3.4.50-stable review
Subsystems (20)
PATCH 1/26 b43: stop format string leaking into error msgs
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit e0e29b683d6784ef59bbc914eac85a04b650e63c upstream.
The module parameter "fwpostfix" is userspace controllable, unfiltered, and is used to define the firmware filename. b43_do_request_fw() populates ctx->errors[] on error, containing the firmware filename. b43err() parses its arguments as a format string. For systems with b43 hardware, this could lead to a uid-0 to ring-0 escalation.
CVE-2013-2852
--- drivers/net/wireless/b43/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/b43/main.c +1 -1
@@ -2449,7 +2449,7 @@ static void b43_request_firmware(structfor (i =0 ; i <B43_NR_FWTYPES ; i++) { errmsg = ctx->errors[i];if (strlen (errmsg)) -b43err (dev->wl, errmsg); +b43err (dev->wl,"%s" , errmsg); }b43_print_fw_helptext (dev->wl,1 ); goto out;
PATCH 4/26 ceph: ceph_pagelist_append might sleep while atomic
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Schutt <[email protected]>
commit 39be95e9c8c0b5668c9f8806ffe29bf9f4bc0f40 upstream.
Ceph's encode_caps_cb() worked hard to not call __page_cache_alloc() while holding a lock, but it's spoiled because ceph_pagelist_addpage() always calls kmap(), which might sleep. Here's the result:
[13439.295457] ceph: mds0 reconnect start
[13439.300572] BUG: sleeping function called from invalid context at include/linux/highmem.h:58
[13439.309243] in_atomic(): 1, irqs_disabled(): 0, pid: 12059, name: kworker/1:1
. . .
[13439.376225] Call Trace:
[13439.378757] [<ffffffff81076f4c>] __might_sleep+0xfc/0x110
[13439.384353] [<ffffffffa03f4ce0>] ceph_pagelist_append+0x120/0x1b0 [libceph]
[13439.391491] [<ffffffffa0448fe9>] ceph_encode_locks+0x89/0x190 [ceph]
[13439.398035] [<ffffffff814ee849>] ? _raw_spin_lock+0x49/0x50
[13439.403775] [<ffffffff811cadf5>] ? lock_flocks+0x15/0x20
[13439.409277] [<ffffffffa045e2af>] encode_caps_cb+0x41f/0x4a0 [ceph]
[13439.415622] [<ffffffff81196748>] ? igrab+0x28/0x70
[13439.420610] [<ffffffffa045e9f8>] ? iterate_session_caps+0xe8/0x250 [ceph]
[13439.427584] [<ffffffffa045ea25>] iterate_session_caps+0x115/0x250 [ceph]
[13439.434499] [<ffffffffa045de90>] ? set_request_path_attr+0x2d0/0x2d0 [ceph]
[13439.441646] [<ffffffffa0462888>] send_mds_reconnect+0x238/0x450 [ceph]
[13439.448363] [<ffffffffa0464542>] ? ceph_mdsmap_decode+0x5e2/0x770 [ceph]
[13439.455250] [<ffffffffa0462e42>] check_new_map+0x352/0x500 [ceph]
[13439.461534] [<ffffffffa04631ad>] ceph_mdsc_handle_map+0x1bd/0x260 [ceph]
[13439.468432] [<ffffffff814ebc7e>] ? mutex_unlock+0xe/0x10
[13439.473934] [<ffffffffa043c612>] extra_mon_dispatch+0x22/0x30 [ceph]
[13439.480464] [<ffffffffa03f6c2c>] dispatch+0xbc/0x110 [libceph]
[13439.486492] [<ffffffffa03eec3d>] process_message+0x1ad/0x1d0 [libceph]
[13439.493190] [<ffffffffa03f1498>] ? read_partial_message+0x3e8/0x520 [libceph]
. . .
[13439.587132] ceph: mds0 reconnect success
[13490.720032] ceph: mds0 caps stale
[13501.235257] ceph: mds0 recovery completed
[13501.300419] ceph: mds0 caps renewedFix it up by encoding locks into a buffer first, and when the number of encoded locks is stable, copy that into a ceph_pagelist.
[[email protected]: abbreviated the stack info a bit.]
--- fs/ceph/locks.c | 76 +++++++++++++++++++++++++++++++-------------------- fs/ceph/mds_client.c | 63 ++++++++++++++++++++++-------------------- fs/ceph/super.h | 9 ++++-- 3 files changed, 88 insertions(+), 60 deletions(-)
fs/ceph/locks.c +47 -29
@@ -191,29 +191,23 @@ void ceph_count_locks(struct inode *inod }/** -* Encode the flock and fcntl locks for the given inode into the pagelist. -* Format is: #fcntl locks, sequential fcntl locks, #flock locks, -* sequential flock locks. -* Must be called with lock_flocks() already held. -* If we encounter more of a specific lock type than expected, -* we return the value 1. +* Encode the flock and fcntl locks for the given inode into the ceph_filelock +* array. Must be called with lock_flocks() already held. +* If we encounter more of a specific lock type than expected, return -ENOSPC. */ -int ceph_encode_locks (struct inode *inode,struct ceph_pagelist *pagelist, -int num_fcntl_locks,int num_flock_locks) +int ceph_encode_locks_to_buffer (struct inode *inode, +struct ceph_filelock *flocks, +int num_fcntl_locks,int num_flock_locks) {struct file_lock *lock; -struct ceph_filelock cephlock;int err =0 ;int seen_fcntl =0 ;int seen_flock =0 ; -__le32 nlocks; +int l =0 ;dout ("encoding %d flock and %d fcntl locks" , num_flock_locks, num_fcntl_locks); - nlocks =cpu_to_le32 (num_fcntl_locks); - err =ceph_pagelist_append (pagelist, &nlocks,sizeof (nlocks)); -if (err) - goto fail; +for (lock = inode->i_flock; lock !=NULL ; lock = lock->fl_next) {if (lock->fl_flags &FL_POSIX ) { ++seen_fcntl;
@@ -221,20 +215,12 @@ int ceph_encode_locks(struct inode *inod err = -ENOSPC ; goto fail; } - err =lock_to_ceph_filelock (lock, &cephlock); + err =lock_to_ceph_filelock (lock, &flocks[l]);if (err) goto fail; - err =ceph_pagelist_append (pagelist, &cephlock, -sizeof (struct ceph_filelock )); + ++l; } -if (err) - goto fail; } - - nlocks =cpu_to_le32 (num_flock_locks); - err =ceph_pagelist_append (pagelist, &nlocks,sizeof (nlocks)); -if (err) - goto fail;for (lock = inode->i_flock; lock !=NULL ; lock = lock->fl_next) {if (lock->fl_flags &FL_FLOCK ) { ++seen_flock;
@@ -242,19 +228,51 @@ int ceph_encode_locks(struct inode *inod err = -ENOSPC ; goto fail; } - err =lock_to_ceph_filelock (lock, &cephlock); + err =lock_to_ceph_filelock (lock, &flocks[l]);if (err) goto fail; - err =ceph_pagelist_append (pagelist, &cephlock, -sizeof (struct ceph_filelock )); + ++l; } -if (err) - goto fail; } fail:return err; } +/** +* Copy the encoded flock and fcntl locks into the pagelist. +* Format is: #fcntl locks, sequential fcntl locks, #flock locks, +* sequential flock locks. +* Returns zero on success. +*/ +int ceph_locks_to_pagelist (struct ceph_filelock *flocks, +struct ceph_pagelist *pagelist, +int num_fcntl_locks,int num_flock_locks) +{ +int err =0 ; +__le32 nlocks; + + nlocks =cpu_to_le32 (num_fcntl_locks); + err =ceph_pagelist_append (pagelist, &nlocks,sizeof (nlocks)); +if (err) + goto out_fail; + + err =ceph_pagelist_append (pagelist, flocks, + num_fcntl_locks *sizeof (*flocks)); +if (err) + goto out_fail; + + nlocks =cpu_to_le32 (num_flock_locks); + err =ceph_pagelist_append (pagelist, &nlocks,sizeof (nlocks)); +if (err) + goto out_fail; + + err =ceph_pagelist_append (pagelist, + &flocks[num_fcntl_locks], + num_flock_locks *sizeof (*flocks)); +out_fail: +return err; +} +/* * Given a pointer to a lock, convert it to a ceph filelock */
fs/ceph/mds_client.c +34 -29
73 lines not on this page · raw message
fs/ceph/super.h +7 -2
@@ -847,8 +847,13 @@ extern const struct export_operations ceextern int ceph_lock (struct file *file,int cmd,struct file_lock *fl);extern int ceph_flock (struct file *file,int cmd,struct file_lock *fl);extern void ceph_count_locks (struct inode *inode,int *p_num,int *f_num); -extern int ceph_encode_locks (struct inode *i,struct ceph_pagelist *p, -int p_locks,int f_locks); +extern int ceph_encode_locks_to_buffer (struct inode *inode, +struct ceph_filelock *flocks, +int num_fcntl_locks, +int num_flock_locks); +extern int ceph_locks_to_pagelist (struct ceph_filelock *flocks, +struct ceph_pagelist *pagelist, +int num_fcntl_locks,int num_flock_locks);extern int lock_to_ceph_filelock (struct file_lock *fl,struct ceph_filelock *c);/* debugfs.c */
PATCH 8/26 Bluetooth: Fix mgmt handling of power on failures
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hedberg <[email protected]>
commit 96570ffcca0b872dc8626e97569d2697f374d868 upstream.
If hci_dev_open fails we need to ensure that the corresponding mgmt_set_powered command gets an appropriate response. This patch fixes the missing response by adding a new mgmt_set_powered_failed function that's used to indicate a power on failure to mgmt. Since a situation with the device being rfkilled may require special handling in user space the patch uses a new dedicated mgmt status code for this.
