XFS development tree branch, xfs-libxfs-restructure, created. xfs-for-linus-3.15-rc6-858-gd12984e
[email protected]
Reviewed-by Dave Chinner Reviewed-by Christoph Hellwig Reviewed-by Dave Chinner Acked-by Ingo Molnar Tested-by Marc MERLIN Acked-by Peter Zijlstra Reviewed-by Darren Hart Acked-by Toshi Kani Acked-by Toshi Kani Reviewed-by Ben Segall Acked-by Peter Zijlstra Tested-by Arnaldo Carvalho de Melo Acked-by Arnaldo Carvalho de Melo Tested-by Arnaldo Carvalho de Melo Acked-by Prarit Bhargava Acked-by Tejun Heo Acked-by Alexei Starovoitov Tested-by Alexei Starovoitov Acked-by Flavio Leitner Acked-by Bjørn Mork Acked-by Bjørn Mork Acked-by Vlad Yasevich Acked-by Borislav Petkov Acked-by Vivek Goyal Reviewed-by Jiri Pirko Acked-by Toshiaki Makita Acked-by Stephen Hemminger Reviewed-by Daniel Vetter Acked-by Bjørn Mork Acked-by Antonio Quartulli Tested-by Ken Moffat Reviewed-by Christian König Acked-by Steve Capper Tested-by Marc Zyngier Tested-by Ville Syrjälä Tested-by Jorge Reviewed-by Steven Rostedt Reviewed-by Paul Burton Tested-by Bart van Assche Acked-by Joe Thornber Acked-by Kurt Van Dijck Reviewed-by Ville Syrjälä Acked-by Julian Anastasov Acked-by Uwe Kleine-König Acked-by Linus Walleij Reviewed-by Anurag Aggarwal Reviewed-by Nicolas Pitre Acked-by Uwe Kleine-König Reviewed-by Guenter Roeck Reviewed-by Guenter Roeck Reviewed-by Guenter Roeck Tested-by Fabio Estevam Tested-by Shawn Guo Acked-by Stephen Warren Tested-by Will Deacon Acked-by Randy Dunlap Acked-by Johannes Weiner Acked-by Jeff Moyer Reviewed-by Naoya Horiguchi Tested-by Naoya Horiguchi Reviewed-by Andi Kleen Acked-by Miklos Szeredi Acked-by Helge Deller Reviewed-by Nathaniel Wesley Filardo Reviewed-by Tejun Heo Reviewed-by Tejun Heo Acked-by Leonid Yegoshin Acked-by Victor Kamensky Acked-by Dan Williams Acked-by Tony Prisk Tested-by Jet Chen Acked-by Alexei Starovoitov Acked-by Veaceslav Falico Acked-by Daniel Borkmann Acked-by Giuseppe Cavallaro Acked-by Chen-Yu Tsai Acked-by Alexandre Belloni Acked-by Nicolas Ferre Reviewed-by Markos Chandras Acked-by Juri Lelli Acked-by Michael Kerrisk Acked-by Michael Kerrisk Acked-by Uwe Kleine-König Acked-by Sam Ravnborg Acked-by Tony Lindgren Reviewed-by Alex Deucher Tested-by Ken Moffat Reviewed-by Alex Deucher Reviewed-by Marek Olšák Reviewed-by Alex Deucher Reviewed-by Alex Deucher Acked-by Arnd Bergmann Acked-by Arnd Bergmann Acked-by Tony Luck Acked-by Helge Deller Acked-by Geert Uytterhoeven Tested-by SaveTheRobots Acked-by Viresh Kumar Tested-by Fabio Estevam Acked-by Alex Williamson Tested-by Tony Lindgren Reviewed-by Tomasz Figa Acked-by Lars-Peter Clausen Tested-by Alexander Stein Acked-by Dmitry Kravkov Tested-by Mikko Perttunen Reviewed-by Thierry Reding Tested-by Thierry Reding Acked-by Thierry Reding Tested-by Timo Teräs Acked-by Florian Fainelli Acked-by Wei Liu Acked-by Ian Campbell Reviewed-by Sage Weil Reviewed-by Ilya Dryomov Acked-by John Crispin Acked-by Lee Jones Acked-by Linus Walleij Acked-by Veaceslav Falico Acked-by Ian Campbell Acked-by Hannes Frederic Sowa Acked-by Florian Fainelli Reviewed-by Chris Leech Reviewed-by Sagi Grimberg Acked-by Michael S. Tsirkin Acked-by Martin Hundebøll Acked-by Antonio Quartulli Tested-by Robert Navarro Tested-by Vitaly Minko Acked-by Christian Borntraeger Reviewed-by Chris Wilson Reviewed-by Jesse Barnes Tested-by Knut Petersen Reviewed-by Daniel Vetter Reviewed-by Rodrigo Vivi Tested-by Rodrigo Vivi Acked-by Peter Zijlstra Tested-by David Herrmann Tested-by Doug Anderson Tested-by Javi Merino Tested-by Javi Merino Reviewed-by Tomasz Figa Reviewed-by Ivan T. Ivanov Acked-by Bjorn Andersson Acked-by Kukjin Kim Acked-by Linus Walleij Acked-by Mika Westerberg Tested-by Jouni Malinen Acked-by Eric Paris Acked-by Paul Moore Acked-by Dave Hansen Acked-by Laurent Pinchart Acked-by Jonathan Corbet Acked-by Mike Christie Tested-by Shawn Guo Acked-by Li Zefan Acked-by Li Zefan Acked-by Gregory CLEMENT Tested-by Gregory CLEMENT Tested-by Andrew Lunn Tested-by Willy Tarreau Acked-by Gregory CLEMENT Tested-by Gregory CLEMENT Tested-by Andrew Lunn Tested-by Willy Tarreau Reviewed-by Johannes Berg Tested-by Andrey Wagin Acked-by Thomas Graf Acked-by Geert Uytterhoeven Reviewed-by Wolfram Sang Acked-by Maciej W. Rozycki Acked-by Nicolas Ferre Acked-by Shradha Shah Reviewed-by Arend Van Spriel Reviewed-by Jean Delvare Acked-by Mark Rutland Acked-by Catalin Marinas Acked-by Richard Cochran Tested-by Brandon Casey Reviewed-by Andrea Arcangeli Acked-by Michel Lespinasse Acked-by Johannes Weiner Acked-by Shawn Guo Tested-by Darren Hart Reviewed-by Mika Kuoppala Acked-by Peter Korsgaard Tested-by Eric Paris Acked-by Toshi Kani Acked-by Florian Fainelli Acked-by Mugunthan V N Reviewed-by Johannes Berg Reviewed-by Aaron Lu Reviewed-by Imre Deak Tested-by Markus Blank-Burian Reviewed-by Damien Lespiau Reviewed-by Damien Lespiau Reviewed-by Damien Lespiau Acked-by [email protected] Reviewed-by Preeti U Murthy Acked-by Juri Lelli Reviewed-by Paul E. McKenney Tested-by Vince Weaver Acked-by Kukjin Kim Reviewed-by Johannes Berg Reviewed-by Luciano Coelho Acked-by Serge Hallyn Acked-by Andrew Lunn Acked-by Serge Hallyn Acked-by Geert Uytterhoeven Acked-by Laurent Pinchart Tested-by Pavel Machek Tested-by Markus Mayer Acked-by Hans de Goede Reviewed-by Aneesh Kumar K.V Reviewed-by Aneesh Kumar K.V Tested-by Pranavkumar Sawargaonkar Reviewed-by Ian Campbell Acked-by Philipp Zabel Acked-by Arnd Bergmann Acked-by Gregory CLEMENT Acked-by Gregory CLEMENT Tested-by Arnaud Ebalard Tested-by Willy Tarreau Acked-by Ezequiel Garcia Acked-by Gregory CLEMENT Acked-by Ezequiel Garcia Acked-by Gregory CLEMENT Acked-by Ezequiel Garcia Acked-by Gregory CLEMENT Tested-by Nishanth Menon Acked-by Santosh Shilimkar Tested-by Nishanth Menon Acked-by Dan Williams Tested-by Neil Greatorex Acked-by Bjorn Helgaas Tested-by Neil Greatorex Reviewed-by Jason Gunthorpe Tested-by Neil Greatorex Acked-by Bjorn Helgaas Acked-by Philipp Zabel Tested-by Shawn Guo Acked-by Boris BREZILLON Acked-by Alexandre Belloni Acked-by Stephen Warren Acked-by Sebastian Hesselbarth Acked-by Ezequiel Garcia Acked-by Gregory CLEMENT Acked-by Lai Jiangshan Acked-by Greg Kroah-Hartman Acked-by Hans de Goede Tested-by Martin PelikanThis is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "XFS development tree".
The branch, xfs-libxfs-restructure has been created
at d12984ec02037de7af328580075ba1bb88272ffd (commit)
- Log ----------------------------------------------------------------- commit d12984ec02037de7af328580075ba1bb88272ffd
Author: Dave Chinner <[email protected]> Date: Tue Jun 10 09:55:44 2014 +1000
libxfs: move source files
Move all the source files that are shared with userspace into libxfs/. This is done as one big chunk simpy to get it done quickly
commit f212d6fcf5c1cc3a3980dd320804c1dfb9f49b75
Author: Dave Chinner <[email protected]> Date: Tue Jun 10 09:34:14 2014 +1000
libxfs: move header files
Move all the header files that are shared with userspace into libxfs. This is done as one big chunk simpy to get it done quickly.
commit e10404cf914273de8016d5992c7049bdb9a9a089
Author: Dave Chinner <[email protected]> Date: Tue Jun 10 09:18:10 2014 +1000
xfs: create libxfs infrastructure
To minimise the differences between kernel and userspace code, split the kernel code into the same structure as the userspace code. That is, the gneric core functionality of XFS is moved to a libxfs/ directory and treat it as a layering barrier in the XFS code.
This patch introduces the libxfs directory, the build infrastructure and an initial source and header file to build. The libxfs directory will contain the header files that are needed to build libxfs - most of userspace does not care about the location of these header files as they are accessed indirectly. Hence keeping them inside libxfs makes it easy to track the changes and script the sync process as the directory structure will be identical.
To allow this changeover to occur in the kernel code, there are some temporary infrastructure in the makefiles to grab the header filesystem from both locations. Once all the files are moved, modifications will be made in the source code that will make the need for these include directives go away.
commit f3a19b3ad85dcc4a073270e1fb594eff37709788
Author: Eric Sandeen <[email protected]> Date: Tue Jun 10 08:58:24 2014 +1000
xfs: Nuke XFS_ERROR macro
XFS_ERROR was designed long ago to trap return values, but it's not runtime configurable, it's not consistently used, and we can do similar error trapping with ftrace scripts and triggers from userspace.
Just nuke XFS_ERROR and associated bits.
commit d5a6cda3cf2c0860543db26bb5df7ed4404f74cd
Author: Eric Sandeen <[email protected]> Date: Tue Jun 10 08:55:14 2014 +1000
xfs: return is not a function
return is not a function. "return(EIO);" is silly; "return (EIO);" moreso. return is not a function. Nuke the pointless parens.
[dchinner: catch a couple of extra cases in xfs_attr_list.c, xfs_acl.c and xfs_linux.h.]
commit 1a72690b705f8d0142108188f4a2d84367e51efb
Merge: 1860e37 7691283
Author: Dave Chinner <[email protected]>
Date: Tue Jun 10 08:48:28 2014 +1000
Merge branch 'for-next' into xfs-error-negate
commit 1860e379875dfe7271c649058aeddffe5afd9d0d
Author: Linus Torvalds <[email protected]> Date: Sun Jun 8 11:19:54 2014 -0700
Linux 3.15
commit bb077d600689dbf9305758efed1e16775db1c84c
Author: Linus Torvalds <[email protected]> Date: Sun Jun 8 10:09:49 2014 -0700
Revert "x86/smpboot: Initialize secondary CPU only if master CPU will wait for it"
This reverts commit 3e1a878b7ccdb31da6d9d2b855c72ad87afeba3f.
It came in very late, and already has one reported failure: Sitsofe reports that the current tree fails to boot on his EeePC, and bisected it down to this. Rather than waste time trying to figure out what's wrong, just revert it.
commit c593e8978722f7f4a12932733cfeed6c0c74fbaa
Merge: 052e5c7 01a9a8a
Author: Linus Torvalds <[email protected]>
Date: Sat Jun 7 15:12:18 2014 -0700
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs
Pull btrfs fix from Chris Mason:
"I had this in my 3.16 merge window queue, but it is small and obvious
enough for 3.15. I cherry-picked and retested against current rc8"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
Btrfs: send, fix corrupted path strings for long paths
commit 052e5c7e28cc22017f9ad3f67026f911fdfc2edc
Merge: 813895f f145377
Author: Linus Torvalds <[email protected]>
Date: Sat Jun 7 15:01:39 2014 -0700
Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
Pull SCSI target fixes from Nicholas Bellinger:
"Here are the remaining fixes for v3.15.
This series includes:
- iser-target fix for ImmediateData exception reference count bug (Sagi + nab)
- iscsi-target fix for MC/S login + potential iser-target MRDSL buffer overrun (Santosh + Roland)
- iser-target fix for v3.15-rc multi network portal shutdown regression (nab)
- target fix for allowing READ_CAPCITY during ALUA Standby access state (Chris + nab)
- target fix for NULL pointer dereference of alua_access_state for un-configured devices (Chris + nab)"
* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
target: Fix alua_access_state attribute OOPs for un-configured devices
target: Allow READ_CAPACITY opcode in ALUA Standby access state
iser-target: Fix multi network portal shutdown regression
iscsi-target: Fix wrong buffer / buffer overrun in iscsi_change_param_value()
iser-target: Add missing target_put_sess_cmd for ImmedateData failure
commit 813895f8dcb31bc6b0e9f5fc35e8c687a467f3dd
Merge: d4c5491 745c516
Author: Linus Torvalds <[email protected]>
Date: Sat Jun 7 14:50:38 2014 -0700
Merge branch 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Peter Anvin:
"A significantly larger than I'd like set of patches for just below the
wire. All of these, however, fix real problems.
The one thing that is genuinely scary in here is the change of SMP initialization, but that *does* fix a confirmed hang when booting virtual machines.
There is also a patch to actually do the right thing about not offlining a CPU when there are not enough interrupt vectors available in the system; the accounting was done incorrectly. The worst case for that patch is that we fail to offline CPUs when we should (the new code is strictly more conservative than the old), so is not particularly risky.
Most of the rest is minor stuff; the EFI patches are all about exporting correct information to boot loaders and kexec"
* 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/boot: EFI_MIXED should not prohibit loading above 4G x86/smpboot: Initialize secondary CPU only if master CPU will wait for it x86/smpboot: Log error on secondary CPU wakeup failure at ERR level
x86: Fix list/memory corruption on CPU hotplug
x86: irq: Get correct available vectors for cpu disable x86/efi: Do not export efi runtime map in case old map x86/efi: earlyprintk=efi,keep fix
commit 745c51673e289acf4d9ffc2835524de73ef923fd
Author: Matt Fleming <[email protected]> Date: Sat Jun 7 12:26:20 2014 +0100
x86/boot: EFI_MIXED should not prohibit loading above 4G
commit 7d453eee36ae ("x86/efi: Wire up CONFIG_EFI_MIXED") introduced a regression for the functionality to load kernels above 4G. The relevant (incorrect) reasoning behind this change can be seen in the commit message,
"The xloadflags field in the bzImage header is also updated to reflect that the kernel supports both entry points by setting both of XLF_EFI_HANDOVER_32 and XLF_EFI_HANDOVER_64 when CONFIG_EFI_MIXED=y. XLF_CAN_BE_LOADED_ABOVE_4G is disabled so that the kernel text is guaranteed to be addressable with 32-bits."
This is obviously bogus since 32-bit EFI loaders will never place the kernel above the 4G mark. So this restriction is entirely unnecessary.
But things are worse than that - since we want to encourage people to always compile with CONFIG_EFI_MIXED=y so that their kernels work out of the box for both 32-bit and 64-bit firmware, commit 7d453eee36ae effectively disables XLF_CAN_BE_LOADED_ABOVE_4G completely.
Remove the overzealous and superfluous restriction and restore the XLF_CAN_BE_LOADED_ABOVE_4G functionality.
commit d4c54919ed86302094c0ca7d48a8cbd4ee753e92
Author: Naoya Horiguchi <[email protected]> Date: Fri Jun 6 10:00:01 2014 -0400
mm: add !pte_present() check on existing hugetlb_entry callbacks
The age table walker doesn't check non-present hugetlb entry in common path, so hugetlb_entry() callbacks must check it. The reason for this behavior is that some callers want to handle it in its own way.
[ I think that reason is bogus, btw - it should just do what the regular
code does, which is to call the "pte_hole()" function for such hugetlb entries - Linus]
However, some callers don't check it now, which causes unpredictable result, for example when we have a race between migrating hugepage and reading /proc/pid/numa_maps. This patch fixes it by adding !pte_present checks on buggy callbacks.
This bug exists for years and got visible by introducing hugepage migration.
ChangeLog v2:
- fix if condition (check !pte_present() instead of pte_present())
commit 01a9a8a9e20012f5676ec9cd16b6aed08b267066
Author: Filipe Manana <[email protected]> Date: Wed May 21 17:38:13 2014 +0100
Btrfs: send, fix corrupted path strings for long paths
If a path has more than 230 characters, we allocate a new buffer to use for the path, but we were forgotting to copy the contents of the previous buffer into the new one, which has random content from the kmalloc call.
Test:
mkfs.btrfs -f /dev/sdd
mount /dev/sdd /mnt
TEST_PATH="/mnt/fdmanana/.config/google-chrome-mysetup/Default/Pepper_Data/Shockwave_Flash/WritableRoot/#SharedObjects/JSHJ4ZKN/s.wsj.net/[[IMPORT]]/players.edgesuite.net/flash/plugins/osmf/advanced-streaming-plugin/v2.7/osmf1.6/Ak#" mkdir -p $TEST_PATH
echo "hello world" > $TEST_PATH/amaiAdvancedStreamingPlugin.txt
btrfs subvolume snapshot -r /mnt /mnt/mysnap1 btrfs send /mnt/mysnap1 -f /tmp/1.snap
A test for xfstests follows.
commit d54d14bfb49f0b61aed9f20cb84cb692566cf83b
Merge: 624483f 09dc4ab
Author: Linus Torvalds <[email protected]>
Date: Fri Jun 6 09:53:32 2014 -0700
Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
"Four misc fixes: each was deemed serious enough to warrant v3.15
inclusion"
* 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/fair: Fix tg_set_cfs_bandwidth() deadlock on rq->lock sched/dl: Fix race in dl_task_timer()
sched: Fix sched_policy < 0 comparison
sched/numa: Fix use of spin_{un}lock_irq() when interrupts are disabled
commit 624483f3ea82598ab0f62f1bdb9177f531ab1892
Author: Andrey Ryabinin <[email protected]> Date: Fri Jun 6 19:09:30 2014 +0400
mm: rmap: fix use-after-free in __put_anon_vma
While working address sanitizer for kernel I've discovered use-after-free bug in __put_anon_vma.
For the last anon_vma, anon_vma->root freed before child anon_vma. Later in anon_vma_free(anon_vma) we are referencing to already freed anon_vma->root to check rwsem.
This fixes it by freeing the child anon_vma before freeing anon_vma->root.
commit f1453773514bb8b0bba0716301e8c8f17f8d39c7
Author: Nicholas Bellinger <[email protected]> Date: Fri Jun 6 00:52:57 2014 -0700
target: Fix alua_access_state attribute OOPs for un-configured devices
This patch fixes a OOPs where an attempt to write to the per-device alua_access_state configfs attribute at:
/sys/kernel/config/target/core/$HBA/$DEV/alua/$TG_PT_GP/alua_access_state
results in an NULL pointer dereference when the backend device has not yet been configured.
This patch adds an explicit check for DF_CONFIGURED, and fails with -ENODEV to avoid this case.
commit e7810c2d2c37fa8e58dda74b00790dab60fe6fba
Author: Nicholas Bellinger <[email protected]> Date: Thu Jun 5 23:37:00 2014 -0700
target: Allow READ_CAPACITY opcode in ALUA Standby access state
This patch allows READ_CAPACITY + SAI_READ_CAPACITY_16 opcode processing to occur while the associated ALUA group is in Standby access state.
This is required to avoid host side LUN probe failures during the initial scan if an ALUA group has already implicitly changed into Standby access state.
This addresses a bug reported by Chris + Philip using dm-multipath
+ ESX hosts configured with ALUA multipath.
commit 177875423eb01179738f6badcbb9eef4be789a0e
Merge: 3e1a878 a3530e8
Author: H. Peter Anvin <[email protected]>
Date: Thu Jun 5 13:09:44 2014 -0700
Merge tag 'efi-urgent' into x86/urgent
* Fix earlyprintk=efi,keep support by switching to an ioremap() mapping of the framebuffer when early_ioremap() is no longer available and dropping __init from functions that may be invoked after free_initmem() - Dave Young
* We shouldn't be exporting the EFI runtime map in sysfs if not using the new 1:1 EFI mapping code since in that case the mappings are not static across a kexec reboot - Dave Young
commit 951e273060d15b233a7f7ccaf76ba682b5b05a03
Merge: 1c5aefb 22c91aa
Author: Linus Torvalds <[email protected]>
Date: Thu Jun 5 12:51:05 2014 -0700
Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf fixes from Ingo Molnar:
"Two last minute tooling fixes"
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf probe: Fix perf probe to find correct variable DIE
perf probe: Fix a segfault if asked for variable it doesn't find
commit 1c5aefb5b12a90e29866c960a57c1f8f75def617
Merge: 54539cd 54a2178
Author: Linus Torvalds <[email protected]>
Date: Thu Jun 5 12:31:32 2014 -0700
Merge branch 'futex-fixes' (futex fixes from Thomas Gleixner)
Merge futex fixes from Thomas Gleixner:
"So with more awake and less futex wreckaged brain, I went through my
list of points again and came up with the following 4 patches.
1) Prevent pi requeueing on the same futex
I kept Kees check for uaddr1 == uaddr2 as a early check for private futexes and added a key comparison to both futex_requeue and futex_wait_requeue_pi.
Sebastian, sorry for the confusion yesterday night. I really misunderstood your question.
You are right the check is pointless for shared futexes where the same physical address is mapped to two different virtual addresses.
2) Sanity check atomic acquisiton in futex_lock_pi_atomic
That's basically what Darren suggested.
I just simplified it to use futex_top_waiter() to find kernel internal state. If state is found return -EINVAL and do not bother to fix up the user space variable. It's corrupted already.
3) Ensure state consistency in futex_unlock_pi
The code is silly versus the owner died bit. There is no point to preserve it on unlock when the user space thread owns the futex.
What's worse is that it does not update the user space value when the owner died bit is set. So the kernel itself creates observable inconsistency.
Another "optimization" is to retry an atomic unlock. That's pointless as in a sane environment user space would not call into that code if it could have unlocked it atomically. So we always check whether there is kernel state around and only if there is none, we do the unlock by setting the user space value to 0.
4) Sanitize lookup_pi_state
lookup_pi_state is ambigous about TID == 0 in the user space value.
This can be a valid state even if there is kernel state on this uaddr, but we miss a few corner case checks.
I tried to come up with a smaller solution hacking the checks into the current cruft, but it turned out to be ugly as hell and I got more confused than I was before. So I rewrote the sanity checks along the state documentation with awful lots of commentry"
* emailed patches from Thomas Gleixner <[email protected]>:
futex: Make lookup_pi_state more robust
futex: Always cleanup owner tid in unlock_pi
futex: Validate atomic acquisition in futex_lock_pi_atomic() futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)
commit 54a217887a7b658e2650c3feff22756ab80c7339
Author: Thomas Gleixner <[email protected]> Date: Tue Jun 3 12:27:08 2014 +0000
futex: Make lookup_pi_state more robust
The current implementation of lookup_pi_state has ambigous handling of the TID value 0 in the user space futex. We can get into the kernel even if the TID value is 0, because either there is a stale waiters bit or the owner died bit is set or we are called from the requeue_pi path or from user space just for fun.
The current code avoids an explicit sanity check for pid = 0 in case that kernel internal state (waiters) are found for the user space address. This can lead to state leakage and worse under some circumstances.
Handle the cases explicit:
Waiter | pi_state | pi->owner | uTID | uODIED | ?
[1] NULL | --- | --- | 0 | 0/1 | Valid
[2] NULL | --- | --- | >0 | 0/1 | Valid
[3] Found | NULL | -- | Any | 0/1 | Invalid
[4] Found | Found | NULL | 0 | 1 | Valid
[5] Found | Found | NULL | >0 | 1 | Invalid
[6] Found | Found | task | 0 | 1 | Valid
[7] Found | Found | NULL | Any | 0 | Invalid
[8] Found | Found | task | ==taskTID | 0/1 | Valid
[9] Found | Found | task | 0 | 0 | Invalid
[10] Found | Found | task | !=taskTID | 0/1 | Invalid
[1] Indicates that the kernel can acquire the futex atomically. We came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.
[2] Valid, if TID does not belong to a kernel thread. If no matching thread is found then it indicates that the owner TID has died.
[3] Invalid. The waiter is queued on a non PI futex
[4] Valid state after exit_robust_list(), which sets the user space value to FUTEX_WAITERS | FUTEX_OWNER_DIED.
[5] The user space value got manipulated between exit_robust_list() and exit_pi_state_list()
[6] Valid state after exit_pi_state_list() which sets the new owner in the pi_state but cannot access the user space value.
[7] pi_state->owner can only be NULL when the OWNER_DIED bit is set.
[8] Owner and user space value match
[9] There is no transient state which sets the user space TID to 0 except exit_robust_list(), but this is indicated by the FUTEX_OWNER_DIED bit. See [4]
[10] There is no transient state which leaves owner and user space TID out of sync.
commit 13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e
Author: Thomas Gleixner <[email protected]> Date: Tue Jun 3 12:27:07 2014 +0000
futex: Always cleanup owner tid in unlock_pi
If the owner died bit is set at futex_unlock_pi, we currently do not cleanup the user space futex. So the owner TID of the current owner (the unlocker) persists. That's observable inconsistant state, especially when the ownership of the pi state got transferred.
Clean it up unconditionally.
commit b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270
Author: Thomas Gleixner <[email protected]> Date: Tue Jun 3 12:27:06 2014 +0000
futex: Validate atomic acquisition in futex_lock_pi_atomic()
We need to protect the atomic acquisition in the kernel against rogue user space which sets the user space futex to 0, so the kernel side acquisition succeeds while there is existing state in the kernel associated to the real owner.
Verify whether the futex has waiters associated with kernel state. If it has, return -EINVAL. The state is corrupted already, so no point in cleaning it up. Subsequent calls will fail as well. Not our problem.
[ tglx: Use futex_top_waiter() and explain why we do not need to try
restoring the already corrupted user space state. ]
commit e9c243a5a6de0be8e584c604d353412584b592f8
Author: Thomas Gleixner <[email protected]> Date: Tue Jun 3 12:27:06 2014 +0000
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)
If uaddr == uaddr2, then we have broken the rule of only requeueing from a non-pi futex to a pi futex with this call. If we attempt this, then dangling pointers may be left for rt_waiter resulting in an exploitable condition.
This change brings futex_requeue() in line with futex_wait_requeue_pi() which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi()")
[ tglx: Compare the resulting keys as well, as uaddrs might be
different depending on the mapping ]
Fixes CVE-2014-3153.
commit 3e1a878b7ccdb31da6d9d2b855c72ad87afeba3f
Author: Igor Mammedov <[email protected]> Date: Thu Jun 5 15:42:45 2014 +0200
x86/smpboot: Initialize secondary CPU only if master CPU will wait for it
Hang is observed on virtual machines during CPU hotplug, especially in big guests with many CPUs. (It reproducible more often if host is over-committed).
It happens because master CPU gives up waiting on secondary CPU and allows it to run wild. As result AP causes locking or crashing system. For example as described here:
https://lkml.org/lkml/2014/3/6/257
If master CPU have sent STARTUP IPI successfully, and AP signalled to master CPU that it's ready to start initialization, make master CPU wait indefinitely till AP is onlined.
To ensure that AP won't ever run wild, make it wait at early startup till master CPU confirms its intention to wait for AP. If AP doesn't respond in 10 seconds, the master CPU will timeout and cancel AP onlining.
commit feef1e8ecbadf24f8e6829c935df8683cabae41b
Author: Igor Mammedov <[email protected]> Date: Thu Jun 5 15:42:44 2014 +0200
x86/smpboot: Log error on secondary CPU wakeup failure at ERR level
If system is running without debug level logging, it will not log error if do_boot_cpu() failed to wakeup AP. It may lead to silent AP bringup failures at boot time.
Change message level to KERN_ERR to make error visible to user as it's done on other architectures.
commit 89f898c1e195fa6235c869bb457e500b7b3ac49d
Author: Igor Mammedov <[email protected]> Date: Thu Jun 5 15:42:43 2014 +0200
x86: Fix list/memory corruption on CPU hotplug
currently if AP wake up is failed, master CPU marks AP as not
present in do_boot_cpu() by calling set_cpu_present(cpu, false).
That leads to following list corruption on the next physical CPU
hotplug:
[ 418.107336] WARNING: CPU: 1 PID: 45 at lib/list_debug.c:33 __list_add+0xbe/0xd0()
[ 418.115268] list_add corruption. prev->next should be next (ffff88003dc57600), but was ffff88003e20c3a0. (prev=ffff88003e20c3a0).
[ 418.123693] Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast ipt_MASQUERADE ip6t_REJECT ipt_REJECT cfg80211 xt_conntrack rfkill ee
[ 418.138979] CPU: 1 PID: 45 Comm: kworker/u10:1 Not tainted 3.14.0-rc6+ #387
[ 418.149989] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2007
[ 418.165750] Workqueue: kacpi_hotplug acpi_hotplug_work_fn
[ 418.166433] 0000000000000021 ffff880038ca7988 ffffffff8159b22d 0000000000000021
[ 418.176460] ffff880038ca79d8 ffff880038ca79c8 ffffffff8106942c ffff880038ca79e8
[ 418.177453] ffff88003e20c3a0 ffff88003dc57600 ffff88003e20c3a0 00000000ffffffea
[ 418.178445] Call Trace:
[ 418.185811] [<ffffffff8159b22d>] dump_stack+0x49/0x5c
[ 418.186440] [<ffffffff8106942c>] warn_slowpath_common+0x8c/0xc0
[ 418.187192] [<ffffffff81069516>] warn_slowpath_fmt+0x46/0x50
[ 418.191231] [<ffffffff8136ef51>] ? acpi_ns_get_node+0xb7/0xc7
[ 418.193889] [<ffffffff812f796e>] __list_add+0xbe/0xd0
[ 418.196649] [<ffffffff812e2aa9>] kobject_add_internal+0x79/0x200
[ 418.208610] [<ffffffff812e2e18>] kobject_add_varg+0x38/0x60
[ 418.213831] [<ffffffff812e2ef4>] kobject_add+0x44/0x70
[ 418.229961] [<ffffffff813e2c60>] device_add+0xd0/0x550
[ 418.234991] [<ffffffff813f0e95>] ? pm_runtime_init+0xe5/0xf0
[ 418.250226] [<ffffffff813e32be>] device_register+0x1e/0x30
[ 418.255296] [<ffffffff813e82a3>] register_cpu+0xe3/0x130
[ 418.266539] [<ffffffff81592be5>] arch_register_cpu+0x65/0x150
[ 418.285845] [<ffffffff81355c0d>] acpi_processor_hotadd_init+0x5a/0x9b
...
Which is caused by the fact that generic_processor_info() allocates
logical CPU id by calling:
cpu = cpumask_next_zero(-1, cpu_present_mask);
which returns id of previously failed to wake up CPU, since its
bit is cleared by do_boot_cpu() and as result register_cpu()
tries to register another CPU with the same id as already
present but failed to be onlined CPU.
Taking in account that AP will not do anything if master CPU
failed to wake it up, there is no reason to mark that AP as not
present and break next cpu hotplug attempts. As a side effect of
not marking AP as not present, user would be allowed to online
it again later.
Also fix memory corruption in acpi_unmap_lsapic()
if during CPU hotplug master CPU failed to wake up AP
it set percpu x86_cpu_to_apicid to BAD_APICID=0xFFFF for AP.
However following attempt to unplug that CPU will lead to
out of bound write access to __apicid_to_node[] which is
32768 items long on x86_64 kernel.
So with above fix of cpu_present_mask make sure that a present
CPU has a valid APIC ID by not setting x86_cpu_to_apicid
to BAD_APICID in do_boot_cpu() on failure and allow
acpi_processor_remove()->acpi_unmap_lsapic() cleanly remove CPU.
Signed-off-by: Igor Mammedov <[email protected]>
Acked-by: Toshi Kani <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>commit 09dc4ab03936df5c5aa711d27c81283c6d09f495
Author: Roman Gushchin <[email protected]> Date: Mon May 19 15:10:09 2014 +0400
sched/fair: Fix tg_set_cfs_bandwidth() deadlock on rq->lock
tg_set_cfs_bandwidth() sets cfs_b->timer_active to 0 to force the period timer restart. It's not safe, because can lead to deadlock, described in commit 927b54fccbf0:
"__start_cfs_bandwidth calls hrtimer_cancel while holding rq->lock, waiting for the hrtimer to finish. However, if sched_cfs_period_timer runs for another loop iteration, the hrtimer can attempt to take rq->lock, resulting in deadlock."
