLE) +* done by the caller to avoid the race with signal_wake_up(). +*/ +smp_mb__before_spinlock ();raw_spin_lock_irq (&rq->lock); switch_count = &prev->nivcsw;
Greg Kroah-Hartman
maintainerPATCH 73/129 mm: fix TLB flush race between migration, and change_protection_range
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
commit 20841405940e7be0617612d521e206e4b6b325db upstream.
There are a few subtle races, between change_protection_range (used by mprotect and change_prot_numa) on one side, and NUMA page migration and compaction on the other side.
The basic race is that there is a time window between when the PTE gets made non-present (PROT_NONE or NUMA), and the TLB is flushed.
During that time, a CPU may continue writing to the page.
This is fine most of the time, however compaction or the NUMA migration code may come in, and migrate the page away.
When that happens, the CPU may continue writing, through the cached translation, to what is no longer the current memory location of the process.
This only affects x86, which has a somewhat optimistic pte_accessible. All other architectures appear to be safe, and will either always flush, or flush whenever there is a valid mapping, even with no permissions (SPARC).
The basic race looks like this:
CPU A CPU B CPU C
load TLB entry
make entry PTE/PMD_NUMA
fault on entry
read/write old page
start migrating page
change PTE/PMD to new page
read/write old page [*]
flush TLB
reload TLB from new entry read/write new page lose data
[*] the old page may belong to a new user at this point!
The obvious fix is to flush remote TLB entries, by making sure that pte_accessible aware of the fact that PROT_NONE and PROT_NUMA memory may still be accessible if there is a TLB flush pending for the mm.
This should fix both NUMA migration and compaction.
--- arch/sparc/include/asm/pgtable_64.h | 4 +-- arch/x86/include/asm/pgtable.h | 11 +++++++-- include/asm-generic/pgtable.h | 2 - include/linux/mm_types.h | 44 ++++++++++++++++++++++++++++++++++++ kernel/fork.c | 1 mm/huge_memory.c | 7 +++++ mm/mprotect.c | 2 + mm/pgtable-generic.c | 5 ++-- 8 files changed, 69 insertions(+), 7 deletions(-)
arch/sparc/include/asm/pgtable_64.h +2 -2
@@ -616,7 +616,7 @@ static inline unsigned long pte_present( }#define pte_accessible pte_accessible -static inline unsigned long pte_accessible (pte_t a) +static inline unsigned long pte_accessible (struct mm_struct *mm,pte_t a) {return pte_val (a) & _PAGE_VALID; }
@@ -806,7 +806,7 @@ static inline void __set_pte_at(struct m* SUN4V NOTE: _PAGE_VALID is the same value in both the SUN4U * and SUN4V pte layout, so this inline test is fine. */ -if (likely (mm != &init_mm) &&pte_accessible (orig)) +if (likely (mm != &init_mm) &&pte_accessible (mm, orig))tlb_batch_add (mm, addr, ptep, orig, fullmm); }
arch/x86/include/asm/pgtable.h +9 -2
@@ -415,9 +415,16 @@ static inline int pte_present(pte_t a) }#define pte_accessible pte_accessible -static inline int pte_accessible (pte_t a) +static inline bool pte_accessible (struct mm_struct *mm,pte_t a) { -return pte_flags (a) & _PAGE_PRESENT; +if (pte_flags (a) & _PAGE_PRESENT) +return true; + +if ((pte_flags (a) & (_PAGE_PROTNONE | _PAGE_NUMA)) && +mm_tlb_flush_pending (mm)) +return true; + +return false; }static inline int pte_hidden (pte_t pte)
include/asm-generic/pgtable.h +1 -1
@@ -220,7 +220,7 @@ static inline int pmd_same(pmd_t pmd_a,#endif #ifndef pte_accessible -# define pte_accessible (pte) ((void)(pte),1) +# define pte_accessible (mm, pte) ((void)(pte), 1)#endif #ifndef flush_tlb_fix_spurious_fault
include/linux/mm_types.h +44 -0
54 lines not on this page · raw message
kernel/fork.c +1 -0
@@ -544,6 +544,7 @@ static struct mm_struct *mm_init(struct mm->cached_hole_size = ~0UL ;mm_init_aio (mm);mm_init_owner (mm, p); +clear_tlb_flush_pending (mm);if (likely (!mm_alloc_pgd (mm))) { mm->def_flags =0 ;
mm/huge_memory.c +7 -0
@@ -1352,6 +1352,13 @@ int do_huge_pmd_numa_page(struct mm_stru }/* +* The page_table_lock above provides a memory barrier +* with change_protection_range. +*/ +if (mm_tlb_flush_pending (mm)) +flush_tlb_range (vma, haddr, haddr +HPAGE_PMD_SIZE ); + +/* * Migrate the THP to the requested node, returns with page unlocked * and pmd_numa cleared. */
mm/mprotect.c +2 -0
@@ -206,6 +206,7 @@ static unsigned long change_protection_rBUG_ON (addr >= end); pgd =pgd_offset (mm, addr);flush_cache_range (vma, addr, end); +set_tlb_flush_pending (mm); do { next = pgd_addr_end(addr, end); if (pgd_none_or_clear_bad(pgd))
@@ -217,6 +218,7 @@ static unsigned long change_protection_r/* Only flush the TLB if we actually modified any entries: */ if (pages)flush_tlb_range (vma, start, end); +clear_tlb_flush_pending (mm);return pages; }
mm/pgtable-generic.c +3 -2
@@ -86,9 +86,10 @@ int pmdp_clear_flush_young(struct vm_arepte_t ptep_clear_flush (struct vm_area_struct *vma,unsigned long address,pte_t *ptep) { +struct mm_struct *mm = (vma)->vm_mm;pte_t pte; - pte =ptep_get_and_clear ((vma)->vm_mm, address, ptep); -if (pte_accessible (pte)) + pte =ptep_get_and_clear (mm, address, ptep); +if (pte_accessible (mm, pte))flush_tlb_page (vma, address);return pte; }
Greg Kroah-Hartman
maintainerPATCH 74/129 mm: numa: guarantee that tlb_flush_pending updates are visible before page table updates
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <[email protected]>
commit af2c1401e6f9177483be4fad876d0073669df9df upstream.
According to documentation on barriers, stores issued before a LOCK can complete after the lock implying that it's possible tlb_flush_pending can be visible after a page table update. As per revised documentation, this patch adds a smp_mb__before_spinlock to guarantee the correct ordering.
--- include/linux/mm_types.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
include/linux/mm_types.h +6 -1
@@ -480,7 +480,12 @@ static inline bool mm_tlb_flush_pending(static inline void set_tlb_flush_pending (struct mm_struct *mm) { mm->tlb_flush_pending = true; -barrier (); + +/* +* Guarantee that the tlb_flush_pending store does not leak into the +* critical section updating the page tables +*/ +smp_mb__before_spinlock (); }/* Clearing is done after a TLB flush, which also provides a barrier. */ static inline void clear_tlb_flush_pending (struct mm_struct *mm)
Greg Kroah-Hartman
maintainerPATCH 75/129 mm/mempolicy: correct putback method for isolate pages if failed
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joonsoo Kim <[email protected]>
commit b0e5fd7359f1ce8db4ccb862b3aa80d2f2cbf4d0 upstream.
queue_pages_range() isolates hugetlbfs pages and putback_lru_pages() can't handle these. We should change it to putback_movable_pages().
Naoya said that it is worth going into stable, because it can break in-use hugepage list.
--- mm/mempolicy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/mempolicy.c +1 -1
@@ -1271,7 +1271,7 @@ static long do_mbind(unsigned long startif (nr_failed && (flags &MPOL_MF_STRICT )) err = -EIO ; }else -putback_lru_pages (&pagelist); +putback_movable_pages (&pagelist);up_write (&mm->mmap_sem); mpol_out:
Re: [PATCH 3.10 075/129] mm/mempolicy: correct putback method for isolate pages if failed
Quoted 1 line · Greg Kroah-Hartman
3.10-stable review patch. If anyone has any objections, please let me know.
This commit was tagged for 3.12 stable only, so you may want to drop it.
Cheers,
--
Luis
Quoted 48 lines
------------------
From: Joonsoo Kim <[email protected]>
commit
b0e5fd7359f1ce8db4ccb862b3aa80d2f2cbf4d0upstream.
queue_pages_range()isolates hugetlbfs pages andputback_lru_pages()can't handle these. We should change it toputback_movable_pages().Naoya said that it is worth going into stable, because it can break in-use hugepage list.
Signed-off-by Joonsoo Kim <[email protected]>Acked-by Rafael Aquini <[email protected]>Reviewed-by Naoya Horiguchi <[email protected]>Reviewed-by Wanpeng Li <[email protected]>Cc Christoph Lameter <[email protected]>Cc Vlastimil Babka <[email protected]>Cc Wanpeng Li <[email protected]>Cc Mel Gorman <[email protected]>Cc Rik van Riel <[email protected]>Cc Vlastimil Babka <[email protected]>Cc Zhang Yanfei <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- mm/mempolicy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)mm/mempolicy.c +1
-2@@ -1271,7 +1271,7 @@ static long do_mbind(unsigned long startif (nr_failed && (flags &MPOL_MF_STRICT )) err = -EIO ; }else -putback_lru_pages (&pagelist); +putback_movable_pages (&pagelist);up_write (&mm->mmap_sem); mpol_out: --To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Greg Kroah-Hartman
maintainerRe: [PATCH 3.10 075/129] mm/mempolicy: correct putback method for isolate pages if failed
Quoted 4 lines · Luis Henriques
Quoted 1 line · Greg Kroah-Hartman
3.10-stable review patch. If anyone has any objections, please let me know.
This commit was tagged for 3.12 stable only, so you may want to drop it.
Thanks, somehow missed, that, now dropped.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 76/129 mm/compaction: respect ignore_skip_hint in update_pageblock_skip
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joonsoo Kim <[email protected]>
commit 6815bf3f233e0b10c99a758497d5d236063b010b upstream.
update_pageblock_skip() only fits to compaction which tries to isolate by pageblock unit. If isolate_migratepages_range() is called by CMA, it try to isolate regardless of pageblock unit and it don't reference get_pageblock_skip() by ignore_skip_hint. We should also respect it on update_pageblock_skip() to prevent from setting the wrong information.
--- mm/compaction.c | 4 ++++ 1 file changed, 4 insertions(+)
mm/compaction.c +4 -0
@@ -134,6 +134,10 @@ static void update_pageblock_skip(struct bool migrate_scanner) {struct zone *zone = cc->zone; + +if (cc->ignore_skip_hint) +return ; +if (!page)return ;
Greg Kroah-Hartman
maintainerPATCH 77/129 mm/hugetlb: check for pte NULL pointer in __page_check_address()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianguo Wu <[email protected]>
commit 98398c32f6687ee1e1f3ae084effb4b75adb0747 upstream.
In __page_check_address(), if address's pud is not present, huge_pte_offset() will return NULL, we should check the return value.
--- mm/rmap.c | 4 ++++ 1 file changed, 4 insertions(+)
mm/rmap.c +4 -0
@@ -600,7 +600,11 @@ pte_t *__page_check_address(struct pagespinlock_t *ptl;if (unlikely (PageHuge (page))) { +/* when pud is not present, pte will be NULL */ pte =huge_pte_offset (mm, address); +if (!pte) +return NULL ; + ptl = &mm->page_table_lock; goto check; }
Greg Kroah-Hartman
maintainerPATCH 78/129 mm: fix use-after-free in sys_remap_file_pages
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
commit 4eb919825e6c3c7fb3630d5621f6d11e98a18b3a upstream.
remap_file_pages calls mmap_region, which may merge the VMA with other existing VMAs, and free "vma". This can lead to a use-after-free bug. Avoid the bug by remembering vm_flags before calling mmap_region, and not trying to dereference vma later.
--- mm/fremap.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
mm/fremap.c +5 -3
@@ -203,9 +203,10 @@ get_write_lock:if (mapping_cap_account_dirty (mapping)) {unsigned long addr;struct file *file =get_file (vma->vm_file); +/* mmap_region may free vma; grab the info now */ + vm_flags = vma->vm_flags; - addr =mmap_region (file, start, size, - vma->vm_flags, pgoff); + addr =mmap_region (file, start, size, vm_flags, pgoff);fput (file);if (IS_ERR_VALUE (addr)) { err = addr;
@@ -213,7 +214,7 @@ get_write_lock:BUG_ON (addr != start); err =0 ; } - goto out; + goto out_freed; }mutex_lock (&mapping->i_mmap_mutex);flush_dcache_mmap_lock (mapping);
@@ -248,6 +249,7 @@ get_write_lock: out:if (vma) vm_flags = vma->vm_flags; +out_freed:if (likely (!has_write_lock))up_read (&mm->mmap_sem);else
Greg Kroah-Hartman
maintainerPATCH 79/129 mm/memory-failure.c: transfer page count from head page to tail page after split thp
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naoya Horiguchi <[email protected]>
commit a3e0f9e47d5ef7858a26cc12d90ad5146e802d47 upstream.
Memory failures on thp tail pages cause kernel panic like below:
mce: [Hardware Error]: Machine check events logged MCE exception done on CPU 7
BUG: unable to handle kernel NULL pointer dereference at 0000000000000058
IP: [<ffffffff811b7cd1>] dequeue_hwpoisoned_huge_page+0x131/0x1e0
PGD bae42067 PUD ba47d067 PMD 0
Oops: 0000 [#1] SMP
...
CPU: 7 PID: 128 Comm: kworker/7:2 Tainted: G M O 3.13.0-rc4-131217-1558-00003-g83b7df08e462 #25
...
Call Trace:
me_huge_page+0x3e/0x50
memory_failure+0x4bb/0xc20
mce_process_work+0x3e/0x70
process_one_work+0x171/0x420
worker_thread+0x11b/0x3a0
? manage_workers.isra.25+0x2b0/0x2b0
kthread+0xe4/0x100
? kthread_create_on_node+0x190/0x190
ret_from_fork+0x7c/0xb0
? kthread_create_on_node+0x190/0x190
...
RIP dequeue_hwpoisoned_huge_page+0x131/0x1e0
CR2: 0000000000000058The reasoning of this problem is shown below:
- when we have a memory error on a thp tail page, the memory error handler grabs a refcount of the head page to keep the thp under us.
- Before unmapping the error page from processes, we split the thp, where page refcounts of both of head/tail pages don't change.
- Then we call try_to_unmap() over the error page (which was a tail page before). We didn't pin the error page to handle the memory error, this error page is freed and removed from LRU list.
- We never have the error page on LRU list, so the first page state check returns "unknown page," then we move to the second check with the saved page flag.
- The saved page flag have PG_tail set, so the second page state check returns "hugepage."
- We call me_huge_page() for freed error page, then we hit the above panic.
The root cause is that we didn't move refcount from the head page to the tail page after split thp. So this patch suggests to do this.
This panic was introduced by commit 524fca1e73 ("HWPOISON: fix misjudgement of page_action() for errors on mlocked pages"). Note that we did have the same refcount problem before this commit, but it was just ignored because we had only first page state check which returned "unknown page." The commit changed the refcount problem from "doesn't work" to "kernel panic."
--- mm/memory-failure.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
mm/memory-failure.c +10 -0
@@ -936,6 +936,16 @@ static int hwpoison_user_mappings(structBUG_ON (!PageHWPoison (p));return SWAP_FAIL ; } +/* +* We pinned the head page for hwpoison handling, +* now we split the thp and we are interested in +* the hwpoisoned raw page, so move the refcount +* to it. +*/ +if (hpage != p) { +put_page (hpage); +get_page (p); + }/* THP is split, so ppage should be the real poisoned page. */ ppage = p; }
Greg Kroah-Hartman
maintainerPATCH 80/129 Input: allocate absinfo data when setting ABS capability
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 28a2a2e1aedbe2d8b2301e6e0e4e63f6e4177aca upstream.
We need to make sure we allocate absinfo data when we are setting one of EV_ABS/ABS_XXX capabilities, otherwise we may bomb when we try to emit this event.