--- include/net/bluetooth/hci_core.h | 1 + include/net/bluetooth/mgmt.h | 1 + net/bluetooth/hci_core.c | 6 +++++- net/bluetooth/mgmt.c | 21 +++++++++++++++++++++ 4 files changed, 28 insertions(+), 1 deletion(-)
include/net/bluetooth/hci_core.h +1 -0
@@ -976,6 +976,7 @@ void hci_sock_dev_event(struct hci_dev *int mgmt_control (struct sock *sk,struct msghdr *msg,size_t len);int mgmt_index_added (struct hci_dev *hdev);int mgmt_index_removed (struct hci_dev *hdev); +int mgmt_set_powered_failed (struct hci_dev *hdev,int err);int mgmt_powered (struct hci_dev *hdev,u8 powered);int mgmt_discoverable (struct hci_dev *hdev,u8 discoverable);int mgmt_connectable (struct hci_dev *hdev,u8 connectable);
include/net/bluetooth/mgmt.h +1 -0
@@ -42,6 +42,7 @@#define MGMT_STATUS_NOT_POWERED 0x0f#define MGMT_STATUS_CANCELLED 0x10#define MGMT_STATUS_INVALID_INDEX 0x11 +#define MGMT_STATUS_RFKILLED 0x12struct mgmt_hdr {__le16 opcode;
net/bluetooth/hci_core.c +5 -1
@@ -1120,11 +1120,15 @@ EXPORT_SYMBOL(hci_free_dev);static void hci_power_on (struct work_struct *work) { struct hci_dev *hdev = container_of(work, struct hci_dev, power_on); +int err;BT_DBG ("%s" , hdev->name); -if (hci_dev_open (hdev->id) <0 ) + err =hci_dev_open (hdev->id); +if (err <0 ) { +mgmt_set_powered_failed (hdev, err);return ; + }if (test_bit (HCI_AUTO_OFF , &hdev->dev_flags)) schedule_delayed_work(&hdev->power_off,
net/bluetooth/mgmt.c +21 -0
@@ -2833,6 +2833,27 @@ int mgmt_powered(struct hci_dev *hdev, ureturn err; } +int mgmt_set_powered_failed (struct hci_dev *hdev,int err) +{ +struct pending_cmd *cmd; +u8 status; + + cmd =mgmt_pending_find (MGMT_OP_SET_POWERED , hdev); +if (!cmd) +return -ENOENT ; + +if (err == -ERFKILL ) + status =MGMT_STATUS_RFKILLED ; +else + status =MGMT_STATUS_FAILED ; + + err =cmd_status (cmd->sk, hdev->id,MGMT_OP_SET_POWERED , status); + +mgmt_pending_remove (cmd); + +return err; +} +int mgmt_discoverable (struct hci_dev *hdev,u8 discoverable) {struct cmd_lookup match = {NULL , hdev };
cover 3.4.50-stable review
From: Greg Kroah-Hartman <[email protected]>
This is the start of the stable review cycle for the 3.4.50 release. There are 26 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Jun 20 16:10:38 UTC 2013. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.50-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.4.50-rc1
Benjamin Herrenschmidt <[email protected]>
powerpc: Fix missing/delayed calls to irq_work
Michael Ellerman <[email protected]>
powerpc: Fix stack overflow crash in resume_kernel when ftracing
Sage Weil <[email protected]>
ceph: fix statvfs fr_size
Sage Weil <[email protected]>
libceph: wrap auth methods in a mutex
Sage Weil <[email protected]>
libceph: wrap auth ops in wrapper functions
Sage Weil <[email protected]>
libceph: add update_authorizer auth method
Sage Weil <[email protected]>
libceph: fix authorizer invalidation
Sage Weil <[email protected]>
libceph: clear messenger auth_retry flag when we authenticate
Kees Cook <[email protected]>
x86: Fix typo in kexec register clearing
Naoya Horiguchi <[email protected]>
mm: migration: add migrate_entry_wait_huge()
Alex Lyakas <[email protected]>
md/raid1: consider WRITE as successful only if at least one non-Faulty and non-rebuilding drive completed it.
Rafael Aquini <[email protected]>
swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion
Daniel Vetter <[email protected]>
drm/i915: prefer VBT modes for SVDO-LVDS over EDID
Stephen M. Cameron <[email protected]>
cciss: fix broken mutex usage in ioctl
Robin Holt <[email protected]>
reboot: rigrate shutdown/reboot to boot cpu
Srivatsa S. Bhat <[email protected]>
CPU hotplug: provide a generic helper to disable/enable CPU hotplug
Sujith Manoharan <[email protected]>
ath9k: Use minstrel rate control by default
Sujith Manoharan <[email protected]>
ath9k: Disable PowerSave by default
Johan Hedberg <[email protected]>
Bluetooth: Fix mgmt handling of power on failures
Patrik Jakobsson <[email protected]>
drm/gma500/cdv: Unpin framebuffer on crtc disable
Patrik Jakobsson <[email protected]>
drm/gma500/psb: Unpin framebuffer on crtc disable
Tony Lindgren <[email protected]>
drivers/rtc/rtc-twl.c: fix missing device_init_wakeup() when booted with device tree
Jim Schutt <[email protected]>
ceph: ceph_pagelist_append might sleep while atomic
Jim Schutt <[email protected]>
ceph: add cpu_to_le32() calls when encoding a reconnect capability
Alex Elder <[email protected]>
libceph: must hold mutex for reset_changed_osds()
Kees Cook <[email protected]>
b43: stop format string leaking into error msgs
-------------
Diffstat:
Makefile | 4 +- arch/powerpc/include/asm/exception-64s.h | 2 +- arch/powerpc/kernel/irq.c | 2 +- arch/powerpc/kernel/process.c | 4 +- arch/x86/kernel/relocate_kernel_64.S | 2 +- drivers/block/cciss.c | 32 ++++---- drivers/gpu/drm/gma500/cdv_intel_display.c | 14 ++++ drivers/gpu/drm/gma500/psb_intel_display.c | 14 ++++ drivers/gpu/drm/i915/intel_sdvo.c | 10 ++- drivers/md/raid1.c | 12 ++- drivers/md/raid10.c | 12 ++- drivers/net/wireless/ath/ath9k/Kconfig | 10 ++- drivers/net/wireless/ath/ath9k/Makefile | 2 +- drivers/net/wireless/ath/ath9k/init.c | 7 +- drivers/net/wireless/ath/ath9k/rc.h | 2 +- drivers/net/wireless/b43/main.c | 2 +- drivers/rtc/rtc-twl.c | 1 + fs/ceph/locks.c | 73 +++++++++++------- fs/ceph/mds_client.c | 90 ++++++++++++---------- fs/ceph/super.c | 7 +- fs/ceph/super.h | 11 ++- include/linux/ceph/auth.h | 18 +++++ include/linux/cpu.h | 4 + include/linux/swapops.h | 3 + include/net/bluetooth/hci_core.h | 1 + include/net/bluetooth/mgmt.h | 1 + kernel/cpu.c | 55 ++++++-------- kernel/sys.c | 29 ++++++- mm/hugetlb.c | 2 +- mm/migrate.c | 23 ++++-- mm/swap_state.c | 18 ++++- net/bluetooth/hci_core.c | 6 +- net/bluetooth/mgmt.c | 21 ++++++ net/ceph/auth.c | 117 ++++++++++++++++++++++++----- net/ceph/auth_x.c | 24 +++++- net/ceph/auth_x.h | 1 + net/ceph/messenger.c | 3 +- net/ceph/mon_client.c | 7 +- net/ceph/osd_client.c | 29 ++++--- 39 files changed, 479 insertions(+), 196 deletions(-)
PATCH 2/26 libceph: must hold mutex for reset_changed_osds()
From: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Elder <[email protected]>
commit 14d2f38df67fadee34625fcbd282ee22514c4846 upstream.
An osd client has a red-black tree describing its osds, and occasionally we would get crashes due to one of these trees tree becoming corrupt somehow.
The problem turned out to be that reset_changed_osds() was being called without protection of the osd client request mutex. That function would call __reset_osd() for any osd that had changed, and __reset_osd() would call __remove_osd() for any osd with no outstanding requests, and finally __remove_osd() would remove the corresponding entry from the red-black tree. Thus, the tree was getting modified without having any lock protection, and was vulnerable to problems due to concurrent updates.
This appears to be the only osd tree updating path that has this problem. It can be fairly easily fixed by moving the call up a few lines, to just before the request mutex gets dropped in kick_requests().
This resolves:
http://tracker.ceph.com/issues/5043
--- net/ceph/osd_client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ceph/osd_client.c +1 -1
@@ -1337,13 +1337,13 @@ static void kick_requests(struct ceph_os__register_request (osdc, req);__unregister_linger_request (osdc, req); } +reset_changed_osds (osdc);mutex_unlock (&osdc->request_mutex);if (needmap) {dout ("%d requests for down osds, need new map\n" , needmap);ceph_monc_request_next_osdmap (&osdc->client->monc); } -reset_changed_osds (osdc); }
PATCH 10/26 ath9k: Use minstrel rate control by default
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sujith Manoharan <[email protected]>
commit 5efac94999ff218e0101f67a059e44abb4b0b523 upstream.
The ath9k rate control algorithm has various architectural issues that make it a poor fit in scenarios like congested environments etc.
An example: https://bugzilla.redhat.com/show_bug.cgi?id=927191
Change the default to minstrel which is more robust in such cases. The ath9k RC code is left in the driver for now, maybe it can be removed altogether later on.
