* [PATCH 3.16 001/158] reiserfs: fix corruption introduced by balance_leaf refactor
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 002/158] reiserfs: Fix use after free in journal teardown Greg Kroah-Hartman
` (155 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeff Mahoney, Jan Kara
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <jeffm@suse.com>
commit 27d0e5bc85f3341b9ba66f0c23627cf9d7538c9d upstream.
Commits f1f007c308e (reiserfs: balance_leaf refactor, pull out
balance_leaf_insert_left) and cf22df182bf (reiserfs: balance_leaf
refactor, pull out balance_leaf_paste_left) missed that the `body'
pointer was getting repositioned. Subsequent users of the pointer
would expect it to be repositioned, and as a result, parts of the
tree would get overwritten. The most common observed corruption
is indirect block pointers being overwritten.
Since the body value isn't actually used anymore in the called routines,
we can pass back the offset it should be shifted. We constify the body
and ih pointers in the balance_leaf as a mostly-free preventative measure.
Reported-and-tested-by: Jeff Chua <jeff.chua.linux@gmail.com>
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/reiserfs/do_balan.c | 111 +++++++++++++++++++++++++++----------------------
fs/reiserfs/lbalance.c | 5 +-
fs/reiserfs/reiserfs.h | 9 ++-
3 files changed, 71 insertions(+), 54 deletions(-)
--- a/fs/reiserfs/do_balan.c
+++ b/fs/reiserfs/do_balan.c
@@ -286,12 +286,14 @@ static int balance_leaf_when_delete(stru
return 0;
}
-static void balance_leaf_insert_left(struct tree_balance *tb,
- struct item_head *ih, const char *body)
+static unsigned int balance_leaf_insert_left(struct tree_balance *tb,
+ struct item_head *const ih,
+ const char * const body)
{
int ret;
struct buffer_info bi;
int n = B_NR_ITEMS(tb->L[0]);
+ unsigned body_shift_bytes = 0;
if (tb->item_pos == tb->lnum[0] - 1 && tb->lbytes != -1) {
/* part of new item falls into L[0] */
@@ -329,7 +331,7 @@ static void balance_leaf_insert_left(str
put_ih_item_len(ih, new_item_len);
if (tb->lbytes > tb->zeroes_num) {
- body += (tb->lbytes - tb->zeroes_num);
+ body_shift_bytes = tb->lbytes - tb->zeroes_num;
tb->zeroes_num = 0;
} else
tb->zeroes_num -= tb->lbytes;
@@ -349,11 +351,12 @@ static void balance_leaf_insert_left(str
tb->insert_size[0] = 0;
tb->zeroes_num = 0;
}
+ return body_shift_bytes;
}
static void balance_leaf_paste_left_shift_dirent(struct tree_balance *tb,
- struct item_head *ih,
- const char *body)
+ struct item_head * const ih,
+ const char * const body)
{
int n = B_NR_ITEMS(tb->L[0]);
struct buffer_info bi;
@@ -413,17 +416,18 @@ static void balance_leaf_paste_left_shif
tb->pos_in_item -= tb->lbytes;
}
-static void balance_leaf_paste_left_shift(struct tree_balance *tb,
- struct item_head *ih,
- const char *body)
+static unsigned int balance_leaf_paste_left_shift(struct tree_balance *tb,
+ struct item_head * const ih,
+ const char * const body)
{
struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
int n = B_NR_ITEMS(tb->L[0]);
struct buffer_info bi;
+ int body_shift_bytes = 0;
if (is_direntry_le_ih(item_head(tbS0, tb->item_pos))) {
balance_leaf_paste_left_shift_dirent(tb, ih, body);
- return;
+ return 0;
}
RFALSE(tb->lbytes <= 0,
@@ -497,7 +501,7 @@ static void balance_leaf_paste_left_shif
* insert_size[0]
*/
if (l_n > tb->zeroes_num) {
- body += (l_n - tb->zeroes_num);
+ body_shift_bytes = l_n - tb->zeroes_num;
tb->zeroes_num = 0;
} else
tb->zeroes_num -= l_n;
@@ -526,13 +530,14 @@ static void balance_leaf_paste_left_shif
*/
leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
}
+ return body_shift_bytes;
}
/* appended item will be in L[0] in whole */
static void balance_leaf_paste_left_whole(struct tree_balance *tb,
- struct item_head *ih,
- const char *body)
+ struct item_head * const ih,
+ const char * const body)
{
struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
int n = B_NR_ITEMS(tb->L[0]);
@@ -584,39 +589,44 @@ static void balance_leaf_paste_left_whol
tb->zeroes_num = 0;
}
-static void balance_leaf_paste_left(struct tree_balance *tb,
- struct item_head *ih, const char *body)
+static unsigned int balance_leaf_paste_left(struct tree_balance *tb,
+ struct item_head * const ih,
+ const char * const body)
{
/* we must shift the part of the appended item */
if (tb->item_pos == tb->lnum[0] - 1 && tb->lbytes != -1)
- balance_leaf_paste_left_shift(tb, ih, body);
+ return balance_leaf_paste_left_shift(tb, ih, body);
else
balance_leaf_paste_left_whole(tb, ih, body);
+ return 0;
}
/* Shift lnum[0] items from S[0] to the left neighbor L[0] */
-static void balance_leaf_left(struct tree_balance *tb, struct item_head *ih,