--- drivers/input/input.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/input/input.c +4 -0
@@ -1866,6 +1866,10 @@ void input_set_capability(struct input_dbreak ;case EV_ABS : +input_alloc_absinfo (dev); +if (!dev->absinfo) +return ; +__set_bit (code, dev->absbit);break ;
Greg Kroah-Hartman
maintainerPATCH 81/129 GFS2: dont hold s_umount over blkdev_put
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Whitehouse <[email protected]>
commit dfe5b9ad83a63180f358b27d1018649a27b394a9 upstream.
This is a GFS2 version of Tejun's patch:4f331f01b9c43bf001d3ffee578a97a1e0633eac
vfs: don't hold s_umount over close_bdev_exclusive() call
In this case its blkdev_put itself that is the issue and this patch uses the same solution of dropping and retaking s_umount.
--- fs/gfs2/ops_fstype.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/gfs2/ops_fstype.c +11 -1
@@ -1317,8 +1317,18 @@ static struct dentry *gfs2_mount(structif (IS_ERR (s)) goto error_bdev; -if (s->s_root) +if (s->s_root) { +/* +* s_umount nests inside bd_mutex during +* __invalidate_device(). blkdev_put() acquires +* bd_mutex and can't be called under s_umount. Drop +* s_umount temporarily. This is safe as we're +* holding an active reference. +*/ +up_write (&s->s_umount);blkdev_put (bdev, mode); +down_write (&s->s_umount); + }memset (&args,0 ,sizeof (args)); args.ar_quota =GFS2_QUOTA_DEFAULT ;
Greg Kroah-Hartman
maintainerPATCH 82/129 GFS2: Fix incorrect invalidation for DIO/buffered I/O
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Whitehouse <[email protected]>
commit dfd11184d894cd0a92397b25cac18831a1a6a5bc upstream.
In patch 209806aba9d540dde3db0a5ce72307f85f33468f we allowed local deferred locks to be granted against a cached exclusive lock. That opened up a corner case which this patch now fixes.
The solution to the problem is to check whether we have cached pages each time we do direct I/O and if so to unmap, flush and invalidate those pages. Since the glock state machine normally does that for us, mostly the code will be a no-op.
--- fs/gfs2/aops.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
fs/gfs2/aops.c +30 -0
@@ -999,6 +999,7 @@ static ssize_t gfs2_direct_IO(int rw, st {struct file *file = iocb->ki_filp;struct inode *inode = file->f_mapping->host; +struct address_space *mapping = inode->i_mapping;struct gfs2_inode *ip =GFS2_I (inode);struct gfs2_holder gh;int rv;
@@ -1019,6 +1020,35 @@ static ssize_t gfs2_direct_IO(int rw, stif (rv !=1 ) goto out;/* dio not valid, fall back to buffered i/o */ +/* +* Now since we are holding a deferred (CW) lock at this point, you +* might be wondering why this is ever needed. There is a case however +* where we've granted a deferred local lock against a cached exclusive +* glock. That is ok provided all granted local locks are deferred, but +* it also means that it is possible to encounter pages which are +* cached and possibly also mapped. So here we check for that and sort +* them out ahead of the dio. The glock state machine will take care of +* everything else. +* +* If in fact the cached glock state (gl->gl_state) is deferred (CW) in +* the first place, mapping->nr_pages will always be zero. +*/ +if (mapping->nrpages) { +loff_t lstart = offset & (PAGE_CACHE_SIZE -1 ); +loff_t len =iov_length (iov, nr_segs); +loff_t end =PAGE_ALIGN (offset + len) -1 ; + + rv =0 ; +if (len ==0 ) + goto out; +if (test_and_clear_bit (GIF_SW_PAGED , &ip->i_flags)) +unmap_shared_mapping_range (ip->i_inode.i_mapping, offset, len); + rv =filemap_write_and_wait_range (mapping, lstart, end); +if (rv) +return rv; +truncate_inode_pages_range (mapping, lstart, end); + } + rv =__blockdev_direct_IO (rw, iocb, inode, inode->i_sb->s_bdev, iov, offset, nr_segs, gfs2_get_block_direct,NULL ,NULL ,0 );
Greg Kroah-Hartman
maintainerPATCH 83/129 memcg: fix memcg_size() calculation
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Davydov <[email protected]>
commit 695c60830764945cf61a2cc623eb1392d137223e upstream.
The mem_cgroup structure contains nr_node_ids pointers to mem_cgroup_per_node objects, not the objects themselves.
--- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/memcontrol.c +1 -1
@@ -379,7 +379,7 @@ struct mem_cgroup {static size_t memcg_size (void ) {return sizeof (struct mem_cgroup ) + - nr_node_ids *sizeof (struct mem_cgroup_per_node ); + nr_node_ids *sizeof (struct mem_cgroup_per_node *); }/* internal only representation about the status of kmem accounting. */
Greg Kroah-Hartman
maintainerPATCH 84/129 s390/3270: fix allocation of tty3270_screen structure
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <[email protected]>
commit 36d9f4d3b68c7035ead3850dc85f310a579ed0eb upstream.
The tty3270_alloc_screen function is called from tty3270_install with swapped arguments, the number of columns instead of rows and vice versa. The number of rows is typically smaller than the number of columns which makes the screen array too big but the individual cell arrays for the lines too small. Creating lines longer than the number of rows will clobber the memory after the end of the cell array.
The fix is simple, call tty3270_alloc_screen with the correct argument order.
--- drivers/s390/char/tty3270.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/char/tty3270.c +1 -1
@@ -942,7 +942,7 @@ static int tty3270_install(struct tty_drreturn rc; } - tp->screen =tty3270_alloc_screen (tp->view.cols, tp->view.rows); + tp->screen =tty3270_alloc_screen (tp->view.rows, tp->view.cols);if (IS_ERR (tp->screen)) { rc =PTR_ERR (tp->screen);raw3270_put_view (&tp->view);
Greg Kroah-Hartman
maintainerPATCH 85/129 jbd2: dont BUG but return ENOSPC if a handle runs out of space
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit f6c07cad081ba222d63623d913aafba5586c1d2c upstream.
If a handle runs out of space, we currently stop the kernel with a BUG in jbd2_journal_dirty_metadata(). This makes it hard to figure out what might be going on. So return an error of ENOSPC, so we can let the file system layer figure out what is going on, to make it more likely we can get useful debugging information). This should make it easier to debug problems such as the one which was reported by:
https://bugzilla.kernel.org/show_bug.cgi?id=44731
The only two callers of this function are ext4_handle_dirty_metadata() and ocfs2_journal_dirty(). The ocfs2 function will trigger a BUG_ON(), which means there will be no change in behavior. The ext4 function will call ext4_error_inode() which will print the useful debugging information and then handle the situation using ext4's error handling mechanisms (i.e., which might mean halting the kernel or remounting the file system read-only).
Also, since both file systems already call WARN_ON(), drop the WARN_ON from jbd2_journal_dirty_metadata() to avoid two stack traces from being displayed.
--- fs/jbd2/transaction.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/jbd2/transaction.c +4 -2
@@ -1151,7 +1151,10 @@ int jbd2_journal_dirty_metadata(handle_t* once a transaction -bzzz */ jh->b_modified =1 ; -J_ASSERT_JH (jh, handle->h_buffer_credits >0 ); +if (handle->h_buffer_credits <=0 ) { + ret = -ENOSPC ; + goto out_unlock_bh; + } handle->h_buffer_credits--; }
@@ -1234,7 +1237,6 @@ out_unlock_bh:jbd2_journal_put_journal_head (jh); out:JBUFFER_TRACE (jh,"exit" ); -WARN_ON (ret);/* All errors are bugs, so dump the stack */ return ret; }
Greg Kroah-Hartman
maintainerPATCH 86/129 gpio: twl4030: Fix regression for twl gpio LED output
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
commit f5837ec11f8cfa6d53ebc5806582771b2c9988c6 upstream.
Commit 0b2aa8be introduced a regression that causes failure in setting LED GPO direction to OUT.
This causes USB host probe failures for Beagleboard C4.
platform usb_phy_gen_xceiv.2: Driver usb_phy_gen_xceiv requests probe deferralhsusb2_vcc: Failed to request enable GPIO510: -22 reg-fixed-voltage reg-fixed-voltage.0.auto: Failed to register regulator: -22
reg-fixed-voltage: probe of reg-fixed-voltage.0.auto failed with error -22
direction_out/direction_in must return 0 if the operation succeeded.
Also, don't update direction flag and output data if twl4030_set_gpio_direction() failed inside twl_direction_out();
--- drivers/gpio/gpio-twl4030.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/gpio/gpio-twl4030.c +12 -3
@@ -300,7 +300,7 @@ static int twl_direction_in(struct gpio_if (offset <TWL4030_GPIO_MAX ) ret =twl4030_set_gpio_direction (offset,1 );else - ret = -EINVAL ; + ret = -EINVAL ;/* LED outputs can't be set as input */ if (!ret) priv->direction &= ~BIT (offset);
@@ -354,11 +354,20 @@ static void twl_set(struct gpio_chip *chstatic int twl_direction_out (struct gpio_chip *chip,unsigned offset,int value) {struct gpio_twl4030_priv *priv =to_gpio_twl4030 (chip); -int ret = -EINVAL ; +int ret =0 ;mutex_lock (&priv->mutex); -if (offset <TWL4030_GPIO_MAX ) +if (offset <TWL4030_GPIO_MAX ) { ret =twl4030_set_gpio_direction (offset,0 ); +if (ret) { +mutex_unlock (&priv->mutex); +return ret; + } + } + +/* +* LED gpios i.e. offset >= TWL4030_GPIO_MAX are always output +*/ priv->direction |=BIT (offset);mutex_unlock (&priv->mutex);
Greg Kroah-Hartman
maintainerPATCH 87/129 gpio: msm: Fix irq mask/unmask by writing bits instead of numbers
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
commit 4cc629b7a20945ce35628179180329b6bc9e552b upstream.
We should be writing bits here but instead we're writing the numbers that correspond to the bits we want to write. Fix it by wrapping the numbers in the BIT() macro. This fixes gpios acting as interrupts.
--- drivers/gpio/gpio-msm-v2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpio/gpio-msm-v2.c +2 -2
@@ -248,7 +248,7 @@ static void msm_gpio_irq_mask(struct irqspin_lock_irqsave (&tlmm_lock, irq_flags);writel (TARGET_PROC_NONE ,GPIO_INTR_CFG_SU (gpio)); -clear_gpio_bits (INTR_RAW_STATUS_EN |INTR_ENABLE ,GPIO_INTR_CFG (gpio)); +clear_gpio_bits (BIT (INTR_RAW_STATUS_EN ) |BIT (INTR_ENABLE ),GPIO_INTR_CFG (gpio));__clear_bit (gpio, msm_gpio.enabled_irqs);spin_unlock_irqrestore (&tlmm_lock, irq_flags); }
@@ -260,7 +260,7 @@ static void msm_gpio_irq_unmask(struct ispin_lock_irqsave (&tlmm_lock, irq_flags);__set_bit (gpio, msm_gpio.enabled_irqs); -set_gpio_bits (INTR_RAW_STATUS_EN |INTR_ENABLE ,GPIO_INTR_CFG (gpio)); +set_gpio_bits (BIT (INTR_RAW_STATUS_EN ) |BIT (INTR_ENABLE ),GPIO_INTR_CFG (gpio));writel (TARGET_PROC_SCORPION ,GPIO_INTR_CFG_SU (gpio));spin_unlock_irqrestore (&tlmm_lock, irq_flags); }
Greg Kroah-Hartman
maintainerPATCH 88/129 sh: always link in helper functions extracted from libgcc
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
commit 84ed8a99058e61567f495cc43118344261641c5f upstream.
E.g. landisk_defconfig, which has CONFIG_NTFS_FS=m:
ERROR: "__ashrdi3" [fs/ntfs/ntfs.ko] undefined!
For "lib-y", if no symbols in a compilation unit are referenced by other units, the compilation unit will not be included in vmlinux. This breaks modules that do reference those symbols.
Use "obj-y" instead to fix this.
http://kisskb.ellerman.id.au/kisskb/buildresult/8838077/
This doesn't fix all cases. There are others, e.g. udivsi3. This is also not limited to sh, many architectures handle this in the same way.
A simple solution is to unconditionally include all helper functions. A more complex solution is to make the choice of "lib-y" or "obj-y" depend on CONFIG_MODULES:
obj-$(CONFIG_MODULES) += ... lib-y($CONFIG_MODULES) += ...
--- arch/sh/lib/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sh/lib/Makefile +1 -1
@@ -6,7 +6,7 @@ lib-y = delay.o memmove.o memchr.o \ checksum.o strlen.o div64.o div64-generic.o # Extracted from libgcc -lib-y += movmem.o ashldi3.o ashrdi3.o lshrdi3.o \ +obj-y += movmem.o ashldi3.o ashrdi3.o lshrdi3.o \ ashlsi3.o ashrsi3.o ashiftrt.o lshrsi3.o \ udiv_qrnnd.o
Greg Kroah-Hartman
maintainerPATCH 89/129 selinux: look for IPsec labels on both inbound and outbound packets
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <[email protected]>
commit 817eff718dca4e54d5721211ddde0914428fbb7c upstream.
Previously selinux_skb_peerlbl_sid() would only check for labeled IPsec security labels on inbound packets, this patch enables it to check both inbound and outbound traffic for labeled IPsec security labels.
--- security/selinux/hooks.c | 2 - security/selinux/include/xfrm.h | 9 +++--- security/selinux/xfrm.c | 53 +++++++++++++++++++++++++++++++--------- 3 files changed, 48 insertions(+), 16 deletions(-)
security/selinux/hooks.c +1 -1
@@ -3723,7 +3723,7 @@ static int selinux_skb_peerlbl_sid(strucu32 nlbl_sid;u32 nlbl_type; -selinux_skb_xfrm_sid (skb, &xfrm_sid); +selinux_xfrm_skb_sid (skb, &xfrm_sid);selinux_netlbl_skbuff_getsid (skb, family, &nlbl_type, &nlbl_sid); err =security_net_peersid_resolve (nlbl_sid, nlbl_type, xfrm_sid, sid);
security/selinux/include/xfrm.h +5 -4
@@ -47,6 +47,7 @@ int selinux_xfrm_sock_rcv_skb(u32 sid, sint selinux_xfrm_postroute_last (u32 isec_sid,struct sk_buff *skb,struct common_audit_data *ad,u8 proto);int selinux_xfrm_decode_session (struct sk_buff *skb,u32 *sid,int ckall); +int selinux_xfrm_skb_sid (struct sk_buff *skb,u32 *sid);static inline void selinux_xfrm_notify_policyload (void ) {
@@ -80,12 +81,12 @@ static inline int selinux_xfrm_decode_sestatic inline void selinux_xfrm_notify_policyload (void ) { } -#endif -static inline void selinux_skb_xfrm_sid (struct sk_buff *skb,u32 *sid) +static inline int selinux_xfrm_skb_sid (struct sk_buff *skb,u32 *sid) { -int err =selinux_xfrm_decode_session (skb, sid,0 ); -BUG_ON (err); + *sid =SECSID_NULL ; +return 0 ; } +#endif #endif /* _SELINUX_XFRM_H_ */
security/selinux/xfrm.c +42 -11
69 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 90/129 selinux: process labeled IPsec TCP SYN-ACK packets properly in selinux_ip_postroute()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <[email protected]>
commit c0828e50485932b7e019df377a6b0a8d1ebd3080 upstream.
Due to difficulty in arriving at the proper security label for TCP SYN-ACK packets in selinux_ip_postroute(), we need to check packets while/before they are undergoing XFRM transforms instead of waiting until afterwards so that we can determine the correct security label.