--- drivers/net/wireless/ath/ath9k/Kconfig | 10 +++++++--- drivers/net/wireless/ath/ath9k/Makefile | 2 +- drivers/net/wireless/ath/ath9k/init.c | 4 ---- drivers/net/wireless/ath/ath9k/rc.h | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-)
drivers/net/wireless/ath/ath9k/Kconfig +7 -3
@@ -89,13 +89,17 @@ config ATH9K_MAC_DEBUG This option enables collection of statistics for Rx/Tx status data and some other MAC related statistics -config ATH9K_RATE_CONTROL +config ATH9K_LEGACY_RATE_CONTROL bool "Atheros ath9k rate control" depends on ATH9K - default y + default n ---help--- Say Y, if you want to use the ath9k specific rate control - module instead of minstrel_ht. + module instead of minstrel_ht. Be warned that there are various + issues with the ath9k RC and minstrel is a more robust algorithm. + Note that even if this option is selected, "ath9k_rate_control" + has to be passed to mac80211 using the module parameter, + ieee80211_default_rc_algo. config ATH9K_HTC tristate "Atheros HTC based wireless cards support"
drivers/net/wireless/ath/ath9k/Makefile +1 -1
@@ -6,7 +6,7 @@ ath9k-y += beacon.o \ xmit.o ath9k-$(CONFIG_ATH9K_BTCOEX_SUPPORT) += mci.o -ath9k-$(CONFIG_ATH9K_RATE_CONTROL) += rc.o +ath9k-$(CONFIG_ATH9K_LEGACY_RATE_CONTROL) += rc.o ath9k-$(CONFIG_ATH9K_PCI) += pci.o ath9k-$(CONFIG_ATH9K_AHB) += ahb.o ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o
drivers/net/wireless/ath/ath9k/init.c +0 -4
@@ -694,10 +694,6 @@ void ath9k_set_hw_capab(struct ath_softc sc->ant_rx = hw->wiphy->available_antennas_rx; sc->ant_tx = hw->wiphy->available_antennas_tx; -#ifdef CONFIG_ATH9K_RATE_CONTROL - hw->rate_control_algorithm ="ath9k_rate_control" ; -#endif -if (sc->sc_ah->caps.hw_caps &ATH9K_HW_CAP_2GHZ ) hw->wiphy->bands[IEEE80211_BAND_2GHZ ] = &sc->sbands[IEEE80211_BAND_2GHZ ];
drivers/net/wireless/ath/ath9k/rc.h +1 -1
@@ -219,7 +219,7 @@ struct ath_rate_priv {struct ath_rc_stats rcstats[RATE_TABLE_SIZE ]; }; -#ifdef CONFIG_ATH9K_RATE_CONTROL +#ifdef CONFIG_ATH9K_LEGACY_RATE_CONTROL int ath_rate_control_register (void );void ath_rate_control_unregister (void );#else
PATCH 3/26 ceph: add cpu_to_le32() calls when encoding a reconnect capability
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Schutt <[email protected]>
commit c420276a532a10ef59849adc2681f45306166b89 upstream.
In his review, Alex Elder mentioned that he hadn't checked that num_fcntl_locks and num_flock_locks were properly decoded on the server side, from a le32 over-the-wire type to a cpu type. I checked, and AFAICS it is done; those interested can consult
Locker::_do_cap_update()
in src/mds/Locker.cc and src/include/encoding.h in the Ceph server code (git://github.com/ceph/ceph).
I also checked the server side for flock_len decoding, and I believe that also happens correctly, by virtue of having been declared __le32 in struct ceph_mds_cap_reconnect, in src/include/ceph_fs.h.
--- fs/ceph/locks.c | 7 +++++-- fs/ceph/mds_client.c | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-)
fs/ceph/locks.c +5 -2
@@ -206,10 +206,12 @@ int ceph_encode_locks(struct inode *inodint err =0 ;int seen_fcntl =0 ;int seen_flock =0 ; +__le32 nlocks;dout ("encoding %d flock and %d fcntl locks" , num_flock_locks, num_fcntl_locks); - err =ceph_pagelist_append (pagelist, &num_fcntl_locks,sizeof (u32)); + nlocks =cpu_to_le32 (num_fcntl_locks); + err =ceph_pagelist_append (pagelist, &nlocks,sizeof (nlocks));if (err) goto fail;for (lock = inode->i_flock; lock !=NULL ; lock = lock->fl_next) {
@@ -229,7 +231,8 @@ int ceph_encode_locks(struct inode *inod goto fail; } - err =ceph_pagelist_append (pagelist, &num_flock_locks,sizeof (u32)); + nlocks =cpu_to_le32 (num_flock_locks); + err =ceph_pagelist_append (pagelist, &nlocks,sizeof (nlocks));if (err) goto fail;for (lock = inode->i_flock; lock !=NULL ; lock = lock->fl_next) {
fs/ceph/mds_client.c +1 -1
@@ -2462,7 +2462,7 @@ static int encode_caps_cb(struct inode *lock_flocks ();ceph_count_locks (inode, &num_fcntl_locks, &num_flock_locks); - rec.v2.flock_len = (2 *sizeof (u32) + + rec.v2.flock_len =cpu_to_le32 (2 *sizeof (u32) + (num_fcntl_locks+num_flock_locks) *sizeof (struct ceph_filelock ));unlock_flocks ();
PATCH 5/26 drivers/rtc/rtc-twl.c: fix missing device_init_wakeup() when booted with device tree
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
commit 24b8256a1fb28d357bc6fa09184ba29b4255ba5c upstream.
When booted in legacy mode device_init_wakeup() gets called by drivers/mfd/twl-core.c when the children are initialized. However, when booted using device tree, the children are created with of_platform_populate() instead add_children().
This means that the RTC driver will not have device_init_wakeup() set, and we need to call it from the driver probe like RTC drivers typically do.
Without this we cannot test PM wake-up events on omaps for cases where there may not be any physical wake-up event.
--- drivers/rtc/rtc-twl.c | 1 + 1 file changed, 1 insertion(+)
drivers/rtc/rtc-twl.c +1 -0
@@ -523,6 +523,7 @@ static int __devinit twl_rtc_probe(struc }platform_set_drvdata (pdev, rtc); +device_init_wakeup (&pdev->dev,1 );return 0 ; out2:
PATCH 9/26 ath9k: Disable PowerSave by default
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sujith Manoharan <[email protected]>
commit 531671cb17af07281e6f28c1425f754346e65c41 upstream.
Almost all the DMA issues which have plagued ath9k (in station mode) for years are related to PS. Disabling PS usually "fixes" the user's connection stablility. Reports of DMA problems are still trickling in and are sitting in the kernel bugzilla. Until the PS code in ath9k is given a thorough review, disbale it by default. The slight increase in chip power consumption is a small price to pay for improved link stability.
--- drivers/net/wireless/ath/ath9k/init.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/init.c +1 -2
@@ -671,8 +671,7 @@ void ath9k_set_hw_capab(struct ath_softcBIT (NL80211_IFTYPE_ADHOC ) |BIT (NL80211_IFTYPE_MESH_POINT ); -if (AR_SREV_5416 (sc->sc_ah)) - hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT ; + hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT ; hw->wiphy->flags |=WIPHY_FLAG_IBSS_RSN ; hw->wiphy->flags |=WIPHY_FLAG_SUPPORTS_TDLS ;
PATCH 6/26 drm/gma500/psb: Unpin framebuffer on crtc disable
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrik Jakobsson <[email protected]>
commit 820de86a90089ee607d7864538c98a23b503c846 upstream.
The framebuffer needs to be unpinned in the crtc->disable callback because of previous pinning in psb_intel_pipe_set_base(). This will fix a memory leak where the framebuffer was released but not unpinned properly. This patch only affects Poulsbo.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=889511
Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=812113
--- drivers/gpu/drm/gma500/psb_intel_display.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/gpu/drm/gma500/psb_intel_display.c +14 -0
@@ -1262,6 +1262,19 @@ void psb_intel_crtc_destroy(struct drm_ckfree (psb_intel_crtc); } +static void psb_intel_crtc_disable (struct drm_crtc *crtc) +{ +struct gtt_range *gt; +struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private; + + crtc_funcs->dpms (crtc,DRM_MODE_DPMS_OFF ); + +if (crtc->fb) { + gt =to_psb_fb (crtc->fb)->gtt; +psb_gtt_unpin (gt); + } +} +const struct drm_crtc_helper_funcs psb_intel_helper_funcs = { .dpms = psb_intel_crtc_dpms, .mode_fixup = psb_intel_crtc_mode_fixup,
@@ -1269,6 +1282,7 @@ const struct drm_crtc_helper_funcs psb_i .mode_set_base = psb_intel_pipe_set_base, .prepare = psb_intel_crtc_prepare, .commit = psb_intel_crtc_commit, + .disable = psb_intel_crtc_disable, };const struct drm_crtc_funcs psb_intel_crtc_funcs = {
PATCH 7/26 drm/gma500/cdv: Unpin framebuffer on crtc disable
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrik Jakobsson <[email protected]>
commit 22e7c385a80d771aaf3a15ae7ccea3b0686bbe10 upstream.
The framebuffer needs to be unpinned in the crtc->disable callback because of previous pinning in psb_intel_pipe_set_base(). This will fix a memory leak where the framebuffer was released but not unpinned properly. This patch only affects Cedarview.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=889511
Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=812113
--- drivers/gpu/drm/gma500/cdv_intel_display.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/gpu/drm/gma500/cdv_intel_display.c +14 -0
@@ -1439,6 +1439,19 @@ static void cdv_intel_crtc_destroy(struckfree (psb_intel_crtc); } +static void cdv_intel_crtc_disable (struct drm_crtc *crtc) +{ +struct gtt_range *gt; +struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private; + + crtc_funcs->dpms (crtc,DRM_MODE_DPMS_OFF ); + +if (crtc->fb) { + gt =to_psb_fb (crtc->fb)->gtt; +psb_gtt_unpin (gt); + } +} +const struct drm_crtc_helper_funcs cdv_intel_helper_funcs = { .dpms = cdv_intel_crtc_dpms, .mode_fixup = cdv_intel_crtc_mode_fixup,
@@ -1446,6 +1459,7 @@ const struct drm_crtc_helper_funcs cdv_i .mode_set_base = cdv_intel_pipe_set_base, .prepare = cdv_intel_crtc_prepare, .commit = cdv_intel_crtc_commit, + .disable = cdv_intel_crtc_disable, };const struct drm_crtc_funcs cdv_intel_crtc_funcs = {
PATCH 11/26 CPU hotplug: provide a generic helper to disable/enable CPU hotplug
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Srivatsa S. Bhat" <[email protected]>
commit 16e53dbf10a2d7e228709a7286310e629ede5e45 upstream.
There are instances in the kernel where we would like to disable CPU hotplug (from sysfs) during some important operation. Today the freezer code depends on this and the code to do it was kinda tailor-made for that.
Restructure the code and make it generic enough to be useful for other usecases too.