- const char *body, int flag)
+static unsigned int balance_leaf_left(struct tree_balance *tb,
+ struct item_head * const ih,
+ const char * const body, int flag)
{
if (tb->lnum[0] <= 0)
- return;
+ return 0;
/* new item or it part falls to L[0], shift it too */
if (tb->item_pos < tb->lnum[0]) {
BUG_ON(flag != M_INSERT && flag != M_PASTE);
if (flag == M_INSERT)
- balance_leaf_insert_left(tb, ih, body);
+ return balance_leaf_insert_left(tb, ih, body);
else /* M_PASTE */
- balance_leaf_paste_left(tb, ih, body);
+ return balance_leaf_paste_left(tb, ih, body);
} else
/* new item doesn't fall into L[0] */
leaf_shift_left(tb, tb->lnum[0], tb->lbytes);
+ return 0;
}
static void balance_leaf_insert_right(struct tree_balance *tb,
- struct item_head *ih, const char *body)
+ struct item_head * const ih,
+ const char * const body)
{
struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
@@ -704,7 +714,8 @@ static void balance_leaf_insert_right(st
static void balance_leaf_paste_right_shift_dirent(struct tree_balance *tb,
- struct item_head *ih, const char *body)
+ struct item_head * const ih,
+ const char * const body)
{
struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
struct buffer_info bi;
@@ -754,7 +765,8 @@ static void balance_leaf_paste_right_shi
}
static void balance_leaf_paste_right_shift(struct tree_balance *tb,
- struct item_head *ih, const char *body)
+ struct item_head * const ih,
+ const char * const body)
{
struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
int n_shift, n_rem, r_zeroes_number, version;
@@ -831,7 +843,8 @@ static void balance_leaf_paste_right_shi
}
static void balance_leaf_paste_right_whole(struct tree_balance *tb,
- struct item_head *ih, const char *body)
+ struct item_head * const ih,
+ const char * const body)
{
struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
int n = B_NR_ITEMS(tbS0);
@@ -874,7 +887,8 @@ static void balance_leaf_paste_right_who
}
static void balance_leaf_paste_right(struct tree_balance *tb,
- struct item_head *ih, const char *body)
+ struct item_head * const ih,
+ const char * const body)
{
struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
int n = B_NR_ITEMS(tbS0);
@@ -896,8 +910,9 @@ static void balance_leaf_paste_right(str
}
/* shift rnum[0] items from S[0] to the right neighbor R[0] */
-static void balance_leaf_right(struct tree_balance *tb, struct item_head *ih,
- const char *body, int flag)
+static void balance_leaf_right(struct tree_balance *tb,
+ struct item_head * const ih,
+ const char * const body, int flag)
{
if (tb->rnum[0] <= 0)
return;
@@ -911,8 +926,8 @@ static void balance_leaf_right(struct tr
}
static void balance_leaf_new_nodes_insert(struct tree_balance *tb,
- struct item_head *ih,
- const char *body,
+ struct item_head * const ih,
+ const char * const body,
struct item_head *insert_key,
struct buffer_head **insert_ptr,
int i)
@@ -1003,8 +1018,8 @@ static void balance_leaf_new_nodes_inser
/* we append to directory item */
static void balance_leaf_new_nodes_paste_dirent(struct tree_balance *tb,
- struct item_head *ih,
- const char *body,
+ struct item_head * const ih,
+ const char * const body,
struct item_head *insert_key,
struct buffer_head **insert_ptr,
int i)
@@ -1058,8 +1073,8 @@ static void balance_leaf_new_nodes_paste
}
static void balance_leaf_new_nodes_paste_shift(struct tree_balance *tb,
- struct item_head *ih,
- const char *body,
+ struct item_head * const ih,
+ const char * const body,
struct item_head *insert_key,
struct buffer_head **insert_ptr,
int i)
@@ -1131,8 +1146,8 @@ static void balance_leaf_new_nodes_paste
}
static void balance_leaf_new_nodes_paste_whole(struct tree_balance *tb,
- struct item_head *ih,
- const char *body,
+ struct item_head * const ih,
+ const char * const body,
struct item_head *insert_key,
struct buffer_head **insert_ptr,
int i)
@@ -1184,8 +1199,8 @@ static void balance_leaf_new_nodes_paste
}
static void balance_leaf_new_nodes_paste(struct tree_balance *tb,
- struct item_head *ih,
- const char *body,
+ struct item_head * const ih,
+ const char * const body,
struct item_head *insert_key,
struct buffer_head **insert_ptr,
int i)
@@ -1214,8 +1229,8 @@ static void balance_leaf_new_nodes_paste
/* Fill new nodes that appear in place of S[0] */
static void balance_leaf_new_nodes(struct tree_balance *tb,
- struct item_head *ih,
- const char *body,
+ struct item_head * const ih,
+ const char * const body,
struct item_head *insert_key,
struct buffer_head **insert_ptr,
int flag)
@@ -1254,8 +1269,8 @@ static void balance_leaf_new_nodes(struc
}
static void balance_leaf_finish_node_insert(struct tree_balance *tb,