--- security/selinux/hooks.c | 43 ++++++++++++++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 7 deletions(-)
security/selinux/hooks.c +36 -7
@@ -4742,22 +4742,32 @@ static unsigned int selinux_ip_postroute* as fast and as clean as possible. */ if (!selinux_policycap_netpeer)return selinux_ip_postroute_compat (skb, ifindex, family); + + secmark_active =selinux_secmark_enabled (); + peerlbl_active =netlbl_enabled () ||selinux_xfrm_enabled (); +if (!secmark_active && !peerlbl_active) +return NF_ACCEPT ; + + sk = skb->sk; +#ifdef CONFIG_XFRM /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec * packet transformation so allow the packet to pass without any checks * since we'll have another chance to perform access control checks * when the packet is on it's final way out. * NOTE: there appear to be some IPv6 multicast cases where skb->dst -* is NULL, in this case go ahead and apply access control. */ -if (skb_dst (skb) !=NULL &&skb_dst (skb)->xfrm !=NULL ) +* is NULL, in this case go ahead and apply access control. +* is NULL, in this case go ahead and apply access control. +* NOTE: if this is a local socket (skb->sk != NULL) that is in the +* TCP listening state we cannot wait until the XFRM processing +* is done as we will miss out on the SA label if we do; +* unfortunately, this means more work, but it is only once per +* connection. */ +if (skb_dst (skb) !=NULL &&skb_dst (skb)->xfrm !=NULL && + !(sk !=NULL && sk->sk_state ==TCP_LISTEN ))return NF_ACCEPT ;#endif - secmark_active =selinux_secmark_enabled (); - peerlbl_active =netlbl_enabled () ||selinux_xfrm_enabled (); -if (!secmark_active && !peerlbl_active) -return NF_ACCEPT ; - sk = skb->sk;if (sk ==NULL ) {/* Without an associated socket the packet is either coming * from the kernel or it is being forwarded; check the packet
@@ -4785,6 +4795,25 @@ static unsigned int selinux_ip_postroutestruct sk_security_struct *sksec = sk->sk_security;if (selinux_skb_peerlbl_sid (skb, family, &skb_sid))return NF_DROP ; +/* At this point, if the returned skb peerlbl is SECSID_NULL +* and the packet has been through at least one XFRM +* transformation then we must be dealing with the "final" +* form of labeled IPsec packet; since we've already applied +* all of our access controls on this packet we can safely +* pass the packet. */ +if (skb_sid ==SECSID_NULL ) { +switch (family) { +case PF_INET : +if (IPCB (skb)->flags &IPSKB_XFRM_TRANSFORMED ) +return NF_ACCEPT ; +break ; +case PF_INET6 : +if (IP6CB (skb)->flags &IP6SKB_XFRM_TRANSFORMED ) +return NF_ACCEPT ; +default : +return NF_DROP_ERR (-ECONNREFUSED ); + } + }if (selinux_conn_sid (sksec->sid, skb_sid, &peer_sid))return NF_DROP ; secmark_perm =PACKET__SEND ;
Greg Kroah-Hartman
maintainerPATCH 91/129 clocksource: dw_apb_timer_of: Fix read_sched_clock
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinh Nguyen <[email protected]>
commit 85dc6ee1237c8a4a7742e6abab96a20389b7d682 upstream.
The read_sched_clock should return the ~value because the clock is a countdown implementation. read_sched_clock() should be the same as
__apbt_read_clocksource().
--- drivers/clocksource/dw_apb_timer_of.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clocksource/dw_apb_timer_of.c +1 -1
@@ -77,7 +77,7 @@ static void __iomem *sched_io_base;static u32 read_sched_clock (void ) { -return __raw_readl (sched_io_base); +return ~__raw_readl (sched_io_base); }static const struct of_device_id sptimer_ids[]__initconst = {
Greg Kroah-Hartman
maintainerPATCH 92/129 ceph: improve error handling in ceph_mdsmap_decode
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Goode <[email protected]>
commit c213b50b7dcbf06abcfbf1e4eee5b76586718bd9 upstream.
This patch makes the following improvements to the error handling in the ceph_mdsmap_decode function:
- Add a NULL check for return value from kcalloc
- Make use of the variable err
--- fs/ceph/mdsmap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ceph/mdsmap.c +3 -1
@@ -138,6 +138,8 @@ struct ceph_mdsmap *ceph_mdsmap_decode(v m->m_info[mds].export_targets =kcalloc (num_export_targets,sizeof (u32),GFP_NOFS ); +if (m->m_info[mds].export_targets ==NULL ) + goto badmem;for (j =0 ; j < num_export_targets; j++) m->m_info[mds].export_targets[j] =ceph_decode_32 (&pexport_targets);
@@ -170,7 +172,7 @@ bad:DUMP_PREFIX_OFFSET ,16 ,1 , start, end - start, true);ceph_mdsmap_destroy (m); -return ERR_PTR (-EINVAL ); +return ERR_PTR (err); }void ceph_mdsmap_destroy (struct ceph_mdsmap *m)
Greg Kroah-Hartman
maintainerPATCH 93/129 libceph: add lingering request reference when registered
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Elder <[email protected]>
commit 96e4dac66f69d28af2b736e723364efbbdf9fdee upstream.
When an osd request is set to linger, the osd client holds onto the request so it can be re-submitted following certain osd map changes. The osd client holds a reference to the request until it is unregistered. This is used by rbd for watch requests.
Currently, the reference is taken when the request is marked with the linger flag. This means that if an error occurs after that time but before the the request completes successfully, that reference is leaked.
There's really no reason to take the reference until the request is registered in the the osd client's list of lingering requests, and that only happens when the lingering (watch) request completes successfully.
So take that reference only when it gets registered following succesful completion, and drop it (as before) when the request gets unregistered. This avoids the reference problem on error in rbd.
Rearrange ceph_osdc_unregister_linger_request() to avoid using the request pointer after it may have been freed.
And hold an extra reference in kick_requests() while handling a linger request that has not yet been registered, to ensure it doesn't go away.
This resolves:
http://tracker.ceph.com/issues/3859
--- net/ceph/osd_client.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
net/ceph/osd_client.c +5 -7
@@ -1174,6 +1174,7 @@ static void __register_linger_request(st struct ceph_osd_request *req) {dout ("__register_linger_request %p\n" , req); +ceph_osdc_get_request (req);list_add_tail (&req->r_linger_item, &osdc->req_linger);if (req->r_osd) list_add_tail(&req->r_linger_osd,
@@ -1196,6 +1197,7 @@ static void __unregister_linger_request(if (list_empty (&req->r_osd_item)) req->r_osd =NULL ; } +ceph_osdc_put_request (req); } void ceph_osdc_unregister_linger_request(struct ceph_osd_client *osdc,
@@ -1203,9 +1205,8 @@ void ceph_osdc_unregister_linger_request {mutex_lock (&osdc->request_mutex);if (req->r_linger) { -__unregister_linger_request (osdc, req); req->r_linger =0 ; -ceph_osdc_put_request (req); +__unregister_linger_request (osdc, req); }mutex_unlock (&osdc->request_mutex); }
@@ -1217,11 +1218,6 @@ void ceph_osdc_set_request_linger(structif (!req->r_linger) {dout ("set_request_linger %p\n" , req); req->r_linger =1 ; -/* -* caller is now responsible for calling -* unregister_linger_request -*/ -ceph_osdc_get_request (req); } }EXPORT_SYMBOL (ceph_osdc_set_request_linger);
@@ -1633,8 +1629,10 @@ static void kick_requests(struct ceph_osdout ("%p tid %llu restart on osd%d\n" , req, req->r_tid, req->r_osd ? req->r_osd->o_osd :-1 ); +ceph_osdc_get_request (req);__unregister_request (osdc, req);__register_linger_request (osdc, req); +ceph_osdc_put_request (req);continue ; }
Greg Kroah-Hartman
maintainerPATCH 94/129 rbd: flush dcache after zeroing page data
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Elder <[email protected]>
commit e215605417b87732c6debf65da6d953016a1e5bc upstream.
Neither zero_bio_chain() nor zero_pages() contains a call to flush caches after zeroing a portion of a page. This can cause problems on architectures that have caches that allow virtual address aliasing.
This resolves:
http://tracker.ceph.com/issues/4777
--- drivers/block/rbd.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/block/rbd.c +2 -0
@@ -1126,6 +1126,7 @@ static void zero_bio_chain(struct bio *c buf =bvec_kmap_irq (bv, &flags);memset (buf + remainder,0 , bv->bv_len - remainder); +flush_dcache_page (bv->bv_page);bvec_kunmap_irq (buf, &flags); } pos += bv->bv_len;
@@ -1158,6 +1159,7 @@ static void zero_pages(struct page **paglocal_irq_save (flags); kaddr =kmap_atomic (*page);memset (kaddr + page_offset,0 , length); +flush_dcache_page (*page);kunmap_atomic (kaddr);local_irq_restore (flags);
Greg Kroah-Hartman
maintainerPATCH 95/129 rbd: set removing flag while holding list lock
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Elder <[email protected]>
commit 751cc0e3cfabdda87c4c21519253c6751e97a8d4 upstream.
When unmapping a device, its id is supplied, and that is used to look up which rbd device should be unmapped. Looking up the device involves searching the rbd device list while holding a spinlock that protects access to that list.
Currently all of this is done under protection of the control lock, but that protection is going away soon. To ensure the rbd_dev is still valid (still on the list) while setting its REMOVING flag, do so while still holding the list lock. To do so, get rid of __rbd_get_dev(), and open code what it did in the one place it was used.
--- drivers/block/rbd.c | 53 +++++++++++++++++++++------------------------------- 1 file changed, 22 insertions(+), 31 deletions(-)
drivers/block/rbd.c +22 -31
@@ -5061,23 +5061,6 @@ err_out_module:return (ssize_t )rc; } -static struct rbd_device *__rbd_get_dev (unsigned long dev_id) -{ -struct list_head *tmp; -struct rbd_device *rbd_dev; - -spin_lock (&rbd_dev_list_lock); -list_for_each (tmp, &rbd_dev_list) { - rbd_dev = list_entry(tmp, struct rbd_device, node); -if (rbd_dev->dev_id == dev_id) { -spin_unlock (&rbd_dev_list_lock); -return rbd_dev; - } - } -spin_unlock (&rbd_dev_list_lock); -return NULL ; -} -static void rbd_dev_device_release (struct device *dev) {struct rbd_device *rbd_dev =dev_to_rbd_dev (dev);
@@ -5122,7 +5105,8 @@ static ssize_t rbd_remove(struct bus_typ size_t count) {struct rbd_device *rbd_dev =NULL ; -int target_id; +struct list_head *tmp; +int dev_id;unsigned long ul;int ret;
@@ -5131,26 +5115,33 @@ static ssize_t rbd_remove(struct bus_typreturn ret;/* convert to int; abort if we lost anything in the conversion */ - target_id = (int ) ul; -if (target_id != ul) + dev_id = (int )ul; +if (dev_id != ul)return -EINVAL ;mutex_lock_nested (&ctl_mutex,SINGLE_DEPTH_NESTING ); - rbd_dev =__rbd_get_dev (target_id); -if (!rbd_dev) { - ret = -ENOENT ; - goto done; + ret = -ENOENT ; +spin_lock (&rbd_dev_list_lock); +list_for_each (tmp, &rbd_dev_list) { + rbd_dev = list_entry(tmp, struct rbd_device, node); +if (rbd_dev->dev_id == dev_id) { + ret =0 ; +break ; + } } - -spin_lock_irq (&rbd_dev->lock); -if (rbd_dev->open_count) - ret = -EBUSY ; -else -set_bit (RBD_DEV_FLAG_REMOVING , &rbd_dev->flags); -spin_unlock_irq (&rbd_dev->lock); +if (!ret) { +spin_lock_irq (&rbd_dev->lock); +if (rbd_dev->open_count) + ret = -EBUSY ; +else +set_bit (RBD_DEV_FLAG_REMOVING , &rbd_dev->flags); +spin_unlock_irq (&rbd_dev->lock); + } +spin_unlock (&rbd_dev_list_lock);if (ret <0 ) goto done; +rbd_bus_del_dev (rbd_dev); ret =rbd_dev_header_watch_sync (rbd_dev, false);if (ret)
Greg Kroah-Hartman
maintainerPATCH 96/129 rbd: protect against concurrent unmaps
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Elder <[email protected]>
commit 82a442d239695a242c4d584464c9606322cd02aa upstream.
Make sure two concurrent unmap operations on the same rbd device won't collide, by only proceeding with the removal and cleanup of a device if is not already underway.
--- drivers/block/rbd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/block/rbd.c +4 -2
@@ -5108,6 +5108,7 @@ static ssize_t rbd_remove(struct bus_typstruct list_head *tmp;int dev_id;unsigned long ul; +bool already = false;int ret; ret =strict_strtoul (buf,10 , &ul);
@@ -5135,11 +5136,12 @@ static ssize_t rbd_remove(struct bus_typif (rbd_dev->open_count) ret = -EBUSY ;else -set_bit (RBD_DEV_FLAG_REMOVING , &rbd_dev->flags); + already =test_and_set_bit (RBD_DEV_FLAG_REMOVING , + &rbd_dev->flags);spin_unlock_irq (&rbd_dev->lock); }spin_unlock (&rbd_dev_list_lock); -if (ret <0 ) +if (ret <0 || already) goto done;rbd_bus_del_dev (rbd_dev);
Greg Kroah-Hartman
maintainerPATCH 97/129 libceph: fix safe completion
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Yan, Zheng" <[email protected]>
commit eb845ff13a44477f8a411baedbf11d678b9daf0a upstream.
handle_reply() calls complete_request() only if the first OSD reply has ONDISK flag.
--- include/linux/ceph/osd_client.h | 1 - net/ceph/osd_client.c | 17 ++++++++--------- 2 files changed, 8 insertions(+), 10 deletions(-)
include/linux/ceph/osd_client.h +0 -1
@@ -145,7 +145,6 @@ struct ceph_osd_request {s32 r_reply_op_result[CEPH_OSD_MAX_OP ];int r_got_reply;int r_linger; -int r_completed;struct ceph_osd_client *r_osdc;struct kref r_kref;
net/ceph/osd_client.c +8 -9
@@ -1522,6 +1522,8 @@ static void handle_reply(struct ceph_osdfor (i =0 ; i < numops; i++) req->r_reply_op_result[i] =ceph_decode_32 (&p); + already_completed = req->r_got_reply; +if (!req->r_got_reply) { req->r_result = result;
@@ -1552,16 +1554,14 @@ static void handle_reply(struct ceph_osd ((flags & CEPH_OSD_FLAG_WRITE) == 0))__unregister_request (osdc, req); - already_completed = req->r_completed; - req->r_completed =1 ;mutex_unlock (&osdc->request_mutex); -if (already_completed) - goto done; -if (req->r_callback) - req->r_callback (req, msg); -else -complete_all (&req->r_completion); +if (!already_completed) { +if (req->r_callback) + req->r_callback (req, msg); +else +complete_all (&req->r_completion); + }if (flags &CEPH_OSD_FLAG_ONDISK )complete_request (req);
@@ -2121,7 +2121,6 @@ int ceph_osdc_start_request(struct ceph___register_request (osdc, req); req->r_sent =0 ; req->r_got_reply =0 ; - req->r_completed =0 ; rc =__map_request (osdc, req,0 );if (rc <0 ) {if (nofail) {
Greg Kroah-Hartman
maintainerPATCH 98/129 libceph: fix truncate size calculation
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Yan, Zheng" <[email protected]>
commit ccca4e37b1a912da3db68aee826557ea66145273 upstream.
check the "not truncated yet" case
--- net/ceph/osd_client.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
net/ceph/osd_client.c +8 -6
@@ -733,12 +733,14 @@ struct ceph_osd_request *ceph_osdc_new_r object_size =le32_to_cpu (layout->fl_object_size); object_base = off - objoff; -if (truncate_size <= object_base) { - truncate_size =0 ; - }else { - truncate_size -= object_base; -if (truncate_size > object_size) - truncate_size = object_size; +if (!(truncate_seq ==1 && truncate_size ==-1ULL )) { +if (truncate_size <= object_base) { + truncate_size =0 ; + }else { + truncate_size -= object_base; +if (truncate_size > object_size) + truncate_size = object_size; + } } osd_req_op_extent_init(req, 0, opcode, objoff, objlen,
Greg Kroah-Hartman
maintainerPATCH 99/129 rbd: fix a couple warnings
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sage Weil <[email protected]>
commit e976cad0f0dbe5440a4ca38e29e1f932d9319125 upstream.
gcc isn't quite smart enough and generates these warnings:
drivers/block/rbd.c: In function 'rbd_img_request_fill':drivers/block/rbd.c:1266:22: warning: 'bio_list' may be used uninitialized in this function [-Wmaybe-uninitialized] drivers/block/rbd.c:2186:14: note: 'bio_list' was declared heredrivers/block/rbd.c:2247:10: warning: 'pages' may be used uninitialized in this function [-Wmaybe-uninitialized]
even though they are initialized for their respective code paths.