--- include/linux/cpu.h | 4 +++ kernel/cpu.c | 55 +++++++++++++++++++++------------------------------- 2 files changed, 27 insertions(+), 32 deletions(-)
include/linux/cpu.h +4 -0
@@ -177,6 +177,8 @@ extern struct bus_type cpu_subsys;extern void get_online_cpus (void );extern void put_online_cpus (void ); +extern void cpu_hotplug_disable (void ); +extern void cpu_hotplug_enable (void );#define hotcpu_notifier (fn, pri) cpu_notifier(fn, pri)#define register_hotcpu_notifier (nb) register_cpu_notifier(nb)#define unregister_hotcpu_notifier (nb) unregister_cpu_notifier(nb)
@@ -199,6 +201,8 @@ static inline void cpu_hotplug_driver_un#define get_online_cpus () do { } while (0)#define put_online_cpus () do { } while (0) +#define cpu_hotplug_disable () do { } while (0) +#define cpu_hotplug_enable () do { } while (0)#define hotcpu_notifier (fn, pri) do { (void)(fn); } while (0)/* These aren't inline functions due to a GCC bug. */ #define register_hotcpu_notifier (nb) ({ (void)(nb); 0; })
kernel/cpu.c +23 -32
77 lines not on this page · raw message
PATCH 12/26 reboot: rigrate shutdown/reboot to boot cpu
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Holt <[email protected]>
commit cf7df378aa4ff7da3a44769b7ff6e9eef1a9f3db upstream.
We recently noticed that reboot of a 1024 cpu machine takes approx 16 minutes of just stopping the cpus. The slowdown was tracked to commit f96972f2dc63 ("kernel/sys.c: call disable_nonboot_cpus() in kernel_restart()").
The current implementation does all the work of hot removing the cpus before halting the system. We are switching to just migrating to the boot cpu and then continuing with shutdown/reboot.
This also has the effect of not breaking x86's command line parameter for specifying the reboot cpu. Note, this code was shamelessly copied from arch/x86/kernel/reboot.c with bits removed pertaining to the reboot_cpu command line parameter.
--- kernel/sys.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-)
kernel/sys.c +26 -3
@@ -353,6 +353,29 @@ int unregister_reboot_notifier(struct no }EXPORT_SYMBOL (unregister_reboot_notifier); +/* Add backwards compatibility for stable trees. */ +#ifndef PF_NO_SETAFFINITY +#define PF_NO_SETAFFINITY PF_THREAD_BOUND +#endif + +static void migrate_to_reboot_cpu (void ) +{ +/* The boot cpu is always logical cpu 0 */ +int cpu =0 ; + +cpu_hotplug_disable (); + +/* Make certain the cpu I'm about to reboot on is online */ +if (!cpu_online (cpu)) + cpu =cpumask_first (cpu_online_mask); + +/* Prevent races with other tasks migrating this task */ + current->flags |=PF_NO_SETAFFINITY ; + +/* Make certain I only run on the appropriate processor */ +set_cpus_allowed_ptr (current,cpumask_of (cpu)); +} +/** * kernel_restart - reboot the system * @cmd: pointer to buffer containing command to execute for restart
@@ -364,7 +387,7 @@ EXPORT_SYMBOL(unregister_reboot_notifiervoid kernel_restart (char *cmd) {kernel_restart_prepare (cmd); -disable_nonboot_cpus (); +migrate_to_reboot_cpu ();syscore_shutdown ();if (!cmd)printk (KERN_EMERG "Restarting system.\n" );
@@ -391,7 +414,7 @@ static void kernel_shutdown_prepare(enumvoid kernel_halt (void ) {kernel_shutdown_prepare (SYSTEM_HALT ); -disable_nonboot_cpus (); +migrate_to_reboot_cpu ();syscore_shutdown ();printk (KERN_EMERG "System halted.\n" );kmsg_dump (KMSG_DUMP_HALT );
@@ -410,7 +433,7 @@ void kernel_power_off(void)kernel_shutdown_prepare (SYSTEM_POWER_OFF );if (pm_power_off_prepare)pm_power_off_prepare (); -disable_nonboot_cpus (); +migrate_to_reboot_cpu ();syscore_shutdown ();printk (KERN_EMERG "Power down.\n" );kmsg_dump (KMSG_DUMP_POWEROFF );
PATCH 15/26 swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Aquini <[email protected]>
commit cbab0e4eec299e9059199ebe6daf48730be46d2b upstream.
read_swap_cache_async() can race against get_swap_page(), and stumble across a SWAP_HAS_CACHE entry in the swap map whose page wasn't brought into the swapcache yet.
This transient swap_map state is expected to be transitory, but the actual placement of discard at scan_swap_map() inserts a wait for I/O completion thus making the thread at read_swap_cache_async() to loop around its -EEXIST case, while the other end at get_swap_page() is scheduled away at scan_swap_map(). This can leave the system deadlocked if the I/O completion happens to be waiting on the CPU waitqueue where read_swap_cache_async() is busy looping and !CONFIG_PREEMPT.
This patch introduces a cond_resched() call to make the aforementioned read_swap_cache_async() busy loop condition to bail out when necessary, thus avoiding the subtle race window.
--- mm/swap_state.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
mm/swap_state.c +17 -1
@@ -313,8 +313,24 @@ struct page *read_swap_cache_async(swp_e* Swap entry may have been freed since our caller observed it. */ err =swapcache_prepare (entry); -if (err == -EEXIST ) {/* seems racy */ +if (err == -EEXIST ) {radix_tree_preload_end (); +/* +* We might race against get_swap_page() and stumble +* across a SWAP_HAS_CACHE swap_map entry whose page +* has not been brought into the swapcache yet, while +* the other end is scheduled away waiting on discard +* I/O completion at scan_swap_map(). +* +* In order to avoid turning this transitory state +* into a permanent loop around this -EEXIST case +* if !CONFIG_PREEMPT and the I/O completion happens +* to be waiting on the CPU waitqueue where we are now +* busy looping, we just conditionally invoke the +* scheduler here, if there are some more important +* tasks to run. +*/ +cond_resched ();continue ; }if (err) {/* swp entry is obsolete ? */
PATCH 13/26 cciss: fix broken mutex usage in ioctl
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Stephen M. Cameron" <[email protected]>
commit 03f47e888daf56c8e9046c674719a0bcc644eed5 upstream.
If a new logical drive is added and the CCISS_REGNEWD ioctl is invoked (as is normal with the Array Configuration Utility) the process will hang as below. It attempts to acquire the same mutex twice, once in do_ioctl() and once in cciss_unlocked_open(). The BKL was recursive, the mutex isn't.
Linux version 3.10.0-rc2 ([email protected]) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-3) (GCC) ) #1 SMP Fri May 24 14:32:12 CDT 2013 [...]
acu D 0000000000000001 0 3246 3191 0x00000080
Call Trace:
schedule+0x29/0x70
schedule_preempt_disabled+0xe/0x10
__mutex_lock_slowpath+0x17b/0x220
mutex_lock+0x2b/0x50
cciss_unlocked_open+0x2f/0x110 [cciss]
__blkdev_get+0xd3/0x470
blkdev_get+0x5c/0x1e0
register_disk+0x182/0x1a0
add_disk+0x17c/0x310
cciss_add_disk+0x13a/0x170 [cciss]
cciss_update_drive_info+0x39b/0x480 [cciss]
rebuild_lun_table+0x258/0x370 [cciss]
cciss_ioctl+0x34f/0x470 [cciss]
do_ioctl+0x49/0x70 [cciss]
__blkdev_driver_ioctl+0x28/0x30
blkdev_ioctl+0x200/0x7b0
block_ioctl+0x3c/0x40
do_vfs_ioctl+0x89/0x350
SyS_ioctl+0xa1/0xb0
system_call_fastpath+0x16/0x1bThis mutex usage was added into the ioctl path when the big kernel lock was removed. As it turns out, these paths are all thread safe anyway (or can easily be made so) and we don't want ioctl() to be single threaded in any case.
--- drivers/block/cciss.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-)
drivers/block/cciss.c +16 -16
@@ -161,8 +161,6 @@ static irqreturn_t do_cciss_msix_intr(instatic int cciss_open (struct block_device *bdev,fmode_t mode);static int cciss_unlocked_open (struct block_device *bdev,fmode_t mode);static int cciss_release (struct gendisk *disk,fmode_t mode); -static int do_ioctl (struct block_device *bdev,fmode_t mode, -unsigned int cmd,unsigned long arg);static int cciss_ioctl (struct block_device *bdev,fmode_t mode,unsigned int cmd,unsigned long arg);static int cciss_getgeo (struct block_device *bdev,struct hd_geometry *geo);
@@ -229,7 +227,7 @@ static const struct block_device_operati .owner = THIS_MODULE, .open = cciss_unlocked_open, .release = cciss_release, - .ioctl = do_ioctl, + .ioctl = cciss_ioctl, .getgeo = cciss_getgeo, #ifdef CONFIG_COMPAT .compat_ioctl = cciss_compat_ioctl,
@@ -1140,16 +1138,6 @@ static int cciss_release(struct gendiskreturn 0 ; } -static int do_ioctl (struct block_device *bdev,fmode_t mode, -unsigned cmd,unsigned long arg) -{ -int ret; -mutex_lock (&cciss_mutex); - ret =cciss_ioctl (bdev, mode, cmd, arg); -mutex_unlock (&cciss_mutex); -return ret; -} -#ifdef CONFIG_COMPAT static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
@@ -1176,7 +1164,7 @@ static int cciss_compat_ioctl(struct blocase CCISS_REGNEWD :case CCISS_RESCANDISK :case CCISS_GETLUNINFO : -return do_ioctl (bdev, mode, cmd, arg); +return cciss_ioctl (bdev, mode, cmd, arg);case CCISS_PASSTHRU32 :return cciss_ioctl32_passthru (bdev, mode, cmd, arg);
@@ -1216,7 +1204,7 @@ static int cciss_ioctl32_passthru(structif (err)return -EFAULT ; - err =do_ioctl (bdev, mode,CCISS_PASSTHRU , (unsigned long )p); + err =cciss_ioctl (bdev, mode,CCISS_PASSTHRU , (unsigned long )p);if (err)return err; err |=
@@ -1258,7 +1246,7 @@ static int cciss_ioctl32_big_passthru(stif (err)return -EFAULT ; - err =do_ioctl (bdev, mode,CCISS_BIG_PASSTHRU , (unsigned long )p); + err =cciss_ioctl (bdev, mode,CCISS_BIG_PASSTHRU , (unsigned long )p);if (err)return err; err |=
@@ -1308,11 +1296,14 @@ static int cciss_getpciinfo(ctlr_info_tstatic int cciss_getintinfo (ctlr_info_t *h,void __user *argp) {cciss_coalint_struct intinfo; +unsigned long flags;if (!argp)return -EINVAL ; +spin_lock_irqsave (&h->lock, flags); intinfo.delay =readl (&h->cfgtable->HostWrite.CoalIntDelay); intinfo.count =readl (&h->cfgtable->HostWrite.CoalIntCount); +spin_unlock_irqrestore (&h->lock, flags);if (copy_to_user (argp, &intinfo,sizeof (cciss_coalint_struct)))return -EFAULT ;
@@ -1353,12 +1344,15 @@ static int cciss_setintinfo(ctlr_info_tstatic int cciss_getnodename (ctlr_info_t *h,void __user *argp) {NodeName_type NodeName; +unsigned long flags;int i;if (!argp)return -EINVAL ; +spin_lock_irqsave (&h->lock, flags);for (i =0 ; i <16 ; i++) NodeName[i] =readb (&h->cfgtable->ServerName[i]); +spin_unlock_irqrestore (&h->lock, flags);if (copy_to_user (argp, NodeName,sizeof (NodeName_type)))return -EFAULT ;return 0 ;
@@ -1395,10 +1389,13 @@ static int cciss_setnodename(ctlr_info_tstatic int cciss_getheartbeat (ctlr_info_t *h,void __user *argp) {Heartbeat_type heartbeat; +unsigned long flags;if (!argp)return -EINVAL ; +spin_lock_irqsave (&h->lock, flags); heartbeat =readl (&h->cfgtable->HeartBeat); +spin_unlock_irqrestore (&h->lock, flags);if (copy_to_user (argp, &heartbeat,sizeof (Heartbeat_type)))return -EFAULT ;return 0 ;
@@ -1407,10 +1404,13 @@ static int cciss_getheartbeat(ctlr_info_static int cciss_getbustypes (ctlr_info_t *h,void __user *argp) {BusTypes_type BusTypes; +unsigned long flags;if (!argp)return -EINVAL ; +spin_lock_irqsave (&h->lock, flags); BusTypes =readl (&h->cfgtable->BusTypes); +spin_unlock_irqrestore (&h->lock, flags);if (copy_to_user (argp, &BusTypes,sizeof (BusTypes_type)))return -EFAULT ;return 0 ;
PATCH 23/26 libceph: wrap auth methods in a mutex
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sage Weil <[email protected]>
commit e9966076cdd952e19f2dd4854cd719be0d7cbebc upstream.