Three CPUs must be involved:
CPU0 CPU1 CPU2
take rq->lock period timer fired
... take cfs_b lock
... ... tg_set_cfs_bandwidth()
throttle_cfs_rq() release cfs_b lock take cfs_b lock
... distribute_cfs_runtime() timer_active = 0
take cfs_b->lock wait for rq->lock ...
__start_cfs_bandwidth()
{wait for timer callback
break if timer_active == 1}
So, CPU0 and CPU1 are deadlocked.
Instead of resetting cfs_b->timer_active, tg_set_cfs_bandwidth can wait for period timer callbacks (ignoring cfs_b->timer_active) and restart the timer explicitly.
commit 0f397f2c90ce68821ee864c2c53baafe78de765d
Author: Kirill Tkhai <[email protected]> Date: Tue May 20 13:33:42 2014 +0400
sched/dl: Fix race in dl_task_timer()
Throttled task is still on rq, and it may be moved to other cpu if user is playing with sched_setaffinity(). Therefore, unlocked task_rq() access makes the race.
Juri Lelli reports he got this race when dl_bandwidth_enabled() was not set.
Other thing, pointed by Peter Zijlstra:
"Now I suppose the problem can still actually happen when
you change the root domain and trigger a effective affinity change that way".
To fix that we do the same as made in __task_rq_lock(). We do not use __task_rq_lock() itself, because it has a useful lockdep check, which is not correct in case of dl_task_timer(). We do not need pi_lock locked here. This case is an exception (PeterZ):
"The only reason we don't strictly need ->pi_lock now is because
we're guaranteed to have p->state == TASK_RUNNING here and are thus free of ttwu races".
commit b14ed2c273f8ab872ae4e6735fe5ab09cb14b8c3
Author: Richard Weinberger <[email protected]> Date: Mon Jun 2 22:38:34 2014 +0200
sched: Fix sched_policy < 0 comparison
attr.sched_policy is u32, therefore a comparison against < 0 is never true. Fix this by casting sched_policy to int.
This issue was reported by coverity CID 1219934.
commit e9dd685ce81815811fb4da72e6ab10a694ac8468
Author: Steven Rostedt <[email protected]> Date: Tue May 27 17:02:04 2014 -0400
sched/numa: Fix use of spin_{un}lock_irq() when interrupts are disabled
As Peter Zijlstra told me, we have the following path:
do_exit()
exit_itimers()
itimer_delete()
spin_lock_irqsave(&timer->it_lock, &flags); timer_delete_hook(timer);
kc->timer_del(timer) := posix_cpu_timer_del()
put_task_struct()
__put_task_struct()
task_numa_free()
spin_lock(&grp->lock);
Which means that task_numa_free() can be called with interrupts disabled, which means that we should not be using spin_lock_irq() but spin_lock_irqsave() instead. Otherwise we are enabling interrupts while holding an interrupt unsafe lock!
commit 22c91aa23547a4363fd2a9ffddde95c899ac8aa0
Merge: fad01e8 082f96a
Author: Ingo Molnar <[email protected]>
Date: Thu Jun 5 09:52:41 2014 +0200
Merge tag 'perf-urgent-for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/jolsa/perf into perf/urgent
Pull perf/urgent fixes from Jiri Olsa:
* Fix perf probe to find correct variable DIE (Masami Hiramatsu)
* Fix a segfault in perf probe if asked for variable it doesn't find (Masami Hiramatsu)
commit 54539cd217d687d9acf385eab22ec02b3f7a86a0
Merge: c717d15 0c36b39
Author: Linus Torvalds <[email protected]>
Date: Wed Jun 4 09:56:03 2014 -0700
Merge branch 'for-3.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu
Pull percpu fix from Tejun Heo:
"It is very late but this is an important percpu-refcount fix from
Sebastian Ott.
The problem is that percpu_ref_*() used __this_cpu_*() instead of this_cpu_*(). The difference between the two is that the latter is atomic on the local cpu while the former is not. this_cpu_inc() is guaranteed to increment the percpu counter on the cpu that the operation is executed on without any synchronization; however, __this_cpu_inc() doesn't and if the local cpu invokes the function from different contexts (e.g. process and irq) of the same CPU, it's not guaranteed to actually increment as it may be implemented as rmw.
This bug existed from the get-go but it hasn't been noticed earlier probably because on x86 __this_cpu_inc() is equivalent to this_cpu_inc() as both get translated into single instruction; however, s390 uses the generic rmw implementation and gets affected by the bug. Kudos to Sebastian and Heiko for diagnosing it.
The change is very low risk and fixes a critical issue on the affected architectures, so I think it's a good candidate for inclusion although it's very late in the devel cycle. On the other hand, this has been broken since v3.11, so backporting it through -stable post -rc1 won't be the end of the world.
I'll ping Christoph whether __this_cpu_*() ops can be better annotated so that it can trigger lockdep warning when used from multiple contexts"
* 'for-3.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu:
percpu-refcount: fix usage of this_cpu_ops
commit 0c36b390a546055b6815d4b93a2c9fed4d980ffb
Author: Sebastian Ott <[email protected]> Date: Wed Jun 4 15:58:24 2014 +0200
percpu-refcount: fix usage of this_cpu_ops
The percpu-refcount infrastructure uses the underscore variants of this_cpu_ops in order to modify percpu reference counters. (e.g. __this_cpu_inc()).
However the underscore variants do not atomically update the percpu variable, instead they may be implemented using read-modify-write semantics (more than one instruction). Therefore it is only safe to use the underscore variant if the context is always the same (process, softirq, or hardirq). Otherwise it is possible to lose updates.
This problem is something that Sebastian has seen within the aio subsystem which uses percpu refcounters both in process and softirq context leading to reference counts that never dropped to zeroes; even though the number of "get" and "put" calls matched.
Fix this by using the non-underscore this_cpu_ops variant which provides correct per cpu atomic semantics and fixes the corrupted reference counts.
References: http://lkml.kernel.org/g/alpine.LFD.2.11.1406041540520.21183@denkbrett
commit c717d1561493c58d030405c7e30e35459db31912
Merge: 9e9a928 bf81022
Author: Linus Torvalds <[email protected]>
Date: Wed Jun 4 07:48:54 2014 -0700
Merge tag 'pm-3.15-final' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull intel pstate fixes from Rafael Wysocki:
"Final power management fixes for 3.15
- Taking non-idle time into account when calculating core busy time was a mistake and led to a performance regression. Since the problem it was supposed to address is now taken care of in a different way, we don't need to do it any more, so drop the non-idle time tracking from intel_pstate. Dirk Brandewie.
- Changing to fixed point math throughout the busy calculation introduced rounding errors that adversely affect the accuracy of intel_pstate's computations. Fix from Dirk Brandewie.
- The PID controller algorithm used by intel_pstate assumes that the time interval between two adjacent samples will always be the same which is not the case for deferable timers (used by intel_pstate) when the system is idle. This leads to inaccurate predictions and artificially increases convergence times for the minimum P-state. Fix from Dirk Brandewie.
- intel_pstate carries out computations using 32-bit variables that may overflow for large enough values of APERF/MPERF. Switch to using 64-bit variables for computations, from Doug Smythies"
* tag 'pm-3.15-final' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
intel_pstate: Improve initial busy calculation
intel_pstate: add sample time scaling
intel_pstate: Correct rounding in busy calculation
intel_pstate: Remove C0 tracking
commit 9e9a928eed8796a0a1aaed7e0b676db86ba84594
Merge: d2cfd31 0a4ae72
Author: Linus Torvalds <[email protected]>
Date: Wed Jun 4 07:48:01 2014 -0700
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
"All fairly small: radeon stability and a panic path fix.
Mostly radeon fixes, suspend/resume fix, stability on the CIK chipsets, along with a locking check avoidance patch for panic times regression"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/radeon: use the CP DMA on CIK
drm/radeon: sync page table updates
drm/radeon: fix vm buffer size estimation drm/crtc-helper: skip locking checks in panicking path drm/radeon/dpm: resume fixes for some systems
commit 082f96a93eb5ba9bf771518a0dda590624568e8e
Author: Masami Hiramatsu <[email protected]> Date: Thu May 29 21:19:30 2014 +0900
perf probe: Fix perf probe to find correct variable DIE
Fix perf probe to find correct variable DIE which has location or external instance by tracking down the lexical blocks.
Current die_find_variable() expects that the all variable DIEs which has DW_TAG_variable have a location. However, since recent dwarf information may have declaration variable DIEs at the entry of function (subprogram), die_find_variable() returns it.
To solve this problem, it must track down the DIE tree to find a DIE which has an actual location or a reference for external instance.
e.g. finding a DIE which origin is <0xdc73>;
<1><11496>: Abbrev Number: 95 (DW_TAG_subprogram)
<11497> DW_AT_abstract_origin: <0xdc42>
<1149b> DW_AT_low_pc : 0x1850
[...]
<2><114cc>: Abbrev Number: 119 (DW_TAG_variable) <- this is a declaration
<114cd> DW_AT_abstract_origin: <0xdc73>
<2><114d1>: Abbrev Number: 119 (DW_TAG_variable)
[...]
<3><115a7>: Abbrev Number: 105 (DW_TAG_lexical_block)
<115a8> DW_AT_ranges : 0xaa0
<4><115ac>: Abbrev Number: 96 (DW_TAG_variable) <- this has a location
<115ad> DW_AT_abstract_origin: <0xdc73>
<115b1> DW_AT_location : 0x486c (location list)
commit 0c188a07b6a399e3df66534c29fef0a2082aaf57
Author: Masami Hiramatsu <[email protected]> Date: Thu May 29 19:52:32 2014 +0900
perf probe: Fix a segfault if asked for variable it doesn't find
Fix a segfault bug by asking for variable it doesn't find. Since the convert_variable() didn't handle error code returned from convert_variable_location(), it just passed an incomplete variable field and then a segfault was occurred when formatting the field.
This fixes that bug by handling success code correctly in convert_variable(). Other callers of convert_variable_location() are correctly checking the return code.
This bug was introduced by following commit. But another hidden erroneous error handling has been there previously (-ENOMEM case).
commit 3d918a12a1b3088ac16ff37fa52760639d6e2403
commit ac2a55395eddccd6e3e39532df9869d61e97b2ee
Author: Yinghai Lu <[email protected]> Date: Tue May 13 11:39:34 2014 -0400
x86: irq: Get correct available vectors for cpu disable
check_irq_vectors_for_cpu_disable() can overestimate the number of available interrupt vectors, so the check for cpu down succeeds, but the actual cpu removal fails.
It iterates from FIRST_EXTERNAL_VECTOR to NR_VECTORS, which is wrong because the systems vectors are not taken into account.
Limit the search to first_system_vector instead of NR_VECTORS.
The second indicator for vector availability the used_vectors bitmap is not taken into account at all. So system vectors, e.g. IA32_SYSCALL_VECTOR (0x80) and IRQ_MOVE_CLEANUP_VECTOR (0x20), are accounted as available.
Add a check for the used_vectors bitmap and do not account vectors which are marked there.
[ tglx: Simplified code. Rewrote changelog and code comments. ]
commit 0a4ae727d6aa459247b027387edb6ff99f657792
Merge: ba6f582 91b0275
Author: Dave Airlie <[email protected]>
Date: Wed Jun 4 13:29:13 2014 +1000
Merge branch 'drm-fixes-3.15' of git://people.freedesktop.org/~deathsimple/linux into drm-fixes
The first one is a one liner fixing a stupid typo in the VM handling code and is only relevant if play with one of the VM defines.
The other two switches CIK to use the CPDMA instead of the SDMA for buffer moves, as it turned out the SDMA is still sometimes not 100% reliable.
* 'drm-fixes-3.15' of git://people.freedesktop.org/~deathsimple/linux:
drm/radeon: use the CP DMA on CIK
drm/radeon: sync page table updates
drm/radeon: fix vm buffer size estimation
commit 2363d196686e44c0158929e7cf96c8589a24a81b
Author: Nicholas Bellinger <[email protected]> Date: Tue Jun 3 18:27:52 2014 -0700
iser-target: Fix multi network portal shutdown regression
This patch fixes a iser-target specific regression introduced in v3.15-rc6 with:
commit 14f4b54fe38f3a8f8392a50b951c8aa43b63687a
Author: Sagi Grimberg <[email protected]>
Date: Tue Apr 29 13:13:47 2014 +0300
Target/iscsi,iser: Avoid accepting transport connections during stop stage
where the change to set iscsi_np->enabled = false within iscsit_clear_tpg_np_login_thread() meant that a iscsi_np with two iscsi_tpg_np exports would have it's parent iscsi_np set to a disabled state, even if other iscsi_tpg_np exports still existed.
This patch changes iscsit_clear_tpg_np_login_thread() to only set iscsi_np->enabled = false when shutdown = true, and also changes iscsit_del_np() to set iscsi_np->enabled = true when iscsi_np->np_exports is non zero.
commit 79d59d08082dd0a0a18f8ceb78c99f9f321d72aa
Author: Roland Dreier <[email protected]> Date: Thu May 29 13:32:30 2014 -0700
iscsi-target: Fix wrong buffer / buffer overrun in iscsi_change_param_value()
In non-leading connection login, iscsi_login_non_zero_tsih_s1() calls iscsi_change_param_value() with the buffer it uses to hold the login PDU, not a temporary buffer. This leads to the login header getting corrupted and login failing for non-leading connections in MC/S.
Fix this by adding a wrapper iscsi_change_param_sprintf() that handles the temporary buffer itself to avoid confusion. Also handle sending a reject in case of failure in the wrapper, which lets the calling code get quite a bit smaller and easier to read.
Finally, bump the size of the temporary buffer from 32 to 64 bytes to be safe, since "MaxRecvDataSegmentLength=" by itself is 25 bytes; with a trailing NUL, a value >= 1M will lead to a buffer overrun. (This isn't the default but we don't need to run right at the ragged edge here)
commit 6cc44a6fb46e1ecc1c28125aa8fa34d317aa9ea7
Author: Nicholas Bellinger <[email protected]> Date: Fri May 23 00:48:35 2014 -0700
iser-target: Add missing target_put_sess_cmd for ImmedateData failure
This patch addresses a bug where an early exception for SCSI WRITE with ImmediateData=Yes was missing the target_put_sess_cmd() call to drop the extra se_cmd->cmd_kref reference obtained during the normal iscsit_setup_scsi_cmd() codepath execution.
This bug was manifesting itself during session shutdown within isert_cq_rx_comp_err() where target_wait_for_sess_cmds() would end up waiting indefinately for the last se_cmd->cmd_kref put to occur for the failed SCSI WRITE + ImmediateData descriptors.
This fix follows what traditional iscsi-target code already does for the same failure case within iscsit_get_immediate_data().
commit d2cfd3105094f593bc1fbd0b042a7752ddf08691
Merge: c9482a5 192a98e
Author: Linus Torvalds <[email protected]>
Date: Tue Jun 3 12:07:30 2014 -0700
Merge tag 'sound-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A few addition of HD-audio fixups for ALC260 and AD1986A codecs. All
marked as stable fixes.
The fixes are pretty local and they are old machines, so quite safe to apply"
* tag 'sound-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hda/realtek - Fix COEF widget NID for ALC260 replacer fixup
ALSA: hda/realtek - Correction of fixup codes for PB V7900 laptop
ALSA: hda/analog - Fix silent output on ASUS A8JN
commit c9482a5bdcc09be9096f40e858c5fe39c389cd52
Author: Jianyu Zhan <[email protected]> Date: Sat Apr 26 15:40:28 2014 +0800
kernfs: move the last knowledge of sysfs out from kernfs
There is still one residue of sysfs remaining: the sb_magic SYSFS_MAGIC. However this should be kernfs user specific, so this patch moves it out. Kerrnfs user should specify their magic number while mouting.
commit cae61ba37b4c2672704cbd8a626fbd85be7e67d9
Merge: ca75517 418c96a
Author: Linus Torvalds <[email protected]>
Date: Mon Jun 2 18:16:41 2014 -0700
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:
1) Unbreak zebra and other netlink apps, from Eric W Biederman.
2) Some new qmi_wwan device IDs, from Aleksander Morgado.
3) Fix info leak in DCB netlink handler of qlcnic driver, from Dan Carpenter.
4) inet_getid() and ipv6_select_ident() do not generate monotonically increasing ID numbers, fix from Eric Dumazet.
5) Fix memory leak in __sk_prepare_filter(), from Leon Yu.
6) Netlink leftover bytes warning message is user triggerable, rate limit it. From Michal Schmidt.
7) Fix non-linear SKB panic in ipvs, from Peter Christensen.
8) Congestion window undo needs to be performed even if only never retransmitted data is SACK'd, fix from Yuching Cheng.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (24 commits)
net: filter: fix possible memory leak in __sk_prepare_filter()
net: ec_bhf: Add runtime dependencies
tcp: fix cwnd undo on DSACK in F-RTO
netlink: Only check file credentials for implicit destinations
ipheth: Add support for iPad 2 and iPad 3
team: fix mtu setting
net: fix inet_getid() and ipv6_select_ident() bugs
net: qmi_wwan: interface #11 in Sierra Wireless MC73xx is not QMI
net: qmi_wwan: add additional Sierra Wireless QMI devices
bridge: Prevent insertion of FDB entry with disallowed vlan
netlink: rate-limit leftover bytes warning and print process name
bridge: notify user space after fdb update
net: qmi_wwan: add Netgear AirCard 341U
net: fix wrong mac_len calculation for vlans
batman-adv: fix NULL pointer dereferences
net/mlx4_core: Reset RoCE VF gids when guest driver goes down
emac: aggregation of v1-2 PLB errors for IER register
emac: add missing support of 10mbit in emac/rgmii
can: only rename enabled led triggers when changing the netdev name
ipvs: Fix panic due to non-linear skb
...
commit 418c96ac151a16a5094a95d14252c92c1d47ec67
Author: Leon Yu <[email protected]> Date: Sun Jun 1 05:37:25 2014 +0000
net: filter: fix possible memory leak in __sk_prepare_filter()
__sk_prepare_filter() was reworked in commit bd4cf0ed3 (net: filter:
rework/optimize internal BPF interpreter's instruction set) so that it should have uncharged memory once things went wrong. However that work isn't complete. Error is handled only in __sk_migrate_filter() while memory can still leak in the error path right after sk_chk_filter().
commit ca755175f245b91f72cfa474aaa8acd9c26996f4
Merge: 3b8d267 2ac295a
Author: Linus Torvalds <[email protected]>
Date: Mon Jun 2 17:04:37 2014 -0700
Merge tag 'md/3.15-fixes' of git://neil.brown.name/md
Pull two md bugfixes from Neil Brown:
"Two md bugfixes for possible corruption when restarting reshape
If a raid5/6 reshape is restarted (After stopping and re-assembling the array) and the array is marked read-only (or read-auto), then the reshape will appear to complete immediately, without actually moving anything around. This can result in corruption.
There are two patches which do much the same thing in different places. They are separate because one is an older bug and so can be applied to more -stable kernels"
* tag 'md/3.15-fixes' of git://neil.brown.name/md:
md: always set MD_RECOVERY_INTR when interrupting a reshape thread.
md: always set MD_RECOVERY_INTR when aborting a reshape or other "resync".
commit 3aab01d800eb195de3f273d9a195fe070a507d56
Author: Jean Delvare <[email protected]> Date: Sat May 31 17:32:27 2014 +0200
net: ec_bhf: Add runtime dependencies
The ec_bhf driver is specific to the Beckhoff CX embedded PC series. These are based on Intel x86 CPU. So we can add a dependency on X86, with COMPILE_TEST as an alternative to still allow for broader build-testing.
commit 3b8d2676d15d6b2326757adb66b70a9cd6650373
Author: Martin K. Petersen <[email protected]> Date: Mon Jun 2 19:57:16 2014 -0400
libata: Blacklist queued trim for Crucial M500
Queued trim only works for some users with MU05 firmware. Revert to blacklisting all firmware versions.
Introduced by commit d121f7d0cbb8 ("libata: Update queued trim blacklist for M5x0 drives") which this effectively reverts, while retaining the blacklisting of M550.
See
https://bugzilla.kernel.org/show_bug.cgi?id=71371
for reports of trouble with MU05 firmware.
commit 92b4e113155f9c8de9ef71ecdf55d796b68e7318
Merge: 8ee7a33 368b69a
Author: Linus Torvalds <[email protected]>
Date: Mon Jun 2 16:57:23 2014 -0700
Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fix from Peter Anvin:
"A single quite small patch that managed to get overlooked earlier, to
prevent a user space triggerable oops on systems without HPET"
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86, vdso: Fix an OOPS accessing the HPET mapping w/o an HPET
commit 8ee7a330fbb78344802cc6c3cc8be023b6d05aa0
Merge: da579dd 5dc2808
Author: Linus Torvalds <[email protected]>
Date: Mon Jun 2 16:56:42 2014 -0700
Merge tag 'usb-3.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB fixes from Greg KH:
"Here are some fixes for 3.15-rc8 that resolve a number of tiny USB
issues that have been reported, and there are some new device ids as well.
All have been tested in linux-next"
* tag 'usb-3.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
xhci: delete endpoints from bandwidth list before freeing whole device
usb: pci-quirks: Prevent Sony VAIO t-series from switching usb ports
USB: cdc-wdm: properly include types.h
usb: cdc-wdm: export cdc-wdm uapi header
USB: serial: option: add support for Novatel E371 PCIe card
USB: ftdi_sio: add NovaTech OrionLXm product ID
USB: io_ti: fix firmware download on big-endian machines (part 2)
USB: Avoid runtime suspend loops for HCDs that can't handle suspend/resume
commit da579dd6a180693368ade74b3ac38701d35f686e
Merge: fad01e8 9326c5c
Author: Linus Torvalds <[email protected]>
Date: Mon Jun 2 16:55:18 2014 -0700
Merge tag 'staging-3.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver fixes from Greg KH:
"Here are some staging driver fixes for 3.15.
Three are for the speakup drivers (one fixes a regression caused in 3.15-rc, and the other two resolve a tty issue found by Ben Hutchings) The comedi and r8192e_pci driver fixes also resolve reported issues"
* tag 'staging-3.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging: r8192e_pci: fix htons error
Staging: speakup: Update __speakup_paste_selection() tty (ab)usage to match vt
Staging: speakup: Move pasting into a work item
staging: comedi: ni_daq_700: add mux settling delay
speakup: fix incorrect perms on speakup_acntsa.c
commit 0cfa5c07d6d1d7f8e710fc671c5ba1ce85e09fa4
Author: Yuchung Cheng <[email protected]> Date: Fri May 30 15:25:59 2014 -0700
tcp: fix cwnd undo on DSACK in F-RTO
This bug is discovered by an recent F-RTO issue on tcpm list
https://www.ietf.org/mail-archive/web/tcpm/current/msg08794.html
The bug is that currently F-RTO does not use DSACK to undo cwnd in certain cases: upon receiving an ACK after the RTO retransmission in F-RTO, and the ACK has DSACK indicating the retransmission is spurious, the sender only calls tcp_try_undo_loss() if some never retransmisted data is sacked (FLAG_ORIG_DATA_SACKED).
The correct behavior is to unconditionally call tcp_try_undo_loss so the DSACK information is used properly to undo the cwnd reduction.
commit 2d7a85f4b06e9c27ff629f07a524c48074f07f81
Author: Eric W. Biederman <[email protected]> Date: Fri May 30 11:04:00 2014 -0700
netlink: Only check file credentials for implicit destinations
It was possible to get a setuid root or setcap executable to write to it's stdout or stderr (which has been set made a netlink socket) and inadvertently reconfigure the networking stack.
To prevent this we check that both the creator of the socket and the currentl applications has permission to reconfigure the network stack.
Unfortunately this breaks Zebra which always uses sendto/sendmsg and creates it's socket without any privileges.
To keep Zebra working don't bother checking if the creator of the socket has privilege when a destination address is specified. Instead rely exclusively on the privileges of the sender of the socket.
Note from Andy: This is exactly Eric's code except for some comment clarifications and formatting fixes. Neither I nor, I think, anyone else is thrilled with this approach, but I'm hesitant to wait on a better fix since 3.15 is almost here.
Note to stable maintainers: This is a mess. An earlier series of patches in 3.15 fix a rather serious security issue (CVE-2014-0181), but they did so in a way that breaks Zebra. The offending series includes:
commit aa4cf9452f469f16cea8c96283b641b4576d4a7b
Author: Eric W. Biederman <[email protected]>
Date: Wed Apr 23 14:28:03 2014 -0700
net: Add variants of capable for use on netlink messages
If a given kernel version is missing that series of fixes, it's probably worth backporting it and this patch. if that series is present, then this fix is critical if you care about Zebra.
commit 22fd2a52f715550930938fc79140defc098287d6
Author: Kristian Evensen <[email protected]> Date: Fri May 30 12:17:00 2014 +0200
ipheth: Add support for iPad 2 and iPad 3
Each iPad model has a different product id, this patch adds support for iPad 2 (pid 0x12a2) and iPad 3 (pid 0x12a6). Note that iPad 2 must be jailbroken and a third-party app must be used for tethering to work. On iPad 3, tethering works out of the box (assuming your ISP is nice).
commit 9d0d68faea6962d62dd501cd6e71ce5cc8ed262b
Author: Jiri Pirko <[email protected]> Date: Thu May 29 20:46:17 2014 +0200
team: fix mtu setting
Now it is not possible to set mtu to team device which has a port enslaved to it. The reason is that when team_change_mtu() calls dev_set_mtu() for port device, notificator for NETDEV_PRECHANGEMTU event is called and team_device_event() returns NOTIFY_BAD forbidding the change. So fix this by returning NOTIFY_DONE here in case team is changing mtu in team_change_mtu().
commit 39c36094d78c39e038c1e499b2364e13bce36f54
Author: Eric Dumazet <[email protected]> Date: Thu May 29 08:45:14 2014 -0700
net: fix inet_getid() and ipv6_select_ident() bugs
I noticed we were sending wrong IPv4 ID in TCP flows when MTU discovery is disabled.
Note how GSO/TSO packets do not have monotonically incrementing ID.
06:37:41.575531 IP (id 14227, proto: TCP (6), length: 4396) 06:37:41.575534 IP (id 14272, proto: TCP (6), length: 65212) 06:37:41.575544 IP (id 14312, proto: TCP (6), length: 57972) 06:37:41.575678 IP (id 14317, proto: TCP (6), length: 7292) 06:37:41.575683 IP (id 14361, proto: TCP (6), length: 63764)
It appears I introduced this bug in linux-3.1.
inet_getid() must return the old value of peer->ip_id_count, not the new one.
Lets revert this part, and remove the prevention of a null identification field in IPv6 Fragment Extension Header, which is dubious and not even done properly.
commit fc0d6e9cd0aefbe5de5ebafb1805f2c59539725b
Author: Aleksander Morgado <[email protected]> Date: Thu May 29 13:51:36 2014 +0200
net: qmi_wwan: interface #11 in Sierra Wireless MC73xx is not QMI
This interface is unusable, as the cdc-wdm character device doesn't reply to any QMI command. Also, the out-of-tree Sierra Wireless GobiNet driver fully skips it.
commit 9a793e71ebd6fc4a2649f33811589a9c4fe7f4e8
Author: Aleksander Morgado <[email protected]> Date: Thu May 29 13:44:45 2014 +0200
net: qmi_wwan: add additional Sierra Wireless QMI devices
A set of new VID/PIDs retrieved from the out-of-tree GobiNet/GobiSerial Sierra Wireless drivers.
commit e0d7968ab6c8bce2437b36fa7f04117e333f196d
Author: Toshiaki Makita <[email protected]> Date: Mon May 26 15:15:53 2014 +0900
bridge: Prevent insertion of FDB entry with disallowed vlan
br_handle_local_finish() is allowing us to insert an FDB entry with disallowed vlan. For example, when port 1 and 2 are communicating in vlan 10, and even if vlan 10 is disallowed on port 3, port 3 can interfere with their communication by spoofed src mac address with vlan id 10.
Note: Even if it is judged that a frame should not be learned, it should not be dropped because it is destined for not forwarding layer but higher layer. See IEEE 802.1Q-2011 8.13.10.
commit bfc5184b69cf9eeb286137640351c650c27f118a
Author: Michal Schmidt <[email protected]> Date: Mon Jun 2 18:25:02 2014 +0200
netlink: rate-limit leftover bytes warning and print process name
Any process is able to send netlink messages with leftover bytes. Make the warning rate-limited to prevent too much log spam.
The warning is supposed to help find userspace bugs, so print the triggering command name to implicate the buggy program.
[v2: Use pr_warn_ratelimited instead of printk_ratelimited.]
commit 192a98e280e560510a62aca8cfa83b4ae7c095bb
Author: Takashi Iwai <[email protected]> Date: Mon Jun 2 15:16:07 2014 +0200
ALSA: hda/realtek - Fix COEF widget NID for ALC260 replacer fixup
The conversion to a fixup table for Replacer model with ALC260 in commit 20f7d928 took the wrong widget NID for COEF setups. Namely, NID 0x1a should have been used instead of NID 0x20, which is the common node for all Realtek codecs but ALC260.
commit e30cf2d2bed3aed74a651c64de323ba26e4ff7d0
Author: Ronan Marquet <[email protected]> Date: Sun Jun 1 18:38:53 2014 +0200
ALSA: hda/realtek - Correction of fixup codes for PB V7900 laptop
Correcion of wrong fixup entries add in commit ca8f0424 to replace static model quirk for PB V7900 laptop (will model).
[note: the removal of ALC260_FIXUP_HP_PIN_0F chain is also needed as a
part of the fix; otherwise the pin is set up wrongly as a headphone, and user-space (PulseAudio) may be wrongly trying to detect the jack state -- tiwai]
commit a3530e8fe980f756b823d451fe9243f26db95fa5
Author: Dave Young <[email protected]> Date: Fri May 30 11:20:10 2014 +0800
x86/efi: Do not export efi runtime map in case old map
For ioremapped efi memory aka old_map the virt addresses are not persistant across kexec reboot. kexec-tools will read the runtime maps from sysfs then pass them to 2nd kernel and assuming kexec efi boot is ok. This will cause kexec boot failure.
To address this issue do not export runtime maps in case efi old_map so userspace can use no efi boot instead.
commit bf8102228a8bf053051f311e5486042fe0542894
Author: Doug Smythies <[email protected]> Date: Fri May 30 10:10:57 2014 -0700
intel_pstate: Improve initial busy calculation
This change makes the busy calculation using 64 bit math which prevents overflow for large values of aperf/mperf.
commit c4ee841f602e5eef8eab673295c49c5b49d7732b
Author: Dirk Brandewie <[email protected]> Date: Thu May 29 09:32:24 2014 -0700
intel_pstate: add sample time scaling
The PID assumes that samples are of equal time, which for a deferable timers this is not true when the system goes idle. This causes the PID to take a long time to converge to the min P state and depending on the pattern of the idle load can make the P state appear stuck.
The hold-off value of three sample times before using the scaling is to give a grace period for applications that have high performance requirements and spend a lot of time idle, The poster child for this behavior is the ffmpeg benchmark in the Phoronix test suite.
commit f0fe3cd7e12d8290c82284b5c8aee723cbd0371a
Author: Dirk Brandewie <[email protected]> Date: Thu May 29 09:32:23 2014 -0700
intel_pstate: Correct rounding in busy calculation
Changing to fixed point math throughout the busy calculation in commit e66c1768 (Change busy calculation to use fixed point math.) Introduced some inaccuracies by rounding the busy value at two points in the calculation. This change removes roundings and moves the rounding to the output of the PID where the calculations are complete and the value returned as an integer.
commit adacdf3f2b8e65aa441613cf61c4f598e9042690
Author: Dirk Brandewie <[email protected]> Date: Thu May 29 09:32:22 2014 -0700
intel_pstate: Remove C0 tracking
Commit fcb6a15c (intel_pstate: Take core C0 time into account for core busy calculation) introduced a regression referenced below. The issue with "lockup" after suspend that this commit was addressing is now dealt with in the suspend path.
commit 91b0275c0ecd1870c5f8bfb73e2da2d6c29414b3
Author: Christian König <[email protected]> Date: Fri May 30 17:52:27 2014 +0200
drm/radeon: use the CP DMA on CIK
The SDMA sometimes doesn't seem to work reliable.
commit 37903b5e08ec9a481a811287b4db3dfe61f6e31f
Author: Christian König <[email protected]> Date: Fri May 30 15:21:16 2014 +0200
drm/radeon: sync page table updates
Only necessary if we don't use the same engine for buffer moves and table updates.
commit 2f93dc32b09a2c97f6f33bafe4c6bdcec7cae774
Author: Christian König <[email protected]> Date: Sat May 31 20:38:34 2014 +0200
drm/radeon: fix vm buffer size estimation
Only relevant if we got VM_BLOCK_SIZE>9, but better save than sorry.
commit c65c7a306610ee7c13669a8f5601b472c19dc6f1
Author: Jon Maxwell <[email protected]> Date: Thu May 29 17:27:16 2014 +1000
bridge: notify user space after fdb update
There has been a number incidents recently where customers running KVM have reported that VM hosts on different Hypervisors are unreachable. Based on pcap traces we found that the bridge was broadcasting the ARP request out onto the network. However some NICs have an inbuilt switch which on occasions were broadcasting the VMs ARP request back through the physical NIC on the Hypervisor. This resulted in the bridge changing ports and incorrectly learning that the VMs mac address was external. As a result the ARP reply was directed back onto the external network and VM never updated it's ARP cache. This patch will notify the bridge command, after a fdb has been updated to identify such port toggling.
commit ba6f582606655754d9dfbfc9dffe75dcf806f1dd
Author: Sergei Antonov <[email protected]> Date: Mon May 12 00:30:48 2014 +0200
drm/crtc-helper: skip locking checks in panicking path
Skip locking checks in drm_helper_*_in_use() if they are called in panicking path. See similar code in drm_warn_on_modeset_not_all_locked().