--- drivers/block/rbd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/block/rbd.c +2 -2
@@ -2173,9 +2173,9 @@ static int rbd_img_request_fill(struct rstruct rbd_obj_request *obj_request =NULL ;struct rbd_obj_request *next_obj_request;bool write_request =img_request_write_test (img_request); -struct bio *bio_list; +struct bio *bio_list =0 ;unsigned int bio_offset =0 ; -struct page **pages; +struct page **pages =0 ;u64 img_offset;u64 resid;u16 opcode;
Greg Kroah-Hartman
maintainerPATCH 100/129 ceph: Free mdsc if alloc mdsc->mdsmap failed.
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: majianpeng <[email protected]>
commit fb3101b6f0db9ae3f35dc8e6ec908d0af8cdf12e upstream.
--- fs/ceph/mds_client.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ceph/mds_client.c +3 -1
@@ -3044,8 +3044,10 @@ int ceph_mdsc_init(struct ceph_fs_client fsc->mdsc = mdsc;mutex_init (&mdsc->mutex); mdsc->mdsmap =kzalloc (sizeof (*mdsc->mdsmap),GFP_NOFS ); -if (mdsc->mdsmap ==NULL ) +if (mdsc->mdsmap ==NULL ) { +kfree (mdsc);return -ENOMEM ; + }init_completion (&mdsc->safe_umount_waiters);init_waitqueue_head (&mdsc->session_close_wq);
Greg Kroah-Hartman
maintainerPATCH 101/129 ceph: avoid accessing invalid memory
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <[email protected]>
commit 5446429630257f4723829409337a26c076907d5d upstream.
when mounting ceph with a dev name that starts with a slash, ceph would attempt to access the character before that slash. Since we don't actually own that byte of memory, we would trigger an invalid access:
[ 43.499934] BUG: unable to handle kernel paging request at ffff880fa3a97fff [ 43.500984] IP: [<ffffffff818f3884>] parse_mount_options+0x1a4/0x300 [ 43.501491] PGD 743b067 PUD 10283c4067 PMD 10282a6067 PTE 8000000fa3a97060 [ 43.502301] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 43.503006] Dumping ftrace buffer: [ 43.503596] (ftrace buffer empty) [ 43.504046] CPU: 0 PID: 10879 Comm: mount Tainted: G W 3.10.0-sasha #1129 [ 43.504851] task: ffff880fa625b000 ti: ffff880fa3412000 task.ti: ffff880fa3412000 [ 43.505608] RIP: 0010:[<ffffffff818f3884>] [<ffffffff818f3884>] parse_mount_options$ [ 43.506552] RSP: 0018:ffff880fa3413d08 EFLAGS: 00010286 [ 43.507133] RAX: ffff880fa3a98000 RBX: ffff880fa3a98000 RCX: 0000000000000000 [ 43.507893] RDX: ffff880fa3a98001 RSI: 000000000000002f RDI: ffff880fa3a98000 [ 43.508610] RBP: ffff880fa3413d58 R08: 0000000000001f99 R09: ffff880fa3fe64c0 [ 43.509426] R10: ffff880fa3413d98 R11: ffff880fa38710d8 R12: ffff880fa3413da0 [ 43.509792] R13: ffff880fa3a97fff R14: 0000000000000000 R15: ffff880fa3413d90 [ 43.509792] FS: 00007fa9c48757e0(0000) GS:ffff880fd2600000(0000) knlGS:000000000000$ [ 43.509792] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 43.509792] CR2: ffff880fa3a97fff CR3: 0000000fa3bb9000 CR4: 00000000000006b0 [ 43.509792] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 43.509792] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 43.509792] Stack: [ 43.509792] 0000e5180000000e ffffffff85ca1900 ffff880fa38710d8 ffff880fa3413d98 [ 43.509792] 0000000000000120 0000000000000000 ffff880fa3a98000 0000000000000000 [ 43.509792] ffffffff85cf32a0 0000000000000000 ffff880fa3413dc8 ffffffff818f3c72 [ 43.509792] Call Trace: [ 43.509792] [<ffffffff818f3c72>] ceph_mount+0xa2/0x390 [ 43.509792] [<ffffffff81226314>] ? pcpu_alloc+0x334/0x3c0 [ 43.509792] [<ffffffff81282f8d>] mount_fs+0x8d/0x1a0 [ 43.509792] [<ffffffff812263d0>] ? __alloc_percpu+0x10/0x20 [ 43.509792] [<ffffffff8129f799>] vfs_kern_mount+0x79/0x100 [ 43.509792] [<ffffffff812a224d>] do_new_mount+0xcd/0x1c0 [ 43.509792] [<ffffffff812a2e8d>] do_mount+0x15d/0x210 [ 43.509792] [<ffffffff81220e55>] ? strndup_user+0x45/0x60 [ 43.509792] [<ffffffff812a2fdd>] SyS_mount+0x9d/0xe0 [ 43.509792] [<ffffffff83fd816c>] tracesys+0xdd/0xe2 [ 43.509792] Code: 4c 8b 5d c0 74 0a 48 8d 50 01 49 89 14 24 eb 17 31 c0 48 83 c9 ff $ [ 43.509792] RIP [<ffffffff818f3884>] parse_mount_options+0x1a4/0x300 [ 43.509792] RSP <ffff880fa3413d08> [ 43.509792] CR2: ffff880fa3a97fff [ 43.509792] ---[ end trace 22469cd81e93af51 ]---
--- fs/ceph/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ceph/super.c +1 -1
@@ -357,7 +357,7 @@ static int parse_mount_options(struct ce } err = -EINVAL ; dev_name_end--;/* back up to ':' separator */ -if (*dev_name_end !=':' ) { +if (dev_name_end < dev_name || *dev_name_end !=':' ) {pr_err ("device name is missing path (no : separator in %s)\n" , dev_name); goto out;
Greg Kroah-Hartman
maintainerPATCH 102/129 libceph: call r_unsafe_callback when unsafe reply is received
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Yan, Zheng" <[email protected]>
commit 61c5d6bf7074ee32d014dcdf7698dc8c59eb712d upstream.
We can't use !req->r_sent to check if OSD request is sent for the first time, this is because __cancel_request() zeros req->r_sent when OSD map changes. Rather than adding a new variable to struct ceph_osd_request to indicate if it's sent for the first time, We can call the unsafe callback only when unsafe OSD reply is received. If OSD's first reply is safe, just skip calling the unsafe callback.
The purpose of unsafe callback is adding unsafe request to a list, so that fsync(2) can wait for the safe reply. fsync(2) doesn't need to wait for a write(2) that hasn't returned yet. So it's OK to add request to the unsafe list when the first OSD reply is received. (ceph_sync_write() returns after receiving the first OSD reply)
--- net/ceph/osd_client.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/ceph/osd_client.c +7 -7
@@ -1337,10 +1337,6 @@ static void __send_request(struct ceph_oceph_msg_get (req->r_request);/* send consumes a ref */ -/* Mark the request unsafe if this is the first timet's being sent. */ - -if (!req->r_sent && req->r_unsafe_callback) - req->r_unsafe_callback (req, true); req->r_sent = req->r_osd->o_incarnation;ceph_con_send (&req->r_osd->o_con, req->r_request);
@@ -1431,8 +1427,6 @@ static void handle_osds_timeout(struct wstatic void complete_request (struct ceph_osd_request *req) { -if (req->r_unsafe_callback) - req->r_unsafe_callback (req, false);complete_all (&req->r_safe_completion);/* fsync waiter */ }
@@ -1559,14 +1553,20 @@ static void handle_reply(struct ceph_osdmutex_unlock (&osdc->request_mutex);if (!already_completed) { +if (req->r_unsafe_callback && + result >=0 && !(flags &CEPH_OSD_FLAG_ONDISK )) + req->r_unsafe_callback (req, true);if (req->r_callback) req->r_callback (req, msg);else complete_all (&req->r_completion); } -if (flags &CEPH_OSD_FLAG_ONDISK ) +if (flags &CEPH_OSD_FLAG_ONDISK ) { +if (req->r_unsafe_callback && already_completed) + req->r_unsafe_callback (req, false);complete_request (req); + } done:dout ("req=%p req->r_linger=%d\n" , req, req->r_linger);
Greg Kroah-Hartman
maintainerPATCH 103/129 ceph: fix null pointer dereference
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathaniel Yazdani <[email protected]>
commit c338c07c51e3106711fad5eb599e375eadb6855d upstream.
When register_session() is given an out-of-range argument for mds, ceph_mdsmap_get_addr() will return a null pointer, which would be given to ceph_con_open() & be dereferenced, causing a kernel oops. This fixes bug #4685 in the Ceph bug tracker <http://tracker.ceph.com/issues/4685>.
--- fs/ceph/mds_client.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ceph/mds_client.c +3 -0
@@ -414,6 +414,9 @@ static struct ceph_mds_session *register {struct ceph_mds_session *s; +if (mds >= mdsc->mdsmap->m_max_mds) +return ERR_PTR (-EINVAL ); + s =kzalloc (sizeof (*s),GFP_NOFS );if (!s)return ERR_PTR (-ENOMEM );
Greg Kroah-Hartman
maintainerPATCH 104/129 ceph: cleanup types in striped_read()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 688bac461ba3e9d221a879ab40b687f5d7b5b19c upstream.
We pass in a u64 value for "len" and then immediately truncate away the upper 32 bits.
--- fs/ceph/file.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/ceph/file.c +4 -4
@@ -313,9 +313,9 @@ static int striped_read(struct inode *in {struct ceph_fs_client *fsc =ceph_inode_to_client (inode);struct ceph_inode_info *ci =ceph_inode (inode); -u64 pos, this_len; +u64 pos, this_len, left;int io_align, page_align; -int left, pages_left; +int pages_left;int read;struct page **page_pos;int ret;
@@ -346,7 +346,7 @@ more: ret =0 ; hit_stripe = this_len < left; was_short = ret >=0 && ret < this_len; -dout ("striped_read %llu~%u (read %u) got %d%s%s\n" , pos, left, read, +dout ("striped_read %llu~%llu (read %u) got %d%s%s\n" , pos, left, read, ret, hit_stripe ?" HITSTRIPE" :"" , was_short ?" SHORT" :"" );if (ret >0 ) {
@@ -378,7 +378,7 @@ more:if (pos + left > inode->i_size) left = inode->i_size - pos; -dout ("zero tail %d\n" , left); +dout ("zero tail %llu\n" , left);ceph_zero_page_vector_range (page_align + read, left, pages); read += left;
Greg Kroah-Hartman
maintainerPATCH 105/129 ceph: Add check returned value on func ceph_calc_ceph_pg.
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: majianpeng <[email protected]>
commit 2fbcbff1d6b9243ef71c64a8ab993bc3c7bb7af1 upstream.
Func ceph_calc_ceph_pg maybe failed.So add check for returned value.
--- fs/ceph/ioctl.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/ceph/ioctl.c +6 -2
@@ -211,8 +211,12 @@ static long ceph_ioctl_get_dataloc(strucsnprintf (dl.object_name,sizeof (dl.object_name),"%llx.%08llx" ,ceph_ino (inode), dl.object_no); -ceph_calc_ceph_pg (&pgid, dl.object_name, osdc->osdmap, -ceph_file_layout_pg_pool (ci->i_layout)); + r =ceph_calc_ceph_pg (&pgid, dl.object_name, osdc->osdmap, +ceph_file_layout_pg_pool (ci->i_layout)); +if (r <0 ) { +up_read (&osdc->map_sem); +return r; + } dl.osd =ceph_calc_pg_primary (osdc->osdmap, pgid);if (dl.osd >=0 ) {
Greg Kroah-Hartman
maintainerPATCH 106/129 libceph: fix error handling in handle_reply()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 1874119664dafda3ef2ed9b51b4759a9540d4a1a upstream.
We've tried to fix the error paths in this function before, but there is still a hidden goto in the ceph_decode_need() macro which goes to the wrong place. We need to release the "req" and unlock a mutex before returning.
--- net/ceph/osd_client.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ceph/osd_client.c +3 -3
@@ -1488,14 +1488,14 @@ static void handle_reply(struct ceph_osddout ("handle_reply %p tid %llu req %p result %d\n" , msg, tid, req, result); -ceph_decode_need (&p, end,4 , bad); +ceph_decode_need (&p, end,4 , bad_put); numops =ceph_decode_32 (&p);if (numops >CEPH_OSD_MAX_OP ) goto bad_put;if (numops != req->r_num_ops) goto bad_put; payload_len =0 ; -ceph_decode_need (&p, end, numops *sizeof (struct ceph_osd_op ), bad); +ceph_decode_need (&p, end, numops *sizeof (struct ceph_osd_op ), bad_put);for (i =0 ; i < numops; i++) {struct ceph_osd_op *op = p;int len;
@@ -1513,7 +1513,7 @@ static void handle_reply(struct ceph_osd goto bad_put; } -ceph_decode_need (&p, end,4 + numops *4 , bad); +ceph_decode_need (&p, end,4 + numops *4 , bad_put); retry_attempt =ceph_decode_32 (&p);for (i =0 ; i < numops; i++) req->r_reply_op_result[i] =ceph_decode_32 (&p);
Greg Kroah-Hartman
maintainerPATCH 107/129 libceph: potential NULL dereference in ceph_osdc_handle_map()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit b72e19b9225d4297a18715b0998093d843d170fa upstream.
There are two places where we read "nr_maps" if both of them are set to zero then we would hit a NULL dereference here.
--- net/ceph/osd_client.c | 2 ++ 1 file changed, 2 insertions(+)
net/ceph/osd_client.c +2 -0
@@ -1786,6 +1786,8 @@ void ceph_osdc_handle_map(struct ceph_os nr_maps--; } +if (!osdc->osdmap) + goto bad; done:downgrade_write (&osdc->map_sem);ceph_monc_got_osdmap (&osdc->client->monc, osdc->osdmap->epoch);
Greg Kroah-Hartman
maintainerPATCH 108/129 libceph: create_singlethread_workqueue() doesnt return ERR_PTRs
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit dbcae088fa660086bde6e10d63bb3c9264832d85 upstream.
create_singlethread_workqueue() returns NULL on error, and it doesn't return ERR_PTRs.
I tweaked the error handling a little to be consistent with earlier in the function.
--- net/ceph/osd_client.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/ceph/osd_client.c +2 -4
@@ -2257,12 +2257,10 @@ int ceph_osdc_init(struct ceph_osd_clienif (err <0 ) goto out_msgpool; + err = -ENOMEM ; osdc->notify_wq =create_singlethread_workqueue ("ceph-watch-notify" ); -if (IS_ERR (osdc->notify_wq)) { - err =PTR_ERR (osdc->notify_wq); - osdc->notify_wq =NULL ; +if (!osdc->notify_wq) goto out_msgpool; - }return 0 ; out_msgpool:
Greg Kroah-Hartman
maintainerPATCH 109/129 ceph: fix bugs about handling short-read for sync read mode.