The auth code is called from a variety of contexts, include the mon_client (protected by the monc's mutex) and the messenger callbacks (currently protected by nothing). Avoid chaos by protecting all auth state with a mutex. Nothing is blocking, so this should be simple and lightweight.
--- include/linux/ceph/auth.h | 2 + net/ceph/auth.c | 78 +++++++++++++++++++++++++++++++++------------- 2 files changed, 58 insertions(+), 22 deletions(-)
include/linux/ceph/auth.h +2 -0
@@ -78,6 +78,8 @@ struct ceph_auth_client {u64 global_id;/* our unique id in system */ const struct ceph_crypto_key *key;/* our secret key */ unsigned want_keys;/* which services we want */ + +struct mutex mutex; }; extern struct ceph_auth_client *ceph_auth_init(const char *name,
net/ceph/auth.c +56 -22
185 lines not on this page · raw message
PATCH 14/26 drm/i915: prefer VBT modes for SVDO-LVDS over EDID
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <[email protected]>
commit c3456fb3e4712d0448592af3c5d644c9472cd3c1 upstream.
In
commit 53d3b4d7778daf15900867336c85d3f8dd70600c
Author: Egbert Eich <[email protected]> Date: Tue Jun 4 17:13:21 2013 +0200
drm/i915/sdvo: Use &intel_sdvo->ddc instead of intel_sdvo->i2c for DDC
Egbert Eich fixed a long-standing bug where we simply used a non-working i2c controller to read the EDID for SDVO-LVDS panels. Unfortunately some machines seem to not be able to cope with the mode provided in the EDID. Specifically they seem to not be able to cope with a 4x pixel mutliplier instead of a 2x one, which seems to have been worked around by slightly changing the panels native mode in the VBT so that the dotclock is just barely above 50MHz.
Since it took forever to notice the breakage it's fairly safe to assume that at least for SDVO-LVDS panels the VBT contains fairly sane data. So just switch around the order and use VBT modes first.
v2: Also add EDID modes just in case, and spell Egbert correctly.
v3: Elaborate a bit more about what's going on on Chris' machine.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=65524
--- drivers/gpu/drm/i915/intel_sdvo.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/intel_sdvo.c +6 -4
@@ -1582,10 +1582,13 @@ static void intel_sdvo_get_lvds_modes(st* arranged in priority order. */ intel_ddc_get_modes (connector, &intel_sdvo->ddc); -if (list_empty (&connector->probed_modes) == false) - goto end; -/* Fetch modes from VBT */ +/* +* Fetch modes from VBT. For SDVO prefer the VBT mode since some +* SDVO->LVDS transcoders can't cope with the EDID mode. Since +* drm_mode_probed_add adds the mode at the head of the list we add it +* last. +*/ if (dev_priv->sdvo_lvds_vbt_mode !=NULL ) { newmode =drm_mode_duplicate (connector->dev, dev_priv->sdvo_lvds_vbt_mode);
@@ -1597,7 +1600,6 @@ static void intel_sdvo_get_lvds_modes(st } } -end:list_for_each_entry (newmode, &connector->probed_modes, head) {if (newmode->type &DRM_MODE_TYPE_PREFERRED ) { intel_sdvo->sdvo_lvds_fixed_mode =
PATCH 16/26 md/raid1: consider WRITE as successful only if at least one non-Faulty and non-rebuilding drive completed it.
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Lyakas <[email protected]>
commit 3056e3aec8d8ba61a0710fb78b2d562600aa2ea7 upstream.
Without that fix, the following scenario could happen:
- RAID1 with drives A and B; drive B was freshly-added and is rebuilding
- Drive A fails
- WRITE request arrives to the array. It is failed by drive A, so r1_bio is marked as R1BIO_WriteError, but the rebuilding drive B succeeds in writing it, so the same r1_bio is marked as R1BIO_Uptodate.
- r1_bio arrives to handle_write_finished, badblocks are disabled, md_error()->error() does nothing because we don't fail the last drive of raid1
- raid_end_bio_io() calls call_bio_endio()
- As a result, in call_bio_endio():
if (!test_bit(R1BIO_Uptodate, &r1_bio->state))
clear_bit(BIO_UPTODATE, &bio->bi_flags);this code doesn't clear the BIO_UPTODATE flag, and the whole master WRITE succeeds, back to the upper layer.
So we returned success to the upper layer, even though we had written the data onto the rebuilding drive only. But when we want to read the data back, we would not read from the rebuilding drive, so this data is lost.
[neilb - applied identical change to raid10 as well]
This bug can result in lost data, so it is suitable for any -stable kernel.
--- drivers/md/raid1.c | 12 +++++++++++- drivers/md/raid10.c | 12 +++++++++++- 2 files changed, 22 insertions(+), 2 deletions(-)
drivers/md/raid1.c +11 -1
@@ -413,7 +413,17 @@ static void raid1_end_write_request(stru r1_bio->bios[mirror] =NULL ; to_put = bio; -set_bit (R1BIO_Uptodate, &r1_bio->state); +/* +* Do not set R1BIO_Uptodate if the current device is +* rebuilding or Faulty. This is because we cannot use +* such device for properly reading the data back (we could +* potentially use it, if the current write would have felt +* before rdev->recovery_offset, but for simplicity we don't +* check this here. +*/ +if (test_bit (In_sync, &conf->mirrors[mirror].rdev->flags) && + !test_bit (Faulty, &conf->mirrors[mirror].rdev->flags)) +set_bit (R1BIO_Uptodate, &r1_bio->state);/* Maybe we can clear some bad blocks. */ if (is_badblock(conf->mirrors[mirror].rdev,
drivers/md/raid10.c +11 -1
@@ -452,7 +452,17 @@ static void raid10_end_write_request(strsector_t first_bad;int bad_sectors; -set_bit (R10BIO_Uptodate, &r10_bio->state); +/* +* Do not set R10BIO_Uptodate if the current device is +* rebuilding or Faulty. This is because we cannot use +* such device for properly reading the data back (we could +* potentially use it, if the current write would have felt +* before rdev->recovery_offset, but for simplicity we don't +* check this here. +*/ +if (test_bit (In_sync, &rdev->flags) && + !test_bit (Faulty, &rdev->flags)) +set_bit (R10BIO_Uptodate, &r10_bio->state);/* Maybe we can clear some bad blocks. */ if (is_badblock(rdev,
PATCH 17/26 mm: migration: add migrate_entry_wait_huge()
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naoya Horiguchi <[email protected]>
commit 30dad30922ccc733cfdbfe232090cf674dc374dc upstream.
When we have a page fault for the address which is backed by a hugepage under migration, the kernel can't wait correctly and do busy looping on hugepage fault until the migration finishes. As a result, users who try to kick hugepage migration (via soft offlining, for example) occasionally experience long delay or soft lockup.
This is because pte_offset_map_lock() can't get a correct migration entry or a correct page table lock for hugepage. This patch introduces migration_entry_wait_huge() to solve this.