After panic information has been output, these WARN_ONs go off outputing a lot of lines and scrolling the panic information out of the screen. Here is a partial call trace showing how execution reaches them:
? drm_helper_crtc_in_use()
? __drm_helper_disable_unused_functions()
? several *_set_config functions
? drm_fb_helper_restore_fbdev_mode()
commit 3640da2faa952a2e9439a254c1ce76033ca0a6dc
Author: Alex Deucher <[email protected]> Date: Fri May 30 12:40:15 2014 -0400
drm/radeon/dpm: resume fixes for some systems
Setting the power state prior to restoring the display hardware leads to blank screens on some systems. Drop the power state set from dpm resume. The power state will get set as part of the mode set sequence. Also add an explicit power state set after mode set resume to cover PX and headless systems.
bug:
https://bugzilla.kernel.org/show_bug.cgi?id=76761
commit 4324be1e0bab67194a263be263b7e48c176d43c7
Author: Aleksander Morgado <[email protected]> Date: Wed May 28 21:05:03 2014 +0200
net: qmi_wwan: add Netgear AirCard 341U
commit 4b9b1cdf83c4facba89e0646aeac8ead679851b8
Author: Nikolay Aleksandrov <[email protected]> Date: Wed May 28 18:03:48 2014 +0200
net: fix wrong mac_len calculation for vlans
After 1e785f48d29a ("net: Start with correct mac_len in skb_network_protocol") skb->mac_len is used as a start of the calculation in skb_network_protocol() but that is not always correct. If skb->protocol == 8021Q/AD, usually the vlan header is already inserted in the skb (i.e. vlan reorder hdr == 0). Usually when the packet enters dev_hard_xmit it has mac_len == 0 so we take 2 bytes from the destination mac address (skb->data + VLAN_HLEN) as a type in skb_network_protocol() and return vlan_depth == 4. In the case where TSO is off, then the mac_len is set but it's == 18 (ETH_HLEN + VLAN_HLEN), so skb_network_protocol() returns a type from inside the packet and offset == 22. Also make vlan_depth unsigned as suggested before. As suggested by Eric Dumazet, move the while() loop in the if() so we can avoid additional testing in fast path.
Here are few netperf tests + debug printk's to illustrate:
cat netperf.tso-on.reorder-on.bugged
- Vlan -> device (reorder on, default, this case is okay) MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 192.168.3.1 () port 0 AF_INET
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
87380 16384 16384 10.00 7111.54
[ 81.605435] skb->len 65226 skb->gso_size 1448 skb->proto 0x800
skb->mac_len 0 vlan_depth 0 type 0x800
- Vlan -> device (reorder off, bad)
cat netperf.tso-on.reorder-off.bugged
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 192.168.3.1 () port 0 AF_INET
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
87380 16384 16384 10.00 241.35
[ 204.578332] skb->len 1518 skb->gso_size 0 skb->proto 0x8100 skb->mac_len 0 vlan_depth 4 type 0x5301
0x5301 are the last two bytes of the destination mac.
And if we stop TSO, we may get even the following:
[ 83.343156] skb->len 2966 skb->gso_size 1448 skb->proto 0x8100
skb->mac_len 18 vlan_depth 22 type 0xb84 Because mac_len already accounts for VLAN_HLEN.
After the fix:
cat netperf.tso-on.reorder-off.fixed
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 192.168.3.1 () port 0 AF_INET
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
87380 16384 16384 10.01 5001.46
[ 81.888489] skb->len 65230 skb->gso_size 1448 skb->proto 0x8100
skb->mac_len 0 vlan_depth 18 type 0x800
skb_network_protocol")
commit fad01e866afdbe01a1f3ec06a39c3a8b9e197014
Author: Linus Torvalds <[email protected]> Date: Sun Jun 1 19:12:24 2014 -0700
Linux 3.15-rc8
commit 204fe0380b14557a3179cf18f1101d4ed6532172
Merge: 568180a 8212f58
Author: Linus Torvalds <[email protected]>
Date: Sun Jun 1 18:30:07 2014 -0700
Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
Pull powerpc fix from Ben Herrenschmidt:
"Here's just one trivial patch to wire up sys_renameat2 which I seem to
have completely missed so far.
(My test build scripts fwd me warnings but miss the ones generated for missing syscalls)"
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc: Wire renameat2() syscall
commit 568180a517aee88a8afdc9938f6884e047a2613f
Merge: 3243970 f3f0d95
Author: Linus Torvalds <[email protected]>
Date: Sun Jun 1 18:28:58 2014 -0700
Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus
Pull MIPS fixes from Ralf Baechle:
"A fair number of fixes across the field. Nothing terribly
complicated; the one liners in below changelog should be fairly descriptive.
Noteworthy is the SB1 change which the result of changes to binutils resulting in one big gas warning for most files being assembled as well as the asid_cache and branch emulation fixes which fix corruption or possible uninteded behaviour of kernel or application code. The remainder of fixes are more platforms or subsystem specific"
* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
MIPS: R46000: Fix Micro-assembler field overflow for R4600 V2
MIPS: ptrace: Avoid smp_processor_id() in preemptible code
MIPS: Lemote 2F: cs5536: mfgpt: use raw locks
MIPS: SB1: Fix excessive kernel warnings.
MIPS: RC32434: fix broken PCI resource initialization
MIPS: malta: memory.c: Initialize the 'memsize' variable
MIPS: Fix typo when reporting cache and ftlb errors for ImgTec cores
MIPS: Fix inconsistancy of __NR_Linux_syscalls value
MIPS: Fix branch emulation of branch likely instructions.
MIPS: Fix a typo error in AUDIT_ARCH definition
MIPS: Change type of asid_cache to unsigned long
commit 32439700fe1c0fc3c2d3f2aedd3ad6707c88b8ba
Merge: a4bf79e 6acbfb9
Author: Linus Torvalds <[email protected]>
Date: Sun Jun 1 18:26:59 2014 -0700
Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
"Various fixlets, mostly related to the (root-only) SCHED_DEADLINE
policy, but also a hotplug bug fix and a fix for a NR_CPUS related overallocation bug causing a suspend/resume regression"
* 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched: Fix hotplug vs. set_cpus_allowed_ptr()
sched/cpupri: Replace NR_CPUS arrays
sched/deadline: Replace NR_CPUS arrays
sched/deadline: Restrict user params max value to 2^63 ns sched/deadline: Change sched_getparam() behaviour vs SCHED_DEADLINE
sched: Disallow sched_attr::sched_policy < 0
sched: Make sched_setattr() correctly return -EFBIG
commit 8212f58a9b151d842fa60a70f354e43c61fad839
Author: Benjamin Herrenschmidt <[email protected]> Date: Mon Jun 2 09:24:27 2014 +1000
powerpc: Wire renameat2() syscall
commit 6ce995c6f466e59a5f16e6eae8b265c1d13bb202
Merge: dbfc4b6 af0a171
Author: David S. Miller <[email protected]>
Date: Sat May 31 20:01:47 2014 -0700
Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge
Included changes:
- prevent NULL dereference in multicast code
Antonion Quartulli says:
====================
pull request net: batman-adv 20140527
here you have another very small fix intended for net/linux-3.15. It prevents some multicast functions from dereferencing a NULL pointer. (Actually it was nothing more than a typo)
I hope it is not too late for such a small patch.
====================
commit a4bf79eb6a42e863e0fccf19f9383c618e8efc43
Merge: 80e0679 397335f
Author: Linus Torvalds <[email protected]>
Date: Sat May 31 09:47:55 2014 -0700
Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull core futex/rtmutex fixes from Thomas Gleixner:
"Three fixlets for long standing issues in the futex/rtmutex code
unearthed by Dave Jones syscall fuzzer:
- Add missing early deadlock detection checks in the futex code
- Prevent user space from attaching a futex to kernel threads
- Make the deadlock detector of rtmutex work again
Looks large, but is more comments than code change"
* 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
rtmutex: Fix deadlock detector for real
futex: Prevent attaching to kernel threads
futex: Add another early deadlock detection check
commit 80e0679469a481ab8baa4fe982205f99004a0686
Merge: 9f12600 18ee37a
Author: Linus Torvalds <[email protected]>
Date: Sat May 31 09:19:02 2014 -0700
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
"Mostly quiet now:
i915:
fixing userspace visiblie issues, all stable marked
radeon:
one more pll fix, two crashers, one suspend/resume regression"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/radeon: Resume fbcon last
drm/radeon: only allocate necessary size for vm bo list drm/radeon: don't allow RADEON_GEM_DOMAIN_CPU for command submission drm/radeon: avoid crash if VM command submission isn't available drm/radeon: lower the ref * post PLL maximum once more drm/i915: Prevent negative relocation deltas from wrapping drm/i915: Only copy back the modified fields to userspace from execbuffer drm/i915: Fix dynamic allocation of physical handles
commit 9f12600fe425bc28f0ccba034a77783c09c15af4
Author: Linus Torvalds <[email protected]> Date: Sat May 31 09:13:21 2014 -0700
dcache: add missing lockdep annotation
lock_parent() very much on purpose does nested locking of dentries, and is careful to maintain the right order (lock parent first). But because it didn't annotate the nested locking order, lockdep thought it might be a deadlock on d_lock, and complained.
Add the proper annotation for the inner locking of the child dentry to make lockdep happy.
Introduced by commit 046b961b45f9 ("shrink_dentry_list(): take parent's ->d_lock earlier").
commit af0a171c07174661db71f92e442d4e6e90984b77
Author: Marek Lindner <[email protected]> Date: Thu Apr 24 03:41:26 2014 +0800
batman-adv: fix NULL pointer dereferences
Was introduced with 4c8755d69cbde2ec464a39c932aed0a83f9ff89f ("batman-adv: Send multicast packets to nodes with a WANT_ALL flag")
commit dbfc4b698ab83494eb8a03f5f3c478cec29a4f62
Merge: 554215c f44a5f4
Author: David S. Miller <[email protected]>
Date: Fri May 30 17:56:09 2014 -0700
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
Pablo Neira Ayuso says:
====================
The following patchset contains a late fix for IPVS:
* Fix crash when trying to remove the transport header with non-linear skbuffs, this was introduced in 3.6-rc. Patch from Peter Christensen via the IPVS folks.
I'll pass this to -stable once this hits mainstream.
====================
commit 554215c5ca08d196ed48a66693e7fc6e5f81f00e
Merge: 111c609 45fb4f8
Author: David S. Miller <[email protected]>
Date: Fri May 30 17:32:53 2014 -0700
Merge tag 'linux-can-fixes-for-3.15-20140528' of git://gitorious.org/linux-can/linux-can
Marc Kleine-Budde says:
====================
pull-request: can 2014-05-28
here's a pull request for v3.15, hope it's not too late.
Oliver Hartkopp fixed a bug in the CAN led trigger device renaming code.
====================
commit 111c6094bd7731cb1a415b2ea7d450fa23d6857c
Author: Jack Morgenstein <[email protected]> Date: Tue May 27 09:26:38 2014 +0300
net/mlx4_core: Reset RoCE VF gids when guest driver goes down
Reset the GIDs assigned to a VF in the port RoCE GID table when that guest goes down (either crashes or goes down cleanly).
As part of this fix, we refactor the RoCE gid table driver copy, moving it to the mlx4_port_info structure (together with the MAC and VLAN tables).
As with the MAC and VLAN tables, we now use a mutex per port for the GID table so that modifying the driver copy and modifying the firmware copy of a port GID table becomes an atomic operation (thus avoiding driver-copy/FW-copy mismatches).
commit 09271db6e0f2b282f9bfe0ab6e8b644a93237c5e
Author: Ivan Mikhaylov <[email protected]> Date: Mon May 26 22:34:39 2014 +0400
emac: aggregation of v1-2 PLB errors for IER register
Aggreagation of version 1-2 because of version 1 can hit PLB errors too. If it's not set so we missing events for PLB bits and driver can't process those interrupts.
commit faacd3af0cf4a3ef5565da86038812a25f6fe9eb
Author: Ivan Mikhaylov <[email protected]> Date: Mon May 26 22:24:17 2014 +0400
emac: add missing support of 10mbit in emac/rgmii
In chips of emac/rgmii b'000' for 0/1 channel isn't suitable which resulted in non working network interface in this mode.
commit 18ee37a485653aa635cfab9a3710e9bcf5fbca01
Author: Daniel Vetter <[email protected]> Date: Fri May 30 16:41:23 2014 +0200
drm/radeon: Resume fbcon last
So a few people complained that
commit 177cf92de4aa97ec1435987e91696ed8b5023130
Author: Daniel Vetter <[email protected]>
Date: Tue Apr 1 22:14:59 2014 +0200
drm/crtc-helpers: fix dpms on logic
which was merged into 3.15-rc1, broke resume on radeons. Strangely git bisect lead everyone to
commit 25f397a429dfa43f22c278d0119a60a343aa568f
Author: Daniel Vetter <[email protected]>
Date: Fri Jul 19 18:57:11 2013 +0200
drm/crtc-helper: explicit DPMS on after modeset
which was merged long ago and actually part of 3.14.
Digging deeper I've noticed (again) that the call to drm_helper_resume_force_mode in the radeon resume handlers was a no-op previously because everything gets shut down on suspend. radeon does this with explicit calls to drm_helper_connector_dpms with DPMS_OFF. But with 177c we now force the dpms state to ON, so suddenly resume_force_mode actually forced the crtcs back on.
This is the intention of the change after all, the problem is that radeon resumes the fbdev console layer _before_ restoring the display, through calling fb_set_suspend. And fbcon does an immediate ->set_par, which in turn causes the same forced mode restore to happen.
Two concurrent modeset operations didn't lead to happiness. Fix this by delaying the fbcon resume until the end of the readeon resum functions.
v2: Fix up a bit of the spelling fail.
References: https://lkml.org/lkml/2014/5/29/1043
References: https://lkml.org/lkml/2014/5/2/388
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=74751
commit 1446e04c9b9b7d27437a5fefee37d9984afcd560
Merge: efb27e7 7d95f6c
Author: Dave Airlie <[email protected]>
Date: Sat May 31 09:19:05 2014 +1000
Merge branch 'drm-fixes-3.15' of git://people.freedesktop.org/~deathsimple/linux into drm-fixes
this is the next pull request for stashed up radeon fixes for 3.15. This is finally calming down with only four patches in this pull request.
* 'drm-fixes-3.15' of git://people.freedesktop.org/~deathsimple/linux:
drm/radeon: only allocate necessary size for vm bo list drm/radeon: don't allow RADEON_GEM_DOMAIN_CPU for command submission drm/radeon: avoid crash if VM command submission isn't available drm/radeon: lower the ref * post PLL maximum once more
commit 1487385edb55a68a629cf3a30fc04958ad798df1
Merge: 1326af2 0f68f39
Author: Linus Torvalds <[email protected]>
Date: Fri May 30 12:07:48 2014 -0700
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input subsystem fixes from Dmitry Torokhov:
"A couple of driver/build fixups and also redone quirk for Synaptics
touchpads on Lenovo boxes (now using PNP IDs instead of DMI data to limit number of quirks)"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: synaptics - change min/max quirk table to pnp-id matching
Input: synaptics - add a matches_pnp_id helper function
Input: synaptics - T540p - unify with other LEN0034 models
Input: synaptics - add min/max quirk for the ThinkPad W540
Input: ambakmi - request a shared interrupt for AMBA KMI devices
Input: pxa27x-keypad - fix generating scancode
Input: atmel-wm97xx - only build for AVR32
Input: fix ps2/serio module dependency
commit 1326af2464fc29290d1710447297d33a90a6ece4
Merge: 24e19d2 2fe2023
Author: Linus Torvalds <[email protected]>
Date: Fri May 30 12:06:15 2014 -0700
Merge tag 'firewire-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394
Pull firewire fix from Stefan Richter:
"A regression fix for the IEEE 1394 subsystem: re-enable IRQ-based
asynchronous request reception at addresses below 128 TB"
* tag 'firewire-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
firewire: revert to 4 GB RDMA, fix protocols using Memory Space
commit 24e19d279f9e289e965b4bc4710fbccab824c4c4
Merge: 6538b8e 63d832c
Author: Linus Torvalds <[email protected]>
Date: Fri May 30 12:04:56 2014 -0700
Merge tag 'dm-3.15-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
Pull device-mapper fixes from Mike Snitzer:
"A dm-cache stable fix to split discards on cache block boundaries
because dm-cache cannot yet handle discards that span cache blocks.
Really fix a dm-mpath LOCKDEP warning that was introduced in -rc1.
Add a 'no_space_timeout' control to dm-thinp to restore the ability to queue IO indefinitely when no data space is available. This fixes a change in behavior that was introduced in -rc6 where the timeout couldn't be disabled"
* tag 'dm-3.15-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
dm mpath: really fix lockdep warning
dm cache: always split discards on cache block boundaries
dm thin: add 'no_space_timeout' dm-thin-pool module param
commit 6538b8ea886e472f4431db8ca1d60478f838d14b
Author: Minchan Kim <[email protected]> Date: Wed May 28 15:53:59 2014 +0900
x86_64: expand kernel stack to 16K
While I play inhouse patches with much memory pressure on qemu-kvm, 3.14 kernel was randomly crashed. The reason was kernel stack overflow.
When I investigated the problem, the callstack was a little bit deeper by involve with reclaim functions but not direct reclaim path.
I tried to diet stack size of some functions related with alloc/reclaim so did a hundred of byte but overflow was't disappeard so that I encounter overflow by another deeper callstack on reclaim/allocator path.
Of course, we might sweep every sites we have found for reducing stack usage but I'm not sure how long it saves the world(surely, lots of developer start to add nice features which will use stack agains) and if we consider another more complex feature in I/O layer and/or reclaim path, it might be better to increase stack size( meanwhile, stack usage on 64bit machine was doubled compared to 32bit while it have sticked to 8K. Hmm, it's not a fair to me and arm64 already expaned to 16K. )
So, my stupid idea is just let's expand stack size and keep an eye toward stack consumption on each kernel functions via stacktrace of ftrace. For example, we can have a bar like that each funcion shouldn't exceed 200K and emit the warning when some function consumes more in runtime. Of course, it could make false positive but at least, it could make a chance to think over it.
I guess this topic was discussed several time so there might be strong reason not to increase kernel stack size on x86_64, for me not knowing so Ccing x86_64 maintainers, other MM guys and virtio maintainers.
Here's an example call trace using up the kernel stack:
Depth Size Location (51 entries)
----- ---- --------
0) 7696 16 lookup_address
1) 7680 16 _lookup_address_cpa.isra.3
2) 7664 24 __change_page_attr_set_clr
3) 7640 392 kernel_map_pages
4) 7248 256 get_page_from_freelist
5) 6992 352 __alloc_pages_nodemask
6) 6640 8 alloc_pages_current
7) 6632 168 new_slab
8) 6464 8 __slab_alloc
9) 6456 80 __kmalloc
10) 6376 376 vring_add_indirect
11) 6000 144 virtqueue_add_sgs
12) 5856 288 __virtblk_add_req
13) 5568 96 virtio_queue_rq
14) 5472 128 __blk_mq_run_hw_queue
15) 5344 16 blk_mq_run_hw_queue
16) 5328 96 blk_mq_insert_requests
17) 5232 112 blk_mq_flush_plug_list
18) 5120 112 blk_flush_plug_list
19) 5008 64 io_schedule_timeout
20) 4944 128 mempool_alloc
21) 4816 96 bio_alloc_bioset
22) 4720 48 get_swap_bio
23) 4672 160 __swap_writepage
24) 4512 32 swap_writepage
25) 4480 320 shrink_page_list
26) 4160 208 shrink_inactive_list
27) 3952 304 shrink_lruvec
28) 3648 80 shrink_zone
29) 3568 128 do_try_to_free_pages
30) 3440 208 try_to_free_pages
31) 3232 352 __alloc_pages_nodemask
32) 2880 8 alloc_pages_current
33) 2872 200 __page_cache_alloc
34) 2672 80 find_or_create_page
35) 2592 80 ext4_mb_load_buddy
36) 2512 176 ext4_mb_regular_allocator
37) 2336 128 ext4_mb_new_blocks
38) 2208 256 ext4_ext_map_blocks
39) 1952 160 ext4_map_blocks
40) 1792 384 ext4_writepages
41) 1408 16 do_writepages
42) 1392 96 __writeback_single_inode
43) 1296 176 writeback_sb_inodes
44) 1120 80 __writeback_inodes_wb
45) 1040 160 wb_writeback
46) 880 208 bdi_writeback_workfn
47) 672 144 process_one_work
48) 528 112 worker_thread
49) 416 240 kthread
50) 176 176 ret_from_fork
[ Note: the problem is exacerbated by certain gcc versions that seem to
generate much bigger stack frames due to apparently bad coalescing of temporaries and generating too many spills. Rusty saw gcc-4.6.4 using 35% more stack on the virtio path than 4.8.2 does, for example.
Minchan not only uses such a bad gcc version (4.6.3 in his case), but some of the stack use is due to debugging (CONFIG_DEBUG_PAGEALLOC is what causes that kernel_map_pages() frame, for example). But we're clearly getting too close.
The VM code also seems to have excessive stack frames partly for the same compiler reason, triggered by excessive inlining and lots of function arguments.
We need to improve on our stack use, but in the meantime let's do this simple stack increase too. Unlike most earlier reports, there is nothing simple that stands out as being really horribly wrong here, apart from the fact that the stack frames are just bigger than they
should need to be. - Linus ]
commit 6f6111e4a73d0f6370eb8be4f8e4523210b6a67d
Merge: fe45736 8cbf74d
Author: Linus Torvalds <[email protected]>
Date: Fri May 30 09:52:55 2014 -0700
Merge branch 'for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull vfs dcache livelock fix from Al Viro:
"Fixes for livelocks in shrink_dentry_list() introduced by fixes to
shrink list corruption; the root cause was that trylock of parent's ->d_lock could be disrupted by d_walk() happening on other CPUs, resulting in shrink_dentry_list() making no progress *and* the same d_walk() being called again and again for as long as shrink_dentry_list() doesn't get past that mess.
The solution is to have shrink_dentry_list() treat that trylock failure not as 'try to do the same thing again', but 'lock them in the right order'"
* 'for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
dentry_kill() doesn't need the second argument now
dealing with the rest of shrink_dentry_list() livelock shrink_dentry_list(): take parent's ->d_lock earlier
expand dentry_kill(dentry, 0) in shrink_dentry_list()
split dentry_kill()
lift the "already marked killed" case into shrink_dentry_list()
commit 8cbf74da435d1bd13dbb790f94c7ff67b2fb6af4
Author: Al Viro <[email protected]> Date: Thu May 29 09:18:26 2014 -0400
dentry_kill() doesn't need the second argument now
it's 1 in the only remaining caller.
commit b2b80195d8829921506880f6dccd21cabd163d0d
Author: Al Viro <[email protected]> Date: Thu May 29 09:11:45 2014 -0400
dealing with the rest of shrink_dentry_list() livelock
We have the same problem with ->d_lock order in the inner loop, where we are dropping references to ancestors. Same solution, basically - instead of using dentry_kill() we use lock_parent() (introduced in the previous commit) to get that lock in a safe way, recheck ->d_count (in case if lock_parent() has ended up dropping and retaking ->d_lock and somebody managed to grab a reference during that window), trylock the inode->i_lock and use __dentry_kill() to do the rest.
commit 046b961b45f93a92e4c70525a12f3d378bced130
Author: Al Viro <[email protected]> Date: Thu May 29 08:54:52 2014 -0400
shrink_dentry_list(): take parent's ->d_lock earlier
The cause of livelocks there is that we are taking ->d_lock on dentry and its parent in the wrong order, forcing us to use trylock on the parent's one. d_walk() takes them in the right order, and unfortunately it's not hard to create a situation when shrink_dentry_list() can't make progress since trylock keeps failing, and shrink_dcache_parent() or check_submounts_and_drop() keeps calling d_walk() disrupting the very shrink_dentry_list() it's waiting for.
Solution is straightforward - if that trylock fails, let's unlock the dentry itself and take locks in the right order. We need to stabilize ->d_parent without holding ->d_lock, but that's doable using RCU. And we'd better do that in the very beginning of the loop in shrink_dentry_list(), since the checks on refcount, etc. would need to be redone anyway.
That deals with a half of the problem - killing dentries on the shrink list itself. Another one (dropping their parents) is in the next commit.
locking parent is interesting - it would be easy to do rcu_read_lock(), lock whatever we think is a parent, lock dentry itself and check if the parent is still the right one. Except that we need to check that *before* locking the dentry, or we are risking taking ->d_lock out of order. Fortunately, once the D1 is locked, we can check if D2->d_parent is equal to D1 without the need to lock D2; D2->d_parent can start or stop pointing to D1 only under D1->d_lock, so taking D1->d_lock is enough. In other words, the right solution is rcu_read_lock/lock what looks like parent right now/check if it's still our parent/rcu_read_unlock/lock the child.
commit 7d95f6cc4ef73572a43d4a0a1907a13ace17a62a
Author: Christian König <[email protected]> Date: Wed May 28 12:24:17 2014 +0200
drm/radeon: only allocate necessary size for vm bo list
No need to always allocate the theoretical maximum here.
commit ec65da385d46f63740c1c9230b891a6dcbd64c71
Author: Marek Olšák <[email protected]> Date: Tue May 27 02:56:36 2014 +0200
drm/radeon: don't allow RADEON_GEM_DOMAIN_CPU for command submission
It hangs the hardware.
commit 60a445405a1731bac2279eab354173c9c3156747
Author: Christian König <[email protected]> Date: Wed May 21 17:43:59 2014 +0200
drm/radeon: avoid crash if VM command submission isn't available
commit 4b21ce1b4b5d262e7d4656b8ececc891fc3cb806
Author: Christian König <[email protected]> Date: Wed May 21 15:25:41 2014 +0200
drm/radeon: lower the ref * post PLL maximum once more
Let's be conservative and use 100 here until we find something better.
Bugs: https://bugzilla.kernel.org/show_bug.cgi?id=75241
commit 598e306184d26fa1d546334f2eb370b4d94a4ad3
Author: Takashi Iwai <[email protected]> Date: Fri May 23 09:21:06 2014 +0200
ALSA: hda/analog - Fix silent output on ASUS A8JN
ASUS A8JN with AD1986A codec seems following the normal EAPD in the normal order (0 = off, 1 = on) unlike other machines with AD1986A. Apply the workaround used for Toshiba laptop that showed the same problem.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=75041
commit fe45736f4134b9656c656ac5e15b915192f2704a
Merge: a991639 3f8517e
Author: Linus Torvalds <[email protected]>
Date: Thu May 29 18:31:09 2014 -0700
Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm
Pull ARM fixes from Russell King:
"The usual random collection of relatively small ARM fixes"
* 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
ARM: 8063/1: bL_switcher: fix individual online status reporting of removed CPUs
ARM: 8064/1: fix v7-M signal return
ARM: 8057/1: amba: Add Qualcomm vendor ID.
ARM: 8052/1: unwind: Fix handling of "Pop r4-r[4+nnn],r14" opcode
ARM: 8051/1: put_user: fix possible data corruption in put_user
ARM: 8048/1: fix v7-M setup stack location
commit a991639c26c7231ddb6de7f34899fb70832b7d04
Merge: f035b3d ceb2183
Author: Linus Torvalds <[email protected]>
Date: Thu May 29 14:14:43 2014 -0700
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fix from Will Deacon:
"Fix CoW regression for transparent hugepages by routing set_pmd_at to
set_pte_at, which correctly handles PTE_WRITE and will mark the resulting table entry as read-only where appropriate"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: mm: fix pmd_write CoW brokenness
commit f035b3d32256b93a4c39622afe6ac7ade8eedbea
Merge: 15a7b60 9b961aa
Author: Linus Torvalds <[email protected]>
Date: Thu May 29 14:05:57 2014 -0700
Merge tag 'pm+acpi-3.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI and power management fixes from Rafael Wysocki:
"These are three stable-candidate fixes, one for the ACPI thermal
driver and two for cpufreq drivers.
Specifics:
- A workqueue is destroyed too early during the ACPI thermal driver module unload which leads to a NULL pointer dereference in the driver's remove callback. Fix from Aaron Lu.
- A wrong argument is passed to devm_regulator_get_optional() in the probe routine of the cpu0 cpufreq driver which leads to resource leaks if the driver is unbound from the cpufreq platform device. Fix from Lucas Stach.
- A lock is missing in cpufreq_governor_dbs() which leads to memory corruption and NULL pointer dereferences during system suspend/resume, for example. Fix from Bibek Basu"
* tag 'pm+acpi-3.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPI / thermal: fix workqueue destroy order
cpufreq: cpu0: drop wrong devm usage
cpufreq: remove race while accessing cur_policy
commit 15a7b60ea157d4e7cb498ac88515a558d79d7da2
Merge: f2159d1 5178438
Author: Linus Torvalds <[email protected]>
Date: Thu May 29 13:59:18 2014 -0700
Merge tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mike.turquette/linux
Pull clock fixes from Mike Turquette:
"Small number of user-visible regression fixes for clock drivers.
There is a memory leak fix for an ST platform, an infinite Loop Of Doom fix for the recent changes to the basic clock divider (hopefully the last fix for those recent changes) and some Tegra PLL changes which keep PCI from being hosed on that platform"
* tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mike.turquette/linux:
clk: st: Fix memory leak
clk: divider: Fix table round up function
clk: tegra: Fix enabling of PLLE
clk: tegra: Introduce divider mask and shift helpers
clk: tegra: Fix PLLE programming
commit 2fe2023adf695d08af5b598b2be3b288a95d563c
Author: Stefan Richter <[email protected]> Date: Thu May 29 15:23:26 2014 +0200
firewire: revert to 4 GB RDMA, fix protocols using Memory Space
Undo a feature introduced in v3.14 by commit fcd46b34425d "firewire: Enable remote DMA above 4 GB". That change raised the minimum address at which protocol drivers and user programs can register for request reception from 0x0001'0000'0000 to 0x8000'0000'0000. It turned out that at least one vendor-specific protocol exists which uses lower addresses: https://bugzilla.kernel.org/show_bug.cgi?id=76921
For the time being, revert most of commit fcd46b34425d so that affected protocols work like with kernel v3.13 and before. Just keep the valid documentation parts from the regressing commit, and the ability to identify controllers which could be programmed to accept >32 bit physical DMA addresses. The rest of fcd46b34425d should probably be brought back as an optional instead of default feature.
commit ff2fde9929feb2aef45377ce56b8b12df85dda69
Author: Al Viro <[email protected]> Date: Wed May 28 13:59:13 2014 -0400
expand dentry_kill(dentry, 0) in shrink_dentry_list()
Result will be massaged to saner shape in the next commits. It is ugly, no questions - the point of that one is to be a provably equivalent transformation (and it might be worth splitting a bit more).
commit e55fd011549eae01a230e3cace6f4d031b6a3453
Author: Al Viro <[email protected]> Date: Wed May 28 13:51:12 2014 -0400
split dentry_kill()
... into trylocks and everything else. The latter (actual killing) is __dentry_kill().
commit ceb218359de22e70980801d4fa04fffbfc44adb8
Author: Will Deacon <[email protected]> Date: Tue May 27 19:11:58 2014 +0100
arm64: mm: fix pmd_write CoW brokenness
Commit 9c7e535fcc17 ("arm64: mm: Route pmd thp functions through pte equivalents") changed the pmd manipulator and accessor functions to convert the target pmd to a pte, process it with the pte functions, then convert it back. Along the way, we gained support for PTE_WRITE, however this is completely ignored by set_pmd_at, and so we fail to set the PMD_SECT_RDONLY for PMDs, resulting in all sorts of lovely failures (like CoW not working).
Partially reverting the offending commit (by making use of PMD_SECT_RDONLY explicitly for pmd_{write,wrprotect,mkwrite} functions) leads to further issues because pmd_write can then return potentially incorrect values for page table entries marked as RDONLY, leading to BUG_ON(pmd_write(entry)) tripping under some THP workloads.
This patch fixes the issue by routing set_pmd_at through set_pte_at, which correctly takes the PTE_WRITE flag into account. Given that THP mappings are always anonymous, the additional cache-flushing code in __sync_icache_dcache won't impose any significant overhead as the flush will be skipped.
commit 2ac295a544dcae9299cba13ce250419117ae7fd1
Author: NeilBrown <[email protected]> Date: Thu May 29 11:40:03 2014 +1000
md: always set MD_RECOVERY_INTR when interrupting a reshape thread.
Commit 8313b8e57f55b15e5b7f7fc5d1630bbf686a9a97
md: fix problem when adding device to read-only array with bitmap.
added a called to md_reap_sync_thread() which cause a reshape thread to be interrupted (in particular, it could cause md_thread() to never even call md_do_sync()).
However it didn't set MD_RECOVERY_INTR so ->finish_reshape() would not know that the reshape didn't complete.
This only happens when mddev->ro is set and normally reshape threads don't run in that situation. But raid5 and raid10 can start a reshape thread during "run" is the array is in the middle of a reshape. They do this even if ->ro is set.
So it is best to set MD_RECOVERY_INTR before abortingg the sync thread, just in case.