- struct item_head *ih,
- const char *body)
+ struct item_head * const ih,
+ const char * const body)
{
struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
struct buffer_info bi;
@@ -1271,8 +1286,8 @@ static void balance_leaf_finish_node_ins
}
static void balance_leaf_finish_node_paste_dirent(struct tree_balance *tb,
- struct item_head *ih,
- const char *body)
+ struct item_head * const ih,
+ const char * const body)
{
struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
struct item_head *pasted = item_head(tbS0, tb->item_pos);
@@ -1305,8 +1320,8 @@ static void balance_leaf_finish_node_pas
}
static void balance_leaf_finish_node_paste(struct tree_balance *tb,
- struct item_head *ih,
- const char *body)
+ struct item_head * const ih,
+ const char * const body)
{
struct buffer_head *tbS0 = PATH_PLAST_BUFFER(tb->tb_path);
struct buffer_info bi;
@@ -1349,8 +1364,8 @@ static void balance_leaf_finish_node_pas
* of the affected item which remains in S
*/
static void balance_leaf_finish_node(struct tree_balance *tb,
- struct item_head *ih,
- const char *body, int flag)
+ struct item_head * const ih,
+ const char * const body, int flag)
{
/* if we must insert or append into buffer S[0] */
if (0 <= tb->item_pos && tb->item_pos < tb->s0num) {
@@ -1402,7 +1417,7 @@ static int balance_leaf(struct tree_bala
&& is_indirect_le_ih(item_head(tbS0, tb->item_pos)))
tb->pos_in_item *= UNFM_P_SIZE;
- balance_leaf_left(tb, ih, body, flag);
+ body += balance_leaf_left(tb, ih, body, flag);
/* tb->lnum[0] > 0 */
/* Calculate new item position */
--- a/fs/reiserfs/lbalance.c
+++ b/fs/reiserfs/lbalance.c
@@ -899,8 +899,9 @@ void leaf_delete_items(struct buffer_inf
/* insert item into the leaf node in position before */
void leaf_insert_into_buf(struct buffer_info *bi, int before,
- struct item_head *inserted_item_ih,
- const char *inserted_item_body, int zeros_number)
+ struct item_head * const inserted_item_ih,
+ const char * const inserted_item_body,
+ int zeros_number)
{
struct buffer_head *bh = bi->bi_bh;
int nr, free_space;
--- a/fs/reiserfs/reiserfs.h
+++ b/fs/reiserfs/reiserfs.h
@@ -3216,11 +3216,12 @@ int leaf_shift_right(struct tree_balance
void leaf_delete_items(struct buffer_info *cur_bi, int last_first, int first,
int del_num, int del_bytes);
void leaf_insert_into_buf(struct buffer_info *bi, int before,
- struct item_head *inserted_item_ih,
- const char *inserted_item_body, int zeros_number);
-void leaf_paste_in_buffer(struct buffer_info *bi, int pasted_item_num,
- int pos_in_item, int paste_size, const char *body,
+ struct item_head * const inserted_item_ih,
+ const char * const inserted_item_body,
int zeros_number);
+void leaf_paste_in_buffer(struct buffer_info *bi, int pasted_item_num,
+ int pos_in_item, int paste_size,
+ const char * const body, int zeros_number);
void leaf_cut_from_buffer(struct buffer_info *bi, int cut_item_num,
int pos_in_item, int cut_size);
void leaf_paste_entries(struct buffer_info *bi, int item_num, int before,
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 002/158] reiserfs: Fix use after free in journal teardown
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 001/158] reiserfs: fix corruption introduced by balance_leaf refactor Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 003/158] media: xc5000: Fix get_frequency() Greg Kroah-Hartman
` (154 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jan Kara
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 01777836c87081e4f68c4a43c9abe6114805f91e upstream.
If do_journal_release() races with do_journal_end() which requeues
delayed works for transaction flushing, we can leave work items for
flushing outstanding transactions queued while freeing them. That
results in use after free and possible crash in run_timers_softirq().
Fix the problem by not requeueing works if superblock is being shut down
(MS_ACTIVE not set) and using cancel_delayed_work_sync() in
do_journal_release().
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/reiserfs/journal.c | 22 ++++++++++++++++------
fs/reiserfs/super.c | 6 +++++-
2 files changed, 21 insertions(+), 7 deletions(-)
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -1947,8 +1947,6 @@ static int do_journal_release(struct rei
}
}
- /* wait for all commits to finish */
- cancel_delayed_work(&SB_JOURNAL(sb)->j_work);
/*
* We must release the write lock here because
@@ -1956,8 +1954,14 @@ static int do_journal_release(struct rei
*/
reiserfs_write_unlock(sb);
+ /*
+ * Cancel flushing of old commits. Note that neither of these works
+ * will be requeued because superblock is being shutdown and doesn't
+ * have MS_ACTIVE set.