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: majianpeng <[email protected]>
commit 02ae66d8b229708fd94b764f6c17ead1c7741fcf upstream.
cephfs . show_layout
Quoted 4 lines
layyout.data_pool: 0 layout.object_size: 4194304 layout.stripe_unit: 4194304 layout.stripe_count: 1
TestA:
Quoted 3 lines
dd if=/dev/urandom of=test bs=1M count=2 oflag=direct dd if=/dev/urandom of=test bs=1M count=2 seek=4 oflag=direct dd if=test of=/dev/null bs=6M count=1 iflag=direct
The messages from func striped_read are:
ceph: file.c:350 : striped_read 0~6291456 (read 0) got 2097152 HITSTRIPE SHORT ceph: file.c:350 : striped_read 2097152~4194304 (read 2097152) got 0 HITSTRIPE SHORT ceph: file.c:381 : zero tail 4194304 ceph: file.c:390 : striped_read returns 6291456 The hole of file is from 2M--4M.But actualy it zero the last 4M include the last 2M area which isn't a hole. Using this patch, the messages are: ceph: file.c:350 : striped_read 0~6291456 (read 0) got 2097152 HITSTRIPE SHORT ceph: file.c:358 : zero gap 2097152 to 4194304 ceph: file.c:350 : striped_read 4194304~2097152 (read 4194304) got 2097152 ceph: file.c:384 : striped_read returns 6291456
TestB:
Quoted 2 lines
echo majianpeng > test
dd if=test of=/dev/null bs=2M count=1 iflag=direct
The messages are:
ceph: file.c:350 : striped_read 0~6291456 (read 0) got 11 HITSTRIPE SHORT ceph: file.c:350 : striped_read 11~6291445 (read 11) got 0 HITSTRIPE SHORT ceph: file.c:390 : striped_read returns 11 For this case,it did once more striped_read.It's no meaningless. Using this patch, the message are: ceph: file.c:350 : striped_read 0~6291456 (read 0) got 11 HITSTRIPE SHORT ceph: file.c:384 : striped_read returns 11
Big thanks to Yan Zheng for the patch.
--- fs/ceph/file.c | 39 ++++++++++++++++----------------------- 1 file changed, 16 insertions(+), 23 deletions(-)
fs/ceph/file.c +16 -23
@@ -349,44 +349,37 @@ more:dout ("striped_read %llu~%llu (read %u) got %d%s%s\n" , pos, left, read, ret, hit_stripe ?" HITSTRIPE" :"" , was_short ?" SHORT" :"" ); -if (ret >0 ) { -int didpages = (page_align + ret) >>PAGE_CACHE_SHIFT ; - -if (read < pos - off) { -dout (" zero gap %llu to %llu\n" , off + read, pos); -ceph_zero_page_vector_range (page_align + read, - pos - off - read, pages); +if (ret >=0 ) { +int didpages; +if (was_short && (pos + ret < inode->i_size)) { +u64 tmp =min (this_len - ret, + inode->i_size - pos - ret); +dout (" zero gap %llu to %llu\n" , + pos + ret, pos + ret + tmp); +ceph_zero_page_vector_range (page_align + read + ret, + tmp, pages); + ret += tmp; } + + didpages = (page_align + ret) >>PAGE_CACHE_SHIFT ; pos += ret; read = pos - off; left -= ret; page_pos += didpages; pages_left -= didpages; -/* hit stripe? */ -if (left && hit_stripe) +/* hit stripe and need continue*/ +if (left && hit_stripe && pos < inode->i_size) goto more; } -if (was_short) { +if (ret >=0 ) { + ret = read;/* did we bounce off eof? */ if (pos + left > inode->i_size) *checkeof =1 ; - -/* zero trailing bytes (inside i_size) */ -if (left >0 && pos < inode->i_size) { -if (pos + left > inode->i_size) - left = inode->i_size - pos; - -dout ("zero tail %llu\n" , left); -ceph_zero_page_vector_range (page_align + read, left, - pages); - read += left; - } } -if (ret >=0 ) - ret = read;dout ("striped_read returns %d\n" , ret);return ret; }
Greg Kroah-Hartman
maintainerPATCH 110/129 ceph: allow sync_read/write return partial successed size of read/write.
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: majianpeng <[email protected]>
commit ee7289bfadda5f4ef60884547ebc9989c8fb314a upstream.
For sync_read/write, it may do multi stripe operations.If one of those met erro, we return the former successed size rather than a error value. There is a exception for write-operation met -EOLDSNAPC.If this occur,we retry the whole write again.
--- fs/ceph/file.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ceph/file.c +3 -1
@@ -373,7 +373,7 @@ more: goto more; } -if (ret >=0 ) { +if (read >0 ) { ret = read;/* did we bounce off eof? */ if (pos + left > inode->i_size)
@@ -611,6 +611,8 @@ out:if (check_caps)ceph_check_caps (ceph_inode (inode),CHECK_CAPS_AUTHONLY ,NULL ); + }else if (ret != -EOLDSNAPC && written >0 ) { + ret = written; }return ret; }
Greg Kroah-Hartman
maintainerPATCH 111/129 rbd: fix buffer size for writes to images with snapshots
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Durgin <[email protected]>
commit 03507db631c94a48e316c7f638ffb2991544d617 upstream.
rbd_osd_req_create() needs to know the snapshot context size to create a buffer large enough to send it with the message front. It gets this from the img_request, which was not set for the obj_request yet. This resulted in trying to write past the end of the front payload, hitting this BUG:
libceph: BUG_ON(p > msg->front.iov_base + msg->front.iov_len);
Fix this by associating the obj_request with its img_request immediately after it's created, before the osd request is created.
--- drivers/block/rbd.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/block/rbd.c +5 -5
@@ -2213,6 +2213,11 @@ static int rbd_img_request_fill(struct rrbd_segment_name_free (object_name);if (!obj_request) goto out_unwind; +/* +* set obj_request->img_request before creating the +* osd_request so that it gets the right snapc +*/ +rbd_img_obj_request_add (img_request, obj_request);if (type ==OBJ_REQUEST_BIO ) {unsigned int clone_size;
@@ -2254,11 +2259,6 @@ static int rbd_img_request_fill(struct r obj_request->pages, length, offset & ~PAGE_MASK, false, false); -/* -* set obj_request->img_request before formatting -* the osd_request so that it gets the right snapc -*/ -rbd_img_obj_request_add (img_request, obj_request);if (write_request)rbd_osd_req_format_write (obj_request);else
Greg Kroah-Hartman
maintainerPATCH 112/129 rbd: fix null dereference in dout
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Durgin <[email protected]>
commit c35455791c1131e7ccbf56ea6fbdd562401c2ce2 upstream.
The order parameter is sometimes NULL in _rbd_dev_v2_snap_size(), but the dout() always derefences it. Move this to another dout() protected by a check that order is non-NULL.
--- drivers/block/rbd.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/block/rbd.c +5 -3
@@ -3712,12 +3712,14 @@ static int _rbd_dev_v2_snap_size(structif (ret <sizeof (size_buf))return -ERANGE ; -if (order) +if (order) { *order = size_buf.order; +dout (" order %u" , (unsigned int )*order); + } *snap_size =le64_to_cpu (size_buf.size); -dout (" snap_id 0x%016llx order = %u, snap_size = %llu\n" , - (unsigned long long )snap_id, (unsigned int )*order, +dout (" snap_id 0x%016llx snap_size = %llu\n" , + (unsigned long long )snap_id, (unsigned long long )*snap_size);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 113/129 libceph: add function to ensure notifies are complete
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Durgin <[email protected]>
commit dd935f44a40f8fb02aff2cc0df2269c92422df1c upstream.
Without a way to flush the osd client's notify workqueue, a watch event that is unregistered could continue receiving callbacks indefinitely.
Unregistering the event simply means no new notifies are added to the queue, but there may still be events in the queue that will call the watch callback for the event. If the queue is flushed after the event is unregistered, the caller can be sure no more watch callbacks will occur for the canceled watch.
--- include/linux/ceph/osd_client.h | 2 ++ net/ceph/osd_client.c | 11 +++++++++++ 2 files changed, 13 insertions(+)
include/linux/ceph/osd_client.h +2 -0
@@ -335,6 +335,8 @@ extern int ceph_osdc_wait_request(struct struct ceph_osd_request *req);extern void ceph_osdc_sync (struct ceph_osd_client *osdc); +extern void ceph_osdc_flush_notifies (struct ceph_osd_client *osdc); + extern int ceph_osdc_readpages(struct ceph_osd_client *osdc, struct ceph_vino vino, struct ceph_file_layout *layout,
net/ceph/osd_client.c +11 -0
@@ -2209,6 +2209,17 @@ void ceph_osdc_sync(struct ceph_osd_clieEXPORT_SYMBOL (ceph_osdc_sync);/* +* Call all pending notify callbacks - for use after a watch is +* unregistered, to make sure no more callbacks for it will be invoked +*/ +extern void ceph_osdc_flush_notifies (struct ceph_osd_client *osdc) +{ +flush_workqueue (osdc->notify_wq); +} +EXPORT_SYMBOL (ceph_osdc_flush_notifies); + + +/* * init, shutdown */ int ceph_osdc_init (struct ceph_osd_client *osdc,struct ceph_client *client)
Greg Kroah-Hartman
maintainerPATCH 114/129 rbd: complete notifies before cleaning up osd_client and rbd_dev
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Durgin <[email protected]>
commit 9abc59908e0c5f983aaa91150da32d5b62cf60b7 upstream.
To ensure rbd_dev is not used after it's released, flush all pending notify callbacks before calling rbd_dev_image_release(). No new notifies can be added to the queue at this point because the watch has already be unregistered with the osd_client.
--- drivers/block/rbd.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/block/rbd.c +7 -0
@@ -5150,6 +5150,13 @@ static ssize_t rbd_remove(struct bus_typ ret =rbd_dev_header_watch_sync (rbd_dev, false);if (ret)rbd_warn (rbd_dev,"failed to cancel watch event (%d)\n" , ret); + +/* +* flush remaining watch callbacks - these must be complete +* before the osd_client is shutdown +*/ +dout ("%s: flushing notifies" , __func__); +ceph_osdc_flush_notifies (&rbd_dev->rbd_client->client->osdc);rbd_dev_image_release (rbd_dev);module_put (THIS_MODULE ); ret = count;
Greg Kroah-Hartman
maintainerPATCH 115/129 rbd: make rbd_obj_notify_ack() synchronous
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Durgin <[email protected]>
commit 20e0af67ce88c657d0601977b9941a2256afbdaa upstream.
The only user of rbd_obj_notify_ack() is rbd_watch_cb(). It used asynchronously with no tracking of when the notify ack completes, so it may still be in progress when the osd_client is shut down. This results in a BUG() since the osd client assumes no requests are in flight when it stops. Since all notifies are flushed before the osd_client is stopped, waiting for the notify ack to complete before returning from the watch callback ensures there are no notify acks in flight during shutdown.
Rename rbd_obj_notify_ack() to rbd_obj_notify_ack_sync() to reflect its new synchronous nature.
--- drivers/block/rbd.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/block/rbd.c +6 -5
@@ -2819,7 +2819,7 @@ out_err:obj_request_done_set (obj_request); } -static int rbd_obj_notify_ack (struct rbd_device *rbd_dev,u64 notify_id) +static int rbd_obj_notify_ack_sync (struct rbd_device *rbd_dev,u64 notify_id) {struct rbd_obj_request *obj_request;struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
@@ -2834,16 +2834,17 @@ static int rbd_obj_notify_ack(struct rbd obj_request->osd_req =rbd_osd_req_create (rbd_dev, false, obj_request);if (!obj_request->osd_req) goto out; - obj_request->callback = rbd_obj_request_put;osd_req_op_watch_init (obj_request->osd_req,0 ,CEPH_OSD_OP_NOTIFY_ACK , notify_id,0 ,0 );rbd_osd_req_format_read (obj_request); ret =rbd_obj_request_submit (osdc, obj_request); -out:if (ret) -rbd_obj_request_put (obj_request); + goto out; + ret =rbd_obj_request_wait (obj_request); +out: +rbd_obj_request_put (obj_request);return ret; }
@@ -2863,7 +2864,7 @@ static void rbd_watch_cb(u64 ver, u64 noif (ret)rbd_warn (rbd_dev,": header refresh error (%d)\n" , ret); -rbd_obj_notify_ack (rbd_dev, notify_id); +rbd_obj_notify_ack_sync (rbd_dev, notify_id); }/*
Greg Kroah-Hartman
maintainerPATCH 116/129 rbd: fix use-after free of rbd_dev->disk
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Durgin <[email protected]>
commit 9875201e10496612080e7d164acc8f625c18725c upstream.
Removing a device deallocates the disk, unschedules the watch, and finally cleans up the rbd_dev structure. rbd_dev_refresh(), called from the watch callback, updates the disk size and rbd_dev structure. With no locking between them, rbd_dev_refresh() may use the device or rbd_dev after they've been freed.
To fix this, check whether RBD_DEV_FLAG_REMOVING is set before updating the disk size in rbd_dev_refresh(). In order to prevent a race where rbd_dev_refresh() is already revalidating the disk when rbd_remove() is called, move the call to rbd_bus_del_dev() after the watch is unregistered and all notifies are complete. It's safe to defer deleting this structure because no new requests can be submitted once the RBD_DEV_FLAG_REMOVING is set, since the device cannot be opened.
--- drivers/block/rbd.c | 40 +++++++++++++++++++++++++++++++++------- 1 file changed, 33 insertions(+), 7 deletions(-)
drivers/block/rbd.c +33 -7
@@ -3336,6 +3336,31 @@ static void rbd_exists_validate(struct rclear_bit (RBD_DEV_FLAG_EXISTS , &rbd_dev->flags); } +static void rbd_dev_update_size (struct rbd_device *rbd_dev) +{ +sector_t size; +bool removing; + +/* +* Don't hold the lock while doing disk operations, +* or lock ordering will conflict with the bdev mutex via: +* rbd_add() -> blkdev_get() -> rbd_open() +*/ +spin_lock_irq (&rbd_dev->lock); + removing =test_bit (RBD_DEV_FLAG_REMOVING , &rbd_dev->flags); +spin_unlock_irq (&rbd_dev->lock); +/* +* If the device is being removed, rbd_dev->disk has +* been destroyed, so don't try to update its size +*/ +if (!removing) { + size = (sector_t )rbd_dev->mapping.size /SECTOR_SIZE ; +dout ("setting size to %llu sectors" , (unsigned long long )size); +set_capacity (rbd_dev->disk, size); +revalidate_disk (rbd_dev->disk); + } +} +static int rbd_dev_refresh (struct rbd_device *rbd_dev) {u64 mapping_size;
@@ -3354,12 +3379,7 @@ static int rbd_dev_refresh(struct rbd_derbd_exists_validate (rbd_dev);mutex_unlock (&ctl_mutex);if (mapping_size != rbd_dev->mapping.size) { -sector_t size; - - size = (sector_t )rbd_dev->mapping.size /SECTOR_SIZE ; -dout ("setting size to %llu sectors" , (unsigned long long )size); -set_capacity (rbd_dev->disk, size); -revalidate_disk (rbd_dev->disk); +rbd_dev_update_size (rbd_dev); }return ret;
@@ -5147,7 +5167,6 @@ static ssize_t rbd_remove(struct bus_typif (ret <0 || already) goto done; -rbd_bus_del_dev (rbd_dev); ret =rbd_dev_header_watch_sync (rbd_dev, false);if (ret)rbd_warn (rbd_dev,"failed to cancel watch event (%d)\n" , ret);
@@ -5158,6 +5177,13 @@ static ssize_t rbd_remove(struct bus_typ*/ dout ("%s: flushing notifies" , __func__);ceph_osdc_flush_notifies (&rbd_dev->rbd_client->client->osdc); +/* +* Don't free anything from rbd_dev->disk until after all +* notifies are completely processed. Otherwise +* rbd_bus_del_dev() will race with rbd_watch_cb(), resulting +* in a potential use after free of rbd_dev->disk or rbd_dev. +*/ +rbd_bus_del_dev (rbd_dev);rbd_dev_image_release (rbd_dev);module_put (THIS_MODULE ); ret = count;
Greg Kroah-Hartman
maintainerPATCH 117/129 rbd: ignore unmapped snapshots that no longer exist
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Durgin <[email protected]>
commit efadc98aab674153709cc357ba565f04e3164fcd upstream.