--- include/linux/swapops.h | 3 +++ mm/hugetlb.c | 2 +- mm/migrate.c | 23 ++++++++++++++++++----- 3 files changed, 22 insertions(+), 6 deletions(-)
include/linux/swapops.h +3 -0
@@ -137,6 +137,7 @@ static inline void make_migration_entry_extern void migration_entry_wait (struct mm_struct *mm,pmd_t *pmd,unsigned long address); +extern void migration_entry_wait_huge (struct mm_struct *mm,pte_t *pte);#else #define make_migration_entry (page, write) swp_entry(0, 0)
@@ -148,6 +149,8 @@ static inline int is_migration_entry(swpstatic inline void make_migration_entry_read (swp_entry_t *entryp) { }static inline void migration_entry_wait (struct mm_struct *mm,pmd_t *pmd,unsigned long address) { } +static inline void migration_entry_wait_huge (struct mm_struct *mm, +pte_t *pte) { }static inline int is_write_migration_entry (swp_entry_t entry) {return 0 ;
mm/hugetlb.c +1 -1
@@ -2768,7 +2768,7 @@ int hugetlb_fault(struct mm_struct *mm,if (ptep) { entry =huge_ptep_get (ptep);if (unlikely (is_hugetlb_entry_migration (entry))) { -migration_entry_wait (mm, (pmd_t *)ptep, address); +migration_entry_wait_huge (mm, ptep);return 0 ; }else if (unlikely (is_hugetlb_entry_hwpoisoned (entry))) return VM_FAULT_HWPOISON_LARGE |
mm/migrate.c +18 -5
@@ -180,15 +180,14 @@ static void remove_migration_ptes(struct* get to the page and wait until migration is finished. * When we return from this function the fault will be retried. */ -void migration_entry_wait (struct mm_struct *mm,pmd_t *pmd, -unsigned long address) +static void __migration_entry_wait (struct mm_struct *mm,pte_t *ptep, +spinlock_t *ptl) { -pte_t *ptep, pte; -spinlock_t *ptl; +pte_t pte;swp_entry_t entry;struct page *page; - ptep =pte_offset_map_lock (mm, pmd, address, &ptl); +spin_lock (ptl); pte = *ptep;if (!is_swap_pte (pte)) goto out;
@@ -216,6 +215,20 @@ out:pte_unmap_unlock (ptep, ptl); } +void migration_entry_wait (struct mm_struct *mm,pmd_t *pmd, +unsigned long address) +{ +spinlock_t *ptl =pte_lockptr (mm, pmd); +pte_t *ptep =pte_offset_map (pmd, address); +__migration_entry_wait (mm, ptep, ptl); +} + +void migration_entry_wait_huge (struct mm_struct *mm,pte_t *pte) +{ +spinlock_t *ptl = &(mm)->page_table_lock; +__migration_entry_wait (mm, pte, ptl); +} +#ifdef CONFIG_BLOCK /* Returns true if all buffers are successfully locked */ static bool buffer_migrate_lock_buffers(struct buffer_head *head,
PATCH 18/26 x86: Fix typo in kexec register clearing
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit c8a22d19dd238ede87aa0ac4f7dbea8da039b9c1 upstream.
Fixes a typo in register clearing code. Thanks to PaX Team for fixing this originally, and James Troup for pointing it out.
--- arch/x86/kernel/relocate_kernel_64.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/relocate_kernel_64.S +1 -1
@@ -160,7 +160,7 @@ identity_mapped: xorq %rbp, %rbp xorq %r8, %r8 xorq %r9, %r9 - xorq %r10, %r9 + xorq %r10, %r10 xorq %r11, %r11 xorq %r12, %r12 xorq %r13, %r13
PATCH 19/26 libceph: clear messenger auth_retry flag when we authenticate
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sage Weil <[email protected]>
commit 20e55c4cc758e4dccdfd92ae8e9588dd624b2cd7 upstream.
We maintain a counter of failed auth attempts to allow us to retry once before failing. However, if the second attempt succeeds, the flag isn't cleared, which makes us think auth failed again later when the connection resets for other reasons (like a socket error).
This is one part of the sorry sequence of events in bug
http://tracker.ceph.com/issues/4282
--- net/ceph/messenger.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/ceph/messenger.c +1 -2
@@ -1542,7 +1542,6 @@ static int process_connect(struct ceph_c con->error_msg ="connect authorization failure" ;return -1 ; } - con->auth_retry =1 ;con_out_kvec_reset (con); ret =prepare_write_connect (con);if (ret <0 )
@@ -1627,7 +1626,7 @@ static int process_connect(struct ceph_cWARN_ON (con->state !=CON_STATE_NEGOTIATING ); con->state =CON_STATE_OPEN ; - + con->auth_retry =0 ;/* we authenticated; clear flag */ con->peer_global_seq =le32_to_cpu (con->in_reply.global_seq); con->connect_seq++; con->peer_features = server_feat;
PATCH 20/26 libceph: fix authorizer invalidation
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sage Weil <[email protected]>
commit 4b8e8b5d78b8322351d44487c1b76f7e9d3412bc upstream.
We were invalidating the authorizer by removing the ticket handler entirely. This was effective in inducing us to request a new authorizer, but in the meantime it mean that any authorizer we generated would get a new and initialized handler with secret_id=0, which would always be rejected by the server side with a confusing error message:
auth: could not find secret_id=0
cephx: verify_authorizer could not get service secret for service osd secret_id=0
Instead, simply clear the validity field. This will still induce the auth code to request a new secret, but will let us continue to use the old ticket in the meantime. The messenger code will probably continue to fail, but the exponential backoff will kick in, and eventually the we will get a new (hopefully more valid) ticket from the mon and be able to continue.
--- net/ceph/auth_x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ceph/auth_x.c +1 -1
@@ -630,7 +630,7 @@ static void ceph_x_invalidate_authorizer th =get_ticket_handler (ac, peer_type);if (!IS_ERR (th)) -remove_ticket_handler (ac, th); +memset (&th->validity,0 ,sizeof (th->validity)); }
PATCH 21/26 libceph: add update_authorizer auth method
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sage Weil <[email protected]>
commit 0bed9b5c523d577378b6f83eab5835fe30c27208 upstream.
Currently the messenger calls out to a get_authorizer con op, which will create a new authorizer if it doesn't yet have one. In the meantime, when we rotate our service keys, the authorizer doesn't get updated. Eventually it will be rejected by the server on a new connection attempt and get invalidated, and we will then rebuild a new authorizer, but this is not ideal.
Instead, if we do have an authorizer, call a new update_authorizer op that will verify that the current authorizer is using the latest secret. If it is not, we will build a new one that does. This avoids the transient failure.
This fixes one of the sorry sequence of events for bug
http://tracker.ceph.com/issues/4282
--- fs/ceph/mds_client.c | 7 ++++++- include/linux/ceph/auth.h | 3 +++ net/ceph/auth_x.c | 23 +++++++++++++++++++++++ net/ceph/auth_x.h | 1 + net/ceph/osd_client.c | 5 +++++ 5 files changed, 38 insertions(+), 1 deletion(-)
fs/ceph/mds_client.c +6 -1
@@ -3425,7 +3425,12 @@ static struct ceph_auth_handshake *get_a }if (!auth->authorizer && ac->ops && ac->ops->create_authorizer) {int ret = ac->ops->create_authorizer (ac,CEPH_ENTITY_TYPE_MDS , - auth); + auth); +if (ret) +return ERR_PTR (ret); + }else if (ac->ops && ac->ops_update_authorizer) { +int ret = ac->ops->update_authorizer (ac,CEPH_ENTITY_TYPE_MDS , + auth);if (ret)return ERR_PTR (ret); }
include/linux/ceph/auth.h +3 -0
@@ -52,6 +52,9 @@ struct ceph_auth_client_ops {*/ int (*create_authorizer)(struct ceph_auth_client *ac,int peer_type,struct ceph_auth_handshake *auth); +/* ensure that an existing authorizer is up to date */ +int (*update_authorizer)(struct ceph_auth_client *ac,int peer_type, +struct ceph_auth_handshake *auth);int (*verify_authorizer_reply)(struct ceph_auth_client *ac,struct ceph_authorizer *a,size_t len); void (*destroy_authorizer)(struct ceph_auth_client *ac,
net/ceph/auth_x.c +23 -0
@@ -298,6 +298,7 @@ static int ceph_x_build_authorizer(strucreturn -ENOMEM ; } au->service = th->service; + au->secret_id = th->secret_id; msg_a = au->buf->vec.iov_base; msg_a->struct_v =1 ;
@@ -555,6 +556,27 @@ static int ceph_x_create_authorizer(return 0 ; } +static int ceph_x_update_authorizer ( +struct ceph_auth_client *ac,int peer_type, +struct ceph_auth_handshake *auth) +{ +struct ceph_x_authorizer *au; +struct ceph_x_ticket_handler *th; +int ret; + + th =get_ticket_handler (ac, peer_type); +if (IS_ERR (th)) +return PTR_ERR (th); + + au = (struct ceph_x_authorizer *)auth->authorizer; +if (au->secret_id < th->secret_id) { +dout ("ceph_x_update_authorizer service %u secret %llu < %llu\n" , + au->service, au->secret_id, th->secret_id); +return ceph_x_build_authorizer (ac, th, au); + } +return 0 ; +} +static int ceph_x_verify_authorizer_reply (struct ceph_auth_client *ac,struct ceph_authorizer *a,size_t len) {
@@ -641,6 +663,7 @@ static const struct ceph_auth_client_ops .build_request = ceph_x_build_request, .handle_reply = ceph_x_handle_reply, .create_authorizer = ceph_x_create_authorizer, + .update_authorizer = ceph_x_update_authorizer, .verify_authorizer_reply = ceph_x_verify_authorizer_reply, .destroy_authorizer = ceph_x_destroy_authorizer, .invalidate_authorizer = ceph_x_invalidate_authorizer,
net/ceph/auth_x.h +1 -0
@@ -29,6 +29,7 @@ struct ceph_x_authorizer {struct ceph_buffer *buf;unsigned service;u64 nonce; +u64 secret_id;char reply_buf[128 ];/* big enough for encrypted blob */ };
net/ceph/osd_client.c +5 -0
@@ -2136,6 +2136,11 @@ static struct ceph_auth_handshake *get_a auth);if (ret)return ERR_PTR (ret); + }else if (ac->ops && ac->ops->update_authorizer) { +int ret = ac->ops->update_authorizer (ac,CEPH_ENTITY_TYPE_OSD , + auth); +if (ret) +return ERR_PTR (ret); } *proto = ac->protocol;
PATCH 22/26 libceph: wrap auth ops in wrapper functions
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sage Weil <[email protected]>
commit 27859f9773e4a0b2042435b13400ee2c891a61f4 upstream.
Use wrapper functions that check whether the auth op exists so that callers do not need a bunch of conditional checks. Simplifies the external interface.