+ */
cancel_delayed_work_sync(&REISERFS_SB(sb)->old_work);
- flush_workqueue(REISERFS_SB(sb)->commit_wq);
+ /* wait for all commits to finish */
+ cancel_delayed_work_sync(&SB_JOURNAL(sb)->j_work);
free_journal_ram(sb);
@@ -4292,9 +4296,15 @@ static int do_journal_end(struct reiserf
if (flush) {
flush_commit_list(sb, jl, 1);
flush_journal_list(sb, jl, 1);
- } else if (!(jl->j_state & LIST_COMMIT_PENDING))
- queue_delayed_work(REISERFS_SB(sb)->commit_wq,
- &journal->j_work, HZ / 10);
+ } else if (!(jl->j_state & LIST_COMMIT_PENDING)) {
+ /*
+ * Avoid queueing work when sb is being shut down. Transaction
+ * will be flushed on journal shutdown.
+ */
+ if (sb->s_flags & MS_ACTIVE)
+ queue_delayed_work(REISERFS_SB(sb)->commit_wq,
+ &journal->j_work, HZ / 10);
+ }
/*
* if the next transaction has any chance of wrapping, flush
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -100,7 +100,11 @@ void reiserfs_schedule_old_flush(struct
struct reiserfs_sb_info *sbi = REISERFS_SB(s);
unsigned long delay;
- if (s->s_flags & MS_RDONLY)
+ /*
+ * Avoid scheduling flush when sb is being shut down. It can race
+ * with journal shutdown and free still queued delayed work.
+ */
+ if (s->s_flags & MS_RDONLY || !(s->s_flags & MS_ACTIVE))
return;
spin_lock(&sbi->old_work_lock);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 003/158] media: xc5000: Fix get_frequency()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 001/158] reiserfs: fix corruption introduced by balance_leaf refactor Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 002/158] reiserfs: Fix use after free in journal teardown Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 004/158] media: xc4000: " Greg Kroah-Hartman
` (153 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <m.chehab@samsung.com>
commit a3eec916cbc17dc1aaa3ddf120836cd5200eb4ef upstream.
The programmed frequency on xc5000 is not the middle
frequency, but the initial frequency on the bandwidth range.
However, the DVB API works with the middle frequency.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/tuners/xc5000.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
--- a/drivers/media/tuners/xc5000.c
+++ b/drivers/media/tuners/xc5000.c
@@ -56,7 +56,7 @@ struct xc5000_priv {
u32 if_khz;
u16 xtal_khz;
- u32 freq_hz;
+ u32 freq_hz, freq_offset;
u32 bandwidth;
u8 video_standard;
u8 rf_mode;
@@ -749,13 +749,13 @@ static int xc5000_set_params(struct dvb_
case SYS_ATSC:
dprintk(1, "%s() VSB modulation\n", __func__);
priv->rf_mode = XC_RF_MODE_AIR;
- priv->freq_hz = freq - 1750000;
+ priv->freq_offset = 1750000;
priv->video_standard = DTV6;
break;
case SYS_DVBC_ANNEX_B:
dprintk(1, "%s() QAM modulation\n", __func__);
priv->rf_mode = XC_RF_MODE_CABLE;
- priv->freq_hz = freq - 1750000;
+ priv->freq_offset = 1750000;
priv->video_standard = DTV6;
break;
case SYS_ISDBT:
@@ -770,15 +770,15 @@ static int xc5000_set_params(struct dvb_
switch (bw) {
case 6000000:
priv->video_standard = DTV6;
- priv->freq_hz = freq - 1750000;
+ priv->freq_offset = 1750000;
break;
case 7000000:
priv->video_standard = DTV7;
- priv->freq_hz = freq - 2250000;
+ priv->freq_offset = 2250000;
break;
case 8000000:
priv->video_standard = DTV8;
- priv->freq_hz = freq - 2750000;
+ priv->freq_offset = 2750000;
break;
default:
printk(KERN_ERR "xc5000 bandwidth not set!\n");
@@ -792,15 +792,15 @@ static int xc5000_set_params(struct dvb_
priv->rf_mode = XC_RF_MODE_CABLE;
if (bw <= 6000000) {
priv->video_standard = DTV6;
- priv->freq_hz = freq - 1750000;
+ priv->freq_offset = 1750000;
b = 6;
} else if (bw <= 7000000) {
priv->video_standard = DTV7;
- priv->freq_hz = freq - 2250000;
+ priv->freq_offset = 2250000;
b = 7;
} else {
priv->video_standard = DTV7_8;
- priv->freq_hz = freq - 2750000;
+ priv->freq_offset = 2750000;
b = 8;
}
dprintk(1, "%s() Bandwidth %dMHz (%d)\n", __func__,
@@ -811,6 +811,8 @@ static int xc5000_set_params(struct dvb_
return -EINVAL;
}
+ priv->freq_hz = freq - priv->freq_offset;
+
dprintk(1, "%s() frequency=%d (compensated to %d)\n",
__func__, freq, priv->freq_hz);
@@ -1061,7 +1063,7 @@ static int xc5000_get_frequency(struct d
{
struct xc5000_priv *priv = fe->tuner_priv;
dprintk(1, "%s()\n", __func__);
- *freq = priv->freq_hz;
+ *freq = priv->freq_hz + priv->freq_offset;
return 0;
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 004/158] media: xc4000: Fix get_frequency()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 003/158] media: xc5000: Fix get_frequency() Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 005/158] media: au0828: Only alt setting logic when needed Greg Kroah-Hartman
` (152 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <m.chehab@samsung.com>
commit 4c07e32884ab69574cfd9eb4de3334233c938071 upstream.