Though it rare for this to trigger a problem it can cause data corruption because the reshape isn't finished properly.
So it is suitable for any stable which the offending commit was applied to. (3.2 or later)
commit 5dc2808c4729bf080487e61b80ee04e0fdb12a37
Author: Mathias Nyman <[email protected]> Date: Wed May 28 23:51:13 2014 +0300
xhci: delete endpoints from bandwidth list before freeing whole device
Lists of endpoints are stored for bandwidth calculation for roothub ports. Make sure we remove all endpoints from the list before the whole device, containing its endpoints list_head stuctures, is freed.
This used to be done in the wrong order in xhci_mem_cleanup(), and triggered an oops in resume from S4 (hibernate).
commit 9326c5ca0982f548cc08c0cffb14dcbd020f3d43
Author: Sean MacLennan <[email protected]> Date: Wed May 28 11:19:00 2014 -0400
staging: r8192e_pci: fix htons error
A sparse error fixup removed a htons() which is required for the driver to function. This patch puts the htons() back and fixes the sparse warning correctly by changing the left side cast.
commit b38f09ccc3fd453180e96273bf3f34083c30809a
Author: Mathias Nyman <[email protected]> Date: Wed May 28 23:18:35 2014 +0300
usb: pci-quirks: Prevent Sony VAIO t-series from switching usb ports
Sony VAIO t-series machines are not capable of switching usb2 ports over from Intel EHCI to xHCI controller. If tried the USB2 port will be left unconnected and unusable.
This patch should be backported to stable kernels as old as 3.12, that contain the commit 26b76798e0507429506b93cd49f8c4cfdab06896 "Intel xhci: refactor EHCI/xHCI port switching"
commit f2159d1e99612ceb94bf9a2dc2fbca409d828b1b
Merge: 2826958 77f0780
Author: Linus Torvalds <[email protected]>
Date: Wed May 28 11:17:41 2014 -0700
Merge tag 'sound-3.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"Just two small stable fixes: an HD-audio fix for the new Intel
chipsets and a PM handling fix in PCM dmaengine core"
* tag 'sound-3.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hda - Fix onboard audio on Intel H97/Z97 chipsets
ALSA: pcm_dmaengine: Add check during device suspend
commit 282695802957b069d293a9f8773a14399093bd6f
Merge: 4efdedc b6dd6f4
Author: Linus Torvalds <[email protected]>
Date: Wed May 28 11:15:57 2014 -0700
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull vfs fix from Al Viro:
"Oh, well... Still nothing useful on that livelock (I had something
that looked kinda-sorta like a non-invasive solution, but it deadlocks), so it's just Miklos' vmsplice fix for now"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
vfs: fix vmplice_to_user()
commit 3f8517e7937d04ac7df9082c741fefc9c873065b
Author: Nicolas Pitre <[email protected]> Date: Fri May 23 22:31:44 2014 +0100
ARM: 8063/1: bL_switcher: fix individual online status reporting of removed CPUs
The content of /sys/devices/system/cpu/cpu*/online is still 1 for those CPUs that the switcher has removed even though the global state in /sys/devices/system/cpu/online is updated correctly.
It turns out that commit 0902a9044f ("Driver core: Use generic offline/online for CPU offline/online") has changed the way those files retrieve their content by relying on on the generic attribute handling code. The switcher, by calling cpu_down() directly, bypasses this handling and the attribute value doesn't get updated.
Fix this by calling device_offline()/device_online() instead.
commit 397335f004f41e5fcf7a795e94eb3ab83411a17c
Author: Thomas Gleixner <[email protected]> Date: Thu May 22 03:25:39 2014 +0000
rtmutex: Fix deadlock detector for real
The current deadlock detection logic does not work reliably due to the following early exit path:
/*
* Drop out, when the task has no waiters. Note,
* top_waiter can be NULL, when we are in the deboosting
* mode!
*/
if (top_waiter && (!task_has_pi_waiters(task) ||
top_waiter != task_top_pi_waiter(task)))
goto out_unlock_pi;
So this not only exits when the task has no waiters, it also exits unconditionally when the current waiter is not the top priority waiter of the task.
So in a nested locking scenario, it might abort the lock chain walk and therefor miss a potential deadlock.
Simple fix: Continue the chain walk, when deadlock detection is enabled.
We also avoid the whole enqueue, if we detect the deadlock right away (A-A). It's an optimization, but also prevents that another waiter who comes in after the detection and before the task has undone the damage observes the situation and detects the deadlock and returns -EDEADLOCK, which is wrong as the other task is not in a deadlock situation.
commit 4efdedca932658cc54866ee19001af3cbffa3769
Merge: 9e3d633 a4e91d0
Author: Linus Torvalds <[email protected]>
Date: Wed May 28 08:08:03 2014 -0700
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm fixes from Paolo Bonzini:
"Small fixes for x86, slightly larger fixes for PPC, and a forgotten
s390 patch. The PPC fixes are important because they fix breakage that is new in 3.15"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: s390: announce irqfd capability
KVM: x86: disable master clock if TSC is reset during suspend
KVM: vmx: disable APIC virtualization in nested guests
KVM guest: Make pv trampoline code executable
KVM: PPC: Book3S: ifdef on CONFIG_KVM_BOOK3S_32_HANDLER for 32bit
KVM: PPC: Book3S HV: Add missing code for transaction reclaim on guest exit
KVM: PPC: Book3S: HV: make _PAGE_NUMA take effect
commit 9e3d6331789b113e4abc831ed3447fb67a105430
Merge: cd79bde 011e4b0
Author: Linus Torvalds <[email protected]>
Date: Wed May 28 08:06:50 2014 -0700
Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
Pull two powerpc fixes from Ben Herrenschmidt:
"Here's a pair of powerpc fixes for 3.15 which are also going to
stable.
One's a fix for building with newer binutils (the problem currently only affects the BookE kernels but the affected macro might come back into use on BookS platforms at any time). Unfortunately, the binutils maintainer did a backward incompatible change to a construct that we use so we have to add Makefile check.
The other one is a fix for CPUs getting stuck in kexec when running single threaded. Since we routinely use kexec on power (including in our newer bootloaders), I deemed that important enough"
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc, kexec: Fix "Processor X is stuck" issue during kexec from ST mode
powerpc: Fix 64 bit builds with binutils 2.24
commit 64fd72e0a44bdd62c5ca277cb24d0d02b2d8e9dc
Author: Al Viro <[email protected]> Date: Wed May 28 09:48:44 2014 -0400
lift the "already marked killed" case into shrink_dentry_list()
It can happen only when dentry_kill() is called with unlock_on_failure equal to 0 - other callers had dentry pinned until the moment they've got ->d_lock and DCACHE_DENTRY_KILLED is set only after lockref_mark_dead().
IOW, only one of three call sites of dentry_kill() might end up reaching that code. Just move it there.
commit f3f0d95146901a94eff8fe723eef2a6daf0ae152
Author: Thomas Bogendoerfer <[email protected]> Date: Tue Apr 8 08:58:01 2014 +0200
MIPS: R46000: Fix Micro-assembler field overflow for R4600 V2
Fix uasm warning, which triggered because of workaround for R4600 V2 CPUs.
Patchwork: https://patchwork.linux-mips.org/patch/6716/
commit 57c7ea513f0e4b033ba602550992e2ca0e6b8d2c
Author: Alex Smith <[email protected]> Date: Thu May 1 12:51:19 2014 +0100
MIPS: ptrace: Avoid smp_processor_id() in preemptible code
ptrace_{get,set}_watch_regs access current_cpu_data to get the watch register count/masks, which calls smp_processor_id(). However they are run in preemptible context and therefore trigger warnings like so:
[ 6340.092000] BUG: using smp_processor_id() in preemptible [00000000] code: gdb/367 [ 6340.092000] caller is ptrace_get_watch_regs+0x44/0x220
Since the watch register count/masks should be the same across all CPUs, use boot_cpu_data instead. Note that this may need to change in future should a heterogenous system be supported where the count/masks are not the same across all CPUs (the current code is also incorrect for this scenario - current_cpu_data here would not necessarily be correct for the CPU that the target task will execute on).
Patchwork: https://patchwork.linux-mips.org/patch/6879/
commit f02ffb199d3af57407a79075f3e0e6c0e8980b6c
Author: Sebastian Andrzej Siewior <[email protected]> Date: Tue May 13 17:07:04 2014 +0200
MIPS: Lemote 2F: cs5536: mfgpt: use raw locks
The lock is taken in the raw irq path and therefore a rawlock should be used instead of a normal spinlock.
While here I drop the export symbol on that variable since there are no other users.
Patchwork: https://patchwork.linux-mips.org/patch/6936/
commit bb6c0bd3fdb67c8a1fceea1d4700b9ee593309f9
Author: Ralf Baechle <[email protected]> Date: Wed May 28 08:36:23 2014 +0200
MIPS: SB1: Fix excessive kernel warnings.
A kernel build with binutils 2.24 is going to emit warnings like
CC kernel/sys.o
{standard input}: Assembler messages:
{standard input}:701: Warning: the 32-bit MIPS architecture does not support the mdmx' extension {standard input}:701: Warning: the mdmx' extension requires 64-bit FPRs {standard input}:701: Warning: the mips3d' extension requires MIPS32 revision 2 or greater {standard input}:701: Warning: the mips3d' extension requires 64-bit FPRs
for almost every file. This is caused by changes to gas' interpretation of .set semantics. Fixed by explicitly disabling MIPS3D and MDMX for Sibyte builds.
commit b6dd6f4738837439c520e73995ec93fe1de2ec72
Author: Miklos Szeredi <[email protected]> Date: Tue May 27 16:41:16 2014 +0200
vfs: fix vmplice_to_user()
Commit 6130f5315ee8 "switch vmsplice_to_user() to copy_page_to_iter()" in v3.15-rc1 broke vmsplice(2).
This patch fixes two bugs:
- count is not initialized to a proper value, which resulted in no data being copied
- if rw_copy_check_uvector() returns negative then the iov might be leaked.
Tested OK.
commit 5178438041cc94680e606e5a9c6d1ad9c911199b
Merge: 72b1c2c 4ccc402
Author: Mike Turquette <[email protected]>
Date: Tue May 27 21:11:08 2014 -0700
Merge tag 'clk-tegra-fixes-3.15' of git://nv-tegra.nvidia.com/user/pdeschrijver/linux into clk-fixes
PLLE fixes for 3.15
commit 3991b31ea072b070081ca3bfa860a077eda67de5
Author: NeilBrown <[email protected]> Date: Wed May 28 13:39:23 2014 +1000
md: always set MD_RECOVERY_INTR when aborting a reshape or other "resync".
If mddev->ro is set, md_to_sync will (correctly) abort. However in that case MD_RECOVERY_INTR isn't set.
If a RESHAPE had been requested, then ->finish_reshape() will be called and it will think the reshape was successful even though nothing happened.
Normally a resync will not be requested if ->ro is set, but if an array is stopped while a reshape is on-going, then when the array is started, the reshape will be restarted. If the array is also set read-only at this point, the reshape will instantly appear to success, resulting in data corruption.
Consequently, this patch is suitable for any -stable kernel.
commit 011e4b02f1da156ac7fea28a9da878f3c23af739
Author: Srivatsa S. Bhat <[email protected]> Date: Tue May 27 16:25:34 2014 +0530
powerpc, kexec: Fix "Processor X is stuck" issue during kexec from ST mode
If we try to perform a kexec when the machine is in ST (Single-Threaded) mode
(ppc64_cpu --smt=off), the kexec operation doesn't succeed properly, and we
get the following messages during boot:
[ 0.089866] POWER8 performance monitor hardware support registered
[ 0.089985] power8-pmu: PMAO restore workaround active.
[ 5.095419] Processor 1 is stuck.
[ 10.097933] Processor 2 is stuck.
[ 15.100480] Processor 3 is stuck.
[ 20.102982] Processor 4 is stuck.
[ 25.105489] Processor 5 is stuck.
[ 30.108005] Processor 6 is stuck.
[ 35.110518] Processor 7 is stuck.
[ 40.113369] Processor 9 is stuck.
[ 45.115879] Processor 10 is stuck.
[ 50.118389] Processor 11 is stuck.
[ 55.120904] Processor 12 is stuck.
[ 60.123425] Processor 13 is stuck.
[ 65.125970] Processor 14 is stuck.
[ 70.128495] Processor 15 is stuck.
[ 75.131316] Processor 17 is stuck.
Note that only the sibling threads are stuck, while the primary threads (0, 8,
16 etc) boot just fine. Looking closer at the previous step of kexec, we observe
that kexec tries to wakeup (bring online) the sibling threads of all the cores,
before performing kexec:
[ 9464.131231] Starting new kernel
[ 9464.148507] kexec: Waking offline cpu 1.
[ 9464.148552] kexec: Waking offline cpu 2.
[ 9464.148600] kexec: Waking offline cpu 3.
[ 9464.148636] kexec: Waking offline cpu 4.
[ 9464.148671] kexec: Waking offline cpu 5.
[ 9464.148708] kexec: Waking offline cpu 6.
[ 9464.148743] kexec: Waking offline cpu 7.
[ 9464.148779] kexec: Waking offline cpu 9.
[ 9464.148815] kexec: Waking offline cpu 10.
[ 9464.148851] kexec: Waking offline cpu 11.
[ 9464.148887] kexec: Waking offline cpu 12.
[ 9464.148922] kexec: Waking offline cpu 13.
[ 9464.148958] kexec: Waking offline cpu 14.
[ 9464.148994] kexec: Waking offline cpu 15.
[ 9464.149030] kexec: Waking offline cpu 17.
Instrumenting this piece of code revealed that the cpu_up() operation actually
fails with -EBUSY. Thus, only the primary threads of all the cores are online
during kexec, and hence this is a sure-shot receipe for disaster, as explained
in commit e8e5c2155b (powerpc/kexec: Fix orphaned offline CPUs across kexec),
as well as in the comment above wake_offline_cpus().
It turns out that cpu_up() was returning -EBUSY because the variable
'cpu_hotplug_disabled' was set to 1; and this disabling of CPU hotplug was done
by migrate_to_reboot_cpu() inside kernel_kexec().
Now, migrate_to_reboot_cpu() was originally written with the assumption that
any further code will not need to perform CPU hotplug, since we are anyway in
the reboot path. However, kexec is clearly not such a case, since we depend on
onlining CPUs, atleast on powerpc.
So re-enable cpu-hotplug after returning from migrate_to_reboot_cpu() in the
kexec path, to fix this regression in kexec on powerpc.
Also, wrap the cpu_up() in powerpc kexec code within a WARN_ON(), so that we
can catch such issues more easily in the future.
Fixes: c97102ba963 (kexec: migrate to reboot cpu)
Cc: [email protected]
Signed-off-by: Srivatsa S. Bhat <[email protected]>
Signed-off-by: Benjamin Herrenschmidt <[email protected]>commit 7998eb3dc700aaf499f93f50b3d77da834ef9e1d
Author: Guenter Roeck <[email protected]> Date: Thu May 15 09:33:42 2014 -0700
powerpc: Fix 64 bit builds with binutils 2.24
With binutils 2.24, various 64 bit builds fail with relocation errors such as
arch/powerpc/kernel/built-in.o: In function `exc_debug_crit_book3e':
(.text+0x165ee): relocation truncated to fit: R_PPC64_ADDR16_HI against symbol `interrupt_base_book3e' defined in .text section in arch/powerpc/kernel/built-in.o
arch/powerpc/kernel/built-in.o: In function `exc_debug_crit_book3e':
(.text+0x16602): relocation truncated to fit: R_PPC64_ADDR16_HI against symbol `interrupt_end_book3e' defined in .text section in arch/powerpc/kernel/built-in.o
The assembler maintainer says:
I changed the ABI, something that had to be done but unfortunately happens to break the booke kernel code. When building up a 64-bit value with lis, ori, shl, oris, ori or similar sequences, you now should use @high and @higha in place of @h and @ha. @h and @ha (and their associated relocs R_PPC64_ADDR16_HI and R_PPC64_ADDR16_HA) now report overflow if the value is out of 32-bit signed range. ie. @h and @ha assume you're building a 32-bit value. This is needed to report out-of-range -mcmodel=medium toc pointer offsets in @toc@h and @toc@ha expressions, and for consistency I did the same for all other @h and @ha relocs.
Replacing @h with @high in one strategic location fixes the relocation errors. This has to be done conditionally since the assembler either supports @h or @high but not both.
commit 7ac3764fcafc06e72e1a79a9d998b9fdd900b2a6
Author: Greg Kroah-Hartman <[email protected]> Date: Tue May 27 16:32:10 2014 -0700
USB: cdc-wdm: properly include types.h
The file include/uapi/linux/usb/cdc-wdm.h uses a __u16 so it needs to include types.h as well to make the build system happy.
commit 7d1896360f4d055d68565ef8ed56a677580f1a39
Author: Bjørn Mork <[email protected]> Date: Sat May 10 16:31:40 2014 +0200
usb: cdc-wdm: export cdc-wdm uapi header
The include/uapi/linux/usb/cdc-wdm.h header defines cdc-wdm userspace APIs and should be exported by make headers_install.
commit efb27e73e12633a24dfdc67b8a6a58c4b427f3e4
Merge: c720816 d23db88
Author: Dave Airlie <[email protected]>
Date: Wed May 28 09:18:32 2014 +1000
Merge tag 'drm-intel-fixes-2014-05-27' of git://anongit.freedesktop.org/drm-intel into drm-fixes
Fixes from Chris, all cc: stable.
* tag 'drm-intel-fixes-2014-05-27' of git://anongit.freedesktop.org/drm-intel:
drm/i915: Prevent negative relocation deltas from wrapping drm/i915: Only copy back the modified fields to userspace from execbuffer drm/i915: Fix dynamic allocation of physical handles
commit cd79bde29f00a346eec3fe17c1c5073c37ed95e7
Merge: aa699a1 aa0818c
Author: Linus Torvalds <[email protected]>
Date: Tue May 27 15:59:34 2014 -0700
Merge branch 'for-linus' of git://git.kernel.dk/linux-block
Pull virtio_blk fix from Jens Axboe:
"There's a start/stop queue race in virtio_blk, which causes stalls and
erratic behaviour for some. I've had this queued up for 3.16 for a while, but I think we should push it into the current series as well.
So I cherry picked the commit and added a stable marker as well, so it can propagate down"
* 'for-linus' of git://git.kernel.dk/linux-block:
virtio_blk: fix race between start and stop queue
commit aa699a1d84474eb993867822b6aefc47a9a6ce0c
Merge: 758b671 acbf6d2
Author: Linus Torvalds <[email protected]>
Date: Tue May 27 15:58:20 2014 -0700
Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull two timer fixes from Thomas Gleixner:
"Two small fixlets for ARM SoC clocksource drivers:
- avoid calling functions which might sleep from interrupt [disabled] context in tcb_clksrc used on Atmel SoCs
- use irq_force_affinity() to pin the per cpu timer interrupt on a not yet online cpu in the SiRFprimaII driver"
* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
clocksource: tcb_clksrc: Make tc_mode interrupt safe
clocksource: marco: Fix the affinity set for local timer of CPU1
commit 8a61ba3a47ac39f660702aa66a172185dd605a86
Author: Alexej Starschenko <[email protected]> Date: Wed May 7 10:43:29 2014 +0200
USB: serial: option: add support for Novatel E371 PCIe card
Adds product ID for the Novatel E371 PCI Express Mini Card.
$ lsusb
Bus 001 Device 024: ID 1410:9011 Novatel Wireless
$ usb-devices
T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 24 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=1410 ProdID=9011 Rev=00.03
S: Manufacturer=Novatel Wireless, Inc.
S: Product=Novatel Wireless HSPA
S: SerialNumber=012773002115811
C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I: If#= 6 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
I: If#= 7 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
Tested with kernel 3.2.0.
commit d0839d757e6294921c31b1c4ca4f1dcc5df63bcd
Author: George McCollister <[email protected]> Date: Sat Apr 26 12:04:47 2014 +0200
USB: ftdi_sio: add NovaTech OrionLXm product ID
The NovaTech OrionLXm uses an onboard FTDI serial converter for JTAG and console access.
Here is the lsusb output:
Bus 004 Device 123: ID 0403:7c90 Future Technology Devices International, Ltd
commit c03890ff5e24a4bf59059f2d179f427559b7330a
Author: Johan Hovold <[email protected]> Date: Sat Apr 26 11:53:44 2014 +0200
USB: io_ti: fix firmware download on big-endian machines (part 2)
A recent patch that purported to fix firmware download on big-endian machines failed to add the corresponding sparse annotation to the i2c-header. This was reported by the kbuild test robot.
Adding the appropriate annotation revealed another endianess bug related to the i2c-header Size-field in a code path that is exercised when the firmware is actually being downloaded (and not just verified and left untouched unless older than the firmware at hand).
This patch adds the required sparse annotation to the i2c-header and makes sure that the Size-field is sent in little-endian byte order during firmware download also on big-endian machines.
Note that this patch is only compile-tested, but that there is no functional change for little-endian systems.
commit 758b67126facde350bcbfbb1cd760aa6050f8647
Merge: 51d5665 1b0fe6b
Author: Linus Torvalds <[email protected]>
Date: Tue May 27 13:59:24 2014 -0700
Merge tag 'fixes-for-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc
Pull ARM SoC fixes from Olof Johansson:
"A slightly larger set of fixes than we'd like at this point in the
release. Hopefully our very last batch before 3.15:
OMAP:
- Fix boot regression with CPU_IDLE enabled
- Fixes for audio playback on OMAP5
- Clock rate setting fix for OMAP3
- Misc idle/PM fixes
Exynos:
- Removal of a couple of power domains to work around issues with access when they are powered down
- Enabling missing highspeed-i2c driver to make MMC regulators work
- Secondary CPU spin-up fix for 4212
- Remove MDMA1 engine to avoid conflicts on secure mode platforms
- A few other DT fixes
Marvell:
- PCI-e fixes for clocks and resource allocation
plus a few other smaller fixes, add a MAINTAINERS entry for reset drivers, etc"
* tag 'fixes-for-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (21 commits)
MAINTAINERS: Add reset controller framework entry
ARM: trusted_foundations: fix compile error on non-SMP
ARM: at91: sam9260: fix compilation issues
ARM: mvebu: fix definitions of PCIe interfaces on Armada 38x
ARM: imx: fix error handling in ipu device registration
ARM: OMAP4: Fix the boot regression with CPU_IDLE enabled
ARM: dts: Keep LDO4 always ON for exynos5250-arndale board
ARM: dts: Fix SPI interrupt numbers for exynos5420
ARM: dts: fix incorrect ak8975 compatible for exynos4412-trats2 board
ARM: OMAP2+: Fix DMA hang after off-idle
ARM: OMAP2+: nand: Fix NAND on OMAP2 and OMAP3 boards
ARM: dts: Remove g2d_pd node for exynos5420
ARM: dts: Remove mau_pd node for exynos5420
ARM: exynos_defconfig: enable HS-I2C to fix for mmc partition mount
ARM: dts: disable MDMA1 node for exynos5420
ARM: EXYNOS: fix the secondary CPU boot of exynos4212
ARM: omap5: hwmod_data: Correct IDLEMODE for McPDM
ARM: mvebu: mvebu-soc-id: keep clock enabled if PCIe unit is enabled
ARM: mvebu: mvebu-soc-id: add missing clk_put() call
ARM: at91/dt: sam9260: correct external trigger value
...
commit 51d566523bc0b42cebecf21f635396281954e03c
Merge: c949ddf 7ea4564
Author: Linus Torvalds <[email protected]>
Date: Tue May 27 13:58:46 2014 -0700
Merge tag 'pinctrl-v3.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pinctrl fix from Linus Walleij:
"A single last pinctrl fix for the v3.15 series: the vt8500 driver was
failing to update the output value when the combined set direction output and set value was executed"
* tag 'pinctrl-v3.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
pinctrl: vt8500: Ensure value reg is updated when setting direction
commit c949ddf9eb140f69dbf4495f234b558fc9691cbb
Merge: c720816 fbeb91f
Author: Linus Torvalds <[email protected]>
Date: Tue May 27 13:57:00 2014 -0700
Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma
Pull slave-dmaengine fixes from Vinod Koul:
"We have three small fixes.
First one from Andy reverts the devm_request irq as we need to ensure the tasklet is killed after irq is freed, so we need to do free irq in our code. Other two from Arnd are fixing the compilation issue in omap and sa11x0 drivers with ARM randconfigs"
* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
dmaengine: sa11x0: remove broken #ifdef
dmaengine: omap: hide filter_fn for built-in drivers
dmaengine: dw: went back to plain {request,free}_irq() calls
commit 1b0fe6be858d47e7e80fe0adc47c7366f5924244
Author: Philipp Zabel <[email protected]> Date: Tue May 27 15:58:09 2014 +0200
MAINTAINERS: Add reset controller framework entry
commit 63d832c30142cdceb478b1cac7d943d83b95b2dc
Author: Hannes Reinecke <[email protected]> Date: Mon May 26 14:45:39 2014 +0200
dm mpath: really fix lockdep warning
lockdep complains about a circular locking. And indeed, we need to release the lock before calling dm_table_run_md_queue_async().
As such, commit 4cdd2ad ("dm mpath: fix lock order inconsistency in multipath_ioctl") must also be reverted in addition to fixing the lock order in the other dm_table_run_md_queue_async() callers.
commit aa0818c6ee8d8e4772725a43550823347bc1ad30
Author: Ming Lei <[email protected]> Date: Fri May 16 23:31:21 2014 +0800
virtio_blk: fix race between start and stop queue
When there isn't enough vring descriptor for adding to vq, blk-mq will be put as stopped state until some of pending descriptors are completed & freed.
Unfortunately, the vq's interrupt may come just before blk-mq's BLK_MQ_S_STOPPED flag is set, so the blk-mq will still be kept as stopped even though lots of descriptors are completed and freed in the interrupt handler. The worst case is that all pending descriptors are freed in the interrupt handler, and the queue is kept as stopped forever.
This patch fixes the problem by starting/stopping blk-mq with holding vq_lock.
Conflicts:
drivers/block/virtio_blk.c
commit f1daa838e861ae1a0fb7cd9721a21258430fcc8c
Author: Heinz Mauelshagen <[email protected]> Date: Fri May 23 14:10:01 2014 -0400
dm cache: always split discards on cache block boundaries
The DM cache target cannot cope with discards that span multiple cache blocks, so each discard bio that spans more than one cache block must get split by the DM core.
commit 45fb4f8d81578e0a17c45c4593a3305afbf7a48b
Author: Oliver Hartkopp <[email protected]> Date: Tue May 27 13:30:56 2014 +0200
can: only rename enabled led triggers when changing the netdev name
Commit a1ef7bd9fce8 ("can: rename LED trigger name on netdev renames") renames the led trigger names according to the changed netdevice name.
As not every CAN driver supports and initializes the led triggers, checking for the CAN private datastructure with safe_candev_priv() in the notifier chain is not enough.
This patch adds a check when CONFIG_CAN_LEDS is enabled and the driver does not support led triggers.
For stable 3.9+
commit d23db88c3ab233daed18709e3a24d6c95344117f
Author: Chris Wilson <[email protected]> Date: Fri May 23 08:48:08 2014 +0200
drm/i915: Prevent negative relocation deltas from wrapping
This is pure evil. Userspace, I'm looking at you SNA, repacks batch buffers on the fly after generation as they are being passed to the kernel for execution. These batches also contain self-referenced relocations as a single buffer encompasses the state commands, kernels, vertices and sampler. During generation the buffers are placed at known offsets within the full batch, and then the relocation deltas (as passed to the kernel) are tweaked as the batch is repacked into a smaller buffer. This means that userspace is passing negative relocations deltas, which subsequently wrap to large values if the batch is at a low address. The GPU hangs when it then tries to use the large value as a base for its address offsets, rather than wrapping back to the real value (as one would hope). As the GPU uses positive offsets from the base, we can treat the relocation address as the minimum address read by the GPU. For the upper bound, we trust that userspace will not read beyond the end of the buffer.
So, how do we fix negative relocations from wrapping? We can either check that every relocation looks valid when we write it, and then position each object such that we prevent the offset wraparound, or we just special-case the self-referential behaviour of SNA and force all batches to be above 256k. Daniel prefers the latter approach.
This fixes a GPU hang when it tries to use an address (relocation + offset) greater than the GTT size. The issue would occur quite easily with full-ppgtt as each fd gets its own VM space, so low offsets would often be handed out. However, with the rearrangement of the low GTT due to capturing the BIOS framebuffer, it is already affecting kernels 3.15 onwards. I think only IVB+ is susceptible to this bug, but the workaround should only kick in rarely, so it seems sensible to always apply it.
v3: Use a bias for batch buffers to prevent small negative delta relocations from wrapping.
v4 from Daniel:
- s/BIAS/BATCH_OFFSET_BIAS/
- Extract eb_vma_misplaced/i915_vma_misplaced since the conditions were growing rather cumbersome.
- Add a comment to eb_get_batch explaining why we do this.
- Apply the batch offset bias everywhere but mention that we've only observed it on gen7 gpus.
- Drop PIN_OFFSET_FIX for now, that slipped in from a feature patch.
v5: Add static to eb_get_batch, spotted by 0-day tester.
Testcase: igt/gem_bad_reloc
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=78533
commit 9aab8bff7aa3bee567213ad3c1fdfb217bb980a2
Author: Chris Wilson <[email protected]> Date: Fri May 23 10:45:52 2014 +0100
drm/i915: Only copy back the modified fields to userspace from execbuffer
We only want to modifiy a single field in the userspace view of the execbuffer command buffer, so explicitly change that rather than copy everything back again.
This serves two purposes:
1. The single fields are much cheaper to copy (constant size so the copy uses special case code) and much smaller than the whole array.
2. We modify the array for internal use that need to be masked from the user.
Note: We need this backported since without it the next bugfix will blow up when userspace recycles batchbuffers and relocations.
commit 00731155a73020c8e3c215723be193f96b4fcb1f
Author: Chris Wilson <[email protected]> Date: Wed May 21 12:42:56 2014 +0100
drm/i915: Fix dynamic allocation of physical handles
A single object may be referenced by multiple registers fundamentally breaking the static allotment of ids in the current design. When the object is used the second time, the physical address of the first assignment is relinquished and a second one granted. However, the hardware is still reading (and possibly writing) to the old physical address now returned to the system. Eventually hilarity will ensue, but in the short term, it just means that cursors are broken when using more than one pipe.
v2: Fix up leak of pci handle when handling an error during attachment, and avoid a double kmap/kunmap. (Ville)
Rebase against -fixes.
v3: And fix the error handling added in v2 (Ville)
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=77351
commit 0f68f39c393bc06ac5ccc8794f0e2ed841e41c3e
Author: Hans de Goede <[email protected]> Date: Mon May 19 22:54:09 2014 -0700
Input: synaptics - change min/max quirk table to pnp-id matching
Most of the affected models share pnp-ids for the touchpad. So switching to pnp-ids give us 2 advantages:
1) It shrinks the quirk list
2) It will lower the new quirk addition frequency, ie the recently added W540 quirk would not have been necessary since it uses the same LEN0034 pnp ids as other models already added before it
As an added bonus it actually puts the quirk on the actual psmouse, rather then on the machine, which is technically more correct.
commit e2f611029b370bb7a04236215ad4b36aa8cb98cd
Author: Hans de Goede <[email protected]> Date: Mon May 19 22:53:23 2014 -0700
Input: synaptics - add a matches_pnp_id helper function
This is a preparation patch for simplifying the min/max quirk table.
commit 6d396ede224dc596d92d7cab433713536e68916c
Author: Hans de Goede <[email protected]> Date: Mon May 19 22:52:30 2014 -0700
Input: synaptics - T540p - unify with other LEN0034 models
The T540p has a touchpad with pnp-id LEN0034, all the models with this pnp-id have the same min/max values, except the T540p where the values are slightly off. Fix them to be identical.
This is a preparation patch for simplifying the quirk table.
commit 9b961aa99b8155ecc07dd727643ca97424544256
Merge: c720816 e3beb0a 2807bd1
Author: Rafael J. Wysocki <[email protected]>
Date: Mon May 26 23:20:16 2014 +0200
Merge branches 'pm-cpufreq' and 'acpi-thermal'
* pm-cpufreq:
cpufreq: cpu0: drop wrong devm usage
cpufreq: remove race while accessing cur_policy
* acpi-thermal:
ACPI / thermal: fix workqueue destroy order
commit 2807bd18cc60ec471917b5158e98e4d7b7e030fb
Author: Aaron Lu <[email protected]> Date: Mon May 26 14:34:07 2014 +0200
ACPI / thermal: fix workqueue destroy order
When the thermal module is to be removed, we should destroy the wq acpi_thermal_pm_queue after the ACPI driver's remove callback is executed as we will need to flush the workqueue there, or a NULL pointer access will be hit.
References: http://www.spinics.net/lists/kernel/msg1747251.html
commit 66ef3fab94df1004ed02c292d3d4e78485bfc615
Author: Gabor Juhos <[email protected]> Date: Thu May 15 10:35:44 2014 +0200
MIPS: RC32434: fix broken PCI resource initialization
The parent field of the 'rc32434_res_pci_mem1' resource points to the resource itself which is obviously wrong. Due to the broken initialitazion, the PCI devices on the Mikrotik RB532 boards are not working since commit 22283178 (MIPS: avoid possible resource conflict in register_pci_controller).
Remove the field initialization to fix the issue.