--- fs/ceph/mds_client.c | 26 +++++++++++-------------- include/linux/ceph/auth.h | 13 ++++++++++++ net/ceph/auth.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++ net/ceph/auth_x.c | 1 net/ceph/mon_client.c | 7 ++---- net/ceph/osd_client.c | 26 ++++++++----------------- 6 files changed, 84 insertions(+), 36 deletions(-)
fs/ceph/mds_client.c +12 -14
@@ -335,9 +335,9 @@ void ceph_put_mds_session(struct ceph_md atomic_read(&s->s_ref), atomic_read(&s->s_ref)-1);if (atomic_dec_and_test (&s->s_ref)) {if (s->s_auth.authorizer) - s->s_mdsc->fsc->client->monc.auth->ops->destroy_authorizer ( - s->s_mdsc->fsc->client->monc.auth, - s->s_auth.authorizer); +ceph_auth_destroy_authorizer ( + s->s_mdsc->fsc->client->monc.auth, + s->s_auth.authorizer);kfree (s); } }
@@ -3419,18 +3419,17 @@ static struct ceph_auth_handshake *get_astruct ceph_auth_handshake *auth = &s->s_auth;if (force_new && auth->authorizer) { -if (ac->ops && ac->ops->destroy_authorizer) - ac->ops->destroy_authorizer (ac, auth->authorizer); +ceph_auth_destroy_authorizer (ac, auth->authorizer); auth->authorizer =NULL ; } -if (!auth->authorizer && ac->ops && ac->ops->create_authorizer) { -int ret = ac->ops->create_authorizer (ac,CEPH_ENTITY_TYPE_MDS , - auth); +if (!auth->authorizer) { +int ret =ceph_auth_create_authorizer (ac,CEPH_ENTITY_TYPE_MDS , + auth);if (ret)return ERR_PTR (ret); - }else if (ac->ops && ac->ops_update_authorizer) { -int ret = ac->ops->update_authorizer (ac,CEPH_ENTITY_TYPE_MDS , - auth); + }else { +int ret =ceph_auth_update_authorizer (ac,CEPH_ENTITY_TYPE_MDS , + auth);if (ret)return ERR_PTR (ret); }
@@ -3446,7 +3445,7 @@ static int verify_authorizer_reply(strucstruct ceph_mds_client *mdsc = s->s_mdsc;struct ceph_auth_client *ac = mdsc->fsc->client->monc.auth; -return ac->ops->verify_authorizer_reply (ac, s->s_auth.authorizer, len); +return ceph_auth_verify_authorizer_reply (ac, s->s_auth.authorizer, len); }static int invalidate_authorizer (struct ceph_connection *con)
@@ -3455,8 +3454,7 @@ static int invalidate_authorizer(structstruct ceph_mds_client *mdsc = s->s_mdsc;struct ceph_auth_client *ac = mdsc->fsc->client->monc.auth; -if (ac->ops->invalidate_authorizer) - ac->ops->invalidate_authorizer (ac,CEPH_ENTITY_TYPE_MDS ); +ceph_auth_invalidate_authorizer (ac,CEPH_ENTITY_TYPE_MDS );return ceph_monc_validate_auth (&mdsc->fsc->client->monc); }
include/linux/ceph/auth.h +13 -0
@@ -97,5 +97,18 @@ extern int ceph_build_auth(struct ceph_a void *msg_buf, size_t msg_len);extern int ceph_auth_is_authenticated (struct ceph_auth_client *ac); +extern int ceph_auth_create_authorizer (struct ceph_auth_client *ac, +int peer_type, +struct ceph_auth_handshake *auth); +extern void ceph_auth_destroy_authorizer (struct ceph_auth_client *ac, +struct ceph_authorizer *a); +extern int ceph_auth_update_authorizer (struct ceph_auth_client *ac, +int peer_type, +struct ceph_auth_handshake *a); +extern int ceph_auth_verify_authorizer_reply (struct ceph_auth_client *ac, +struct ceph_authorizer *a, +size_t len); +extern void ceph_auth_invalidate_authorizer (struct ceph_auth_client *ac, +int peer_type);#endif
net/ceph/auth.c +47 -0
50 lines not on this page · raw message
net/ceph/auth_x.c +0 -1
@@ -562,7 +562,6 @@ static int ceph_x_update_authorizer( {struct ceph_x_authorizer *au;struct ceph_x_ticket_handler *th; -int ret; th =get_ticket_handler (ac, peer_type);if (IS_ERR (th))
net/ceph/mon_client.c +3 -4
@@ -737,7 +737,7 @@ static void delayed_work(struct work_str__validate_auth (monc); -if (monc->auth->ops->is_authenticated (monc->auth)) +if (ceph_auth_is_authenticated (monc->auth))__send_subscribe (monc); }__schedule_delayed (monc);
@@ -893,8 +893,7 @@ static void handle_auth_reply(struct cepmutex_lock (&monc->mutex); had_debugfs_info =have_debugfs_info (monc); -if (monc->auth->ops) - was_auth = monc->auth->ops->is_authenticated (monc->auth); + was_auth =ceph_auth_is_authenticated (monc->auth); monc->pending_auth =0 ; ret = ceph_handle_auth_reply(monc->auth, msg->front.iov_base, msg->front.iov_len,
@@ -905,7 +904,7 @@ static void handle_auth_reply(struct cepwake_up_all (&monc->client->auth_wq); }else if (ret >0 ) {__send_prepared_auth_request (monc, ret); - }else if (!was_auth && monc->auth->ops->is_authenticated (monc->auth)) { + }else if (!was_auth &&ceph_auth_is_authenticated (monc->auth)) {dout ("authenticated, starting session\n" ); monc->client->msgr.inst.name.type =CEPH_ENTITY_TYPE_CLIENT ;
net/ceph/osd_client.c +9 -17
@@ -671,8 +671,7 @@ static void put_osd(struct ceph_osd *osdif (atomic_dec_and_test (&osd->o_ref) && osd->o_auth.authorizer) {struct ceph_auth_client *ac = osd->o_osdc->client->monc.auth; -if (ac->ops && ac->ops->destroy_authorizer) - ac->ops->destroy_authorizer (ac, osd->o_auth.authorizer); +ceph_auth_destroy_authorizer (ac, osd->o_auth.authorizer);kfree (osd); } }
@@ -2127,17 +2126,16 @@ static struct ceph_auth_handshake *get_astruct ceph_auth_handshake *auth = &o->o_auth;if (force_new && auth->authorizer) { -if (ac->ops && ac->ops->destroy_authorizer) - ac->ops->destroy_authorizer (ac, auth->authorizer); +ceph_auth_destroy_authorizer (ac, auth->authorizer); auth->authorizer =NULL ; } -if (!auth->authorizer && ac->ops && ac->ops->create_authorizer) { -int ret = ac->ops->create_authorizer (ac,CEPH_ENTITY_TYPE_OSD , - auth); +if (!auth->authorizer) { +int ret =ceph_auth_create_authorizer (ac,CEPH_ENTITY_TYPE_OSD , + auth);if (ret)return ERR_PTR (ret); - }else if (ac->ops && ac->ops->update_authorizer) { -int ret = ac->ops->update_authorizer (ac,CEPH_ENTITY_TYPE_OSD , + }else { +int ret =ceph_auth_update_authorizer (ac,CEPH_ENTITY_TYPE_OSD , auth);if (ret)return ERR_PTR (ret);
@@ -2154,11 +2152,7 @@ static int verify_authorizer_reply(strucstruct ceph_osd_client *osdc = o->o_osdc;struct ceph_auth_client *ac = osdc->client->monc.auth; -/* -* XXX If ac->ops or ac->ops->verify_authorizer_reply is null, -* XXX which do we do: succeed or fail? -*/ -return ac->ops->verify_authorizer_reply (ac, o->o_auth.authorizer, len); +return ceph_auth_verify_authorizer_reply (ac, o->o_auth.authorizer, len); }static int invalidate_authorizer (struct ceph_connection *con)
@@ -2167,9 +2161,7 @@ static int invalidate_authorizer(structstruct ceph_osd_client *osdc = o->o_osdc;struct ceph_auth_client *ac = osdc->client->monc.auth; -if (ac->ops && ac->ops->invalidate_authorizer) - ac->ops->invalidate_authorizer (ac,CEPH_ENTITY_TYPE_OSD ); - +ceph_auth_invalidate_authorizer (ac,CEPH_ENTITY_TYPE_OSD );return ceph_monc_validate_auth (&osdc->client->monc); }
PATCH 24/26 ceph: fix statvfs fr_size
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sage Weil <[email protected]>
commit 92a49fb0f79f3300e6e50ddf56238e70678e4202 upstream.
Different versions of glibc are broken in different ways, but the short of it is that for the time being, frsize should == bsize, and be used as the multiple for the blocks, free, and available fields. This mirrors what is done for NFS. The previous reporting of the page size for frsize meant that newer glibc and df would report a very small value for the fs size.
Fixes http://tracker.ceph.com/issues/3793.
--- fs/ceph/super.c | 7 ++++++- fs/ceph/super.h | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-)
fs/ceph/super.c +6 -1
@@ -70,8 +70,14 @@ static int ceph_statfs(struct dentry *de/* * express utilization in terms of large blocks to avoid * overflow on 32-bit machines. +* +* NOTE: for the time being, we make bsize == frsize to humor +* not-yet-ancient versions of glibc that are broken. +* Someday, we will probably want to report a real block +* size... whatever that may mean for a network file system! */ buf->f_bsize =1 <<CEPH_BLOCK_SHIFT ; + buf->f_frsize =1 <<CEPH_BLOCK_SHIFT ; buf->f_blocks =le64_to_cpu (st.kb) >> (CEPH_BLOCK_SHIFT -10 ); buf->f_bfree =le64_to_cpu (st.kb_avail) >> (CEPH_BLOCK_SHIFT -10 ); buf->f_bavail =le64_to_cpu (st.kb_avail) >> (CEPH_BLOCK_SHIFT -10 );
@@ -79,7 +85,6 @@ static int ceph_statfs(struct dentry *de buf->f_files =le64_to_cpu (st.num_objects); buf->f_ffree =-1 ; buf->f_namelen =NAME_MAX ; - buf->f_frsize =PAGE_CACHE_SIZE ;/* leave fsid little-endian, regardless of host endianness */ fsid = *(u64 *)(&monmap->fsid) ^ *((u64 *)&monmap->fsid +1 );
fs/ceph/super.h +1 -1
@@ -21,7 +21,7 @@/* large granularity for statfs utilization stats to facilitate * large volume sizes on 32-bit machines. */ -#define CEPH_BLOCK_SHIFT 20/* 1 MB */ +#define CEPH_BLOCK_SHIFT 22/* 4 MB */ #define CEPH_BLOCK (1 << CEPH_BLOCK_SHIFT)#define CEPH_MOUNT_OPT_DIRSTAT (1<<4)/* `cat dirname` for stats */
PATCH 25/26 powerpc: Fix stack overflow crash in resume_kernel when ftracing
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
commit 0e37739b1c96d65e6433998454985de994383019 upstream.