The programmed frequency on xc4000 is not the middle
frequency, but the initial frequency on the bandwidth range.
However, the DVB API works with the middle frequency.
This works fine on set_frontend, as the device calculates
the needed offset. However, at get_frequency(), the returned
value is the initial frequency. That's generally not a big
problem on most drivers, however, starting with changeset
6fe1099c7aec, the frequency drift is taken into account at
dib7000p driver.
This broke support for PCTV 340e, with uses dib7000p demod and
xc4000 tuner.
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/tuners/xc4000.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
--- a/drivers/media/tuners/xc4000.c
+++ b/drivers/media/tuners/xc4000.c
@@ -93,7 +93,7 @@ struct xc4000_priv {
struct firmware_description *firm;
int firm_size;
u32 if_khz;
- u32 freq_hz;
+ u32 freq_hz, freq_offset;
u32 bandwidth;
u8 video_standard;
u8 rf_mode;
@@ -1157,14 +1157,14 @@ static int xc4000_set_params(struct dvb_
case SYS_ATSC:
dprintk(1, "%s() VSB modulation\n", __func__);
priv->rf_mode = XC_RF_MODE_AIR;
- priv->freq_hz = c->frequency - 1750000;
+ priv->freq_offset = 1750000;
priv->video_standard = XC4000_DTV6;
type = DTV6;
break;
case SYS_DVBC_ANNEX_B:
dprintk(1, "%s() QAM modulation\n", __func__);
priv->rf_mode = XC_RF_MODE_CABLE;
- priv->freq_hz = c->frequency - 1750000;
+ priv->freq_offset = 1750000;
priv->video_standard = XC4000_DTV6;
type = DTV6;
break;
@@ -1173,23 +1173,23 @@ static int xc4000_set_params(struct dvb_
dprintk(1, "%s() OFDM\n", __func__);
if (bw == 0) {
if (c->frequency < 400000000) {
- priv->freq_hz = c->frequency - 2250000;
+ priv->freq_offset = 2250000;
} else {
- priv->freq_hz = c->frequency - 2750000;
+ priv->freq_offset = 2750000;
}
priv->video_standard = XC4000_DTV7_8;
type = DTV78;
} else if (bw <= 6000000) {
priv->video_standard = XC4000_DTV6;
- priv->freq_hz = c->frequency - 1750000;
+ priv->freq_offset = 1750000;
type = DTV6;
} else if (bw <= 7000000) {
priv->video_standard = XC4000_DTV7;
- priv->freq_hz = c->frequency - 2250000;
+ priv->freq_offset = 2250000;
type = DTV7;
} else {
priv->video_standard = XC4000_DTV8;
- priv->freq_hz = c->frequency - 2750000;
+ priv->freq_offset = 2750000;
type = DTV8;
}
priv->rf_mode = XC_RF_MODE_AIR;
@@ -1200,6 +1200,8 @@ static int xc4000_set_params(struct dvb_
goto fail;
}
+ priv->freq_hz = c->frequency - priv->freq_offset;
+
dprintk(1, "%s() frequency=%d (compensated)\n",
__func__, priv->freq_hz);
@@ -1520,7 +1522,7 @@ static int xc4000_get_frequency(struct d
{
struct xc4000_priv *priv = fe->tuner_priv;
- *freq = priv->freq_hz;
+ *freq = priv->freq_hz + priv->freq_offset;
if (debug) {
mutex_lock(&priv->lock);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 005/158] media: au0828: Only alt setting logic when needed
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 004/158] media: xc4000: " Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 007/158] media: mt9v032: fix hblank calculation Greg Kroah-Hartman
` (151 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <m.chehab@samsung.com>
commit 64ea37bbd8a5815522706f0099ad3f11c7537e15 upstream.
It seems that there's a bug at au0828 hardware/firmware
related to alternate setting: when the device is already at
alt 5, a further call causes the URBs to receive -ESHUTDOWN.
I found two different encarnations of this issue:
1) at qv4l2, it fails the second time we try to open the
video screen;
2) at xawtv, when audio underrun occurs, with is very
frequent, at least on my test machine.
The fix is simple: just check if alt=5 before calling
set_usb_interface().