Patchwork: https://patchwork.linux-mips.org/patch/6940/
commit f44a5f45f544561302e855e7bd104e5f506ec01b
Author: Peter Christensen <[email protected]> Date: Sat May 24 21:40:12 2014 +0200
ipvs: Fix panic due to non-linear skb
Receiving a ICMP response to an IPIP packet in a non-linear skb could cause a kernel panic in __skb_pull.
The problem was introduced in
commit f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e ("ipvs: implement passive PMTUD for IPIP packets").
commit c7208164e66f63e3ec1759b98087849286410741
Author: Linus Torvalds <[email protected]> Date: Sun May 25 16:06:00 2014 -0700
Linux 3.15-rc7
commit 483a6c9d447f625b991fa04a1530493d893984db
Author: Rabin Vincent <[email protected]> Date: Sat May 24 17:38:01 2014 +0100
ARM: 8064/1: fix v7-M signal return
According to the ARM ARM, the behaviour is UNPREDICTABLE if the PC read from the exception return stack is not half word aligned. See the pseudo code for ExceptionReturn() and PopStack().
The signal handler's address has the bit 0 set, and setup_return() directly writes this to regs->ARM_pc. Current hardware happens to discard this bit, but QEMU's emulation doesn't and this makes processes crash. Mask out bit 0 before the exception return in order to get predictable behaviour.
commit fbebf59778600488147744cdf7d7c20d22531025
Author: srinik <[email protected]> Date: Thu May 15 11:28:44 2014 +0100
ARM: 8057/1: amba: Add Qualcomm vendor ID.
This patch adds Qualcomm amba vendor Id to the list. This ID is used in mmci driver. The ID selected in same lines like 0x41 is "A" for ARM, 0x51 is "Q" for Qualcomm.
As there are no physical register on Qcom SOC for amba vendor id, this is a fake ID assigned based on "Q" prefix from Qualcomm.
commit 8203d5b628907ae6141e4eb52f9b48e0f1f46cd2
Author: Nikolay Borisov <[email protected]> Date: Thu May 8 15:54:26 2014 +0100
ARM: 8052/1: unwind: Fix handling of "Pop r4-r[4+nnn],r14" opcode
The arm EABI states that unwind opcode 10100nnn means pop register r4-4[4+nnn],aditionally there is a similar unwind opcode: 10101nnn which means the same thing plus popping r14. Those two cases are handled by the unwind_exec_pop_r4_to_rN function which checks whether the 4th bit is set and does r14 popping.
However, up until now it has been checking whether the 8th bit was set (mask & 0x80) instead of the 4th (mask & 0x8), a simple to make typo but this meant that we were always popping r14 even if we had the former opcode.
This patch changes the mask so that the 2 unwind opcodes are being handled correctly.
commit 537094b64b229bf3ad146042f83e74cf6abe59df
Author: Andrey Ryabinin <[email protected]> Date: Wed May 7 08:07:25 2014 +0100
ARM: 8051/1: put_user: fix possible data corruption in put_user
According to arm procedure call standart r2 register is call-cloberred. So after the result of x expression was put into r2 any following function call in p may overwrite r2. To fix this, the result of p expression must be saved to the temporary variable before the assigment x expression to __r2.
commit f9ff907b0af561dcde4683f7c9f71dc0f41d3be3
Author: Rabin Vincent <[email protected]> Date: Sat May 3 18:19:17 2014 +0100
ARM: 8048/1: fix v7-M setup stack location
__v7m_setup_stack currently sits in the .proc.info.init section, and thus creates a bogus proc info entry (which by the way matches any unknown CPU IDs, due to the entry's mask being 0). Move it out of there.
commit db1003f23189cdbb2d450dff1edbc8e318797344
Merge: ef0d2c1 656f88d
Author: Linus Torvalds <[email protected]>
Date: Sun May 25 12:40:36 2014 -0700
Merge branch 'afs' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs
Pull AFS fixes and cleanups from David Howells:
"Here are some patches to the AFS filesystem:
1) Fix problems in the clean-up parts of the cache manager service handler.
2) Split afs_end_call() introduced in (1) and replace some identical code elsewhere with a call to the first half of the split function.
3) Fix an error introduced in the workqueue PREPARE_WORK() elimination commits.
4) Clean up argument passing to functions called from the workqueue as there's now an insulating layer between them and the workqueue. This is possible from (3)"
* 'afs' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
AFS: Pass an afs_call* to call->async_workfn() instead of a work_struct*
AFS: Fix kafs module unloading
AFS: Part of afs_end_call() is identical to code elsewhere, so split it
AFS: Fix cache manager service handlers
commit ef0d2c1686aa256a5f7a4a5f55415563c1ab184c
Merge: f016a64 3568a1d
Author: Linus Torvalds <[email protected]>
Date: Sun May 25 12:39:08 2014 -0700
Merge branch 'rdunlap' (patches from Randy Dunlap)
Merge documentation fixes from Randy Dunlap.
* emailed patches from Randy Dunlap <[email protected]>:
Documentation: update /proc/stat "intr" count summary
Documentation: update java sample wrapper for java 7
Documentation: update thunderbird email client settings
Documentation: fix typos in drm docbook
commit 3568a1dbf174a1ae0022611998c4e5d588b5014d
Author: Jan Moskyto Matejka <[email protected]> Date: Thu May 15 13:55:34 2014 -0700
Documentation: update /proc/stat "intr" count summary
The sum at the beginning of line "intr" includes also unnumbered interrupts. It implies that the sum at the beginning isn't the sum of the remainder of the line, not even an estimation.
Fixed the documentation to mention that.
This behaviour was added to /proc/stat in commit a2eddfa95919 ("x86:
make /proc/stat account for all interrupts")
commit f76f133b0c3b182c2d4f4de21a04ba4c964d508d
Author: Jonathan Callen <[email protected]> Date: Thu May 15 13:54:52 2014 -0700
Documentation: update java sample wrapper for java 7
The sample wrapper currently fails on some Java 7 .class files. This updates the wrapper to properly handle those files.
commit f9a0974d3f7049f6f753ebd28b8f0907983acf3c
Author: Paul McQuade <[email protected]> Date: Thu May 15 13:54:25 2014 -0700
Documentation: update thunderbird email client settings
Added setting to email-clients that is easier to read and is easier to setup thunderbird. Removed config settings and added GUI settings.
commit f9b899c44fec53c1519b19f853e96191ae96b1c6
Author: Masanari Iida <[email protected]> Date: Thu May 15 13:54:06 2014 -0700
Documentation: fix typos in drm docbook
Fix spelling typo in DocBook/drm.tmpl
commit f016a6441a18000d5918ee3e05d9bdd4d53fed1c
Merge: 0e37c27 ead82d6
Author: Linus Torvalds <[email protected]>
Date: Sun May 25 10:20:36 2014 -0700
Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging
Pull hwmon subsystem fixes from Jean Delvare.
* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
hwmon: (ntc_thermistor) Fix OF device ID mapping
hwmon: (ntc_thermistor) Fix dependencies
hwmon: Document temp[1-*]_min_hyst sysfs attribute
commit 0e37c275426c34712d4661d86c375779f3836a7e
Merge: 80a1de2 6aa6caf
Author: Linus Torvalds <[email protected]>
Date: Sun May 25 10:13:50 2014 -0700
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull single scsi fix from James Bottomley:
"This is a single fix for a bug exposed by a sysfs change in 3.13 which
now causes libsas to trigger a warn on in device removal"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
[SCSI] scsi_transport_sas: move bsg destructor into sas_rphy_remove
commit 80a1de29a5a67abac02cb10c32545eb231e0e778
Merge: 0374300 27b1142
Author: Linus Torvalds <[email protected]>
Date: Sun May 25 10:08:48 2014 -0700
Merge branch 'for-3.15' of git://linux-nfs.org/~bfields/linux
Pull two nfsd bugfixes from Bruce Fields:
"Just two bugfixes, one for a merge-window-introduced ACL regression,
the other for a longer-standing v4 state bug"
* 'for-3.15' of git://linux-nfs.org/~bfields/linux:
nfsd4: warn on finding lockowner without stateid's
nfsd4: remove lockowner when removing lock stateid
nfsd4: fix corruption on setting an ACL.
commit ead82d6792ef5c600d535bca6ec50a4da14ff7c7
Author: Jean Delvare <[email protected]> Date: Sun May 25 17:23:08 2014 +0200
hwmon: (ntc_thermistor) Fix OF device ID mapping
The mapping from OF device IDs to platform device IDs is wrong. TYPE_NCPXXWB473 is 0, TYPE_NCPXXWL333 is 1, so ntc_thermistor_id[TYPE_NCPXXWB473] is { "ncp15wb473", TYPE_NCPXXWB473 } while
ntc_thermistor_id[TYPE_NCPXXWL333] is { "ncp18wb473", TYPE_NCPXXWB473 }.
So the name is wrong for all but the "ntc,ncp15wb473" entry, and the type is wrong for the "ntc,ncp15wl333" entry.
So map the entries by index, it is neither elegant nor robust but at least it is correct.
commit 59cf4243e557aa64ab2ef51280454aa1f3828e14
Author: Jean Delvare <[email protected]> Date: Sun May 25 17:23:08 2014 +0200
hwmon: (ntc_thermistor) Fix dependencies
In commit 9e8269de, support was added for ntc_thermistor devices being declared in the device tree and implemented on top of IIO. With that change, a dependency was added to the ntc_thermistor driver:
depends on (!OF && !IIO) || (OF && IIO)
This construct has the drawback that the driver can no longer be selected when OF is set and IIO isn't, nor when IIO is set and OF is not. This is a regression for the original users of the driver.
As the new code depends on IIO and is useless without OF, include it only if both are enabled, and set the dependencies accordingly. This is clearer, more simple and more correct.
commit 0132514588f3a0685861221058116a383bff4deb
Author: Jean Delvare <[email protected]> Date: Sun May 25 17:23:07 2014 +0200
hwmon: Document temp[1-*]_min_hyst sysfs attribute
The temp[1-*]_min_hyst sysfs attribute is already implemented by 3 hwmon drivers (adt7x10, lm77 and lm92) but was missing from the standard interface.
Also add temp[1-*]_lcrit_hyst for consistency, even though no driver implement that one for the time being.
commit 2ff89d64f23e99da64995844ea42c83b0b4d58c6
Author: Markos Chandras <[email protected]> Date: Fri May 23 13:31:31 2014 +0100
MIPS: malta: memory.c: Initialize the 'memsize' variable
If the 'memsize' environmental variable is not set by the bootloader the 'memsize' variable is not initialized, leading to potential memory problems. This patch fixes the problem by setting the initial value to '0' to force the kernel to set a good default memory size.
Patchwork: https://patchwork.linux-mips.org/patch/6984/
commit 721a9205396c4ef2a811dd665ec2a232163b583d
Author: Markos Chandras <[email protected]> Date: Wed May 21 12:35:00 2014 +0100
MIPS: Fix typo when reporting cache and ftlb errors for ImgTec cores
Introduced by the following two commits:
75b5b5e0a262790fa11043fe45700499c7e3d818
"MIPS: Add support for FTLBs" 6de20451857ed14a4eecc28d08f6de5925d1cf96
"MIPS: Add printing of ES bit for Imgtec cores when cache error occurs"
Patchwork: https://patchwork.linux-mips.org/patch/6980/
commit defb79f08630f4d1944c75ad0070026d0f534fda
Author: Huacai Chen <[email protected]> Date: Sun May 25 10:00:36 2014 +0800
MIPS: Fix inconsistancy of __NR_Linux_syscalls value
Originally, __NR_O32_Linux_syscalls, __NR_N32_Linux_syscalls and __NR_64_Linux_syscalls have the same values as __NR_Linux_syscalls in corresponding ABIs. But after commit 367f0b50e502d (MIPS: Wire up renameat2 syscall) they are not the same. I think this is incorrect and need a fix.
Patchwork: https://patchwork.linux-mips.org/patch/6987/
commit 8646224cdb945eca4293e2131e5be47930ce3e80
Merge: 7df566b 5ca2504
Author: David S. Miller <[email protected]>
Date: Sat May 24 14:06:19 2014 -0400
Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
John W. Linville says:
====================
pull request: wireless 2014-05-23
I have two more fixes intended for the 3.15 stream...
For the iwlwifi one, Emmanuel says:
"A race has been discovered in the beacon filtering code. Since the fix is too big for 3.15, I disable here the feature."
For the bluetooth one, Gustavo says:
"This pull request contains a very important fix for 3.15. Here we fix the permissions of a debugfs file that would otherwise allow unauthorized users to write content to it."
Please let me know if there are problems!
====================
commit 7df566bbdd0af0785542b89466a937e94257fcfb
Author: Dan Carpenter <[email protected]> Date: Fri May 23 19:37:21 2014 +0300
qlcnic: info leak in qlcnic_dcb_peer_app_info()
This function is called from dcbnl_build_peer_app(). The "info" struct isn't initialized at all so we disclose 2 bytes of uninitialized stack data. We should clear it before passing it to the user.
commit 1d61367f522726e789aec68f7da1803c365fa4d3
Author: Bart De Schuymer <[email protected]> Date: Thu May 22 20:57:13 2014 +0200
ebtables: Update MAINTAINERS entry.
commit 037430078fbbb956a9bd6ada00f528e9d1e4c92c
Merge: 1ee1cea c1f43dd
Author: Linus Torvalds <[email protected]>
Date: Fri May 23 16:52:15 2014 -0700
Merge tag 'dmaengine-fixes-3.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/dmaengine
Pull dmaengine fixes from Dan Williams:
"Two fixes for -stable:
- async_mult() sometimes maps less buffers than initially requested. We end up freeing dmaengine_unmap_data on an invalid pool.
- mv_xor: register write ordering fix"
* tag 'dmaengine-fixes-3.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/dmaengine:
dmaengine: fix dmaengine_unmap failure
dma: mv_xor: Flush descriptors before activating a channel
commit 1ee1ceafb572f1a925809168267a7962a4289de8
Merge: 5fa6a68 8ecc1ba
Author: Linus Torvalds <[email protected]>
Date: Fri May 23 15:41:52 2014 -0700
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc
Pull sparc fixes from David Miller:
"A small bunch of bug fixes, in particular:
1) On older cpus we need a different chunk of virtual address space to map the huge page TSB.
2) Missing memory barrier in Niagara2 memcpy.
3) trinity showed some places where fault validation was unnecessarily loud on sparc64
4) Some sysfs printf's need a type adjustment, from Toralf Förster"
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
sparc64: fix format string mismatch in arch/sparc/kernel/sysfs.c
sparc64: Add membar to Niagara2 memcpy code.
sparc64: Fix huge TSB mapping on pre-UltraSPARC-III cpus.
sparc64: Don't bark so loudly about 32-bit tasks generating 64-bit fault addresses.
commit 5fa6a683c061cd4662b436135cc76552dbc29a43
Merge: f02f79d b6ed549
Author: Linus Torvalds <[email protected]>
Date: Fri May 23 15:29:43 2014 -0700
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:
"It looks like a sizeble collection but this is nearly 3 weeks of bug
fixing while you were away.
1) Fix crashes over IPSEC tunnels with NAT, the latter can reroute the packet through a non-IPSEC protected path and the code has to be able to handle SKBs attached to routes lacking an attached xfrm state. From Steffen Klassert.
2) Fix OOPSs in ipv4 and ipv6 ipsec layers for unsupported sub-protocols, also from Steffen Klassert.
3) Set local_df on fragmented netfilter skbs otherwise we won't be able to forward successfully, from Florian Westphal.
4) cdc_mbim ipv6 neighbour code does __vlan_find_dev_deep without holding RCU lock, from Bjorn Mork.
5) local_df test in ip_may_fragment is inverted, from Florian Westphal.
6) jme driver doesn't check for DMA mapping failures, from Neil Horman.
7) qlogic driver doesn't calculate number of TX queues properly, from Shahed Shaikh.
8) fib_info_cnt can drift irreversibly positive if we fail to allocate the fi->fib_metrics array, from Sergey Popovich.
9) Fix use after free in ip6_route_me_harder(), also from Sergey Popovich.
10) When SYSCTL is disabled, we don't handle local_port_range and ping_group_range defaults properly at all, from Cong Wang.
11) Unaccelerated VLAN tagged frames improperly handled by cdc_mbim driver, fix from Bjorn Mork.
12) cassini driver needs nested lock annotations for TX locking, from Emil Goode.
13) On init error ipv6 VTI driver can unregister pernet ops twice, oops. Fix from Mahtias Krause.
14) If macvlan device is down, don't propagate IFF_ALLMULTI changes, from Peter Christensen.
15) Missing NULL pointer check while parsing netlink config options in ip6_tnl_validate(). From Susant Sahani.
16) Fix handling of neighbour entries during ipv6 router reachability probing, from Duan Jiong.
17) x86 and s390 JIT address randomization has some address calculation bugs leading to crashes, from Alexei Starovoitov and Heiko Carstens.
18) Clear up those uglies with nop patching and net_get_random_once(), from Hannes Frederic Sowa.
19) Option length miscalculated in ip6_append_data(), fix also from Hannes Frederic Sowa.
20) A while ago we fixed a race during device unregistry when a namespace went down, turns out there is a second place that needs similar protection. From Cong Wang.
21) In the new Altera TSE driver multicast filtering isn't working, disable it and just use promisc mode until the cause is found. From Vince Bridgers.
22) When we disable router enabling in ipv6 we have to flush the cached routes explicitly, from Duan Jiong.
23) NBMA tunnels should not cache routes on the tunnel object because the key is variable, from Timo Teräs.
24) With stacked devices GRO information in skb->cb[] can be not setup properly, make sure it is in all code paths. From Eric Dumazet.
25) Really fix stacked vlan locking, multiple levels of nesting with intervening non-vlan devices are possible. From Vlad Yasevich.
26) Fallback ipip tunnel device's mtu is not setup properly, from Steffen Klassert.
27) The packet scheduler's tcindex filter can crash because we structure copy objects with list_head's inside, oops. From Cong Wang.
28) Fix CHECKSUM_COMPLETE handling for ipv6 GRE tunnels, from Eric Dumazet.
29) In some configurations 'itag' in __mkroute_input() can end up being used uninitialized because of how fib_validate_source() works. Fix it by explitly initializing itag to zero like all the other fib_validate_source() callers do, from Li RongQing"
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (116 commits)
batman: fix a bogus warning from batadv_is_on_batman_iface()
ipv4: initialise the itag variable in __mkroute_input
bonding: Send ALB learning packets using the right source
bonding: Don't assume 802.1Q when sending alb learning packets.
net: doc: Update references to skb->rxhash
stmmac: Remove unbalanced clk_disable call
ipv6: gro: fix CHECKSUM_COMPLETE support
net_sched: fix an oops in tcindex filter
can: peak_pci: prevent use after free at netdev removal
ip_tunnel: Initialize the fallback device properly
vlan: Fix build error wth vlan_get_encap_level()
can: c_can: remove obsolete STRICT_FRAME_ORDERING Kconfig option
MAINTAINERS: Pravin Shelar is Open vSwitch maintainer.
bnx2x: Convert return 0 to return rc
bonding: Fix alb mode to only use first level vlans.
bonding: Fix stacked device detection in arp monitoring
macvlan: Fix lockdep warnings with stacked macvlan devices
vlan: Fix lockdep warning with stacked vlan devices.
net: Allow for more then a single subclass for netif_addr_lock
net: Find the nesting level of a given device by type.
...
commit 72b1c2c3a4de8891b06df18da95514d69eae65de
Author: Valentin Ilie <[email protected]> Date: Tue Apr 22 16:15:54 2014 +0300
clk: st: Fix memory leak
When it fails to allocate div, gate should be free'd before return
commit 5644b4277fa1d8697479468ad404426a8644149b
Merge: 3aae97c 68d0e40
Author: Arnd Bergmann <[email protected]>
Date: Fri May 23 23:59:28 2014 +0200
Merge tag 'samsung-fixes-2nd-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes
Samsung-fixes-2 for 3.15
- keep LD04 always on for exynos5250-arndale
- fix spi interrupt numbers for exynos5420
- fix ak8975 compatible for exynos4412-trats2
* tag 'samsung-fixes-2nd-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
ARM: dts: Keep LDO4 always ON for exynos5250-arndale board
ARM: dts: Fix SPI interrupt numbers for exynos5420
ARM: dts: fix incorrect ak8975 compatible for exynos4412-trats2 board
commit fe52e7505f8bf365d5ab0eeee19ababe406cbaaf
Author: Maxime COQUELIN <[email protected]> Date: Wed May 7 18:48:52 2014 +0200
clk: divider: Fix table round up function
Commit 1d9fe6b97 ("clk: divider: Fix best div calculation for power-of-two and table dividers") introduces a regression in its _table_round_up function.
When the divider passed to this function is greater than the max divider available in the table, this function returns table's max divider. Problem is that it causes an infinite loop in clk_divider_bestdiv() because _next_div() will never return a value greater than maxdiv.
Instead of returning table's max divider, this patch returns INT_MAX.
commit 3aae97c8b1dbefb23217d193e2818d1490651c95
Author: Alexandre Courbot <[email protected]> Date: Fri May 23 09:23:32 2014 +0900
ARM: trusted_foundations: fix compile error on non-SMP
The setup_max_cpus variable is only defined if CONFIG_SMP is set. Add a preprocessor condition to avoid the following compilation error if CONFIG_SMP is not set:
arch/arm/include/asm/trusted_foundations.h: In function 'register_trusted_foundations':
arch/arm/include/asm/trusted_foundations.h:57:2: error: 'setup_max_cpus' undeclared (first use in this function)
commit 8ef42ddd9a53b73e6fc3934278710c27f80f324f
Author: Alan Stern <[email protected]> Date: Fri May 23 10:45:54 2014 -0400
USB: Avoid runtime suspend loops for HCDs that can't handle suspend/resume
Not all host controller drivers have bus-suspend and bus-resume methods. When one doesn't, it will cause problems if runtime PM is enabled in the kernel. The PM core will attempt to suspend the controller's root hub, the suspend will fail because there is no bus-suspend routine, and a -EBUSY error code will be returned to the PM core. This will cause the suspend attempt to be repeated shortly thereafter, in a never-ending loop.
Part of the problem is that the original error code -ENOENT gets changed to -EBUSY in usb_runtime_suspend(), on the grounds that the PM core will interpret -ENOENT as meaning that the root hub has gotten into a runtime-PM error state. While this change is appropriate for real USB devices, it's not such a good idea for a root hub. In fact, considering the root hub to be in a runtime-PM error state would not be far from the truth. Therefore this patch updates usb_runtime_suspend() so that it adjusts error codes only for non-root-hub devices.
Furthermore, the patch attempts to prevent the problem from occurring in the first place by not enabling runtime PM by default for root hubs whose host controller driver doesn't have bus_suspend and bus_resume methods.
commit 28a821c306889b9f2c3fff49abedc9b2c743eb73
Author: Ben Hutchings <[email protected]> Date: Mon May 19 01:03:06 2014 +0100
Staging: speakup: Update __speakup_paste_selection() tty (ab)usage to match vt
This function is largely a duplicate of paste_selection() in drivers/tty/vt/selection.c, but with its own selection state. The speakup selection mechanism should really be merged with vt.
For now, apply the changes from 'TTY: vt, fix paste_selection ldisc handling', 'tty: Make ldisc input flow control concurrency-friendly', and 'tty: Fix unsafe vt paste_selection()'.
References: https://bugs.debian.org/735202
References: https://bugs.debian.org/744015
commit d7500135802ca55b3f4e01a16544e8b34082f8c3
Author: Ben Hutchings <[email protected]> Date: Mon May 19 00:56:22 2014 +0100
Staging: speakup: Move pasting into a work item
Input is handled in softirq context, but when pasting we may need to sleep. speakup_paste_selection() currently tries to bodge this by busy-waiting if in_atomic(), but that doesn't help because the ldisc may also sleep.
For bonus breakage, speakup_paste_selection() changes the state of current, even though it's not running in process context.
Move it into a work item and make sure to cancel it on exit.
References: https://bugs.debian.org/735202
References: https://bugs.debian.org/744015
commit f02f79dbcb9c0326588c1cbe24b40887737e71d3
Merge: e6a32c3 2b4cfe6
Author: Linus Torvalds <[email protected]>
Date: Fri May 23 10:04:04 2014 -0700
Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
"The biggest commit is an irqtime accounting loop latency fix, the rest
are misc fixes all over the place: deadline scheduling, docs, numa, balancer and a bad to-idle latency fix"
* 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/numa: Initialize newidle balance stats in sd_numa_init()
sched: Fix updating rq->max_idle_balance_cost and rq->next_balance in idle_balance()
sched: Skip double execution of pick_next_task_fair()
sched: Use CPUPRI_NR_PRIORITIES instead of MAX_RT_PRIO in cpupri check sched/deadline: Fix memory leak
sched/deadline: Fix sched_yield() behavior
sched: Sanitize irq accounting madness
sched/docbook: Fix 'make htmldocs' warnings caused by missing description
commit e6a32c3ad1e78a33dda5ee9e9ca5704288d35fd4
Merge: 2b2d323 b69cf53
Author: Linus Torvalds <[email protected]>
Date: Fri May 23 10:02:34 2014 -0700
Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf fixes from Ingo Molnar:
"The biggest changes are fixes for races that kept triggering Trinity
crashes, plus liblockdep build fixes and smaller misc fixes.
The liblockdep bits in perf/urgent are a pull mistake - they should have been in locking/urgent - but by the time I noticed other commits were added and testing was done :-/ Sorry about that"
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Fix a race between ring_buffer_detach() and ring_buffer_attach()
perf: Prevent false warning in perf_swevent_add
perf: Limit perf_event_attr::sample_period to 63 bits tools/liblockdep: Remove all build files when doing make clean tools/liblockdep: Build liblockdep from tools/Makefile perf/x86/intel: Fix Silvermont's event constraints
perf: Fix perf_event_init_context()
perf: Fix race in removing an event
commit 2b2d323a31dc8b369a4c0e33705339399021fa83
Merge: fc3ac5c 77c01be
Author: Linus Torvalds <[email protected]>
Date: Fri May 23 09:41:33 2014 -0700
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm radeon and nouveau fixes from Dave Airlie:
"Fixes for the other big two.
The radeon VCE one is large but it fixes some userspace triggerable issues, otherwise its blackscreens and oopses.
Nouveau fixes a bleeding laptop panel issue when displayport is used sometimes"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/radeon/pm: don't allow debugfs/sysfs access when PX card is off (v2) drm/radeon: avoid segfault on device open when accel is not working. drm/radeon: fix typo in finding PLL params
drm/radeon: fix register typo on si
drm/radeon: fix buffer placement under memory pressure v2 drm/radeon: fix page directory update size estimation drm/radeon: handle non-VGA class pci devices with ATRM drm/radeon: fix DCE83 check for mullins
drm/radeon: check VCE relocation buffer range v3 drm/radeon: also try GART for CPU accessed buffers drm/gf119-/disp: fix nasty bug which can clobber SOR0's clock setup drm/nvd9/therm: handle another kind of PWM fan
commit fc3ac5c75bae55ca6a070eb72038a94d4f130d8d
Merge: 9abd09a 0d9327a
Author: Linus Torvalds <[email protected]>
Date: Fri May 23 09:38:07 2014 -0700
Merge branch 'akpm' (incoming from Andrew)
Merge misc fixes from Andrew Morton:
"9 fixes"
* emailed patches from Andrew Morton <[email protected]>:
MAINTAINERS: add closing angle bracket to Vince Bridgers' email address
Documentation: fix DOCBOOKS=... building
ocfs2: fix double kmem_cache_destroy in dlm_init
mm/memory-failure.c: fix memory leak by race between poison and unpoison
wait: swap EXIT_ZOMBIE(Z) and EXIT_DEAD(X) chars in TASK_STATE_TO_CHAR_STR
memcg: fix swapcache charge from kernel thread context
mm: madvise: fix MADV_WILLNEED on shmem swapouts
mm/filemap.c: avoid always dirtying mapping->flags on O_DIRECT hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage
commit 0d9327ab70038ac8c7af6e20456578ab80158f2d
Author: Tobias Klauser <[email protected]> Date: Thu May 22 11:54:24 2014 -0700
MAINTAINERS: add closing angle bracket to Vince Bridgers' email address
commit e60cbeedc48d80689c249ab5dcc3c31ad0452dea
Author: Johannes Berg <[email protected]> Date: Thu May 22 11:54:23 2014 -0700
Documentation: fix DOCBOOKS=... building
Prior to commit 4266129964b8 ("[media] DocBook: Move all media docbook stuff into its own directory") it was possible to build only a single (or more) book(s) by calling, for example
make htmldocs DOCBOOKS=80211.xml
This now fails:
cp: target `.../Documentation/DocBook//media_api' is not a directory
Ignore errors from that copy to make this possible again.
commit 66db6cfd49825f4e3462ceee3bcbb292d57da6fb
Author: Joseph Qi <[email protected]> Date: Thu May 22 11:54:22 2014 -0700
ocfs2: fix double kmem_cache_destroy in dlm_init
In dlm_init, if create dlm_lockname_cache failed in dlm_init_master_caches, it will destroy dlm_lockres_cache which created before twice. And this will cause system die when loading modules.
commit 3e030ecc0fc7de10fd0da10c1c19939872a31717
Author: Naoya Horiguchi <[email protected]> Date: Thu May 22 11:54:21 2014 -0700
mm/memory-failure.c: fix memory leak by race between poison and unpoison
When a memory error happens on an in-use page or (free and in-use) hugepage, the victim page is isolated with its refcount set to one.
When you try to unpoison it later, unpoison_memory() calls put_page() for it twice in order to bring the page back to free page pool (buddy or free hugepage list). However, if another memory error occurs on the page which we are unpoisoning, memory_failure() returns without releasing the refcount which was incremented in the same call at first, which results in memory leak and unconsistent num_poisoned_pages statistics. This patch fixes it.
commit ad0f614e4723db8cead439cf414108cbf975b224
Author: Masatake YAMATO <[email protected]> Date: Thu May 22 11:54:20 2014 -0700
wait: swap EXIT_ZOMBIE(Z) and EXIT_DEAD(X) chars in TASK_STATE_TO_CHAR_STR
In commit ad86622b478e ("wait: swap EXIT_ZOMBIE and EXIT_DEAD to hide EXIT_TRACE from user-space") the order of task state definitions were
changed: EXIT_DEAD and EXIT_ZOMBIE were swapped. Though the charterers for the states in TASK_STATE_TO_CHAR_STR string were not updated. This patch synchronizes the string to the order of definitions.
commit 6f6acb00514c10be35529402f36ad7a288f08c2e
Author: Michal Hocko <[email protected]> Date: Thu May 22 11:54:19 2014 -0700
memcg: fix swapcache charge from kernel thread context
Commit 284f39afeaa4 ("mm: memcg: push !mm handling out to page cache charge function") explicitly checks for page cache charges without any mm context (from kernel thread context[1]).
This seemed to be the only possible case where memory could be charged without mm context so commit 03583f1a631c ("memcg: remove unnecessary !mm check from try_get_mem_cgroup_from_mm()") removed the mm check from get_mem_cgroup_from_mm(). This however caused another NULL ptr dereference during early boot when loopback kernel thread splices to tmpfs as reported by Stephan Kulow:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000360
IP: get_mem_cgroup_from_mm.isra.42+0x2b/0x60
Oops: 0000 [#1] SMP
Modules linked in: btrfs dm_multipath dm_mod scsi_dh multipath raid10 raid456 async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx raid1 raid0 md_mod parport_pc parport nls_utf8 isofs usb_storage iscsi_ibft iscsi_boot_sysfs arc4 ecb fan thermal nfs lockd fscache nls_iso8859_1 nls_cp437 sg st hid_generic usbhid af_packet sunrpc sr_mod cdrom ata_generic uhci_hcd virtio_net virtio_blk ehci_hcd usbcore ata_piix floppy processor button usb_common virtio_pci virtio_ring virtio edd squashfs loop ppa]
CPU: 0 PID: 97 Comm: loop1 Not tainted 3.15.0-rc5-5-default #1
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
__mem_cgroup_try_charge_swapin+0x40/0xe0
mem_cgroup_charge_file+0x8b/0xd0
shmem_getpage_gfp+0x66b/0x7b0
shmem_file_splice_read+0x18f/0x430
splice_direct_to_actor+0xa2/0x1c0
do_lo_receive+0x5a/0x60 [loop]
loop_thread+0x298/0x720 [loop]
kthread+0xc6/0xe0
ret_from_fork+0x7c/0xb0
Also Branimir Maksimovic reported the following oops which is tiggered for the swapcache charge path from the accounting code for kernel threads:
CPU: 1 PID: 160 Comm: kworker/u8:5 Tainted: P OE 3.15.0-rc5-core2-custom #159
Hardware name: System manufacturer System Product Name/MAXIMUSV GENE, BIOS 1903 08/19/2013
task: ffff880404e349b0 ti: ffff88040486a000 task.ti: ffff88040486a000
RIP: get_mem_cgroup_from_mm.isra.42+0x2b/0x60
Call Trace:
__mem_cgroup_try_charge_swapin+0x45/0xf0 mem_cgroup_charge_file+0x9c/0xe0
shmem_getpage_gfp+0x62c/0x770
shmem_write_begin+0x38/0x40
generic_perform_write+0xc5/0x1c0
__generic_file_aio_write+0x1d1/0x3f0
generic_file_aio_write+0x4f/0xc0
do_sync_write+0x5a/0x90
do_acct_process+0x4b1/0x550
acct_process+0x6d/0xa0
do_exit+0x827/0xa70
kthread+0xc3/0xf0
This patch fixes the issue by reintroducing mm check into get_mem_cgroup_from_mm. We could do the same trick in __mem_cgroup_try_charge_swapin as we do for the regular page cache path but it is not worth troubles. The check is not that expensive and it is better to have get_mem_cgroup_from_mm more robust.