This prevents erroring out while adding a device when a snapshot unrelated to the current mapping is deleted between reading the snapshot context and reading the snapshot names. If the mapped snapshot name is not found an error still occurs as usual.
--- drivers/block/rbd.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/block/rbd.c +7 -2
@@ -4055,8 +4055,13 @@ static u64 rbd_v2_snap_id_by_name(struct snap_id = snapc->snaps[which]; snap_name =rbd_dev_v2_snap_name (rbd_dev, snap_id); -if (IS_ERR (snap_name)) -break ; +if (IS_ERR (snap_name)) { +/* ignore no-longer existing snapshots */ +if (PTR_ERR (snap_name) == -ENOENT ) +continue ; +else +break ; + } found = !strcmp (name, snap_name);kfree (snap_name); }
Greg Kroah-Hartman
maintainerPATCH 118/129 rbd: fix error handling from rbd_snap_name()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Durgin <[email protected]>
commit da6a6b63978d45f9ae582d1f362f182012da3a22 upstream.
rbd_snap_name() calls rbd_dev_v{1,2}_snap_name() depending on the format of the image. The format 1 version returns NULL on error, which is handled by the caller. The format 2 version returns an ERR_PTR, which the caller of rbd_snap_name() does not expect.
Fortunately this is unlikely to occur in practice because rbd_snap_id_by_name() is called before rbd_snap_name(). This would hit similar errors to rbd_snap_name() (like the snapshot not existing) and return early, so rbd_snap_name() would not hit an error unless the snapshot was removed between the two calls or memory was exhausted.
Use an ERR_PTR in rbd_dev_v1_snap_name() so that the specific error can be propagated, and it is consistent with rbd_dev_v2_snap_name(). Handle the ERR_PTR in the only rbd_snap_name() caller.
--- drivers/block/rbd.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/block/rbd.c +6 -4
@@ -937,12 +937,14 @@ static const char *rbd_dev_v1_snap_name( u64 snap_id) {u32 which; +const char *snap_name; which =rbd_dev_snap_index (rbd_dev, snap_id);if (which ==BAD_SNAP_INDEX ) -return NULL ; +return ERR_PTR (-ENOENT ); -return _rbd_dev_v1_snap_name (rbd_dev, which); + snap_name =_rbd_dev_v1_snap_name (rbd_dev, which); +return snap_name ? snap_name :ERR_PTR (-ENOMEM ); }static const char *rbd_snap_name (struct rbd_device *rbd_dev,u64 snap_id)
@@ -4140,8 +4142,8 @@ static int rbd_dev_spec_update(struct rb/* Look up the snapshot name, and make a copy */ snap_name =rbd_snap_name (rbd_dev, spec->snap_id); -if (!snap_name) { - ret = -ENOMEM ; +if (IS_ERR (snap_name)) { + ret =PTR_ERR (snap_name); goto out_err; }
Greg Kroah-Hartman
maintainerPATCH 119/129 arm64: Only enable local interrupts after the CPU is marked online
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <[email protected]>
commit 53ae3acd4390ffeecb3a11dbd5be347b5a3d98f2 upstream.
There is a slight chance that (timer) interrupts are triggered before a secondary CPU has been marked online with implications on softirq thread affinity.
--- arch/arm64/kernel/smp.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
arch/arm64/kernel/smp.c +8 -7
@@ -200,13 +200,6 @@ asmlinkage void __cpuinit secondary_starraw_spin_unlock (&boot_lock);/* -* Enable local interrupts. -*/ -notify_cpu_starting (cpu); -local_irq_enable (); -local_fiq_enable (); - -/* * OK, now it's safe to let the boot CPU continue. Wait for * the CPU migration code to notice that the CPU is online * before we continue.
@@ -215,6 +208,14 @@ asmlinkage void __cpuinit secondary_starcomplete (&cpu_running);/* +* Enable GIC and timers. +*/ +notify_cpu_starting (cpu); + +local_irq_enable (); +local_fiq_enable (); + +/* * OK, it's off to the idle thread for us */ cpu_startup_entry (CPUHP_ONLINE );
Greg Kroah-Hartman
maintainerPATCH 120/129 arm64: virt: ensure visibility of __boot_cpu_mode
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 82b2f495fba338d1e3098dde1df54944a9c19751 upstream.
Secondary CPUs write to __boot_cpu_mode with caches disabled, and thus a cached value of __boot_cpu_mode may be incoherent with that in memory. This could lead to a failure to detect mismatched boot modes.
This patch adds flushing to ensure that writes by secondaries to __boot_cpu_mode are made visible before we test against it.
--- arch/arm64/include/asm/virt.h | 13 +++++++++++++ 1 file changed, 13 insertions(+)
arch/arm64/include/asm/virt.h +13 -0
@@ -21,6 +21,7 @@#define BOOT_CPU_MODE_EL2 (0x0e12b007)#ifndef __ASSEMBLY__ +#include <asm/cacheflush.h> /* * __boot_cpu_mode records what mode CPUs were booted in.
@@ -36,9 +37,20 @@ extern u32 __boot_cpu_mode[2];void __hyp_set_vectors (phys_addr_t phys_vector_base);phys_addr_t __hyp_get_vectors (void ); +static inline void sync_boot_mode (void ) +{ +/* +* As secondaries write to __boot_cpu_mode with caches disabled, we +* must flush the corresponding cache entries to ensure the visibility +* of their writes. +*/ +__flush_dcache_area (__boot_cpu_mode,sizeof (__boot_cpu_mode)); +} +/* Reports the availability of HYP mode */ static inline bool is_hyp_mode_available (void ) { +sync_boot_mode ();return (__boot_cpu_mode[0 ] ==BOOT_CPU_MODE_EL2 && __boot_cpu_mode[1 ] ==BOOT_CPU_MODE_EL2 ); }
@@ -46,6 +58,7 @@ static inline bool is_hyp_mode_available/* Check if the bootloader has booted CPUs in different modes */ static inline bool is_hyp_mode_mismatched (void ) { +sync_boot_mode ();return __boot_cpu_mode[0 ] != __boot_cpu_mode[1 ]; }
Greg Kroah-Hartman
maintainerPATCH 121/129 arm64: Change kernel stack size to 16K
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Kan <[email protected]>
commit 845ad05ec31e0f3872a321e10dbeaf872022632c upstream.
Written by Catalin Marinas, tested by APM on storm platform. This is needed because of the failures encountered when running SpecWeb benchmark test.
--- arch/arm64/include/asm/thread_info.h | 4 ++-- arch/arm64/kernel/entry.S | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/arm64/include/asm/thread_info.h +2 -2
@@ -24,10 +24,10 @@#include <linux/compiler.h> #ifndef CONFIG_ARM64_64K_PAGES -#define THREAD_SIZE_ORDER 1 +#define THREAD_SIZE_ORDER 2#endif -#define THREAD_SIZE 8192 +#define THREAD_SIZE 16384#define THREAD_START_SP (THREAD_SIZE - 16)#ifndef __ASSEMBLY__
arch/arm64/kernel/entry.S +1 -1
@@ -121,7 +121,7 @@ .macro get_thread_info, rd mov \rd, sp - and \rd, \rd, #~((1 << 13) - 1) // top of 8K stack + and \rd, \rd, #~(THREAD_SIZE - 1) // top of stack .endm /*
Greg Kroah-Hartman
maintainerPATCH 122/129 arm64: fix possible invalid FPSIMD initialization state
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Liu <[email protected]>
commit 6db83cea1c975b9a102e17def7d2795814e1ae2b upstream.
If context switching happens during executing fpsimd_flush_thread(), stale value in FPSIMD registers will be saved into current thread's fpsimd_state by fpsimd_thread_switch(). That may cause invalid initialization state for the new process, so disable preemption when executing fpsimd_flush_thread().
--- arch/arm64/kernel/fpsimd.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/kernel/fpsimd.c +2 -0
@@ -79,8 +79,10 @@ void fpsimd_thread_switch(struct task_stvoid fpsimd_flush_thread (void ) { +preempt_disable ();memset (¤t->thread.fpsimd_state,0 ,sizeof (struct fpsimd_state ));fpsimd_load_state (¤t->thread.fpsimd_state); +preempt_enable (); }/*
Greg Kroah-Hartman
maintainerPATCH 123/129 arm64: check for number of arguments in syscall_get/set_arguments()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: AKASHI Takahiro <[email protected]>
commit 7b22c03536a539142f931815528d55df455ffe2d upstream.
In ftrace_syscall_enter(),
syscall_get_arguments(..., 0, n, ...)
if (i == 0) { <handle orig_x0> ...; n--;}
memcpy(..., n * sizeof(args[0]));If 'number of arguments(n)' is zero and 'argument index(i)' is also zero in syscall_get_arguments(), none of arguments should be copied by memcpy(). Otherwise 'n--' can be a big positive number and unexpected amount of data will be copied. Tracing system calls which take no argument, say sync(void), may hit this case and eventually make the system corrupted.
This patch fixes the issue both in syscall_get_arguments() and syscall_set_arguments().
--- arch/arm64/include/asm/syscall.h | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm64/include/asm/syscall.h +6 -0
@@ -59,6 +59,9 @@ static inline void syscall_get_arguments unsigned int i, unsigned int n, unsigned long *args) { + if (n == 0) + return; +if (i + n >SYSCALL_MAX_ARGS ) {unsigned long *args_bad = args +SYSCALL_MAX_ARGS - i;unsigned int n_bad = n + i -SYSCALL_MAX_ARGS ;
@@ -82,6 +85,9 @@ static inline void syscall_set_arguments unsigned int i, unsigned int n, const unsigned long *args) { + if (n == 0) + return; +if (i + n >SYSCALL_MAX_ARGS ) {pr_warning ("%s called with max args %d, handling only %d\n" , __func__, i + n,SYSCALL_MAX_ARGS );
Greg Kroah-Hartman
maintainerPATCH 124/129 arm64: dts: Reserve the memory used for secondary CPU release address
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <[email protected]>
commit df503ba7f653c590b475ab80bde788edf5af70d5 upstream.
With the spin-table SMP booting method, secondary CPUs poll a location passed in the DT. The foundation-v8.dts file doesn't have this memory reserved and there is a risk of Linux using it before secondary CPUs are started.
--- arch/arm64/boot/dts/foundation-v8.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/foundation-v8.dts +2 -0
@@ -6,6 +6,8 @@ /dts-v1/; +/memreserve/ 0x80000000 0x00010000; + / { model = "Foundation-v8A"; compatible = "arm,foundation-aarch64", "arm,vexpress";
Greg Kroah-Hartman
maintainerPATCH 125/129 arm64: Remove unused cpu_name ascii in arch/arm64/mm/proc.S
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <[email protected]>
commit f3a1d7d53dccf51959aec16b574617cc6bfeca09 upstream.
This string has been moved to arch/arm64/kernel/cputable.c.
--- arch/arm64/mm/proc.S | 4 ---- 1 file changed, 4 deletions(-)
arch/arm64/mm/proc.S +0 -4
@@ -95,10 +95,6 @@ ENTRY(cpu_do_switch_mm) ret ENDPROC(cpu_do_switch_mm) -cpu_name: - .ascii "AArch64 Processor" - .align - .section ".text.init", #alloc, #execinstr /*
Greg Kroah-Hartman
maintainerPATCH 126/129 clocksource: arch_timer: use virtual counters
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit 0d651e4e65e96989f72236bf83bd4c6e55eb6ce4 upstream.
Switching between reading the virtual or physical counters is problematic, as some core code wants a view of time before we're fully set up. Using a function pointer and switching the source after the first read can make time appear to go backwards, and having a check in the read function is an unfortunate block on what we want to be a fast path.
Instead, this patch makes us always use the virtual counters. If we're a guest, or don't have hyp mode, we'll use the virtual timers, and as such don't care about CNTVOFF as long as it doesn't change in such a way as to make time appear to travel backwards. As the guest will use the virtual timers, a (potential) KVM host must use the physical timers (which can wake up the host even if they fire while a guest is executing), and hence a host must have CNTVOFF set to zero so as to have a consistent view of time between the physical timers and virtual counters.
--- arch/arm/include/asm/arch_timer.h | 9 --------- arch/arm64/include/asm/arch_timer.h | 10 ---------- drivers/clocksource/arm_arch_timer.c | 23 +++++------------------ include/clocksource/arm_arch_timer.h | 2 +- 4 files changed, 6 insertions(+), 38 deletions(-)
arch/arm/include/asm/arch_timer.h +0 -9
@@ -80,15 +80,6 @@ static inline u32 arch_timer_get_cntfrq(return val; } -static inline u64 arch_counter_get_cntpct (void ) -{ -u64 cval; - -isb (); - asmvolatile ("mrrc p15, 0, %Q0, %R0, c14" :"=r" (cval)); -return cval; -} -static inline u64 arch_counter_get_cntvct (void ) {u64 cval;
arch/arm64/include/asm/arch_timer.h +0 -10
@@ -110,16 +110,6 @@ static inline void __cpuinit arch_counte asmvolatile ("msr cntkctl_el1, %0" : :"r" (cntkctl)); } -static inline u64 arch_counter_get_cntpct (void ) -{ -u64 cval; - -isb (); - asmvolatile ("mrs %0, cntpct_el0" :"=r" (cval)); - -return cval; -} -static inline u64 arch_counter_get_cntvct (void ) {u64 cval;
drivers/clocksource/arm_arch_timer.c +5 -18
@@ -186,27 +186,19 @@ u32 arch_timer_get_rate(void)return arch_timer_rate; } -/* -* Some external users of arch_timer_read_counter (e.g. sched_clock) may try to -* call it before it has been initialised. Rather than incur a performance -* penalty checking for initialisation, provide a default implementation that -* won't lead to time appearing to jump backwards. -*/ -static u64 arch_timer_read_zero (void ) +u64 arch_timer_read_counter (void ) { -return 0 ; +return arch_counter_get_cntvct (); } -u64 (*arch_timer_read_counter)(void) = arch_timer_read_zero; -static cycle_t arch_counter_read (struct clocksource *cs) { -return arch_timer_read_counter (); +return arch_counter_get_cntvct (); }static cycle_t arch_counter_read_cc (const struct cyclecounter *cc) { -return arch_timer_read_counter (); +return arch_counter_get_cntvct (); }static struct clocksource clocksource_counter = {
@@ -287,7 +279,7 @@ static int __init arch_timer_register(vo cyclecounter.mult = clocksource_counter.mult; cyclecounter.shift = clocksource_counter.shift;timecounter_init (&timecounter, &cyclecounter, -arch_counter_get_cntpct ()); +arch_counter_get_cntvct ());if (arch_timer_use_virtual) { ppi = arch_timer_ppi[VIRT_PPI ];
@@ -376,11 +368,6 @@ static void __init arch_timer_init(struc } } -if (arch_timer_use_virtual) - arch_timer_read_counter = arch_counter_get_cntvct; -else - arch_timer_read_counter = arch_counter_get_cntpct; -arch_timer_register ();arch_timer_arch_init (); }
include/clocksource/arm_arch_timer.h +1 -1
@@ -32,7 +32,7 @@#ifdef CONFIG_ARM_ARCH_TIMER extern u32 arch_timer_get_rate (void ); -extern u64 (*arch_timer_read_counter)(void ); +extern u64 arch_timer_read_counter (void );extern struct timecounter *arch_timer_get_timecounter (void );#else
Re: [PATCH 3.10 126/129] clocksource: arch_timer: use virtual counters
Hi Greg,
Quoted 1 line · Greg Kroah-Hartman
3.10-stable review patch. If anyone has any objections, please let me know.
This patch alone may break ARM systems booted at hyp mode or when KVM is in use, causing CPUs to have different views of time or for a given CPU's view of time to jump backwards.
The following two commits in mainline fix those two problems by ensuring all CPUs have the same virtual timer offset (zero), and maintaining it across KVM world switches. On arm64 the requisite CNTVOFF zeroing is already present in linux-3.10.y.