It's possible for us to crash when running with ftrace enabled, eg:
Bad kernel stack pointer bffffd12 at c00000000000a454 cpu 0x3: Vector: 300 (Data Access) at [c00000000ffe3d40]
pc: c00000000000a454: resume_kernel+0x34/0x60
lr: c00000000000335c: performance_monitor_common+0x15c/0x180
sp: bffffd12
msr: 8000000000001032
dar: bffffd12dsisr: 42000000
If we look at current's stack (paca->__current->stack) we see it is equal to c0000002ecab0000. Our stack is 16K, and comparing to paca->kstack (c0000002ecab3e30) we can see that we have overflowed our kernel stack. This leads to us writing over our struct thread_info, and in this case we have corrupted thread_info->flags and set _TIF_EMULATE_STACK_STORE.
Dumping the stack we see:
3:mon> t c0000002ecab0000
[c0000002ecab0000] c00000000002131c .performance_monitor_exception+0x5c/0x70 [c0000002ecab0080] c00000000000335c performance_monitor_common+0x15c/0x180 --- Exception: f01 (Performance Monitor) at c0000000000fb2ec .trace_hardirqs_off+0x1c/0x30 [c0000002ecab0370] c00000000016fdb0 .trace_graph_entry+0xb0/0x280 (unreliable) [c0000002ecab0410] c00000000003d038 .prepare_ftrace_return+0x98/0x130 [c0000002ecab04b0] c00000000000a920 .ftrace_graph_caller+0x14/0x28 [c0000002ecab0520] c0000000000d6b58 .idle_cpu+0x18/0x90
[c0000002ecab05a0] c00000000000a934 .return_to_handler+0x0/0x34 [c0000002ecab0620] c00000000001e660 .timer_interrupt+0x160/0x300 [c0000002ecab06d0] c0000000000025dc decrementer_common+0x15c/0x180
--- Exception: 901 (Decrementer) at c0000000000104d4 .arch_local_irq_restore+0x74/0xa0 [c0000002ecab09c0] c0000000000fe044 .trace_hardirqs_on+0x14/0x30 (unreliable) [c0000002ecab0fb0] c00000000016fe3c .trace_graph_entry+0x13c/0x280 [c0000002ecab1050] c00000000003d038 .prepare_ftrace_return+0x98/0x130 [c0000002ecab10f0] c00000000000a920 .ftrace_graph_caller+0x14/0x28 [c0000002ecab1160] c0000000000161f0 .__ppc64_runlatch_on+0x10/0x40 [c0000002ecab11d0] c00000000000a934 .return_to_handler+0x0/0x34
--- Exception: 901 (Decrementer) at c0000000000104d4 .arch_local_irq_restore+0x74/0xa0
... and so on
__ppc64_runlatch_on() is called from RUNLATCH_ON in the exception entry path. At that point the irq state is not consistent, ie. interrupts are hard disabled (by the exception entry), but the paca soft-enabled flag may be out of sync.
This leads to the local_irq_restore() in trace_graph_entry() actually enabling interrupts, which we do not want. Because we have not yet reprogrammed the decrementer we immediately take another decrementer exception, and recurse.
The fix is twofold. Firstly make sure we call DISABLE_INTS before calling RUNLATCH_ON. The badly named DISABLE_INTS actually reconciles the irq state in the paca with the hardware, making it safe again to call local_irq_save/restore().
Although that should be sufficient to fix the bug, we also mark the runlatch routines as notrace. They are called very early in the exception entry and we are asking for trouble tracing them. They are also fairly uninteresting and tracing them just adds unnecessary overhead.
[ This regression was introduced by fe1952fc0afb9a2e4c79f103c08aef5d13db1873
"powerpc: Rework runlatch code" by myself --BenH
]
--- arch/powerpc/include/asm/exception-64s.h | 2 +- arch/powerpc/kernel/process.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/powerpc/include/asm/exception-64s.h +1 -1
@@ -320,7 +320,7 @@ label##_common: \*/ #define STD_EXCEPTION_COMMON_ASYNC (trap, label, hdlr) \ EXCEPTION_COMMON(trap, label, hdlr, ret_from_except_lite, \ - FINISH_NAP;RUNLATCH_ON;DISABLE_INTS) + FINISH_NAP;DISABLE_INTS;RUNLATCH_ON)/* * When the idle code in power4_idle puts the CPU into NAP mode,
arch/powerpc/kernel/process.c +2 -2
@@ -1218,7 +1218,7 @@ EXPORT_SYMBOL(dump_stack);#ifdef CONFIG_PPC64 /* Called with hard IRQs off */ -void __ppc64_runlatch_on (void ) +void notrace __ppc64_runlatch_on(void) {struct thread_info *ti =current_thread_info ();unsigned long ctrl;
@@ -1231,7 +1231,7 @@ void __ppc64_runlatch_on(void) }/* Called with hard IRQs off */ -void __ppc64_runlatch_off (void ) +void notrace __ppc64_runlatch_off(void) {struct thread_info *ti =current_thread_info ();unsigned long ctrl;
PATCH 26/26 powerpc: Fix missing/delayed calls to irq_work
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <[email protected]>
commit 230b3034793247f61e6a0b08c44cf415f6d92981 upstream.
When replaying interrupts (as a result of the interrupt occurring while soft-disabled), in the case of the decrementer, we are exclusively testing for a pending timer target. However we also use decrementer interrupts to trigger the new "irq_work", which in this case would be missed.
This change the logic to force a replay in both cases of a timer boundary reached and a decrementer interrupt having actually occurred while disabled. The former test is still useful to catch cases where a CPU having been hard-disabled for a long time completely misses the interrupt due to a decrementer rollover.
--- arch/powerpc/kernel/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/irq.c +1 -1
@@ -162,7 +162,7 @@ notrace unsigned int __check_irq_replay(* in case we also had a rollover while hard disabled */ local_paca->irq_happened &= ~PACA_IRQ_DEC ; -if (decrementer_check_overflow ()) +if ((happened &PACA_IRQ_DEC ) ||decrementer_check_overflow ())return 0x900 ;/* Finally check if an external interrupt happened */
Quoted 20 lines
From: Greg Kroah-Hartman <[email protected]>
Date: Tue, Jun 18, 2013 at 10:14 AM
Subject: [ 00/26] 3.4.50-stable review
To: [email protected]
Cc: Greg Kroah-Hartman <[email protected]>, [email protected], [email protected], [email protected]From: Greg Kroah-Hartman <[email protected]>
This is the start of the stable review cycle for the 3.4.50 release. There are 26 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Jun 20 16:10:38 UTC 2013. Anything received after that time might be too late.
Quoted 8 lines
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.50-rc1.gzand the diffstat can be found below.
thanks,
greg k-h
Patches applied cleanly to 3.0.82, 3.4.49, and 3.9.6
Compiled and booted on the following systems:
Samsung Series 9 900X4C Intel Corei5:
(3.4.50-rc1, and 3.9.7-rc1)
HP ProBook 6475b AMD A10-4600M APU with Radeon(tm) HD Graphics:
(3.0.83-rc1, 3.4.50-rc1, and 3.9.7-rc1)dmesgs for all releases look good. No regressions compared to the previous dmesgs for each of these releases.
Reviewed patches.
Cross-compile testing:
HP Compaq dc7700 SFF desktop: x86-64 Intel Core-i2:
(3.0.83-rc1, 3.4.50-rc1, and 3.9.7-rc1)
Cross-compile tests results:
alpha: defconfig passed on all
arm: defconfig passed on all
arm64: not applicable to 3.0.y, 3.4.y. defconfig passed on 3.9.y
c6x: not applicable to 3.0.y, defconfig passed on 3.4.y and 3.9.y
mips: defconfig passed on all
mipsel: defconfig passed on all
powerpc: wii_defconfig passed on all
sh: defconfig passed on all
sparc: defconfig passed on all
tile: tilegx_defconfig passed on all
thanks,
-- Shuah
Shuah Khan, Linux Kernel Developer - Open Source Group Samsung Research America (Silicon Valley) [email protected] | (970) 672-0658
At Tue, 18 Jun 2013 09:14:40 -0700,
Quoted 10 lines · Greg Kroah-Hartman
From: Greg Kroah-Hartman <[email protected]>
This is the start of the stable review cycle for the 3.4.50 release. There are 26 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Jun 20 16:10:38 UTC 2013. Anything received after that time might be too late.
This kernel can be built and boot without any problem. Building a kernel with this kernel also works fine.
- Build Machine: debian jessy x86_64
CPU: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz x 4
memory: 8GB
- Test machine: debian jessy x86_64(KVM guest on the Build Machine)
vCPU: x2
memory: 2GB
I reviewed the following patches.
The following patch seems to have a bug and I'm asking the original author.
Quoted 2 lines
Naoya Horiguchi <[email protected]>
mm: migration: addmigrate_entry_wait_huge()
The following patches look good to me.
Quoted 2 lines
Kees Cook <[email protected]>
x86: Fix typo in kexec register clearing
...
Quoted 2 lines
Rafael Aquini <[email protected]>
swap: avoidread_swap_cache_async()race to deadlock while waiting on discard I/O completion
...
Quoted 2 lines
Srivatsa S. Bhat <[email protected]>
CPU hotplug: provide a generic helper to disable/enable CPU hotplug
Thanks,
Satoru
Quoted 10 lines · Satoru Takeuchi
At Tue, 18 Jun 2013 09:14:40 -0700,
Quoted 8 lines · Greg Kroah-Hartman
From: Greg Kroah-Hartman <[email protected]>
This is the start of the stable review cycle for the 3.4.50 release. There are 26 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 5 lines
Quoted 2 lines
Responses should be made by Thu Jun 20 16:10:38 UTC 2013. Anything received after that time might be too late.
This kernel can be built and boot without any problem. Building a kernel with this kernel also works fine.
Thanks for testing.
greg k-h