[1] - http://marc.info/?l=linux-mm&m=139463617808941&w=2
commit 55231e5c898c5c03c14194001e349f40f59bd300
Author: Johannes Weiner <[email protected]> Date: Thu May 22 11:54:17 2014 -0700
mm: madvise: fix MADV_WILLNEED on shmem swapouts
MADV_WILLNEED currently does not read swapped out shmem pages back in.
Commit 0cd6144aadd2 ("mm + fs: prepare for non-page entries in page cache radix trees") made find_get_page() filter exceptional radix tree entries but failed to convert all find_get_page() callers that WANT exceptional entries over to find_get_entry(). One of them is shmem swap readahead in madvise, which now skips over any swap-out records.
Convert it to find_get_entry().
commit 7fcbbaf18392f0b17c95e2f033c8ccf87eecde1d
Author: Jens Axboe <[email protected]> Date: Thu May 22 11:54:16 2014 -0700
mm/filemap.c: avoid always dirtying mapping->flags on O_DIRECT
In some testing I ran today (some fio jobs that spread over two nodes), we end up spending 40% of the time in filemap_check_errors(). That smells fishy. Looking further, this is basically what happens:
blkdev_aio_read()
generic_file_aio_read()
filemap_write_and_wait_range()
if (!mapping->nr_pages)
filemap_check_errors()
and filemap_check_errors() always attempts two test_and_clear_bit() on the mapping flags, thus dirtying it for every single invocation. The patch below tests each of these bits before clearing them, avoiding this issue. In my test case (4-socket box), performance went from 1.7M IOPS to 4.0M IOPS.
commit b985194c8c0a130ed155b71662e39f7eaea4876f
Author: Chen Yucong <[email protected]> Date: Thu May 22 11:54:15 2014 -0700
hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage
For handling a free hugepage in memory failure, the race will happen if another thread hwpoisoned this hugepage concurrently. So we need to check PageHWPoison instead of !PageHWPoison.
If hwpoison_filter(p) returns true or a race happens, then we need to unlock_page(hpage).
commit ffed54dced86723f352323f15789d9ad6bee25e1
Author: Ian Abbott <[email protected]> Date: Mon May 19 11:29:04 2014 +0100
staging: comedi: ni_daq_700: add mux settling delay
I got a patch from the original author, Fred Brooks, to add a small settling delay after setting the AI channel multiplexor. The lack of delay resulted in unstable or scrambled data on faster processors.
commit 478da752d0cf652fb3b5d82e2ece94e92724de88
Author: Rusty Russell <[email protected]> Date: Thu Apr 24 13:59:53 2014 +0930
speakup: fix incorrect perms on speakup_acntsa.c
22c9bcad859d5c969289b3b37084a96c621f8f2c contained a bad substitution for ROOT_W => S_IRUSR|S_IRUGO instead of S_IWUSR|S_IRUGO.
commit 9abd09acd664c68f06242da191209d9c70df6953
Author: Linus Torvalds <[email protected]> Date: Fri May 23 09:23:51 2014 -0700
parisc: 'renameat2()' doesn't need (or have) a separate compat system call
The 'renameat2()' system call was incorrectly added as a ENTRY_COMP() in the parisc system call table by commit 18e480aa07f78 ("parisc: add renameat2 syscall"). That causes a link-time error due to there not being any compat version of that system call:
arch/parisc/kernel/built-in.o: In function `sys_call_table':
(.rodata+0xad0): undefined reference to `compat_sys_renameat2'
make: *** [vmlinux] Error 1
Easily fixed by marking the system call as being the same for compat as for native by using ENTRY_SAME() instead of ENTRY_COMP().
commit 756abc8d6de06f0afc2121f69030f0d3f4f8177a
Merge: 85aea46 13984e9
Author: Arnd Bergmann <[email protected]>
Date: Fri May 23 18:13:15 2014 +0200
Merge tag 'at91-fixes2' of git://github.com/at91linux/linux-at91 into fixes
Second 3.15 fixes for AT91
- two fixes concerning iio ADC triggers for at91sam9260 and at91sam9g20 one for the "device" file, the other for the DT.
* tag 'at91-fixes2' of git://github.com/at91linux/linux-at91:
ARM: at91: sam9260: fix compilation issues
ARM: at91/dt: sam9260: correct external trigger value
commit 85aea469ef65091ddcfadb848af1ef7ef1d9cedd
Merge: 767bf9f d903bc9
Author: Arnd Bergmann <[email protected]>
Date: Fri May 23 18:11:01 2014 +0200
Merge tag 'mvebu-fixes-3.15-2' of git://git.infradead.org/linux-mvebu into fixes
mvebu fixes for v3.15 (incremental #2)
- Armada 38x
- fix PCIe dt nodes for handling more interfaces
- mvebu
- mvebu-soc-id: fix clock handling and PCIe interface disabling.
* tag 'mvebu-fixes-3.15-2' of git://git.infradead.org/linux-mvebu:
ARM: mvebu: fix definitions of PCIe interfaces on Armada 38x
ARM: mvebu: mvebu-soc-id: keep clock enabled if PCIe unit is enabled
ARM: mvebu: mvebu-soc-id: add missing clk_put() call
commit 5ca2504ea36df1da815029a9e9277c08540042eb
Merge: b6ed549 2c316e6
Author: John W. Linville <[email protected]>
Date: Fri May 23 10:55:58 2014 -0400
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
commit 656f88ddf1ec3abf2cd20b8b4028c44e8e95f56d
Author: David Howells <[email protected]> Date: Wed May 21 15:55:26 2014 +0100
AFS: Pass an afs_call* to call->async_workfn() instead of a work_struct*
call->async_workfn() can take an afs_call* arg rather than a work_struct* as the functions assigned there are now called from afs_async_workfn() which has to call container_of() anyway.
commit 150a6b478982475c60fa25b7060ab990ece5483d
Author: Nathaniel Wesley Filardo <[email protected]> Date: Wed May 21 14:58:26 2014 +0100
AFS: Fix kafs module unloading
At present, it is not possible to successfully unload the kafs module if there are outstanding async outgoing calls (those made with afs_make_call()). This appears to be due to the changes introduced by:
commit 059499453a9abd1857d442b44da8b4c126dc72a8
Author: Tejun Heo <[email protected]>
Date: Fri Mar 7 10:24:50 2014 -0500
Subject: afs: don't use PREPARE_WORK
which didn't go far enough. The problem is due to:
(1) The aforementioned commit introduced a separate handler function pointer in the call, call->async_workfn, in addition to the original workqueue item, call->async_work, for asynchronous operations because workqueues subsystem cannot handle the workqueue item pointer being changed whilst the item is queued or being processed.
(2) afs_async_workfn() was introduced in that commit to be the callback for call->async_work. Its sole purpose is to run whatever call->async_workfn points to.
(3) call->async_workfn is only used from afs_async_workfn(), which is only set on async_work by afs_collect_incoming_call() - ie. for incoming calls.
(4) call->async_workfn is *not* set by afs_make_call() when outgoing calls are made, and call->async_work is set afs_process_async_call() - and not afs_async_workfn().
(5) afs_process_async_call() now changes call->async_workfn rather than call->async_work to point to afs_delete_async_call() to clean up, but this is only effective for incoming calls because call->async_work does not point to afs_async_workfn() for outgoing calls.
(6) Because, for incoming calls, call->async_work remains pointing to afs_process_async_call() this results in an infinite loop.
Instead, make the workqueue uniformly vector through call->async_workfn, via afs_async_workfn() and simply initialise call->async_workfn to point to afs_process_async_call() in afs_make_call().
commit 6cf12869f5c1a837f18af5f8b2308fa243772735
Author: Nathaniel Wesley Filardo <[email protected]> Date: Wed May 21 16:04:11 2014 +0100
AFS: Part of afs_end_call() is identical to code elsewhere, so split it
Split afs_end_call() into two pieces, one of which is identical to code in afs_process_async_call(). Replace the latter with a call to the first part of afs_end_call().
commit 77f07800cb456bed6e5c345e6e4e83e8eda62437
Author: Takashi Iwai <[email protected]> Date: Fri May 23 09:02:44 2014 +0200
ALSA: hda - Fix onboard audio on Intel H97/Z97 chipsets
The recent Intel H97/Z97 chipsets need the similar setups like other Intel chipsets for snooping, etc. Especially without snooping, the audio playback stutters or gets corrupted. This fix patch just adds the corresponding PCI ID entry with the proper flags.
commit 41ca86e8502952116234fa558f4277092a5aaae9
Author: Ralf Baechle <[email protected]> Date: Thu May 22 23:19:00 2014 +0200
MIPS: Fix branch emulation of branch likely instructions.
Two issues:
o For beql_op, beql_op, bne_op, bnel_op, blez_op, blezl_op, bgtz_op and bgtzl_op the wrong field was being checked for the instruction opcode.
o For blez_op / blezl_op and bgtz_op / bgtzl_op the test was testing for the wrong opcode.
This bug got introduced by d8d4e3ae0b5c179c0bfd3f0af5b352d13bea9cfa [MIPS
Kprobes: Refactor branch emulation].
commit 6aa6caff30f5dcb9e55b03b9710c30b83750cae5
Author: Joe Lawrence <[email protected]> Date: Thu May 22 17:30:54 2014 -0400
[SCSI] scsi_transport_sas: move bsg destructor into sas_rphy_remove
The recent change in sysfs, bcdde7e221a8750f9b62b6d0bd31b72ea4ad9309 "sysfs: make __sysfs_remove_dir() recursive" revealed an asymmetric rphy device creation/deletion sequence in scsi_transport_sas:
modprobe mpt2sas
sas_rphy_add
device_add A rphy->dev
device_add B sas_device transport class
device_add C sas_end_device transport class
device_add D bsg class
rmmod mpt2sas
sas_rphy_delete
sas_rphy_remove
device_del B
device_del C
device_del A
sysfs_remove_group recursive sysfs dir removal
sas_rphy_free
device_del D warning
where device A is the parent of B, C, and D.
When sas_rphy_free tries to unregister the bsg request queue (device D above), the ensuing sysfs cleanup discovers that its sysfs group has already been removed and emits a warning, "sysfs group... not found for kobject 'end_device-X:0'".
Since bsg creation is a side effect of sas_rphy_add, move its complementary removal call into sas_rphy_remove. This imposes the following tear-down order for the devices above: D, B, C, A.
Note the sas_device and sas_end_device transport class devices (B and C above) are created and destroyed both via the list match traversal in attribute_container_device_trigger, so the order in which they are handled is fixed. This is fine as long as they are deleted before their parent device.
commit 7ea456436ff6563b6cf89d3254ae76a8ceab499b
Author: Alexey Charkov <[email protected]> Date: Tue Apr 29 23:42:00 2014 +0400
pinctrl: vt8500: Ensure value reg is updated when setting direction
Current code only touches the direction register when setting direction to output, which breaks logic like
echo high > /sys/class/gpio/gpio0/direction
which is expected to also set the value. This patch also adds a call to update the value register when setting direction to output.
commit b6ed5498601df40489606dbc14a9c7011c16630b
Author: Cong Wang <[email protected]> Date: Thu May 22 11:57:17 2014 -0700
batman: fix a bogus warning from batadv_is_on_batman_iface()
batman tries to search dev->iflink to check if it's a batman interface, but ->iflink could be 0, which is not a valid ifindex. It should just avoid iflink == 0 case.
commit fbdc0ad095c0a299e9abf5d8ac8f58374951149a
Author: Li RongQing <[email protected]> Date: Thu May 22 16:36:55 2014 +0800
ipv4: initialise the itag variable in __mkroute_input
the value of itag is a random value from stack, and may not be initiated by fib_validate_source, which called fib_combine_itag if CONFIG_IP_ROUTE_CLASSID is not set
This will make the cached dst uncertainty
commit d0c21d43a5a12aaebb1e42e10cf78e6491fc9e5a
Author: Vlad Yasevich <[email protected]> Date: Wed May 21 13:19:48 2014 -0400
bonding: Send ALB learning packets using the right source
ALB learning packets are currentlyalways sent using the slave mac
address for all vlans configured on top of bond. This is not always
correct, as vlans may change their mac address.
This patch introduced a concept of strict matching where the source of learning packets can either strictly match the address passed in, or it can determine a more correct address to use.
There are 3 casese to consider:
1) Switchover. In this case, we have a new active slave and we need tell the switch about all addresses available on the slave.
2) Monitor. We'll periodically refresh learning info for all slaves. In this case, we refresh all addresses for current active, and just the slave address for other slaves.
3) Teaching of disabled adddress. This happens as part of the failover and in this case, we alwyas to use just the address provided.
commit d6b694c0b3f20c3ee54d29d4109fa1978d11a033
Author: Vlad Yasevich <[email protected]> Date: Wed May 21 11:24:39 2014 -0400
bonding: Don't assume 802.1Q when sending alb learning packets.
TLB/ALB learning packets always assume 802.1Q vlan protocol, but that is no longer the case since we now have support for Q-in-Q on top of bonding. Pass the vlan protocol to alb_send_lp_vid() so that the packets are properly tagged.
commit a3431acf742455ba738c9fb143802d4ad6937164
Merge: b0db5cd 0b5a958
Author: David S. Miller <[email protected]>
Date: Thu May 22 15:41:20 2014 -0400
Merge tag 'linux-can-fixes-for-3.15-20140521' of git://gitorious.org/linux-can/linux-can
Marc Kleine-Budde says:
====================
pull-request: can 2014-05-21
this is a pull request for net/master, for the v3.15 release cycle, with a single patch. Christopher R. Baker found a use after free during unloading of the peak_pci driver. This is fixes in a patch by Stephane Grosjean.
====================
commit b0db5cdf3975134ca967e8b8370a8f0c91ce2329
Author: Tobias Klauser <[email protected]> Date: Tue May 20 13:52:13 2014 +0200
net: doc: Update references to skb->rxhash
In commit 61b905da33 ("net: Rename skb->rxhash to skb->hash"), skb->rxhash was renamed to skb->hash. Update references in Documentation accordingly.
commit 89df20d951b310f3e33422554054ae6e58a3c7a9
Author: Hans de Goede <[email protected]> Date: Tue May 20 11:38:18 2014 +0200
stmmac: Remove unbalanced clk_disable call
The stmmac_open call was calling clk_disable_unprepare on phy init failure, but it never calls clk_prepare_enable, this causes a WARN_ON in the clk framework to trigger if for some reason phy init fails.
commit 2c316e699fa40f2fc161ebb770b6e2845db4f3b0
Merge: 20b4f9c 7bacc78
Author: John W. Linville <[email protected]>
Date: Thu May 22 13:53:27 2014 -0400
Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes
commit acbf6d21ac81195071b97ebb114b0b37bd9fcc86
Author: David Jander <[email protected]> Date: Thu May 8 12:06:25 2014 +0200
clocksource: tcb_clksrc: Make tc_mode interrupt safe
tc_mode() can be called from interrupt context and thus must not call clk_*prepare*() functions.
commit f214be50f317d78c47532d4ca8aa0ba5e79fc1ca
Author: Zhiwu Song <[email protected]> Date: Wed May 7 14:46:44 2014 +0800
clocksource: marco: Fix the affinity set for local timer of CPU1
irqchip will reject the affinity set to CPUs which is not online yet. but in the CPU1 wakeup stage, OS only sets CPU1 to be online after local timer is set, so that causes the irq_set_affinity not work. this patch moves to irq_force_affinity() for the low level boot stage.
commit 13984e9bb15528f70059bbbbda3f9028157eebf6
Author: Alexandre Belloni <[email protected]> Date: Wed May 7 19:45:48 2014 +0200
ARM: at91: sam9260: fix compilation issues
Use the hexadecimal values for the triggers to match what is done for the device tree. This also fixes compilation issues as the defines have been moved elsewhere.
commit d903bc9ee9b67410d02923d98a8dd4ecf5a1bc69
Merge: b25bcf1 c2a3dd9
Author: Jason Cooper <[email protected]>
Date: Thu May 22 15:16:37 2014 +0000
Merge branch 'mvebu/dt-fixes' into mvebu/fixes
commit c2a3dd9d2b30f65b4f4a62cb5a9b2c7131bd1ac4
Author: Thomas Petazzoni <[email protected]> Date: Tue May 20 16:43:28 2014 +0200
ARM: mvebu: fix definitions of PCIe interfaces on Armada 38x
Due a copy/paste error, the 'reg' values for the third PCIe interface on Armada 380, and the third and fourth PCIe interfaces on Armada 385 are wrong: they are equal to the one of the second PCIe interface.
This patch fixes this by using the appropriate 'reg' values for those PCIe interfaces.
Without this fix, the third and fourth PCIe interfaces are unusable on those platforms.
commit dc93f7b68a039fe7d918613163b1cdd21b279ec5
Author: Huacai Chen <[email protected]> Date: Wed May 21 10:49:19 2014 +0800
MIPS: Fix a typo error in AUDIT_ARCH definition
Missing a "|" in AUDIT_ARCH_MIPSEL64N32 macro definition.
Patchwork: https://patchwork.linux-mips.org/patch/6978/
commit 6acbfb96976fc3350e30d964acb1dbbdf876d55e
Author: Lai Jiangshan <[email protected]> Date: Fri May 16 11:50:42 2014 +0800
sched: Fix hotplug vs. set_cpus_allowed_ptr()
Lai found that:
WARNING: CPU: 1 PID: 13 at arch/x86/kernel/smp.c:124 native_smp_send_reschedule+0x2d/0x4b()
...
migration_cpu_stop+0x1d/0x22
was caused by set_cpus_allowed_ptr() assuming that cpu_active_mask is always a sub-set of cpu_online_mask.
This isn't true since 5fbd036b552f ("sched: Cleanup cpu_active madness").
So set active and online at the same time to avoid this particular problem.
commit 4dac0b638310d2e92f6e19958b73d4c97c9734bb
Author: Peter Zijlstra <[email protected]> Date: Wed May 14 16:04:26 2014 +0200
sched/cpupri: Replace NR_CPUS arrays
Tejun reported that his resume was failing due to order-3 allocations from sched_domain building.
Replace the NR_CPUS arrays in there with a dynamically allocated array.
commit 944770ab54babaef29d9d1dc8189898b3ee8afcf
Author: Peter Zijlstra <[email protected]> Date: Wed May 14 16:13:56 2014 +0200
sched/deadline: Replace NR_CPUS arrays
Tejun reported that his resume was failing due to order-3 allocations from sched_domain building.
Replace the NR_CPUS arrays in there with a dynamically allocated array.
commit b0827819b0da4acfbc1df1e05edcf50efd07cbd1
Author: Juri Lelli <[email protected]> Date: Tue May 13 14:11:31 2014 +0200
sched/deadline: Restrict user params max value to 2^63 ns
Michael Kerrisk noticed that creating SCHED_DEADLINE reservations with certain parameters (e.g, a runtime of something near 2^64 ns) can cause a system freeze for some amount of time.
The problem is that in the interface we have
u64 sched_runtime;
while internally we need to have a signed runtime (to cope with budget overruns)
s64 runtime;
At the time we setup a new dl_entity we copy the first value in the second. The cast turns out with negative values when sched_runtime is too big, and this causes the scheduler to go crazy right from the start.
Moreover, considering how we deal with deadlines wraparound
(s64)(a - b) < 0
we also have to restrict acceptable values for sched_{deadline,period}.
This patch fixes the thing checking that user parameters are always below 2^63 ns (still large enough for everyone).
It also rewrites other conditions that we check, since in __checkparam_dl we don't have to deal with deadline wraparounds and what we have now erroneously fails when the difference between values is too big.
commit ce5f7f8200ca2504f6f290044393d73ca314965a
Author: Peter Zijlstra <[email protected]> Date: Mon May 12 22:50:34 2014 +0200
sched/deadline: Change sched_getparam() behaviour vs SCHED_DEADLINE
The way we read POSIX one should only call sched_getparam() when sched_getscheduler() returns either SCHED_FIFO or SCHED_RR.
Given that we currently return sched_param::sched_priority=0 for all others, extend the same behaviour to SCHED_DEADLINE.
commit dbdb22754fde671dc93d2fae06f8be113d47f2fb
Author: Peter Zijlstra <[email protected]> Date: Fri May 9 10:49:03 2014 +0200
sched: Disallow sched_attr::sched_policy < 0
The scheduler uses policy=-1 to preserve the current policy state to implement sys_sched_setparam(), this got exposed to userspace by accident through sys_sched_setattr(), cure this.
commit 143cf23df25b7082cd706c3c53188e741e7881c3
Author: Michael Kerrisk <[email protected]> Date: Fri May 9 16:54:15 2014 +0200
sched: Make sched_setattr() correctly return -EFBIG
The documented[1] behavior of sched_attr() in the proposed man page text is:
sched_attr::size must be set to the size of the structure, as in sizeof(struct sched_attr), if the provided structure is smaller than the kernel structure, any additional fields are assumed '0'. If the provided structure is larger than the kernel structure, the kernel verifies all additional fields are '0' if not the syscall will fail with -E2BIG.
As currently implemented, sched_copy_attr() returns -EFBIG for for this case, but the logic in sys_sched_setattr() converts that error to -EFAULT. This patch fixes the behavior.
[1] http://thread.gmane.org/gmane.linux.kernel/1615615/focus=1697760
commit 767bf9f00ec753a3bba653844d7b858b8720707f
Merge: d1d70e5 4b353a7
Author: Olof Johansson <[email protected]>
Date: Wed May 21 22:19:27 2014 -0700
Merge tag 'omap-for-v3.15/fixes-v3-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes
Pull "omap fixes for v3.15-rc cycle" from Tony Lindgren:
Regression fixes for omaps for NAND, DMA, cpu_idle and audio. Also a minor one line fix for audio clock on 54xx.
* tag 'omap-for-v3.15/fixes-v3-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
ARM: OMAP4: Fix the boot regression with CPU_IDLE enabled
ARM: OMAP2+: Fix DMA hang after off-idle
ARM: OMAP2+: nand: Fix NAND on OMAP2 and OMAP3 boards
ARM: omap5: hwmod_data: Correct IDLEMODE for McPDM
ARM: OMAP3: clock: Back-propagate rate change from cam_mclk to dpll4_m5 on all OMAP3 platforms
commit d1d70e5dc2cfa9047bb935c41ba808ebb8135696
Author: Emil Goode <[email protected]> Date: Mon May 19 15:07:54 2014 +0800
ARM: imx: fix error handling in ipu device registration
If we fail to allocate struct platform_device pdev we dereference it after the goto label err.
This bug was found using coccinelle.
commit 3bc4a87c03e75c88471450380cb194bf30ea4a87
Merge: 4b660a7 702b691
Author: Olof Johansson <[email protected]>
Date: Wed May 21 22:16:30 2014 -0700
Merge tag 'samsung-fixes' of http://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes
Samsung fixes for 3.15 from Kukjin Kim:
- Remove g2d_pd and mau_pd nodes on exynos5420. Since the power domains are linked to the CMU blocks, kernel panic happens during access clocks when the power domains are disabled. Now this is a best solution.
- Enable HS-I2C on exynos5 by default
MMC partition cannot be mounted for RFS without the enabling HS-I2C because regulators for MMC power are connected to HS-I2C bus.
- Disable MDMA1 node on exynos5420
When MDMA1 runs in secure mode it makes kernel fault, so need to disalbe it on exynos5420 by default instead of each board.
- Fix the secondary CPU boot for exynos4212
* tag 'samsung-fixes' of http://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
ARM: dts: Remove g2d_pd node for exynos5420
ARM: dts: Remove mau_pd node for exynos5420
ARM: exynos_defconfig: enable HS-I2C to fix for mmc partition mount
ARM: dts: disable MDMA1 node for exynos5420
ARM: EXYNOS: fix the secondary CPU boot of exynos4212
commit 77c01bef72a5ce5cb24adae6066ed81a52004d30
Merge: 763b257 4f2f203
Author: Dave Airlie <[email protected]>
Date: Thu May 22 09:15:57 2014 +1000
Merge branch 'drm-fixes-3.15' of git://people.freedesktop.org/~deathsimple/linux into drm-fixes
radeon fixes, VCE one is big but does fix a userspace crash.
* 'drm-fixes-3.15' of git://people.freedesktop.org/~deathsimple/linux:
drm/radeon/pm: don't allow debugfs/sysfs access when PX card is off (v2) drm/radeon: avoid segfault on device open when accel is not working. drm/radeon: fix typo in finding PLL params
drm/radeon: fix register typo on si
drm/radeon: fix buffer placement under memory pressure v2 drm/radeon: fix page directory update size estimation drm/radeon: handle non-VGA class pci devices with ATRM drm/radeon: fix DCE83 check for mullins
drm/radeon: check VCE relocation buffer range v3 drm/radeon: also try GART for CPU accessed buffers
commit 763b2573cf59da8f906b9f2c8a2d437482761005
Merge: 4b660a7 0f1d360
Author: Dave Airlie <[email protected]>
Date: Thu May 22 09:14:50 2014 +1000
Merge branch 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes
fixes nasty panel bleeding bug.
* 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
drm/gf119-/disp: fix nasty bug which can clobber SOR0's clock setup drm/nvd9/therm: handle another kind of PWM fan
commit 368b69a5b010cb00fc9ea04d588cff69af1a1359
Author: Andy Lutomirski <[email protected]> Date: Wed May 14 16:23:13 2014 -0700
x86, vdso: Fix an OOPS accessing the HPET mapping w/o an HPET
The oops can be triggered in qemu using -no-hpet (but not nohpet) by running a 32-bit program and reading a couple of pages before the vdso. This should send SIGBUS instead of OOPSing.
The bug was introduced by:
commit 7a59ed415f5b57469e22e41fc4188d5399e0b194
Author: Stefani Seibold <[email protected]>
Date: Mon Mar 17 23:22:09 2014 +0100
x86, vdso: Add 32 bit VDSO time support for 32 bit kernel
which is new in 3.15.
commit 4b660a7f5c8099d88d1a43d8ae138965112592c7
Author: Linus Torvalds <[email protected]> Date: Thu May 22 06:42:02 2014 +0900
Linux 3.15-rc6
commit 4de462ab63e23953fd05da511aeb460ae10cc726
Author: Eric Dumazet <[email protected]> Date: Mon May 19 21:56:34 2014 -0700
ipv6: gro: fix CHECKSUM_COMPLETE support
When GRE support was added in linux-3.14, CHECKSUM_COMPLETE handling broke on GRE+IPv6 because we did not update/use the appropriate csum :
GRO layer is supposed to use/update NAPI_GRO_CB(skb)->csum instead of skb->csum
Tested using a GRE tunnel and IPv6 traffic. GRO aggregation now happens at the first level (ethernet device) instead of being done in gre tunnel. Native IPv6+TCP is still properly aggregated.
commit c1f43dd9c20d85e66c4d77e284f64ac114abe3f8
Author: Xuelin Shi <[email protected]> Date: Wed May 21 14:02:37 2014 -0700
dmaengine: fix dmaengine_unmap failure
The count which is used to get_unmap_data maybe not the same as the count computed in dmaengine_unmap which causes to free data in a wrong pool.
This patch fixes this issue by keeping the map count with unmap_data structure and use this count to get the pool.
commit 5a9a55bf9157d3490b0c8c4c81d4708602c26e07
Author: Ezequiel Garcia <[email protected]> Date: Wed May 21 14:02:35 2014 -0700
dma: mv_xor: Flush descriptors before activating a channel
We need to use writel() instead of writel_relaxed() when starting a channel, to ensure all the descriptors have been flushed before the activation.
While at it, remove the unneeded read-modify-write and make the code simpler.
commit 6538d625215f29671864649336645dea19214135
Merge: 11da37b 8050936
Author: Linus Torvalds <[email protected]>
Date: Thu May 22 05:55:12 2014 +0900
Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
Pull two powerpc fixes from Ben Herrenschmidt:
"Here are a couple of fixes for 3.15. One from Anton fixes a nasty
regression I introduced when trying to fix a loss of irq_work whose consequences is that we can completely lose timer interrupts on a CPU... not pretty.
The other one is a change to our PCIe reset hook to use a firmware call instead of direct config space accesses to trigger a fundamental reset on the root port. This is necessary so that the FW gets a chance to disable the link down error monitoring, which would otherwise trip and cause subsequent fatal EEH error"
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
powerpc: irq work racing with timer interrupt can result in timer interrupt hang powerpc/powernv: Reset root port in firmware
commit bf63ac73b3e132e6bf0c8798aba7b277c3316e19
Author: Cong Wang <[email protected]> Date: Mon May 19 12:15:49 2014 -0700
net_sched: fix an oops in tcindex filter
Kelly reported the following crash:
IP: [<ffffffff817a993d>] tcf_action_exec+0x46/0x90
PGD 3009067 PUD 300c067 PMD 11ff30067 PTE 800000011634b060
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
CPU: 1 PID: 639 Comm: dhclient Not tainted 3.15.0-rc4+ #342
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
task: ffff8801169ecd00 ti: ffff8800d21b8000 task.ti: ffff8800d21b8000
RIP: 0010:[<ffffffff817a993d>] [<ffffffff817a993d>] tcf_action_exec+0x46/0x90
RSP: 0018:ffff8800d21b9b90 EFLAGS: 00010283
RAX: 00000000ffffffff RBX: ffff88011634b8e8 RCX: ffff8800cf7133d8
RDX: ffff88011634b900 RSI: ffff8800cf7133e0 RDI: ffff8800d210f840
RBP: ffff8800d21b9bb0 R08: ffffffff8287bf60 R09: 0000000000000001
R10: ffff8800d2b22b24 R11: 0000000000000001 R12: ffff8800d210f840
R13: ffff8800d21b9c50 R14: ffff8800cf7133e0 R15: ffff8800cad433d8
FS: 00007f49723e1840(0000) GS:ffff88011a800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88011634b8f0 CR3: 00000000ce469000 CR4: 00000000000006e0
Stack:
ffff8800d2170188 ffff8800d210f840 ffff8800d2171b90 0000000000000000
ffff8800d21b9be8 ffffffff817c55bb ffff8800d21b9c50 ffff8800d2171b90
ffff8800d210f840 ffff8800d21b0300 ffff8800d21b9c50 ffff8800d21b9c18
Call Trace:
[<ffffffff817c55bb>] tcindex_classify+0x88/0x9b
[<ffffffff817a7f7d>] tc_classify_compat+0x3e/0x7b
[<ffffffff817a7fdf>] tc_classify+0x25/0x9f
[<ffffffff817b0e68>] htb_enqueue+0x55/0x27a
[<ffffffff817b6c2e>] dsmark_enqueue+0x165/0x1a4
[<ffffffff81775642>] __dev_queue_xmit+0x35e/0x536
[<ffffffff8177582a>] dev_queue_xmit+0x10/0x12
[<ffffffff818f8ecd>] packet_sendmsg+0xb26/0xb9a
[<ffffffff810b1507>] ? __lock_acquire+0x3ae/0xdf3
[<ffffffff8175cf08>] __sock_sendmsg_nosec+0x25/0x27
[<ffffffff8175d916>] sock_aio_write+0xd0/0xe7
[<ffffffff8117d6b8>] do_sync_write+0x59/0x78
[<ffffffff8117d84d>] vfs_write+0xb5/0x10a
[<ffffffff8117d96a>] SyS_write+0x49/0x7f
[<ffffffff8198e212>] system_call_fastpath+0x16/0x1b
This is because we memcpy struct tcindex_filter_result which contains
struct tcf_exts, obviously struct list_head can not be simply copied.
This is a regression introduced by commit 33be627159913b094bb578
(net_sched: act: use standard struct list_head).
It's not very easy to fix it as the code is a mess:
if (old_r)
memcpy(&cr, r, sizeof(cr));
else {
memset(&cr, 0, sizeof(cr));
tcf_exts_init(&cr.exts, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
}
...
tcf_exts_change(tp, &cr.exts, &e);
...
memcpy(r, &cr, sizeof(cr));
the above code should equal to:
tcindex_filter_result_init(&cr);
if (old_r)
cr.res = r->res;
...
if (old_r)
tcf_exts_change(tp, &r->exts, &e);
else
tcf_exts_change(tp, &cr.exts, &e);
...
r->res = cr.res;
after this change, since there is no need to copy struct tcf_exts.
And it also fixes other places zero'ing struct's contains struct tcf_exts.