0af0b189abf7 (ARM: hyp: initialize CNTVOFF to zero) f793c23ebbe5 (ARM: KVM: arch_timers: zero CNTVOFF upon return to host)
Thanks,
Mark.
Quoted 145 lines
------------------
From: Mark Rutland <[email protected]>
commit
0d651e4e65e96989f72236bf83bd4c6e55eb6ce4upstream.Switching between reading the virtual or physical counters is problematic, as some core code wants a view of time before we're fully set up. Using a function pointer and switching the source after the first read can make time appear to go backwards, and having a check in the read function is an unfortunate block on what we want to be a fast path.
Instead, this patch makes us always use the virtual counters. If we're a guest, or don't have hyp mode, we'll use the virtual timers, and as such don't care about CNTVOFF as long as it doesn't change in such a way as to make time appear to travel backwards. As the guest will use the virtual timers, a (potential) KVM host must use the physical timers (which can wake up the host even if they fire while a guest is executing), and hence a host must have CNTVOFF set to zero so as to have a consistent view of time between the physical timers and virtual counters.
Signed-off-by Mark Rutland <[email protected]>Acked-by Catalin Marinas <[email protected]>Acked-by Marc Zyngier <[email protected]>Cc Rob Herring <[email protected]>Cc Mark Brown <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- arch/arm/include/asm/arch_timer.h | 9 --------- arch/arm64/include/asm/arch_timer.h | 10 ---------- drivers/clocksource/arm_arch_timer.c | 23 +++++------------------ include/clocksource/arm_arch_timer.h | 2 +- 4 files changed, 6 insertions(+), 38 deletions(-)arch/arm/include/asm/arch_timer.h +0
-9@@ -80,15 +80,6 @@ static inline u32 arch_timer_get_cntfrq(return val; } -static inline u64 arch_counter_get_cntpct (void ) -{ -u64 cval; - -isb (); - asmvolatile ("mrrc p15, 0, %Q0, %R0, c14" :"=r" (cval)); -return cval; -} -static inline u64 arch_counter_get_cntvct (void ) {u64 cval;arch/arm64/include/asm/arch_timer.h +0
-10@@ -110,16 +110,6 @@ static inline void __cpuinit arch_counte asmvolatile ("msr cntkctl_el1, %0" : :"r" (cntkctl)); } -static inline u64 arch_counter_get_cntpct (void ) -{ -u64 cval; - -isb (); - asmvolatile ("mrs %0, cntpct_el0" :"=r" (cval)); - -return cval; -} -static inline u64 arch_counter_get_cntvct (void ) {u64 cval;drivers/clocksource/arm_arch_timer.c +5
-18@@ -186,27 +186,19 @@ u32 arch_timer_get_rate(void)return arch_timer_rate; } -/* -* Some external users of arch_timer_read_counter (e.g. sched_clock) may try to -* call it before it has been initialised. Rather than incur a performance -* penalty checking for initialisation, provide a default implementation that -* won't lead to time appearing to jump backwards. -*/ -static u64 arch_timer_read_zero (void ) +u64 arch_timer_read_counter (void ) { -return 0 ; +return arch_counter_get_cntvct (); } -u64 (*arch_timer_read_counter)(void) = arch_timer_read_zero; -static cycle_t arch_counter_read (struct clocksource *cs) { -return arch_timer_read_counter (); +return arch_counter_get_cntvct (); }static cycle_t arch_counter_read_cc (const struct cyclecounter *cc) { -return arch_timer_read_counter (); +return arch_counter_get_cntvct (); }static struct clocksource clocksource_counter = {@@ -287,7 +279,7 @@ static int __init arch_timer_register(vo cyclecounter.mult = clocksource_counter.mult; cyclecounter.shift = clocksource_counter.shift;timecounter_init (&timecounter, &cyclecounter, -arch_counter_get_cntpct ()); +arch_counter_get_cntvct ());if (arch_timer_use_virtual) { ppi = arch_timer_ppi[VIRT_PPI ];@@ -376,11 +368,6 @@ static void __init arch_timer_init(struc } } -if (arch_timer_use_virtual) - arch_timer_read_counter = arch_counter_get_cntvct; -else - arch_timer_read_counter = arch_counter_get_cntpct; -arch_timer_register ();arch_timer_arch_init (); }include/clocksource/arm_arch_timer.h +1
-1@@ -32,7 +32,7 @@#ifdef CONFIG_ARM_ARCH_TIMER extern u32 arch_timer_get_rate (void ); -extern u64 (*arch_timer_read_counter)(void ); +extern u64 arch_timer_read_counter (void );extern struct timecounter *arch_timer_get_timecounter (void );#else
Greg Kroah-Hartman
maintainerRe: [PATCH 3.10 126/129] clocksource: arch_timer: use virtual counters
Quoted 9 lines · Mark Rutland
Hi Greg,
Quoted 1 line · Greg Kroah-Hartman
3.10-stable review patch. If anyone has any objections, please let me know.
This patch alone may break ARM systems booted at hyp mode or when KVM is in use, causing CPUs to have different views of time or for a given CPU's view of time to jump backwards.
Quoted 7 lines
The following two commits in mainline fix those two problems by ensuring all CPUs have the same virtual timer offset (zero), and maintaining it across KVM world switches. On arm64 the requisite CNTVOFF zeroing is already present in linux-3.10.y.
0af0b189abf7(ARM: hyp: initialize CNTVOFF to zero)f793c23ebbe5(ARM: KVM:arch_timers: zero CNTVOFF upon return to host)
Thanks, I've now queued up both of these patches as well. With that, we should be ok, right?
greg k-h
Re: [PATCH 3.10 126/129] clocksource: arch_timer: use virtual counters
Quoted 15 lines · Greg Kroah-Hartman
Quoted 14 lines · Mark Rutland
Hi Greg,
Quoted 1 line · Greg Kroah-Hartman
3.10-stable review patch. If anyone has any objections, please let me know.
This patch alone may break ARM systems booted at hyp mode or when KVM is in use, causing CPUs to have different views of time or for a given CPU's view of time to jump backwards.
The following two commits in mainline fix those two problems by ensuring all CPUs have the same virtual timer offset (zero), and maintaining it across KVM world switches. On arm64 the requisite CNTVOFF zeroing is already present in linux-3.10.y.
Quoted 5 lines
Quoted 2 lines
0af0b189abf7(ARM: hyp: initialize CNTVOFF to zero)f793c23ebbe5(ARM: KVM:arch_timers: zero CNTVOFF upon return to host)Thanks, I've now queued up both of these patches as well. With that, we should be ok, right?
Cheers. I believe that should be sufficient, yes.
Mark.
Greg Kroah-Hartman
maintainerPATCH 127/129 arm64: Avoid cache flushing in flush_dcache_page()
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <[email protected]>
commit b5b6c9e9149d8a7c3f1d7b9d0c046c6184e1dd17 upstream.
The flush_dcache_page() function is called when the kernel modified a page cache page. Since the D-cache on AArch64 does not have aliases this function can simply mark the page as dirty for later flushing via set_pte_at()/__sync_icache_dcache() if the page is executable (to ensure the I-D cache coherency).
--- arch/arm64/mm/flush.c | 22 ++++------------------ 1 file changed, 4 insertions(+), 18 deletions(-)
arch/arm64/mm/flush.c +4 -18
@@ -94,28 +94,14 @@ void __sync_icache_dcache(pte_t pte, uns }/* -* Ensure cache coherency between kernel mapping and userspace mapping of this -* page. +* This function is called when a page has been modified by the kernel. Mark +* it as dirty for later flushing when mapped in user space (if executable, +* see __sync_icache_dcache). */ void flush_dcache_page (struct page *page) { -struct address_space *mapping; - -/* -* The zero page is never written to, so never has any dirty cache -* lines, and therefore never needs to be flushed. -*/ -if (page ==ZERO_PAGE (0 )) -return ; - - mapping =page_mapping (page); -if (mapping &&mapping_mapped (mapping)) { -__flush_dcache_page (page); -__flush_icache_all (); -set_bit (PG_dcache_clean, &page->flags); - }else { +if (test_bit (PG_dcache_clean, &page->flags))clear_bit (PG_dcache_clean, &page->flags); - } }EXPORT_SYMBOL (flush_dcache_page);
Greg Kroah-Hartman
maintainerPATCH 128/129 arm64: Do not flush the D-cache for anonymous pages
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <[email protected]>
commit 7249b79f6b4cc3c2aa9138dca52e535a4c789107 upstream.
The D-cache on AArch64 is VIPT non-aliasing, so there is no need to flush it for anonymous pages.
--- arch/arm64/mm/flush.c | 8 +++----- arch/arm64/mm/mmu.c | 1 - 2 files changed, 3 insertions(+), 6 deletions(-)
arch/arm64/mm/flush.c +3 -5
@@ -77,14 +77,12 @@ void __flush_dcache_page(struct page *pavoid __sync_icache_dcache (pte_t pte,unsigned long addr) { -unsigned long pfn; -struct page *page; +struct page *page =pte_page (pte); - pfn =pte_pfn (pte); -if (!pfn_valid (pfn)) +/* no flushing needed for anonymous pages */ +if (!page_mapping (page))return ; - page =pfn_to_page (pfn);if (!test_and_set_bit (PG_dcache_clean, &page->flags)) {__flush_dcache_page (page);__flush_icache_all ();
arch/arm64/mm/mmu.c +0 -1
@@ -339,7 +339,6 @@ void __init paging_init(void)bootmem_init (); empty_zero_page =virt_to_page (zero_page); -__flush_dcache_page (empty_zero_page);/* * TTBR0 is only used for the identity mapping at this stage. Make it
Greg Kroah-Hartman
maintainerPATCH 129/129 arm64: Use Normal NonCacheable memory for writecombine
In reply to Greg Kroah-Hartman3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <[email protected]>
commit 4f00130b70e5eee813cc7bc298e0f3fdf79673cc upstream.
This provides better performance compared to Device GRE and also allows unaligned accesses. Such memory is intended to be used with standard RAM (e.g. framebuffers) and not I/O.
--- arch/arm64/include/asm/pgtable.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/pgtable.h +1 -1
@@ -184,7 +184,7 @@ static inline void set_pte_at(struct mm_#define pgprot_noncached (prot) \ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRnE))#define pgprot_writecombine (prot) \ - __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_GRE)) + __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC))#define pgprot_dmacoherent (prot) \ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC))#define __HAVE_PHYS_MEM_ACCESS_PROT
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.10.26 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jan 8 22:38:42 UTC 2014. Anything received after that time might be too late.
Build results:
total: 111 pass: 109 skipped: 1 fail: 1
Build avr32:atngw100mkii_evklcd101_defconfig still fails.
qemu tests all passed.
Results are as expected.
Details are available as usual at http://server.roeck-us.net:8010/builders.
Guenter
Greg Kroah-Hartman
maintainerQuoted 11 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.10.26 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jan 8 22:38:42 UTC 2014. Anything received after that time might be too late.
Build results:
Quoted 8 lines
total: 111 pass: 109 skipped: 1 fail: 1Build avr32:atngw100mkii_evklcd101_defconfig still fails.
qemu tests all passed.
Results are as expected.
Details are available as usual at http://server.roeck-us.net:8010/builders.
Thanks for testing.
greg k-h
Greg Kroah-Hartman
maintainer3.10.26-rc1 also had some issues, so here's a -rc2 release.
Chances from -rc1 were the removal of a mm patch that shouldn't have been there, addition of an ext4 fix, sh export symbol fix, and some ARM clocksource fixes.
Full release announcement follows:
----------------------------------
This is the start of the stable review cycle for the 3.10.26 release. There are 132 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Jan 9 19:02:48 UTC 2014. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.10.26-rc2.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.10.26-rc2
Nobuhiro Iwamatsu <[email protected]>
sh: add EXPORT_SYMBOL(min_low_pfn) and EXPORT_SYMBOL(max_low_pfn) to sh_ksyms_32.c
Eric Whitney <[email protected]>
ext4: fix bigalloc regression
Catalin Marinas <[email protected]>
arm64: Use Normal NonCacheable memory for writecombine
Catalin Marinas <[email protected]>
arm64: Do not flush the D-cache for anonymous pages
Catalin Marinas <[email protected]>
arm64: Avoid cache flushing in flush_dcache_page()
Mark Rutland <[email protected]>
ARM: KVM: arch_timers: zero CNTVOFF upon return to host
Marc Zyngier <[email protected]>
ARM: hyp: initialize CNTVOFF to zero
Mark Rutland <[email protected]>
clocksource: arch_timer: use virtual counters
Catalin Marinas <[email protected]>
arm64: Remove unused cpu_name ascii in arch/arm64/mm/proc.S
Catalin Marinas <[email protected]>
arm64: dts: Reserve the memory used for secondary CPU release address
AKASHI Takahiro <[email protected]>
arm64: check for number of arguments in syscall_get/set_arguments()
Jiang Liu <[email protected]>
arm64: fix possible invalid FPSIMD initialization state
Feng Kan <[email protected]>
arm64: Change kernel stack size to 16K
Mark Rutland <[email protected]>
arm64: virt: ensure visibility of __boot_cpu_mode
Catalin Marinas <[email protected]>
arm64: Only enable local interrupts after the CPU is marked online
Josh Durgin <[email protected]>
rbd: fix error handling from rbd_snap_name()
Josh Durgin <[email protected]>
rbd: ignore unmapped snapshots that no longer exist
Josh Durgin <[email protected]>
rbd: fix use-after free of rbd_dev->disk
Josh Durgin <[email protected]>
rbd: make rbd_obj_notify_ack() synchronous
Josh Durgin <[email protected]>
rbd: complete notifies before cleaning up osd_client and rbd_dev
Josh Durgin <[email protected]>
libceph: add function to ensure notifies are complete
Josh Durgin <[email protected]>
rbd: fix null dereference in dout
Josh Durgin <[email protected]>
rbd: fix buffer size for writes to images with snapshots
majianpeng <[email protected]>
ceph: allow sync_read/write return partial successed size of read/write.
majianpeng <[email protected]>
ceph: fix bugs about handling short-read for sync read mode.
Dan Carpenter <[email protected]>
libceph: create_singlethread_workqueue() doesn't return ERR_PTRs
Dan Carpenter <[email protected]>
libceph: potential NULL dereference in ceph_osdc_handle_map()
Dan Carpenter <[email protected]>
libceph: fix error handling in handle_reply()
majianpeng <[email protected]>
ceph: Add check returned value on func ceph_calc_ceph_pg.
Dan Carpenter <[email protected]>
ceph: cleanup types in striped_read()
Nathaniel Yazdani <[email protected]>
ceph: fix null pointer dereference
Yan, Zheng <[email protected]>
libceph: call r_unsafe_callback when unsafe reply is received
Sasha Levin <[email protected]>
ceph: avoid accessing invalid memory
majianpeng <[email protected]>
ceph: Free mdsc if alloc mdsc->mdsmap failed.