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/au0828/au0828-video.c | 34 ++++++++++++++++----------------
1 file changed, 17 insertions(+), 17 deletions(-)
--- a/drivers/media/usb/au0828/au0828-video.c
+++ b/drivers/media/usb/au0828/au0828-video.c
@@ -787,11 +787,27 @@ static int au0828_i2s_init(struct au0828
/*
* Auvitek au0828 analog stream enable
- * Please set interface0 to AS5 before enable the stream
*/
static int au0828_analog_stream_enable(struct au0828_dev *d)
{
+ struct usb_interface *iface;
+ int ret;
+
dprintk(1, "au0828_analog_stream_enable called\n");
+
+ iface = usb_ifnum_to_if(d->usbdev, 0);
+ if (iface && iface->cur_altsetting->desc.bAlternateSetting != 5) {
+ dprintk(1, "Changing intf#0 to alt 5\n");
+ /* set au0828 interface0 to AS5 here again */
+ ret = usb_set_interface(d->usbdev, 0, 5);
+ if (ret < 0) {
+ printk(KERN_INFO "Au0828 can't set alt setting to 5!\n");
+ return -EBUSY;
+ }
+ }
+
+ /* FIXME: size should be calculated using d->width, d->height */
+
au0828_writereg(d, AU0828_SENSORCTRL_VBI_103, 0x00);
au0828_writereg(d, 0x106, 0x00);
/* set x position */
@@ -1002,15 +1018,6 @@ static int au0828_v4l2_open(struct file
return -ERESTARTSYS;
}
if (dev->users == 0) {
- /* set au0828 interface0 to AS5 here again */
- ret = usb_set_interface(dev->usbdev, 0, 5);
- if (ret < 0) {
- mutex_unlock(&dev->lock);
- printk(KERN_INFO "Au0828 can't set alternate to 5!\n");
- kfree(fh);
- return -EBUSY;
- }
-
au0828_analog_stream_enable(dev);
au0828_analog_stream_reset(dev);
@@ -1252,13 +1259,6 @@ static int au0828_set_format(struct au08
}
}
- /* set au0828 interface0 to AS5 here again */
- ret = usb_set_interface(dev->usbdev, 0, 5);
- if (ret < 0) {
- printk(KERN_INFO "Au0828 can't set alt setting to 5!\n");
- return -EBUSY;
- }
-
au0828_analog_stream_enable(dev);
return 0;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 007/158] media: mt9v032: fix hblank calculation
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 005/158] media: au0828: Only alt setting logic when needed Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 008/158] media: v4l: vsp1: Remove the unneeded vsp1_video_buffer video field Greg Kroah-Hartman
` (150 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Philipp Zabel, Laurent Pinchart,
Mauro Carvalho Chehab
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Zabel <p.zabel@pengutronix.de>
commit f17bc3f4707eb87bdb80b895911c551cdd606fbd upstream.
Since (min_row_time - crop->width) can be negative, we have to do a signed
comparison here. Otherwise max_t casts the negative value to unsigned int
and sets min_hblank to that invalid value.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/mt9v032.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/i2c/mt9v032.c
+++ b/drivers/media/i2c/mt9v032.c
@@ -305,8 +305,8 @@ mt9v032_update_hblank(struct mt9v032 *mt
if (mt9v032->version->version == MT9V034_CHIP_ID_REV1)
min_hblank += (mt9v032->hratio - 1) * 10;
- min_hblank = max_t(unsigned int, (int)mt9v032->model->data->min_row_time - crop->width,
- (int)min_hblank);
+ min_hblank = max_t(int, mt9v032->model->data->min_row_time - crop->width,
+ min_hblank);
hblank = max_t(unsigned int, mt9v032->hblank, min_hblank);
return mt9v032_write(client, MT9V032_HORIZONTAL_BLANKING, hblank);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 008/158] media: v4l: vsp1: Remove the unneeded vsp1_video_buffer video field
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 007/158] media: mt9v032: fix hblank calculation Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 009/158] media: v4l: vb2: Fix stream start and buffer completion race Greg Kroah-Hartman
` (149 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Takanari Hayama, Laurent Pinchart,
Mauro Carvalho Chehab
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
commit e51daefc228aa164adcc17fe8fce0f856ad0a1cc upstream.
The field is assigned but never read, remove it.
This fixes a bug caused by the struct vb2_buffer field not being be the
very first field of the vsp1_video_buffer buffer structure as required
by videobuf2.
Reported-by: Takanari Hayama <taki@igel.co.jp>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/vsp1/vsp1_video.c | 2 --
drivers/media/platform/vsp1/vsp1_video.h | 1 -
2 files changed, 3 deletions(-)
--- a/drivers/media/platform/vsp1/vsp1_video.c
+++ b/drivers/media/platform/vsp1/vsp1_video.c
@@ -654,8 +654,6 @@ static int vsp1_video_buffer_prepare(str
if (vb->num_planes < format->num_planes)
return -EINVAL;
- buf->video = video;
-
for (i = 0; i < vb->num_planes; ++i) {
buf->addr[i] = vb2_dma_contig_plane_dma_addr(vb, i);
buf->length[i] = vb2_plane_size(vb, i);
--- a/drivers/media/platform/vsp1/vsp1_video.h
+++ b/drivers/media/platform/vsp1/vsp1_video.h
@@ -90,7 +90,6 @@ static inline struct vsp1_pipeline *to_v
}
struct vsp1_video_buffer {
- struct vsp1_video *video;
struct vb2_buffer buf;
struct list_head queue;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 009/158] media: v4l: vb2: Fix stream start and buffer completion race
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 008/158] media: v4l: vsp1: Remove the unneeded vsp1_video_buffer video field Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 010/158] media: sms: Remove CONFIG_ prefix from Kconfig symbols Greg Kroah-Hartman
` (148 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Hans Verkuil,
Mauro Carvalho Chehab
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
commit bd994ddb2a12a3ff48cd549ec82cdceaea9614df upstream.
videobuf2 stores the driver streaming state internally in the queue in
the start_streaming_called variable. The state is set right after the
driver start_stream operation returns, and checked in the
vb2_buffer_done() function, typically called from the frame completion
interrupt handler. A race condition exists if the hardware finishes
processing the first frame before the start_stream operation returns.