Fixes: commit 33be627159913b0 (net_sched: act: use standard struct list_head)
Reported-by: Kelly Anderson <[email protected]>
Tested-by: Kelly Anderson <[email protected]>
Cc: David S. Miller <[email protected]>
Signed-off-by: Cong Wang <[email protected]>
Signed-off-by: David S. Miller <[email protected]>commit 11da37b26301be772c289c5406aec347ad140bd6
Merge: 3062556 51a6025
Author: Linus Torvalds <[email protected]>
Date: Thu May 22 05:40:13 2014 +0900
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs
Pull two btrfs fixes from Chris Mason:
"This has two fixes that we've been testing for 3.16, but since both
are safe and fix real bugs, it makes sense to send for 3.15 instead"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
Btrfs: send, fix incorrect ref access when using extrefs
Btrfs: fix EIO on reading file after ioctl clone works on it
commit 30625569031641eba1cd1f71148cf188500861a2
Merge: 5e9d9fc f140662
Author: Linus Torvalds <[email protected]>
Date: Thu May 22 05:38:51 2014 +0900
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client
Pull two ceph fixes from Sage Weil:
"The first patch fixes a problem when we have a page count of 0 for
sendpage which is triggered by zfs. The second fixes a bug in CRUSH that was resolved in the userland code a while back but fell through the cracks on the kernel side"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
crush: decode and initialize chooseleaf_vary_r
libceph: fix corruption when using page_count 0 page in rbd
commit 5e9d9fc4edd3f591e3cf76dd19a8b2a9c8d5cee1
Merge: 80932ec ee4eec4
Author: Linus Torvalds <[email protected]>
Date: Thu May 22 05:36:07 2014 +0900
Merge tag 'xfs-for-linus-3.15-rc6' of git://oss.sgi.com/xfs/xfs
Pull xfs fixes from Dave Chinner:
"Code inspection of the XFS error number sign translations found a
bunch of issues, including returning incorrectly signed errors for some data integrity operations.
These leak to userspace and result in applications not getting the errors correctly reported. Hence they need fixing sooner rather than later.
A couple of the bugs are in data integrity operations, a couple more are in the new COLLAPSE_RANGE code. One of these came in through a recent ext4 merge and so I had to update the base tree to 3.15-rc5 before fixing the issues"
* tag 'xfs-for-linus-3.15-rc6' of git://oss.sgi.com/xfs/xfs:
xfs: list_lru_init returns a negative error
xfs: negate xfs_icsb_init_counters error value
xfs: negate mount workqueue init error value
xfs: fix wrong err sign on xfs_set_acl()
xfs: fix wrong errno from xfs_initxattrs
xfs: correct error sign on COLLAPSE_RANGE errors
xfs: xfs_commit_metadata returns wrong errno
xfs: fix incorrect error sign in xfs_file_aio_read
xfs: xfs_dir_fsync() returns positive errno
commit 80932ec1c0da97674417b35ac5aec31732993d8d
Merge: 989d216 68b7752
Author: Linus Torvalds <[email protected]>
Date: Thu May 22 05:34:57 2014 +0900
Merge branch 'renameat2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs
Pull renameat2 arch support from Miklos Szeredi:
"I've collected architecture patches for the renameat2 syscall that
maintainers acked and/or asked me to queue.
This adds architecture support for the renameat2 syscall to m68k, parisc, ia64 and through asm-generic to arc, arm64, c6x, hexagon, metag, openrisc, score, tile, unicore32"
* 'renameat2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
scripts/checksyscalls.sh: Make renameat optional
asm-generic: Add renameat2 syscall
ia64: add renameat2 syscall
parisc: add renameat2 syscall
m68k: add renameat2 syscall
commit 8ecc1bad4c9b485ceb47182d282980d0b0fe20ac
Author: Toralf Förster <[email protected]> Date: Mon May 19 10:26:31 2014 +0200
sparc64: fix format string mismatch in arch/sparc/kernel/sysfs.c
found by cppcheck
commit 989d216f86bbef47059c10aca77be9f56305a7ec
Merge: 677d1bb 2c16c9f
Author: Linus Torvalds <[email protected]>
Date: Thu May 22 04:29:39 2014 +0900
Merge tag 'iommu-fixes-v3.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu
Pull iommu fixes from Joerg Roedel:
"Three fixes for the AMD IOMMU driver:
- fix a locking issue around get_user_pages()
- fix two issues with device aliasing and exclusion range handling"
* tag 'iommu-fixes-v3.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
iommu/amd: fix enabling exclusion range for an exact device
iommu/amd: Take mmap_sem when calling get_user_pages
iommu/amd: Fix interrupt remapping for aliased devices
commit 677d1bb0cbcfc43d10e95ab0c28b9045a1de7b5b
Merge: f6ce579 629c27a
Author: Linus Torvalds <[email protected]>
Date: Thu May 22 04:28:21 2014 +0900
Merge tag 'stable/for-linus-3.15-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft
Pull iscsi_ibft fix from Konrad Rzeszutek Wilk:
"Fix iBFT regression on Broadcom NICs introduced in 3.2"
* tag 'stable/for-linus-3.15-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft:
iscsi_ibft: Fix finding Broadcom specific ibft sign
commit f6ce579d91029123e4b83137d7bf5bc487b7dfb9
Merge: fba69f0 3c90c55
Author: Linus Torvalds <[email protected]>
Date: Thu May 22 04:26:23 2014 +0900
Merge tag 'renesas-sh-drivers-for-v3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas
Pull SH driver fix from Simon Horman:
"Compile drivers/sh/pm_runtime.c if ARCH_SHMOBILE_MULTI
This resolves a regression introduced in v3.14 by commit bf98c1eac1d4 ("ARM: Rename ARCH_SHMOBILE to ARCH_SHMOBILE_LEGACY")"
* tag 'renesas-sh-drivers-for-v3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
drivers: sh: compile drivers/sh/pm_runtime.c if ARCH_SHMOBILE_MULTI
commit 27b11428b7de097c42f205beabb1764f4365443b
Author: J. Bruce Fields <[email protected]> Date: Thu May 8 11:19:41 2014 -0400
nfsd4: warn on finding lockowner without stateid's
The current code assumes a one-to-one lockowner<->lock stateid correspondance.
commit a1b8ff4c97b4375d21b6d6c45d75877303f61b3b
Author: J. Bruce Fields <[email protected]> Date: Tue May 20 15:55:21 2014 -0400
nfsd4: remove lockowner when removing lock stateid
The nfsv4 state code has always assumed a one-to-one correspondance between lock stateid's and lockowners even if it appears not to in some places.
We may actually change that, but for now when FREE_STATEID releases a lock stateid it also needs to release the parent lockowner.
Symptoms were a subsequent LOCK crashing in find_lockowner_str when it calls same_lockowner_ino on a lockowner that unexpectedly has an empty so_stateids list.
commit 6c67c7c38cf32c2a9cbccb6b21aadf61a85fbfb4
Author: David Howells <[email protected]> Date: Wed May 21 14:48:05 2014 +0100
AFS: Fix cache manager service handlers
Fix the cache manager RPC service handlers. The afs_send_empty_reply() and afs_send_simple_reply() functions:
(a) Kill the call and free up the buffers associated with it if they fail.
(b) Return with call intact if it they succeed.
However, none of the callers actually check the result or clean up if successful - and may use the now non-existent data if it fails.
This was detected by Dan Carpenter using a static checker:
The patch 08e0e7c82eea: "[AF_RXRPC]: Make the in-kernel AFS filesystem use AF_RXRPC." from Apr 26, 2007, leads to the following static checker warning:
"fs/afs/cmservice.c:155 SRXAFSCB_CallBack()
warn: 'call' was already freed."
commit e5eb925a1804c4a52994ba57f4f68ee7a9132905
Author: Ralf Baechle <[email protected]> Date: Wed May 21 11:42:10 2014 +0200
MIPS: Change type of asid_cache to unsigned long
asid_cache must be unsigned long otherwise on 64 bit systems it will become 0 if the value in get_new_mmu_context() reaches 0xffffffff and in the end the assumption of ASID_FIRST_VERSION is not true anymore thus leads to more dangerous things.
Initial patch by Yong Zhang <[email protected]>
commit fba69f042ad99f68c0268ef1c012f3199f898fac
Merge: 84e12d9 97d9d23
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 19:01:08 2014 +0900
Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media fixes from Mauro Carvalho Chehab:
"Most of the changes are drivers fixes (rtl28xuu, fc2580, ov7670,
davinci, gspca, s5p-fimc and s5c73m3).
There is also a compat32 fix and one infoleak fixup at the media controller"
* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
[media] V4L2: fix VIDIOC_CREATE_BUFS in 64- / 32-bit compatibility mode [media] V4L2: ov7670: fix a wrong index, potentially Oopsing the kernel from user-space [media] media-device: fix infoleak in ioctl media_enum_entities() [media] fc2580: fix tuning failure on 32-bit arch
[media] Prefer gspca_sonixb over sn9c102 for all devices
[media] media: davinci: vpfe: make sure all the buffers unmapped and released [media] staging: media: davinci: vpfe: make sure all the buffers are released [media] media: davinci: vpbe_display: fix releasing of active buffers [media] media: davinci: vpif_display: fix releasing of active buffers [media] media: davinci: vpif_capture: fix releasing of active buffers [media] s5p-fimc: Fix YUV422P depth
[media] s5c73m3: Add missing rename of v4l2_of_get_next_endpoint() function [media] rtl28xxu: silence error log about disabled rtl2832_sdr module [media] rtl28xxu: do not hard depend on staging SDR module
commit 84e12d992a54bc64590989b50d292e510a7d73cd
Merge: 439c610 bb4e506
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 19:00:09 2014 +0900
Merge tag 'staging-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver fixes from Greg KH:
"Here are five staging driver fixes for 3.15-rc6 that resolve some
reported issues. They are for the imx and rtl8723au drivers"
* tag 'staging-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
staging: rtl8723au: Do not reset wdev->iftype in netdev_close()
staging: rtl8723au: Use correct pipe type for USB interrupts
imx-drm: imx-tve: correct DDC property name to 'ddc-i2c-bus'
imx-drm: imx-drm-core: skip components whose parent device is disabled
imx-drm: imx-drm-core: fix imx_drm_encoder_get_mux_id
commit 439c6109922c8faa920c9b8680d63937189d6915
Merge: 957cf25 f5c16f2
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 18:59:25 2014 +0900
Merge tag 'driver-core-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
Pull driver core fixes from Greg KH:
"Here are two driver core (well, sysfs) fixes for 3.15-rc6 that resolve
some reported issues and a regression from 3.13"
* tag 'driver-core-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
sysfs: make sure read buffer is zeroed
kernfs, sysfs, cgroup: restrict extra perm check on open to sysfs
commit 957cf2582adf2a2164bbbd87036138221c5c118a
Merge: b84293b d0b4cc4
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 18:57:25 2014 +0900
Merge tag 'pci-v3.15-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci
Pull PCI fixes from Bjorn Helgaas:
"These are fixes for an SHPCHP hotplug regression, a "wait for pending
transaction" problem (used in device reset paths), and an email address update.
PCI device hotplug:
- Fix SHPCHP bus speed mismatch issue (Marcel Apfelbaum)
Miscellaneous:
- Fix pci_wait_for_pending_transaction() (Gavin Shan)
- Update email address (Ben Hutchings)"
* tag 'pci-v3.15-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
PCI: Wrong register used to check pending traffic
PCI: shpchp: Check bridge's secondary (not primary) bus speed
PCI: Update my email address
commit b84293b23efd8c98416624866389854fd5dc0020
Merge: 026d68b f9c6d49
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 18:56:35 2014 +0900
Merge tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random
Pull /dev/random fix from Ted Ts'o:
"This fixes a BUG_ON-causing regression that was introduced during the
last merge window"
* tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random:
random: fix BUG_ON caused by accounting simplification
commit 026d68be45a217f65f1617d08271f6838bfc07d7
Merge: b2e3432 d2c834a
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 18:55:17 2014 +0900
Merge tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mike.turquette/linux
Pull clock framework fixes from Mike Turquette:
"Clock framework and driver fixes, all of which fix user-visible
regressions.
As usual most fixes are for platform-specific clock drivers, but there are also two fixes to the clk core after recent changes to the way that clock unregistration is handled"
* tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mike.turquette/linux:
clk: tegra: Fix wrong value written to PLLE_AUX
clk: shmobile: clk-mstp: change to using clock-indices
clk: Fix slab corruption in clk_unregister()
clk: Fix double free due to devm_clk_register()
clk: socfpga: fix clock driver for 3.15
clk: divider: Fix best div calculation for power-of-two and table dividers
clk: bcm281xx: don't use unnamed structs or unions
commit b2e3432af1546a9f44a8278a8a91abfbd439259e
Merge: 081069f fd30c37
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 18:53:55 2014 +0900
Merge tag 'spi-v3.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A few core fixes around outlying cases here, nothing that should
affect most users but useful fixes. The diffstat is rather larger than one might hope due some simple code motion in the fix for !CONFIG_DMA, the actual meaningful change is much smaller.
- Fix handling of unsupported dual and quad mode support on slave registration so that drivers that can degrade gracefully do so, preventing regressions for drivers this is added.
- Fix build in !CONFIG_DMA cases following addition of generic DMA mapping support.
- Fix error handling for queue creation which due to wider kernel changes can be triggered more easily.
- A couple of driver specific fixes"
* tag 'spi-v3.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi/pxa2xx: Prevent DMA from transferring too many bytes
spi: core: Don't destroy master queue if we fail to create it
spi: qup: Fix return value checking for pm_runtime_get_sync()
spi: core: Protect DMA code by #ifdef CONFIG_HAS_DMA
spi: core: Ignore unsupported Dual/Quad Transfer Mode bits
commit 081069ff817ea7434016c482156e1ef0a7ffb4f3
Merge: 06eb4cc 99e4b98
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 18:53:13 2014 +0900
Merge tag 'gpio-v3.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio
Pull GPIO fixes from Linus Walleij:
- fix a null pointer bug in the ICH6 chipset driver
- fix device tree registration for the mcp23s08 driver
* tag 'gpio-v3.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
gpio: mcp23s08: Bug fix of SPI device tree registration.
gpio: ich: set regs and reglen for i3100 and ich6 chipset
commit 7bacc782270ff7db3b9f29fa5d24ad2ee1e8e81d
Author: Emmanuel Grumbach <[email protected]> Date: Sun May 18 19:05:23 2014 +0300
iwlwifi: mvm: disable beacon filtering
This feature has been causing trouble - disable it for now.
commit 06eb4cc2e7ad1b32a3b2580eff772c29b53a2cc6
Merge: 6ab9028 36e9d2e
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 18:36:40 2014 +0900
Merge branch 'for-3.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull more cgroup fixes from Tejun Heo:
"Three more patches to fix cgroup_freezer breakage due to the recent
cgroup internal locking changes - an operation cgroup_freezer was using now requires sleepable context and cgroup_freezer was invoking that while holding a spin lock. cgroup_freezer was using an overly elaborate hierarchical locking scheme.
While it's possible to convert the hierarchical spinlocks directly to mutexes, this patch simplifies the overall locking so that it uses a global mutex. This has the added benefit of avoiding iterating potentially huge number of tasks under a spinlock. While the patch is on the larger side in the devel cycle, the changes made are mostly straight-forward and the locking logic is a lot simpler afterwards"
* 'for-3.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
cgroup: fix rcu_read_lock() leak in update_if_frozen()
cgroup_freezer: replace freezer->lock with freezer_mutex
cgroup: introduce task_css_is_root()
commit 6ab9028d00da2ed34f46a72fa3271b04a402f1e1
Merge: 1f5518b 3685f251
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 18:35:42 2014 +0900
Merge branch 'for-3.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata
Pull libata fixes from Tejun Heo:
"Mostly device-specific fixes. The only thing which isn't is the fix
for zpodd oops-on-detach bug"
* 'for-3.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
ahci: imx: PLL clock needs 100us to settle down
ata: pata_at91 only works on sam9
libata: clean up ZPODD when a port is detached
ahci: imx: software workaround for phy reset issue in resume
ahci: imx: add namespace for register enums
ahci: disable DEVSLP for Intel Valleyview
commit 1f5518b4e7febc2a1026fba2ff311ba54be1abc4
Merge: a7aa96a 3901c11
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 18:34:35 2014 +0900
Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
"This fixes a NULL pointer dereference on allocation failure in caam,
as well as a regression in the ctr mode on s390 that was added with the recent concurrency fixes"
* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: s390 - fix aes,des ctr mode concurrency finding.
crypto: caam - add allocation failure handling in SPRINTFCAT macro
commit a7aa96a92eff3c4b2c7df8c8535691a5a487207d
Merge: b140027 1e1110c
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 18:03:14 2014 +0900
Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending
Pull scsi target fixes from Nicholas Bellinger:
"This series include:
- Close race between iser-target network portal shutdown + accepting new connection logins (sagi)
- Fix free-after-use regression in tcm_fc post conversion to percpu-ida pre-allocation (nab)
- Explicitly disable Immediate + Unsolicited Data for iser-target connections when T10-PI is enabled (sagi + nab)
- Allow pi_prot_type + emulate_write_cache attributes to be set to zero regardless of backend support (andy)
- memory leak fix (mikulas)"
* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
target: fix memory leak on XCOPY
target: Don't allow setting WC emulation if device doesn't support
iscsi-target: Disable Immediate + Unsolicited Data with ISER Protection
tcm_fc: Fix free-after-use regression in ft_free_cmd
iscsi-target: Change BUG_ON to REJECT in iscsit_process_nop_out Target/iscsi,iser: Avoid accepting transport connections during stop stage Target/iser: Fix iscsit_accept_np and rdma_cm racy flow Target/iser: Fix wrong connection requests list addition
target: Allow non-supporting backends to set pi_prot_type to 0
commit b14002761c01dcd2e416ad6d922bd0acf21e4a9d
Merge: 478c7cf d765396
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 18:02:12 2014 +0900
Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
Pull i2c fixes from Wolfram Sang:
"Some I2C bugfixes for 3.15. Typical stuff, I'd say"
* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
i2c: rcar: bail out on zero length transfers
i2c: qup: Fix pm_runtime_get_sync usage
i2c: s3c2410: resume race fix
i2c: nomadik: Don't use IS_ERR for devm_ioremap
i2c: designware: Mask all interrupts during i2c controller enable
commit 478c7cf7a8ff7ad587bd76f8ce9cfeede0df45fb
Merge: 23de4a7 658a0f4
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 17:58:34 2014 +0900
Merge tag 'pm+acpi-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI and power management fixes from Rafael Wysocki:
"Still fixing regressions (partly by reverting commits that broke
things for people), fixing other stable-candidate bugs and adding some blacklist entries for ACPI video and _OSI.
Two ACPICA regression fixes (one recent and one for a 3.14 commit), a fix for an ACPI-related regression in TPM (introduced in 3.14), a revert of the ACPI AC driver conversion in 3.13 that went wrong for an unknown reason, two reverts of commits that attempted to remove an old user space interface in /proc and broke some utilities, in 3.13 too, a fix for a CPU hotplug bug in the ACPI processor driver (stable material), two (stable candidate) fixes for intel_pstate and a few new blacklist entries, mostly for systems that shipped with Windows 8.
Specifics:
- ACPICA fix for a stale pointer access introduced by a recent commit in the XSDT validation code from Lv Zheng.
- ACPICA fix for the default value of the command line switch to favor 32-bit FADT addresses (in case there's a conflict between a 64-bit and a 32-bit address). The previous default was that the 32-bit version would take precedence and we tried to change it to the other way around and it didn't work. From Lv Zheng.
- A TPM commit related to ACPI _DSM in 3.14 caused the driver to refuse to load if a specific _DSM was missing and that broke resume from system suspend on Chromebooks that require the TPM hardware to be restored to a working state during resume by the OS. Restore the old behavior to load the driver if the _DSM in question is not present, but prevent it from using the feature the _DSM is for.
- ACPI AC driver conversion in 3.13 broke thermal management on at least one machine and has to be reverted. From Guenter Roeck.
- Two reverts of 3.13 commits that attempted to remove the old ACPI battery interface in /proc, but turned out to break some utilities still using that interface. From Lan Tianyu.
- ACPI processor driver fix to prevent acpi_processor_add() from modifying the CPU device's .offline field which leads to breakage if the initial online of the CPU fails. From Igor Mammedov.
- Two intel_pstate fixes, one to take a BayTrail documentation update into account and one to avoid forcing the maximum P-state on init which causes CPU PM trouble on systems with P-states coordination when one of the CPU cores is initialized after an offline/online cycle triggered by user space. Both stable candidates, from Dirk Brandewie.
- Fix for the ACPI video DMI blacklist entry for Dell Inspiron 7520 from Aaron Lu.
- Two new ACPI video blacklist entries for machines shipping with Win8 that need to use native backlight so that it can be controlled in a usual way (which doesn't work otherwise due bugs in the ACPI tables) from Hans de Goede.
- Two ACPI _OSI quirks for systems that need them to work correctly with Linux from Edward Lin and Hans de Goede"
* tag 'pm+acpi-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPI / video: Revert native brightness quirk for ThinkPad T530
intel_pstate: remove setting P state to MAX on init
ACPICA: Tables: Restore old behavor to favor 32-bit FADT addresses.
ACPI / video: correct DMI tag for Dell Inspiron 7520
intel_pstate: Set turbo VID for BayTrail
ACPI / TPM: Fix resume regression on Chromebooks
ACPI / proc: Do not say when /proc interfaces will be deleted in Kconfig ACPI / processor: do not mark present at boot but not onlined CPU as onlined
ACPI: Revert "ACPI / AC: convert ACPI ac driver to platform bus"
ACPI / blacklist: Add dmi_enable_osi_linux quirk for Asus EEE PC 1015PX
ACPI: blacklist win8 OSI for Dell Inspiron 7737
ACPI / video: Add use_native_backlight quirks for more systems
ACPI: Revert "ACPI / Battery: Remove battery's proc directory"
ACPI: Revert "ACPI: Remove CONFIG_ACPI_PROCFS_POWER and cm_sbsc.c"
ACPICA: Tables: Fix invalid pointer accesses in acpi_tb_parse_root_table().
commit 23de4a7af7bc3d687f783a612b8e824865b7e6ce
Merge: 31a3fca 4cdd2ad
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 17:57:31 2014 +0900
Merge tag 'dm-3.15-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
Pull device mapper fixes from Mike Snitzer:
"A dm-crypt fix for a cpu hotplug crash that switches from using
per-cpu data to a mempool allocation (which offers allocation with cpu locality, and there is no inter-cpu communication on slab allocation).
A couple dm-thinp stable fixes to address "out-of-data-space" issues.
A dm-multipath fix for a LOCKDEP warning introduced in 3.15-rc1"
* tag 'dm-3.15-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
dm mpath: fix lock order inconsistency in multipath_ioctl
dm thin: add timeout to stop out-of-data-space mode holding IO forever
dm thin: allow metadata commit if pool is in PM_OUT_OF_DATA_SPACE mode
dm crypt: fix cpu hotplug crash by removing per-cpu structure
commit 31a3fcab118f169613777c913f6a35b1ab138591
Merge: 60b5f90 dfc44f8
Author: Linus Torvalds <[email protected]>
Date: Wed May 21 17:54:55 2014 +0900
Merge tag 'dt-for-linus' of git://git.secretlab.ca/git/linux
Pull device tree fixes from Grant Likely:
"Drivercore bugfixes for v3.15
This branch contains bug fixes important to get into v3.15. There is a fix for modifying properties seen during early boot, a fix for an incorrect prototype when CONFIG_OF=n, and a couple of corrections to device tree memory nodes on a few platforms"
* tag 'dt-for-linus' of git://git.secretlab.ca/git/linux:
mips: dts: Fix missing device_type="memory" property in memory nodes
arm: dts: Fix missing device_type="memory" for ste-ccu8540
of: fix CONFIG_OF=n prototype of of_node_full_name()
of: make of_update_property() usable earlier in the boot process
commit 0b5a958cf4df3a5cd578b861471e62138f55c85e
Author: Stephane Grosjean <[email protected]> Date: Tue May 20 11:38:56 2014 +0200
can: peak_pci: prevent use after free at netdev removal
As remarked by Christopher R. Baker in his post at
http://marc.info/?l=linux-can&m=139707295706465&w=2
there's a possibility for an use after free condition at device removal.
This simplified patch introduces an additional variable to prevent the issue. Thanks for catching this.
commit fbeb91fe8e4107dc88df4eaa21de02c3fd9d1cd5
Author: Arnd Bergmann <[email protected]> Date: Thu May 8 16:56:13 2014 +0200
dmaengine: sa11x0: remove broken #ifdef
The sa11x0_dma_pm_ops unconditionally reference sa11x0_dma_resume and sa11x0_dma_suspend, which currently breaks if CONFIG_PM_SLEEP is disabled.
There is probably a better way to remove the reference in this case, but the safe choice is to have the suspend/resume code always built in the driver.
commit a8246fedacadaab18b23b280ea3cf916ef5fc30e
Author: Arnd Bergmann <[email protected]> Date: Thu May 8 16:56:12 2014 +0200
dmaengine: omap: hide filter_fn for built-in drivers
It is not possible to reference the omap_dma_filter_fn filter function from a built-in driver if the dmaengine driver itself is a loadable module, which is a valid configuration otherwise.
This provides only the dummy alternative if the function is referenced by a built-in driver to allow a successful build. The filter function is only required by ATAGS based platforms, which will continue to be broken after this change for the bogus configuration. When booting from DT, with the dma channels correctly listed there, it will work fine.
commit 78ff4be45a4c51d8fb21ad92e4fabb467c6c3eeb
Author: Steffen Klassert <[email protected]> Date: Mon May 19 11:36:56 2014 +0200
ip_tunnel: Initialize the fallback device properly
We need to initialize the fallback device to have a correct mtu set on this device. Otherwise the mtu is set to null and the device is unusable.
commit d8d33c3b8a42fbd9ad23a61498fa5db1d83644e0
Merge: d050de6 524369e
Author: David S. Miller <[email protected]>
Date: Wed May 21 01:58:30 2014 -0400
Merge tag 'linux-can-fixes-for-3.15-20140519' of git://gitorious.org/linux-can/linux-can
Marc Kleine-Budde says:
====================
pull-request: can 2014-05-19
this is a pull request for net/master, for the v3.15 release cycle, with a single patch.
Oliver Hartkopp's patch removes a Kconfig option in the c_can driver, which was added as a workaround during the v3.15 development. With all cleanup patches this workaround is not needed anymore.
====================
commit d050de607f062233cf5e75b2e8f40f20c4b04b91
Merge: e1618d4 3b084e9
Author: David S. Miller <[email protected]>
Date: Wed May 21 01:24:19 2014 -0400
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
Pablo Neira Ayuso says:
====================
Netfilter/nftables fixes for net
The following patchset contains nftables fixes for your net tree, they are:
1) Fix crash when using the goto action in a rule by making sure that we always fall back on the base chain. Otherwise, this may try to access the counter memory area of non-base chains, which does not exists.
2) Fix several aspects of the rule tracing that are currently broken:
* Reset rule number counter after goto/jump action, otherwise the tracing reports a bogus rule number.
* Fix tracing of the goto action.
* Fix bogus rule number counter after goto.
* Fix missing return trace after finishing the walk through the non-base chain.
* Fix missing trace when matching non-terminal rule.
====================
commit 80c578930ce77ba8bcfb226a184b482020bdda7b
Author: Mike Snitzer <[email protected]> Date: Tue May 20 13:38:33 2014 -0400
dm thin: add 'no_space_timeout' dm-thin-pool module param
Commit 85ad643b ("dm thin: add timeout to stop out-of-data-space mode holding IO forever") introduced a fixed 60 second timeout. Users may want to either disable or modify this timeout.
Allow the out-of-data-space timeout to be configured using the 'no_space_timeout' dm-thin-pool module param. Setting it to 0 will disable the timeout, resulting in IO being queued until more data space is added to the thin-pool.
commit 51a60253a58514524b7a347c4e68553821a79d04
Author: Filipe Manana <[email protected]> Date: Tue May 13 22:01:02 2014 +0100
Btrfs: send, fix incorrect ref access when using extrefs
When running send, if an inode only has extended reference items
associated to it and no regular references, send.c:get_first_ref()
was incorrectly assuming the reference it found was of type
BTRFS_INODE_REF_KEY due to use of the wrong key variable.
This caused weird behaviour when using the found item has a regular
reference, such as weird path string, and occasionally (when lucky)
a crash:
[ 190.600652] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
[ 190.600994] Modules linked in: btrfs xor raid6_pq binfmt_misc nfsd auth_rpcgss oid_registry nfs_acl nfs lockd fscache sunrpc psmouse serio_raw evbug pcspkr i2c_piix4 e1000 floppy
[ 190.602565] CPU: 2 PID: 14520 Comm: btrfs Not tainted 3.13.0-fdm-btrfs-next-26+ #1
[ 190.602728] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 190.602868] task: ffff8800d447c920 ti: ffff8801fa79e000 task.ti: ffff8801fa79e000
[ 190.603030] RIP: 0010:[<ffffffff813266b4>] [<ffffffff813266b4>] memcpy+0x54/0x110
[ 190.603262] RSP: 0018:ffff8801fa79f880 EFLAGS: 00010202
[ 190.603395] RAX: ffff8800d4326e3f RBX: 000000000000036a RCX: ffff880000000000
[ 190.603553] RDX: 000000000000032a RSI: ffe708844042936a RDI: ffff8800d43271a9
[ 190.603710] RBP: ffff8801fa79f8c8 R08: 00000000003a4ef0 R09: 0000000000000000
[ 190.603867] R10: 793a4ef09f000000 R11: 9f0000000053726f R12: ffff8800d43271a9
[ 190.604020] R13: 0000160000000000 R14: ffff8802110134f0 R15: 000000000000036a
[ 190.604020] FS: 00007fb423d09b80(0000) GS:ffff880216200000(0000) knlGS:0000000000000000
[ 190.604020] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 190.604020] CR2: 00007fb4229d4b78 CR3: 00000001f5d76000 CR4: 00000000000006e0
[ 190.604020] Stack:
[ 190.604020] ffffffffa01f4d49 ffff8801fa79f8f0 00000000000009f9 ffff8801fa79f8c8
[ 190.604020] 00000000000009f9 ffff880211013260 000000000000f971 ffff88021147dba8
[ 190.604020] 00000000000009f9 ffff8801fa79f918 ffffffffa02367f5 ffff8801fa79f928
[ 190.604020] Call Trace:
[ 190.604020] [<ffffffffa01f4d49>] ? read_extent_buffer+0xb9/0x120 [btrfs]
[ 190.604020] [<ffffffffa02367f5>] fs_path_add_from_extent_buffer+0x45/0x60 [btrfs]
[ 190.604020] [<ffffffffa0238806>] get_first_ref+0x1f6/0x210 [btrfs]
[ 190.604020] [<ffffffffa0238994>] __get_cur_name_and_parent+0x174/0x3a0 [btrfs]
[ 190.604020] [<ffffffff8118df3d>] ? kmem_cache_alloc_trace+0x11d/0x1e0
[ 190.604020] [<ffffffffa0236674>] ? fs_path_alloc+0x24/0x60 [btrfs]
[ 190.604020] [<ffffffffa0238c91>] get_cur_path+0xd1/0x240 [btrfs]
(...)
Steps to reproduce (either crash or some weirdness like an odd path string):
mkfs.btrfs -f -O extref /dev/sdd
mount /dev/sdd /mnt
mkdir /mnt/testdir
touch /mnt/testdir/foobar
for i in `seq 1 2550`; do
ln /mnt/testdir/foobar /mnt/testdir/foobar_link_`printf "%04d" $i`
done
ln /mnt/testdir/foobar /mnt/testdir/final_foobar_name
rm -f /mnt/testdir/foobar
for i in `seq 1 2550`; do
rm -f /mnt/testdir/foobar_link_`printf "%04d" $i`
done
btrfs subvolume snapshot -r /mnt /mnt/mysnap
btrfs send /mnt/mysnap -f /tmp/mysnap.send
Signed-off-by: Filipe David Borba Manana <[email protected]>
Signed-off-by: Chris Mason <[email protected]>
Reviewed-by: Liu Bo <[email protected]>commit d3ecfcdf9108c833e4e501bfa02ecf673a0ace59
Author: Liu Bo <[email protected]> Date: Fri May 9 10:01:02 2014 +0800
Btrfs: fix EIO on reading file after ioctl clone works on it
For inline data extent, we need to make its length aligned, otherwise, we can get a phantom extent map which confuses readpages() to return -EIO.
This can be detected by xfstests/btrfs/035.
commit e1618d461ca18d40f9c3ef70598abb72e75d27ae
Author: Vlad Yasevich <[email protected]> Date: Tue May 20 10:59:26 2014 -0400
vlan: Fix build error wth vlan_get_encap_level()
The new function vlan_get_encap_level() uses vlan_dev_priv() which is only conditionally avaialble when VLAN support is enabled. Make vlan_get_encap_level() conditionally available as well.
commit 4f2f203976964e267dc477de6648bdb3acd2b74b
Author: Alex Deucher <[email protected]> Date: Mon May 19 19:21:29 2014 -0400
drm/radeon/pm: don't allow debugfs/sysfs access when PX card is off (v2)
When the PX card is off don't try and access it. Avoid hw access to the card while it's off (e.g., reading back invalid temperature).
v2: be less strict
bug:
https://bugzilla.kernel.org/show_bug.cgi?id=76321
commit 24f47acc78b0ab5e2201f859fe1f693ae90c7c83
Author: Jérôme Glisse <[email protected]> Date: Wed May 7 16:35:24 2014 -0400
drm/radeon: avoid segfault on device open when accel is not working.