Sage Weil <[email protected]>
rbd: fix a couple warnings
Yan, Zheng <[email protected]>
libceph: fix truncate size calculation
Yan, Zheng <[email protected]>
libceph: fix safe completion
Alex Elder <[email protected]>
rbd: protect against concurrent unmaps
Alex Elder <[email protected]>
rbd: set removing flag while holding list lock
Alex Elder <[email protected]>
rbd: flush dcache after zeroing page data
Alex Elder <[email protected]>
libceph: add lingering request reference when registered
Emil Goode <[email protected]>
ceph: improve error handling in ceph_mdsmap_decode
Dinh Nguyen <[email protected]>
clocksource: dw_apb_timer_of: Fix read_sched_clock
Paul Moore <[email protected]>
selinux: process labeled IPsec TCP SYN-ACK packets properly in selinux_ip_postroute()
Paul Moore <[email protected]>
selinux: look for IPsec labels on both inbound and outbound packets
Geert Uytterhoeven <[email protected]>
sh: always link in helper functions extracted from libgcc
Stephen Boyd <[email protected]>
gpio: msm: Fix irq mask/unmask by writing bits instead of numbers
Roger Quadros <[email protected]>
gpio: twl4030: Fix regression for twl gpio LED output
Theodore Ts'o <[email protected]>
jbd2: don't BUG but return ENOSPC if a handle runs out of space
Martin Schwidefsky <[email protected]>
s390/3270: fix allocation of tty3270_screen structure
Vladimir Davydov <[email protected]>
memcg: fix memcg_size() calculation
Steven Whitehouse <[email protected]>
GFS2: Fix incorrect invalidation for DIO/buffered I/O
Steven Whitehouse <[email protected]>
GFS2: don't hold s_umount over blkdev_put
Dmitry Torokhov <[email protected]>
Input: allocate absinfo data when setting ABS capability
Naoya Horiguchi <[email protected]>
mm/memory-failure.c: transfer page count from head page to tail page after split thp
Rik van Riel <[email protected]>
mm: fix use-after-free in sys_remap_file_pages
Jianguo Wu <[email protected]>
mm/hugetlb: check for pte NULL pointer in __page_check_address()
Joonsoo Kim <[email protected]>
mm/compaction: respect ignore_skip_hint in update_pageblock_skip
Mel Gorman <[email protected]>
mm: numa: guarantee that tlb_flush_pending updates are visible before page table updates
Rik van Riel <[email protected]>
mm: fix TLB flush race between migration, and change_protection_range
Oleg Nesterov <[email protected]>
sched: fix the theoretical signal_wake_up() vs schedule() race
Mel Gorman <[email protected]>
mm: numa: avoid unnecessary work on the failure path
Mel Gorman <[email protected]>
mm: numa: ensure anon_vma is locked to prevent parallel THP splits
Mel Gorman <[email protected]>
mm: clear pmd_numa before invalidating
Rob Herring <[email protected]>
Revert "of/address: Handle #address-cells > 2 specially"
Rafael J. Wysocki <[email protected]>
intel_pstate: Fail initialization if P-state information is missing
Larry Finger <[email protected]>
rtlwifi: pci: Fix oops on driver unload
Johannes Berg <[email protected]>
radiotap: fix bitmap-end-finding buffer overrun
Tejun Heo <[email protected]>
libata, freezer: avoid block device removal while system is frozen
Robin H. Johnson <[email protected]>
libata: disable a disk via libata.force params
Vincent Pelletier <[email protected]>
libata: Add atapi_dmadir force flag
Michele Baldessari <[email protected]>
libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus SpinPoint M8
Josh Boyer <[email protected]>
cpupower: Fix segfault due to incorrect getopt_long arugments
Anton Blanchard <[email protected]>
powerpc: Align p_end
Michael Neuling <[email protected]>
powerpc: Fix bad stack check in exception entry
Jan Kiszka <[email protected]>
KVM: x86: Fix APIC map calculation after re-enabling
Mathy Vanhoef <[email protected]>
ath9k_htc: properly set MAC address and BSSID mask
Sujith Manoharan <[email protected]>
ath9k: Fix interrupt handling for the AR9002 family
Peter Korsgaard <[email protected]>
dm9601: work around tx fifo sync issue on dm962x
Peter Korsgaard <[email protected]>
dm9601: fix reception of full size ethernet frames on dm9620/dm9621a
Ard Biesheuvel <[email protected]>
auxvec.h: account for AT_HWCAP2 in AT_VECTOR_SIZE_BASE
Nithin Sujir <[email protected]>
tg3: Expand 4g_overflow_test workaround to skb fragments of any size.
Li Wang <[email protected]>
ceph: Avoid data inconsistency due to d-cache aliasing in readpage()
Alex Deucher <[email protected]>
drm/radeon: 0x9649 is SUMO2 not SUMO
Christian König <[email protected]>
drm/radeon: fix UVD 256MB check
Chris Wilson <[email protected]>
drm/i915: Use the correct GMCH_CTRL register for Sandybridge+
Alex Deucher <[email protected]>
drm/radeon: fix asic gfx values for scrapper asics
Daniel Vetter <[email protected]>
drm/i915: don't update the dri1 breadcrumb with modesetting
Chris Wilson <[email protected]>
drm/i915: Hold mutex across i915_gem_release
Ville Syrjälä <[email protected]>
drm/i915: Take modeset locks around intel_modeset_setup_hw_state()
Alex Deucher <[email protected]>
drm/radeon: add missing display tiling setup for oland
Alex Deucher <[email protected]>
drm/radeon: Fix sideport problems on certain RS690 boards
Rafał Miłecki <[email protected]>
drm/edid: add quirk for BPC in Samsung NP700G7A-S01PL notebook
Dan Williams <[email protected]>
net_dma: mark broken
Stefan Richter <[email protected]>
firewire: sbp2: bring back WRITE SAME support
Kirill Tkhai <[email protected]>
sched/rt: Fix rq's cpupri leak while enqueue/dequeue child RT entities
Mel Gorman <[email protected]>
sched: numa: skip inaccessible VMAs
Lukas Czerner <[email protected]>
ext4: fix FITRIM in no journal mode
Theodore Ts'o <[email protected]>
ext4: add explicit casts when masking cluster sizes
Jan Kara <[email protected]>
ext4: fix deadlock when writing in ENOSPC conditions
Jan Kara <[email protected]>
ext4: Do not reserve clusters when fs doesn't support extents
Eryu Guan <[email protected]>
ext4: check for overlapping extents in ext4_valid_extent_entries()
Junho Ryu <[email protected]>
ext4: fix use-after-free in ext4_mb_new_blocks
Theodore Ts'o <[email protected]>
ext4: call ext4_error_inode() if jbd2_journal_dirty_metadata() fails
Len Brown <[email protected]>
x86 idle: Repair large-server 50-watt idle-power regression
Suman Anna <[email protected]>
ARM: OMAP2+: hwmod_data: fix missing OMAP_INTC_START in irq data
Catalin Marinas <[email protected]>
arm64: spinlock: retry trylock operation if strex fails on free lock
Will Deacon <[email protected]>
arm64: ptrace: avoid using HW_BREAKPOINT_EMPTY for disabled events
Miao Xie <[email protected]>
ftrace: Initialize the ftrace profiler for each possible cpu
Nicholas Bellinger <[email protected]>
target/file: Update hw_max_sectors based on current block_size
Nicholas Bellinger <[email protected]>
iscsi-target: Fix-up all zero data-length CDBs with R/W_BIT set
Wei Yongjun <[email protected]>
iser-target: fix error return code in isert_create_device_ib_res()
Oleg Nesterov <[email protected]>
selinux: selinux_setprocattr()->ptrace_parent() needs rcu_read_lock()
Chad Hanson <[email protected]>
selinux: fix broken peer recv check
Bjørn Mork <[email protected]>
usb: cdc-wdm: manage_power should always set needs_remote_wakeup
Marc Kleine-Budde <[email protected]>
can: peak_usb: fix mem leak in pcan_usb_pro_init()
Dmitry Kunilov <[email protected]>
usb: serial: zte_ev: move support for ZTE AC2726 from zte_ev back to option
Mika Westerberg <[email protected]>
serial: 8250_dw: add new ACPI IDs
Jonathan Cameron <[email protected]>
iio:adc:ad7887 Fix channel reported endianness from cpu to big endian
Jonathan Cameron <[email protected]>
iio:imu:adis16400 fix pressure channel scan type
David Henningsson <[email protected]>
ALSA: hda - Add enable_msi=0 workaround for four HP machines
JongHo Kim <[email protected]>
ALSA: Add SNDRV_PCM_STATE_PAUSED case in wait_for_avail function
Charles Keepax <[email protected]>
ASoC: wm5110: Correct HPOUT3 DAPM route typo
Charles Keepax <[email protected]>
ASoC: wm_adsp: Add small delay while polling DSP RAM start
Bo Shen <[email protected]>
ASoC: wm8904: fix DSP mode B configuration
Stephen Warren <[email protected]>
ASoC: tegra: fix uninitialized variables in set_fmt
Ian Abbott <[email protected]>
staging: comedi: 8255_pci: fix for newer PCI-DIO48H
Geert Uytterhoeven <[email protected]>
TTY: pmac_zilog, check existence of ports in pmz_console_init()
pingfan liu <[email protected]>
powerpc: kvm: fix rare but potential deadlock scene
Yan, Zheng <[email protected]>
ceph: wake up 'safe' waiters when unregistering request
Yan, Zheng <[email protected]>
ceph: cleanup aborted requests when re-sending requests.
Johan Hovold <[email protected]>
USB: serial: fix race in generic write
-------------
Diffstat:
Documentation/kernel-parameters.txt | 4 + Makefile | 4 +- arch/arm/include/asm/arch_timer.h | 9 -- arch/arm/kernel/hyp-stub.S | 2 + arch/arm/kvm/interrupts_head.S | 4 + arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c | 4 +- arch/arm/mach-omap2/omap_hwmod_3xxx_data.c | 6 +- arch/arm64/boot/dts/foundation-v8.dts | 2 + arch/arm64/include/asm/arch_timer.h | 10 -- arch/arm64/include/asm/pgtable.h | 2 +- arch/arm64/include/asm/spinlock.h | 3 +- arch/arm64/include/asm/syscall.h | 6 + arch/arm64/include/asm/thread_info.h | 4 +- arch/arm64/include/asm/virt.h | 13 ++ arch/arm64/kernel/entry.S | 2 +- arch/arm64/kernel/fpsimd.c | 2 + arch/arm64/kernel/ptrace.c | 38 +++-- arch/arm64/kernel/smp.c | 15 +- arch/arm64/mm/flush.c | 30 +--- arch/arm64/mm/mmu.c | 1 - arch/arm64/mm/proc.S | 4 - arch/powerpc/include/asm/exception-64s.h | 2 +- arch/powerpc/kernel/head_64.S | 1 + arch/powerpc/kvm/book3s_64_mmu_hv.c | 6 +- arch/powerpc/kvm/book3s_hv_rm_mmu.c | 4 + arch/sh/kernel/sh_ksyms_32.c | 5 + arch/sh/lib/Makefile | 2 +- arch/sparc/include/asm/pgtable_64.h | 4 +- arch/x86/include/asm/pgtable.h | 11 +- arch/x86/include/asm/spinlock.h | 4 - arch/x86/kernel/cpu/intel.c | 3 +- arch/x86/kvm/lapic.c | 8 +- drivers/ata/libata-core.c | 7 +- drivers/ata/libata-scsi.c | 21 +++ drivers/block/rbd.c | 158 +++++++++++++-------- drivers/clocksource/arm_arch_timer.c | 23 +-- drivers/clocksource/dw_apb_timer_of.c | 2 +- drivers/cpufreq/intel_pstate.c | 5 + drivers/dma/Kconfig | 1 + drivers/firewire/sbp2.c | 1 - drivers/gpio/gpio-msm-v2.c | 4 +- drivers/gpio/gpio-twl4030.c | 15 +- drivers/gpu/drm/drm_edid.c | 8 ++ drivers/gpu/drm/i915/i915_dma.c | 10 ++ drivers/gpu/drm/i915/i915_gem_context.c | 2 - drivers/gpu/drm/i915/intel_display.c | 7 +- drivers/gpu/drm/radeon/atombios_crtc.c | 4 +- drivers/gpu/drm/radeon/ni.c | 20 ++- drivers/gpu/drm/radeon/radeon_uvd.c | 2 +- drivers/gpu/drm/radeon/rs690.c | 10 ++ drivers/idle/intel_idle.c | 3 + drivers/iio/adc/ad7887.c | 16 ++- drivers/iio/imu/adis16400_core.c | 7 +- drivers/infiniband/ulp/isert/ib_isert.c | 16 ++- drivers/input/input.c | 4 + drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 3 + drivers/net/ethernet/broadcom/tg3.c | 2 +- drivers/net/usb/dm9601.c | 34 +++-- drivers/net/wireless/ath/ath9k/ar9002_mac.c | 52 +++++-- drivers/net/wireless/ath/ath9k/htc_drv_main.c | 25 ++-- drivers/net/wireless/ath/ath9k/main.c | 5 +- drivers/net/wireless/rtlwifi/pci.c | 4 +- drivers/of/address.c | 8 -- drivers/s390/char/tty3270.c | 2 +- drivers/staging/comedi/drivers/8255_pci.c | 15 +- drivers/target/iscsi/iscsi_target.c | 26 ++-- drivers/target/target_core_device.c | 5 + drivers/target/target_core_file.c | 8 +- drivers/target/target_core_file.h | 5 +- drivers/tty/serial/8250/8250_dw.c | 2 + drivers/tty/serial/pmac_zilog.c | 3 + drivers/usb/class/cdc-wdm.c | 8 +- drivers/usb/serial/generic.c | 9 +- drivers/usb/serial/option.c | 2 + drivers/usb/serial/zte_ev.c | 3 +- fs/ceph/addr.c | 8 +- fs/ceph/file.c | 47 +++--- fs/ceph/ioctl.c | 8 +- fs/ceph/mds_client.c | 15 +- fs/ceph/mdsmap.c | 4 +- fs/ceph/super.c | 2 +- fs/ext4/ext4.h | 10 ++ fs/ext4/ext4_jbd2.c | 9 ++ fs/ext4/extents.c | 43 ++++-- fs/ext4/inode.c | 12 -- fs/ext4/mballoc.c | 21 +-- fs/ext4/super.c | 17 ++- fs/gfs2/aops.c | 30 ++++ fs/gfs2/ops_fstype.c | 12 +- fs/jbd2/transaction.c | 6 +- include/asm-generic/pgtable.h | 2 +- include/clocksource/arm_arch_timer.h | 2 +- include/drm/drm_pciids.h | 2 +- include/linux/auxvec.h | 2 +- include/linux/ceph/osd_client.h | 3 +- include/linux/libata.h | 1 + include/linux/mm_types.h | 49 +++++++ include/linux/spinlock.h | 14 +- include/target/target_core_base.h | 1 + kernel/fork.c | 1 + kernel/freezer.c | 6 + kernel/sched/core.c | 14 +- kernel/sched/fair.c | 7 + kernel/sched/rt.c | 14 ++ kernel/trace/ftrace.c | 2 +- mm/compaction.c | 4 + mm/fremap.c | 8 +- mm/huge_memory.c | 14 ++ mm/memcontrol.c | 2 +- mm/memory-failure.c | 10 ++ mm/migrate.c | 4 +- mm/mprotect.c | 2 + mm/pgtable-generic.c | 8 +- mm/rmap.c | 4 + net/ceph/osd_client.c | 82 ++++++----- net/wireless/radiotap.c | 4 + security/selinux/hooks.c | 53 +++++-- security/selinux/include/xfrm.h | 9 +- security/selinux/xfrm.c | 53 +++++-- sound/core/pcm_lib.c | 2 + sound/pci/hda/hda_intel.c | 4 + sound/soc/codecs/wm5110.c | 2 +- sound/soc/codecs/wm8904.c | 2 +- sound/soc/codecs/wm_adsp.c | 10 +- sound/soc/tegra/tegra20_i2s.c | 6 +- sound/soc/tegra/tegra20_spdif.c | 10 +- sound/soc/tegra/tegra30_i2s.c | 6 +- tools/power/cpupower/utils/cpupower-set.c | 6 +- 128 files changed, 996 insertions(+), 455 deletions(-)
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.10.26 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Jan 8 22:38:42 UTC 2014. Anything received after that time might be too late.
Quoted 7 lines
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.10.26-rc1.gzand the diffstat can be found below.
thanks,
greg k-h
Patches testing - passed
Compile testing - passed
Boot testing - passed
dmesg regression testing - passed
Test systems
Samsung Series 9 900X4C Intel Corei5 (3.4 and later) HP ProBook 6475b AMD A10-4600M APU with Radeon(tm) HD Graphics Dell OptiPlex 790 Intel(R) Core(TM) i5-2400
Detailed test status
Patches applied cleanly
dmesgs look good. No regressions compared to the previous dmesgs for this release. dmesg emerg, crit, alert, err are clean. No regressions in warn.
-- Shuah
Signature · 4 lines
Shuah Khan Senior Linux Kernel Developer - Open Source Group Samsung Research America(Silicon Valley) [email protected] | (970) 672-0658