Fix this by setting start_streaming_called to 1 before calling the
start_stream operation, and resetting it to 0 if the operation fails.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/videobuf2-core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -1750,12 +1750,14 @@ static int vb2_start_streaming(struct vb
__enqueue_in_driver(vb);
/* Tell the driver to start streaming */
+ q->start_streaming_called = 1;
ret = call_qop(q, start_streaming, q,
atomic_read(&q->owned_by_drv_count));
- q->start_streaming_called = ret == 0;
if (!ret)
return 0;
+ q->start_streaming_called = 0;
+
dprintk(1, "driver refused to start streaming\n");
if (WARN_ON(atomic_read(&q->owned_by_drv_count))) {
unsigned i;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 010/158] media: sms: Remove CONFIG_ prefix from Kconfig symbols
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 009/158] media: v4l: vb2: Fix stream start and buffer completion race Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 011/158] iommu/vt-d: Exclude devices using RMRRs from IOMMU API domains Greg Kroah-Hartman
` (147 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martin Walch, Paul Bolle,
Mauro Carvalho Chehab
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Bolle <pebolle@tiscali.nl>
commit 3c4b422adb7694418848cefc2a4669d63192c649 upstream.
X-Patchwork-Delegate: mchehab@redhat.com
Remove the CONFIG_ prefix from two Kconfig symbols in a dependency for
SMS_SIANO_DEBUGFS. This prefix is invalid inside Kconfig files.
Note that the current (common sense) dependency on SMS_USB_DRV and
SMS_SDIO_DRV being equal ensures that SMS_SIANO_DEBUGFS will not
violate its constraints. These constraint are that:
- it should only be built if SMS_USB_DRV is set;
- it can't be builtin if USB support is modular.
So drop the dependency on SMS_USB_DRV, as it is unneeded.
Fixes: 6c84b214284e ("[media] sms: fix randconfig building error")
Reported-by: Martin Walch <walch.martin@web.de>
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/common/siano/Kconfig | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/media/common/siano/Kconfig
+++ b/drivers/media/common/siano/Kconfig
@@ -22,8 +22,7 @@ config SMS_SIANO_DEBUGFS
bool "Enable debugfs for smsdvb"
depends on SMS_SIANO_MDTV
depends on DEBUG_FS
- depends on SMS_USB_DRV
- depends on CONFIG_SMS_USB_DRV = CONFIG_SMS_SDIO_DRV
+ depends on SMS_USB_DRV = SMS_SDIO_DRV
---help---
Choose Y to enable visualizing a dump of the frontend
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 011/158] iommu/vt-d: Exclude devices using RMRRs from IOMMU API domains
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 010/158] media: sms: Remove CONFIG_ prefix from Kconfig symbols Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 012/158] powerpc/powernv: Fix IOMMU group lost Greg Kroah-Hartman
` (146 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Williamson, David Woodhouse,
Joerg Roedel
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <alex.williamson@redhat.com>
commit c875d2c1b8083cd627ea0463e20bf22c2d7421ee upstream.
The user of the IOMMU API domain expects to have full control of
the IOVA space for the domain. RMRRs are fundamentally incompatible
with that idea. We can neither map the RMRR into the IOMMU API
domain, nor can we guarantee that the device won't continue DMA with
the area described by the RMRR as part of the new domain. Therefore
we must prevent such devices from being used by the IOMMU API.
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel-iommu.c | 49 +++++++++++++++++++++++++++++++++++---------
1 file changed, 39 insertions(+), 10 deletions(-)
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2523,22 +2523,46 @@ static bool device_has_rmrr(struct devic
return false;
}
+/*
+ * There are a couple cases where we need to restrict the functionality of
+ * devices associated with RMRRs. The first is when evaluating a device for
+ * identity mapping because problems exist when devices are moved in and out
+ * of domains and their respective RMRR information is lost. This means that
+ * a device with associated RMRRs will never be in a "passthrough" domain.
+ * The second is use of the device through the IOMMU API. This interface
+ * expects to have full control of the IOVA space for the device. We cannot
+ * satisfy both the requirement that RMRR access is maintained and have an
+ * unencumbered IOVA space. We also have no ability to quiesce the device's
+ * use of the RMRR space or even inform the IOMMU API user of the restriction.
+ * We therefore prevent devices associated with an RMRR from participating in
+ * the IOMMU API, which eliminates them from device assignment.
+ *
+ * In both cases we assume that PCI USB devices with RMRRs have them largely
+ * for historical reasons and that the RMRR space is not actively used post
+ * boot. This exclusion may change if vendors begin to abuse it.
+ */
+static bool device_is_rmrr_locked(struct device *dev)
+{
+ if (!device_has_rmrr(dev))
+ return false;
+
+ if (dev_is_pci(dev)) {
+ struct pci_dev *pdev = to_pci_dev(dev);
+
+ if ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
+ return false;
+ }
+
+ return true;
+}
+
static int iommu_should_identity_map(struct device *dev, int startup)
{
if (dev_is_pci(dev)) {
struct pci_dev *pdev = to_pci_dev(dev);
- /*
- * We want to prevent any device associated with an RMRR from
- * getting placed into the SI Domain. This is done because
- * problems exist when devices are moved in and out of domains
- * and their respective RMRR info is lost. We exempt USB devices
- * from this process due to their usage of RMRRs that are known
- * to not be needed after BIOS hand-off to OS.