When accel is not working on device with virtual address space radeon segfault because the ib buffer is NULL and trying to map it inside the virtual address space trigger segfault. This patch only map the ib buffer if accel is working.
commit 74ad54f249de39bc040cce7237b1b854a9c6f0ad
Author: Christian König <[email protected]> Date: Tue May 13 12:50:54 2014 +0200
drm/radeon: fix typo in finding PLL params
Otherwise the limit is raised to high.
commit 4955bb073f1be6dd884b5d10041ba4bade6495bf
Author: Alex Deucher <[email protected]> Date: Mon May 5 16:40:42 2014 -0400
drm/radeon: fix register typo on si
Probably a copy paste typo.
commit 4b09556660bfe1b43d72ca858524c6baf2c6cb1d
Author: Christian König <[email protected]> Date: Sat May 10 18:17:09 2014 +0200
drm/radeon: fix buffer placement under memory pressure v2
Some buffers (UVD/VM page tables) must be placed in VRAM, but the byte restriction for moving buffers didn't took this into account.
v2: keep closer to the original code
commit 4906f6891ef987637b766dfaef1c6fc95804253a
Author: Christian König <[email protected]> Date: Mon May 12 14:46:11 2014 +0200
drm/radeon: fix page directory update size estimation
Take padding into account as well.
commit d8ade3526b2aa0505132c404c05a38b73ea15490
Author: Alex Deucher <[email protected]> Date: Thu May 8 20:04:03 2014 -0400
drm/radeon: handle non-VGA class pci devices with ATRM
Newer PX systems have non-VGA pci class dGPUs. Update the ATRM fetch method to handle those cases.
bug:
https://bugzilla.kernel.org/show_bug.cgi?id=75401
commit 89d2618dbd114e679b860c3de1df3fe43ee40f6e
Author: Alex Deucher <[email protected]> Date: Thu May 8 18:26:23 2014 -0400
drm/radeon: fix DCE83 check for mullins
Mullins is DCE83 just like Kabini. Set the proper number of endpoints on mullins.
commit 2fc5703abda201f138faf63bdca743d04dbf4b1a
Author: Leo Liu <[email protected]> Date: Mon May 5 15:42:18 2014 -0400
drm/radeon: check VCE relocation buffer range v3
v2 (chk): fix image size storage
v3 (chk): fix UV size calculation
commit 544092596e8ac269f70e70961b5e9381909c9b1e
Author: Christian König <[email protected]> Date: Mon May 5 18:40:12 2014 +0200
drm/radeon: also try GART for CPU accessed buffers
Placing them exclusively into VRAM might not work all the time.
commit 68b7752462aba4716d9236b28aaa91b48fe059cd
Author: James Hogan <[email protected]> Date: Wed Apr 23 11:08:06 2014 +0100
scripts/checksyscalls.sh: Make renameat optional
The new renameat2 syscall provides all the functionality of renameat with an additional flags argument, so make renameat optional so that future architectures can omit it without getting a warning.
This patch doesn't affect existing architectures.
commit 63ba600028a001fa19f427486527387f54926d61
Author: James Hogan <[email protected]> Date: Wed Apr 23 11:08:05 2014 +0100
asm-generic: Add renameat2 syscall
Add the renameat2 syscall to the generic syscall list, which is used by the following architectures: arc, arm64, c6x, hexagon, metag, openrisc, score, tile, unicore32.
commit 3ca976a2cf95c1d4254a1eb8e13b5063522691d5
Author: Miklos Szeredi <[email protected]> Date: Tue May 20 10:59:38 2014 +0200
ia64: add renameat2 syscall
commit 18e480aa07f78abc7938adfe1035a5d9ce188ad8
Author: Miklos Szeredi <[email protected]> Date: Tue May 20 10:59:37 2014 +0200
parisc: add renameat2 syscall
commit cc79f00f7611cbb8f1ff1b92fe829548efcb4f08
Author: Miklos Szeredi <[email protected]> Date: Tue May 20 10:59:37 2014 +0200
m68k: add renameat2 syscall
commit 60b5f90d0fac7585f1a43ccdad06787b97eda0ab
Merge: c7d6891 665ebe9
Author: Linus Torvalds <[email protected]>
Date: Tue May 20 16:50:38 2014 +0900
Merge tag 'sound-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"Unfortunately this update became bigger than previous pull requests,
which is almost a pattern in rc5-6. But, the only obvious big changes are for the new Intel DSP ASoC drivers, so the impact must be fairly limited.
Other than that, usual small fixes in various fields: HD-audio, ASoC core and ASoC fsl and codec drivers"
* tag 'sound-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (26 commits)
ALSA: sb_mixer: missing return statement
ASoC: wm8962: Update register CLASS_D_CONTROL_1 to be non-volatile
ASoC: Intel: Fix Baytrail SST DSP firmware loading
ALSA: hda - mask buggy stream DMA0 for Broadwell display controller
ALSA: hda - Add new GPU codec ID to snd-hda
ASoC: fsl_esai: Set PCRC and PRRC registers at the end of hw_params()
ASoC: fsl_esai: Only bypass sck_div for EXTAL source
ASoC: fsl_esai: Fix incorrect condition within ratio range check for FP
ASoC: dapm: Fix SUSPEND -> OFF bias sequence
ASoC: dapm: Skip CODEC<->CODEC links in connect_dai_link_widgets()
ASoC: pcm: Fix incorrect condition check for case SNDRV_PCM_TRIGGER_SUSPEND
ALSA: hda - add headset mic detect quirks for three Dell laptops
ASoC: Update Cirrus Logic CODEC maintainers.
ASoC: Intel: Fix block offset calculations.
ASoC: Intel: Fix check for pdata usage before dereference.
ASoC: Intel: Fix stream position pointer.
ASoC: Intel: Fix allow hw_params to be called more than once.
ASoC: Intel: Fix Audio DSP usage when IOMMU is enabled.
ASoC: Intel: Fix Haswell/Broadwell DSP page table creation.
ASoC: Intel: Fix allocated block list usage when adding blocks.
...
commit c7d6891a770aa97dd36c2df3545031e64c6a0ef3
Merge: 6ed8bf8 7bb3940
Author: Linus Torvalds <[email protected]>
Date: Tue May 20 16:47:33 2014 +0900
Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus
Pull MIPS fixes from Ralf Baechle:
"MIPS fixes for various loose ends:
- Fix workarounds for R4000 erratum.
- Patch up DEC, Siemens-Nixdorf and Loongson hardware support.
- Wire up renameat2 syscall.
- Delete unused file - it was causing false warnings from maintenance scripts.
- Revert a patch because it's functionality is now implemented twice which causes superfluous /proc/cpuinfo output.
- Fix a microMIPS regression"
* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
MIPS: mm: Fix broken microMIPS kernel regression.
MIPS: Add new AUDIT_ARCH token for the N32 ABI on MIPS64
MIPS: Wire up renameat2 syscall.
MIPS: inst.h: Rename BITFIELD_FIELD to __BITFIELD_FIELD.
MIPS: Remove file missed when removing rm9k support a while ago. MIPS/loongson2_cpufreq: Fix CPU clock rate setting
MIPS: Loongson: No need to select GENERIC_HARDIRQS_NO__DO_IRQ
MIPS: csum_partial.S CPU_DADDI_WORKAROUNDS bug fix
MIPS: __strncpy_from_user_asm CPU_DADDI_WORKAROUNDS bug fix
MIPS: __delay CPU_DADDI_WORKAROUNDS bug fix
MIPS: DEC/SNI: O32 wrapper stack switching fixes
MIPS: DEC: Bus error handler <asm/cpu-type.h> fixes
MAINTAINERS: TURBOchannel: Update entry
Revert "MIPS: MT: proc: Add support for printing VPE and TC ids"
commit 0f1d360b2ee3a2a0f510d3f1bcd3f5ebe5d41265
Author: Ben Skeggs <[email protected]> Date: Tue May 20 16:13:54 2014 +1000
drm/gf119-/disp: fix nasty bug which can clobber SOR0's clock setup
Fixes a LVDS bleed issue on Lenovo W530 that can occur under a number of circumstances.
commit 6679b2ccc914e84384b1acf0de4423e3738cce9f
Author: Martin Peres <[email protected]> Date: Mon May 12 15:05:01 2014 +0200
drm/nvd9/therm: handle another kind of PWM fan
commit 6ed8bf82fe44752f748bdc19567f79a961cf916c
Merge: 8d900e7 c776cd8
Author: Linus Torvalds <[email protected]>
Date: Tue May 20 14:35:28 2014 +0900
Merge branch 'parisc-3.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux
Pull parisc fixes from Helge Deller:
"There are two patches in here:
The first patch greatly improves latency and corrects the memory ordering in our light-weight atomic locking syscall.
The second patch ratelimits printing of userspace segfaults in the same way as it's done on other platforms. This fixes a possible DOS on parisc since it prevents the syslog to grow too fast. For example, when the debian acl2 package was built on our debian buildd servers, this package produced lots of gigabytes in syslog in very short time and thus filled our harddisks, which then turned the server nearly completely unaccessible and unresponsive"
* 'parisc-3.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
parisc: Improve LWS-CAS performance
parisc: ratelimit userspace segfault printing
commit 8d900e7f3178dccb123c877253bdb193827654c6
Merge: 41abc90 4797ec2
Author: Linus Torvalds <[email protected]>
Date: Tue May 20 14:33:48 2014 +0900
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull two arm64 fixes from Catalin Marinas:
- arm64 migrate_irqs() fix following commit ffde1de64012 (irqchip: Gic:
Support forced affinity setting)
- fix arm64 pud_huge() to return 0 when only 2 levels page tables are used (__PAGETABLE_PMD_FOLDED defined and pmd_huge already covers block entries at the first level), otherwise KVM gets confused
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: fix pud_huge() for 2-level pagetables
arm64: use cpu_online_mask when using forced irq_set_affinity
commit 41abc90228f98774263572ec99e7ab820f091002
Merge: a7b08063 ffe6902
Author: Linus Torvalds <[email protected]>
Date: Tue May 20 14:30:34 2014 +0900
Merge tag 'metag-for-v3.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag
Pull Metag architecture and related fixes from James Hogan:
"Mostly fixes for metag and parisc relating to upgrowing stacks.
- Fix missing compiler barriers in metag memory barriers.
- Fix BUG_ON on metag when RLIMIT_STACK hard limit is increased beyond safe value.
- Make maximum stack size configurable. This reduces the default user stack size back to 80MB (especially on parisc after their removal of _STK_LIM_MAX override). This only affects metag and parisc.
- Remove metag _STK_LIM_MAX override to match other arches and follow parisc, now that it is safe to do so (due to the BUG_ON fix mentioned above).
- Finally now that both metag and parisc _STK_LIM_MAX overrides have been removed, it makes sense to remove _STK_LIM_MAX altogether"
* tag 'metag-for-v3.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag:
asm-generic: remove _STK_LIM_MAX
metag: Remove _STK_LIM_MAX override
parisc,metag: Do not hardcode maximum userspace stack size
metag: Reduce maximum stack size to 256MB
metag: fix memory barriers
commit a7b0806392b527e8a616e7ea6f17aafe33949a9f
Merge: 172de65 4ba4801
Author: Linus Torvalds <[email protected]>
Date: Tue May 20 14:28:33 2014 +0900
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm/intel fixes from Dave Airlie:
"Just some intel fixes.
I have some radeon ones but I need to get some patches dropped from the pull req"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/i915: Increase WM memory latency values on SNB drm/i915: restore backlight precision when converting from ACPI drm/i915: Use the first mode if there is no preferred mode in the EDID drm/i915/dp: force eDP lane count to max available lanes on BDW drm/i915/vlv: reset VLV media force wake request register drm/i915/SDVO: For sysfs link put directory and target in correct order drm/i915: use lane count and link rate from VBT as minimums for eDP drm/i915: clean up VBT eDP link param decoding
drm/i915: consider the source max DP lane count too
commit 172de656b98efd81399aec83837dccaa276622c4
Merge: 95d0858 fa81511
Author: Linus Torvalds <[email protected]>
Date: Tue May 20 14:21:11 2014 +0900
Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Peter Anvin.
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86-64, modify_ldt: Make support for 16-bit segments a runtime option x86, mm, hugetlb: Add missing TLB page invalidation for hugetlb_cow() x86, rdrand: When nordrand is specified, disable RDSEED as well
commit 95d08585e093a9f07562b4a3984370b4d72f1a57
Merge: 3f017a4 84ea7fe
Author: Linus Torvalds <[email protected]>
Date: Tue May 20 14:19:10 2014 +0900
Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fix from Thomas Gleixner:
"A single bug fix for a long standing issue:
- Updating the expiry value of a relative timer _after_ letting the idle logic select a target cpu for the timer based on its stale expiry value is outright stupid. Thanks to Viresh for spotting the brainfart"
* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
hrtimer: Set expiry time before switch_hrtimer_base()
commit 3f017a4ca2de0a87767ab047b2bd2f3f11e87a9e
Merge: 14186fe 2ed9fd2
Author: Linus Torvalds <[email protected]>
Date: Tue May 20 14:18:04 2014 +0900
Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq fixes from Thomas Gleixner:
"Two small updates from the irq departement:
- Provide missing inline stub for a SMP only function
- Add sub-maintainer for the drivers/irqchip/ part of the irq subsystem. YAY!"
* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
MAINTAINERS: Add co-maintainer for drivers/irqchip
genirq: Provide irq_force_affinity fallback for non-SMP
commit f5c16f29bf5e57ba4051fc7785ba7f035f798c71
Author: Tejun Heo <[email protected]> Date: Mon May 19 15:52:10 2014 -0400
sysfs: make sure read buffer is zeroed
13c589d5b0ac ("sysfs: use seq_file when reading regular files") switched sysfs from custom read implementation to seq_file to enable later transition to kernfs. After the change, the buffer passed to ->show() is acquired through seq_get_buf(); unfortunately, this introduces a subtle behavior change. Before the commit, the buffer passed to ->show() was always zero as it was allocated using get_zeroed_page(). Because seq_file doesn't clear buffers on allocation and neither does seq_get_buf(), after the commit, depending on the behavior of ->show(), we may end up exposing uninitialized data to userland thus possibly altering userland visible behavior and leaking information.
Fix it by explicitly clearing the buffer.
commit 4ba4801d73d14690ed15774424e8b1d4c18323a5
Merge: 14186fe e95a2f7
Author: Dave Airlie <[email protected]>
Date: Tue May 20 09:56:26 2014 +1000
Merge tag 'drm-intel-fixes-2014-05-16' of git://anongit.freedesktop.org/drm-intel into drm-fixes
Intel fixes for regressions, black screens and hangs, for 3.15.
* tag 'drm-intel-fixes-2014-05-16' of git://anongit.freedesktop.org/drm-intel:
drm/i915: Increase WM memory latency values on SNB
drm/i915: restore backlight precision when converting from ACPI drm/i915: Use the first mode if there is no preferred mode in the EDID drm/i915/dp: force eDP lane count to max available lanes on BDW drm/i915/vlv: reset VLV media force wake request register drm/i915/SDVO: For sysfs link put directory and target in correct order drm/i915: use lane count and link rate from VBT as minimums for eDP drm/i915: clean up VBT eDP link param decoding
drm/i915: consider the source max DP lane count too
commit e3beb0ac521d50d158a9d253373eae8421ac3998
Author: Lucas Stach <[email protected]> Date: Fri May 16 12:20:42 2014 +0200
cpufreq: cpu0: drop wrong devm usage
This driver is using devres managed calls incorrectly, giving the cpu0 device as first parameter instead of the cpufreq platform device. This results in resources not being freed if the cpufreq platform device is unbound, for example if probing has to be deferred for a missing regulator.
commit c5450db85b828d0c46ac8fc570fb8a51bf07ac40
Author: Bibek Basu <[email protected]> Date: Mon May 19 10:24:01 2014 +0530
cpufreq: remove race while accessing cur_policy
While accessing cur_policy during executing events
CPUFREQ_GOV_START, CPUFREQ_GOV_STOP, CPUFREQ_GOV_LIMITS,
same mutex lock is not taken, dbs_data->mutex, which leads
to race and data corruption while running continious suspend
resume test. This is seen with ondemand governor with suspend
resume test using rtcwake.
Unable to handle kernel NULL pointer dereference at virtual address 00000028
pgd = ed610000
[00000028] *pgd=adf11831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] PREEMPT SMP ARM
Modules linked in: nvhost_vi
CPU: 1 PID: 3243 Comm: rtcwake Not tainted 3.10.24-gf5cf9e5 #1
task: ee708040 ti: ed61c000 task.ti: ed61c000
PC is at cpufreq_governor_dbs+0x400/0x634
LR is at cpufreq_governor_dbs+0x3f8/0x634
pc : [<c05652b8>] lr : [<c05652b0>] psr: 600f0013
sp : ed61dcb0 ip : 000493e0 fp : c1cc14f0
r10: 00000000 r9 : 00000000 r8 : 00000000
r7 : eb725280 r6 : c1cc1560 r5 : eb575200 r4 : ebad7740
r3 : ee708040 r2 : ed61dca8 r1 : 001ebd24 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c5387d Table: ad61006a DAC: 00000015
[<c05652b8>] (cpufreq_governor_dbs+0x400/0x634) from [<c055f700>] (__cpufreq_governor+0x98/0x1b4)
[<c055f700>] (__cpufreq_governor+0x98/0x1b4) from [<c0560770>] (__cpufreq_set_policy+0x250/0x320)
[<c0560770>] (__cpufreq_set_policy+0x250/0x320) from [<c0561dcc>] (cpufreq_update_policy+0xcc/0x168)
[<c0561dcc>] (cpufreq_update_policy+0xcc/0x168) from [<c0561ed0>] (cpu_freq_notify+0x68/0xdc)
[<c0561ed0>] (cpu_freq_notify+0x68/0xdc) from [<c008eff8>] (notifier_call_chain+0x4c/0x8c)
[<c008eff8>] (notifier_call_chain+0x4c/0x8c) from [<c008f3d4>] (__blocking_notifier_call_chain+0x50/0x68)
[<c008f3d4>] (__blocking_notifier_call_chain+0x50/0x68) from [<c008f40c>] (blocking_notifier_call_chain+0x20/0x28)
[<c008f40c>] (blocking_notifier_call_chain+0x20/0x28) from [<c00aac6c>] (pm_qos_update_bounded_target+0xd8/0x310)
[<c00aac6c>] (pm_qos_update_bounded_target+0xd8/0x310) from [<c00ab3b0>] (__pm_qos_update_request+0x64/0x70)
[<c00ab3b0>] (__pm_qos_update_request+0x64/0x70) from [<c004b4b8>] (tegra_pm_notify+0x114/0x134)
[<c004b4b8>] (tegra_pm_notify+0x114/0x134) from [<c008eff8>] (notifier_call_chain+0x4c/0x8c)
[<c008eff8>] (notifier_call_chain+0x4c/0x8c) from [<c008f3d4>] (__blocking_notifier_call_chain+0x50/0x68)
[<c008f3d4>] (__blocking_notifier_call_chain+0x50/0x68) from [<c008f40c>] (blocking_notifier_call_chain+0x20/0x28)
[<c008f40c>] (blocking_notifier_call_chain+0x20/0x28) from [<c00ac228>] (pm_notifier_call_chain+0x1c/0x34)
[<c00ac228>] (pm_notifier_call_chain+0x1c/0x34) from [<c00ad38c>] (enter_state+0xec/0x128)
[<c00ad38c>] (enter_state+0xec/0x128) from [<c00ad400>] (pm_suspend+0x38/0xa4)
[<c00ad400>] (pm_suspend+0x38/0xa4) from [<c00ac114>] (state_store+0x70/0xc0)
[<c00ac114>] (state_store+0x70/0xc0) from [<c027b1e8>] (kobj_attr_store+0x14/0x20)
[<c027b1e8>] (kobj_attr_store+0x14/0x20) from [<c019cd9c>] (sysfs_write_file+0x104/0x184)
[<c019cd9c>] (sysfs_write_file+0x104/0x184) from [<c0143038>] (vfs_write+0xd0/0x19c)
[<c0143038>] (vfs_write+0xd0/0x19c) from [<c0143414>] (SyS_write+0x4c/0x78)
[<c0143414>] (SyS_write+0x4c/0x78) from [<c000f080>] (ret_fast_syscall+0x0/0x30)
Code: e1a00006 eb084346 e59b0020 e5951024 (e5903028)
---[ end trace 0488523c8f6b0f9d ]---
Signed-off-by: Bibek Basu <[email protected]>
Acked-by: Viresh Kumar <[email protected]>
Cc: 3.11+ <[email protected]> # 3.11+
Signed-off-by: Rafael J. Wysocki <[email protected]>commit 20b4f9c73ff4137d720c4f378e1a780ac6a6c04d
Merge: faf1dc6 40b9397
Author: John W. Linville <[email protected]>
Date: Mon May 19 16:34:27 2014 -0400
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
commit 3685f2516116c5f3b9d498d531955ad70216ad84
Author: Shawn Guo <[email protected]> Date: Sat May 17 20:46:01 2014 +0800
ahci: imx: PLL clock needs 100us to settle down
The commit e783c51 (ahci: imx: software workaround for phy reset issue in resume) calls imx_sata_phy_reset() to reset phy immediately after SATA MPLL is enabled. It seems working fine mostly, but fails in some case as below.
...
ahci-imx 2200000.sata: failed to reset phy: -110
ahci-imx: probe of 2200000.sata failed with error -110
After talking to the designer, we learnt that when enabling i.MX6Q SATA MPLL, we need to wait 100us for it to settle down for safety. Add this required delay to fix above failure.
commit d0b4cc4e32705ff00d90d32da7783c266c702c04
Author: Gavin Shan <[email protected]> Date: Mon May 19 13:06:46 2014 +1000
PCI: Wrong register used to check pending traffic
The incorrect register offset is passed to pci_wait_for_pending(), which is caused by commit 157e876ffe ("PCI: Add pci_wait_for_pending() (refactor pci_wait_for_pending_transaction())").
commit 4b353a706a86598ba47307c47301c3c428b79e09
Author: Santosh Shilimkar <[email protected]> Date: Mon May 12 17:37:59 2014 -0400
ARM: OMAP4: Fix the boot regression with CPU_IDLE enabled
On OMAP4 panda board, there have been several bug reports about boot hang and lock-ups with CPU_IDLE enabled. The root cause of the issue is missing interrupts while in idle state. Commit cb7094e8 {cpuidle / omap4 :
use CPUIDLE_FLAG_TIMER_STOP flag} moved the broadcast notifiers to common code for right reasons but on OMAP4 which suffers from a nasty ROM code bug with GIC, commit ff999b8a {ARM: OMAP4460: Workaround for ROM bug ..}, we loose interrupts which leads to issues like lock-up, hangs etc.
Patch reverts commit cb7094 {cpuidle / omap4 : use CPUIDLE_FLAG_TIMER_STOP flag} and 54769d6 {cpuidle: OMAP4: remove timer broadcast initialization} to avoid the issue. With this change, OMAP4 panda boards, the mentioned issues are getting fixed. We no longer loose interrupts which was the cause of the regression.
commit 68d0e40298f064a5cff40670caded0480274d4b2
Author: Sachin Kamat <[email protected]> Date: Tue May 20 01:15:46 2014 +0900
ARM: dts: Keep LDO4 always ON for exynos5250-arndale board
LDO4 regulator was getting disabled preventing the system from going into low power states. Keep it always on to fix it.
commit e3b6c271abddb5363b01b79d6e6e4343008cd991
Author: Sachin Kamat <[email protected]> Date: Tue May 20 01:14:03 2014 +0900
ARM: dts: Fix SPI interrupt numbers for exynos5420
Updated as per the user manual.
commit 30cc798b63fd21ba58c94f4f8b4c1e55137fd029
Author: Beomho Seo <[email protected]> Date: Tue May 20 01:12:50 2014 +0900
ARM: dts: fix incorrect ak8975 compatible for exynos4412-trats2 board
This patch fixed incorrect compatible for ak8975 magnetic sensor. ak8975 magnetic sensor use compatible "ak8975" or "asahi-kasei,ak8975" In this patch, use "asahi-kasei,ak8975" according to dt bindings document.
commit b69cf53640da2b86439596118cfa95233154ee76
Author: Peter Zijlstra <[email protected]> Date: Fri Mar 14 10:50:33 2014 +0100
perf: Fix a race between ring_buffer_detach() and ring_buffer_attach()
Alexander noticed that we use RCU iteration on rb->event_list but do not use list_{add,del}_rcu() to add,remove entries to that list, nor do we observe proper grace periods when re-using the entries.
Merge ring_buffer_detach() into ring_buffer_attach() such that attaching to the NULL buffer is detaching.
Furthermore, ensure that between any 'detach' and 'attach' of the same event we observe the required grace period, but only when strictly required. In effect this means that only ioctl(.request = PERF_EVENT_IOC_SET_OUTPUT) will wait for a grace period, while the normal initial attach and final detach will not be delayed.
This patch should, I think, do the right thing under all circumstances, the 'normal' cases all should never see the extra grace period, but the two cases:
1) PERF_EVENT_IOC_SET_OUTPUT on an event which already has a ring_buffer set, will now observe the required grace period between removing itself from the old and attaching itself to the new buffer.
This case is 'simple' in that both buffers are present in perf_event_set_output() one could think an unconditional synchronize_rcu() would be sufficient; however...
2) an event that has a buffer attached, the buffer is destroyed (munmap) and then the event is attached to a new/different buffer using PERF_EVENT_IOC_SET_OUTPUT.
This case is more complex because the buffer destruction does:
ring_buffer_attach(.rb = NULL)
followed by the ioctl() doing:
ring_buffer_attach(.rb = foo);
and we still need to observe the grace period between these two calls due to us reusing the event->rb_entry list_head.
In order to make 2 happen we use Paul's latest cond_synchronize_rcu() call.
commit 39af6b1678afa5880dda7e375cf3f9d395087f6d
Author: Jiri Olsa <[email protected]> Date: Mon Apr 7 11:04:08 2014 +0200
perf: Prevent false warning in perf_swevent_add
The perf cpu offline callback takes down all cpu context
events and releases swhash->swevent_hlist.
This could race with task context software event being just
scheduled on this cpu via perf_swevent_add while cpu hotplug
code already cleaned up event's data.
The race happens in the gap between the cpu notifier code
and the cpu being actually taken down. Note that only cpu
ctx events are terminated in the perf cpu hotplug code.
It's easily reproduced with:
$ perf record -e faults perf bench sched pipe
while putting one of the cpus offline:
# echo 0 > /sys/devices/system/cpu/cpu1/online
Console emits following warning:
WARNING: CPU: 1 PID: 2845 at kernel/events/core.c:5672 perf_swevent_add+0x18d/0x1a0()
Modules linked in:
CPU: 1 PID: 2845 Comm: sched-pipe Tainted: G W 3.14.0+ #256
Hardware name: Intel Corporation Montevina platform/To be filled by O.E.M., BIOS AMVACRB1.86C.0066.B00.0805070703 05/07/2008
0000000000000009 ffff880077233ab8 ffffffff81665a23 0000000000200005
0000000000000000 ffff880077233af8 ffffffff8104732c 0000000000000046
ffff88007467c800 0000000000000002 ffff88007a9cf2a0 0000000000000001
Call Trace:
[<ffffffff81665a23>] dump_stack+0x4f/0x7c
[<ffffffff8104732c>] warn_slowpath_common+0x8c/0xc0
[<ffffffff8104737a>] warn_slowpath_null+0x1a/0x20
[<ffffffff8110fb3d>] perf_swevent_add+0x18d/0x1a0
[<ffffffff811162ae>] event_sched_in.isra.75+0x9e/0x1f0
[<ffffffff8111646a>] group_sched_in+0x6a/0x1f0
[<ffffffff81083dd5>] ? sched_clock_local+0x25/0xa0
[<ffffffff811167e6>] ctx_sched_in+0x1f6/0x450
[<ffffffff8111757b>] perf_event_sched_in+0x6b/0xa0
[<ffffffff81117a4b>] perf_event_context_sched_in+0x7b/0xc0
[<ffffffff81117ece>] __perf_event_task_sched_in+0x43e/0x460
[<ffffffff81096f1e>] ? put_lock_stats.isra.18+0xe/0x30
[<ffffffff8107b3c8>] finish_task_switch+0xb8/0x100
[<ffffffff8166a7de>] __schedule+0x30e/0xad0
[<ffffffff81172dd2>] ? pipe_read+0x3e2/0x560
[<ffffffff8166b45e>] ? preempt_schedule_irq+0x3e/0x70
[<ffffffff8166b45e>] ? preempt_schedule_irq+0x3e/0x70
[<ffffffff8166b464>] preempt_schedule_irq+0x44/0x70
[<ffffffff816707f0>] retint_kernel+0x20/0x30
[<ffffffff8109e60a>] ? lockdep_sys_exit+0x1a/0x90
[<ffffffff812a4234>] lockdep_sys_exit_thunk+0x35/0x67
[<ffffffff81679321>] ? sysret_check+0x5/0x56
Fixing this by tracking the cpu hotplug state and displaying
the WARN only if current cpu is initialized properly.
Cc: Corey Ashford <[email protected]>
Cc: Frederic Weisbecker <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Paul Mackerras <[email protected]>
Cc: Arnaldo Carvalho de Melo <[email protected]>
Cc: [email protected]
Reported-by: Fengguang Wu <[email protected]>
Signed-off-by: Jiri Olsa <[email protected]>
Signed-off-by: Peter Zijlstra <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Thomas Gleixner <[email protected]>commit 0819b2e30ccb93edf04876237b6205eef84ec8d2
Author: Peter Zijlstra <[email protected]> Date: Thu May 15 20:23:48 2014 +0200
perf: Limit perf_event_attr::sample_period to 63 bits
Vince reported that using a large sample_period (one with bit 63 set) results in wreckage since while the sample_period is fundamentally unsigned (negative periods don't make sense) the way we implement things very much rely on signed logic.
So limit sample_period to 63 bits to avoid tripping over this.
commit f0d71b3dcb8332f7971b5f2363632573e6d9486a
Author: Thomas Gleixner <[email protected]> Date: Mon May 12 20:45:35 2014 +0000
futex: Prevent attaching to kernel threads
We happily allow userspace to declare a random kernel thread to be the owner of a user space PI futex.
Found while analysing the fallout of Dave Jones syscall fuzzer.
We also should validate the thread group for private futexes and find some fast way to validate whether the "alleged" owner has RW access on the file which backs the SHM, but that's a separate issue.
commit 866293ee54227584ffcb4a42f69c1f365974ba7f
Author: Thomas Gleixner <[email protected]> Date: Mon May 12 20:45:34 2014 +0000
futex: Add another early deadlock detection check
Dave Jones trinity syscall fuzzer exposed an issue in the deadlock detection code of rtmutex:
http://lkml.kernel.org/r/[email protected]
That underlying issue has been fixed with a patch to the rtmutex code, but the futex code must not call into rtmutex in that case because
- it can detect that issue early
- it avoids a different and more complex fixup for backing out
If the user space variable got manipulated to 0x80000000 which means no lock holder, but the waiters bit set and an active pi_state in the kernel is found we can figure out the recursive locking issue by looking at the pi_state owner. If that is the current task, then we can safely return -EDEADLK.
The check should have been added in commit 59fa62451 (futex: Handle futex_pi OWNER_DIED take over correctly) already, but I did not see the above issue caused by user space manipulation back then.
commit 02fb05a598e9393382f55132a36aff84f4d76ad5
Author: Tushar Behera <[email protected]> Date: Mon May 19 14:53:53 2014 +0530
ALSA: pcm_dmaengine: Add check during device suspend
Currently snd_dmaengine_pcm_trigger() calls dmaengine_pause() unconditinally during device suspend. In case where DMA controller doesn't support PAUSE/RESUME functionality, this call is not able to stop the DMA controller. In this scenario, audio playback doesn't resume after device resume.
Calling dmaengine_pause/dmaengine_terminate_all conditionally fixes the issue.
It has been tested with audio playback on Samsung platform having PL330 DMA controller which doesn't support PAUSE/RESUME.
commit 524369e2391f4b422d0efdd11d526a373a11a43a
Author: Oliver Hartkopp <[email protected]> Date: Tue May 6 19:45:38 2014 +0200
can: c_can: remove obsolete STRICT_FRAME_ORDERING Kconfig option
In 2b9aecdce2 ("can: c_can: Disable rx split as workaround") a new Kconfig option was introduced as a workaround. The tests performed by Alexander Stein confirmed this option to be obsolete with all the other cleanups and fixes that had been discussed that time:
http://marc.info/?l=linux-can&m=139746476821294&w=2
Both (author and tester) agreed to remove this Kconfig option again:
http://marc.info/?l=linux-can&m=139883820714229&w=2
As some more cleanups took place since then a simple revert is not possible. This patch removes the entire option as it would behave when disabled. Further beautification’s can be done later.
commit 4f337ed5c014752b000f593182fdcfa3ecf0d166
Author: Jesse Gross <[email protected]> Date: Fri May 16 15:57:59 2014 -0700
MAINTAINERS: Pravin Shelar is Open vSwitch maintainer.
Pravin will be maintaining Open vSwitch going forward.
commit 02948344fbf511c6eec28687dc76bb64b758ff93
Author: Joe Perches <[email protected]> Date: Thu May 15 23:51:43 2014 -0700
bnx2x: Convert return 0 to return rc
These "return 0;" uses seem wrong as there are rc variables where error return values are set but unused.
commit 1e1110c43b1cda9fe77fc4a04835e460550e6b3c
Author: Mikulas Patocka <[email protected]> Date: Sat May 17 06:49:22 2014 -0400
target: fix memory leak on XCOPY
On each processed XCOPY command, two "kmalloc-512" memory objects are leaked. These represent two allocations of struct xcopy_pt_cmd in target_core_xcopy.c.
The reason for the memory leak is that the cmd_kref field is not initialized (thus, it is zero because the allocations were done with kzalloc). When we decrement zero kref in target_put_sess_cmd, the result is not zero, thus target_release_cmd_kref is not called.
7,315 lines not shown · raw message
Part of this message is not shown here. View the raw message.