- */
- if (device_has_rmrr(dev) &&
- (pdev->class >> 8) != PCI_CLASS_SERIAL_USB)
+ if (device_is_rmrr_locked(dev))
return 0;
if ((iommu_identity_mapping & IDENTMAP_AZALIA) && IS_AZALIA(pdev))
@@ -4202,6 +4226,11 @@ static int intel_iommu_attach_device(str
int addr_width;
u8 bus, devfn;
+ if (device_is_rmrr_locked(dev)) {
+ dev_warn(dev, "Device is ineligible for IOMMU domain attach due to platform RMRR requirement. Contact your platform vendor.\n");
+ return -EPERM;
+ }
+
/* normally dev is not mapped */
if (unlikely(domain_context_mapped(dev))) {
struct dmar_domain *old_domain;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 012/158] powerpc/powernv: Fix IOMMU group lost
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 011/158] iommu/vt-d: Exclude devices using RMRRs from IOMMU API domains Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 013/158] iommu/vt-d: Defer domain removal if device is assigned to a driver Greg Kroah-Hartman
` (145 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thadeu Lima de Souza Cascardo,
Gavin Shan, Wei Yang, Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Shan <gwshan@linux.vnet.ibm.com>
commit 763fe0addb8fe15ccea67c0aebddc06f4bb25439 upstream.
When we take full hotplug to recover from EEH errors, PCI buses
could be involved. For the case, the child devices of involved
PCI buses can't be attached to IOMMU group properly, which is
caused by commit 3f28c5a ("powerpc/powernv: Reduce multi-hit of
iommu_add_device()").
When adding the PCI devices of the newly created PCI buses to
the system, the IOMMU group is expected to be added in (C).
(A) fails to bind the IOMMU group because bus->is_added is
false. (B) fails because the device doesn't have binding IOMMU
table yet. bus->is_added is set to true at end of (C) and
pdev->is_added is set to true at (D).
pcibios_add_pci_devices()
pci_scan_bridge()
pci_scan_child_bus()
pci_scan_slot()
pci_scan_single_device()
pci_scan_device()
pci_device_add()
pcibios_add_device() A: Ignore
device_add() B: Ignore
pcibios_fixup_bus()
pcibios_setup_bus_devices()
pcibios_setup_device() C: Hit
pcibios_finish_adding_to_bus()
pci_bus_add_devices()
pci_bus_add_device() D: Add device
If the parent PCI bus isn't involved in hotplug, the IOMMU
group is expected to be bound in (B). (A) should fail as the
sysfs entries aren't populated.
The patch fixes the issue by reverting commit 3f28c5a and remove
WARN_ON() in iommu_add_device() to allow calling the function
even the specified device already has associated IOMMU group.
Reported-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Acked-by: Wei Yang <weiyang@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/iommu.c | 38 ++++++++++++++++--------------
arch/powerpc/platforms/powernv/pci-ioda.c | 2 -
2 files changed, 22 insertions(+), 18 deletions(-)
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -1120,37 +1120,41 @@ EXPORT_SYMBOL_GPL(iommu_release_ownershi
int iommu_add_device(struct device *dev)
{
struct iommu_table *tbl;
- int ret = 0;
- if (WARN_ON(dev->iommu_group)) {
- pr_warn("iommu_tce: device %s is already in iommu group %d, skipping\n",
- dev_name(dev),
- iommu_group_id(dev->iommu_group));
+ /*
+ * The sysfs entries should be populated before
+ * binding IOMMU group. If sysfs entries isn't
+ * ready, we simply bail.
+ */
+ if (!device_is_registered(dev))
+ return -ENOENT;
+
+ if (dev->iommu_group) {
+ pr_debug("%s: Skipping device %s with iommu group %d\n",
+ __func__, dev_name(dev),
+ iommu_group_id(dev->iommu_group));
return -EBUSY;
}
tbl = get_iommu_table_base(dev);
if (!tbl || !tbl->it_group) {
- pr_debug("iommu_tce: skipping device %s with no tbl\n",
- dev_name(dev));
+ pr_debug("%s: Skipping device %s with no tbl\n",
+ __func__, dev_name(dev));
return 0;
}
- pr_debug("iommu_tce: adding %s to iommu group %d\n",
- dev_name(dev), iommu_group_id(tbl->it_group));
+ pr_debug("%s: Adding %s to iommu group %d\n",
+ __func__, dev_name(dev),
+ iommu_group_id(tbl->it_group));
if (PAGE_SIZE < IOMMU_PAGE_SIZE(tbl)) {
- pr_err("iommu_tce: unsupported iommu page size.");
- pr_err("%s has not been added\n", dev_name(dev));
+ pr_err("%s: Invalid IOMMU page size %lx (%lx) on %s\n",
+ __func__, IOMMU_PAGE_SIZE(tbl),
+ PAGE_SIZE, dev_name(dev));
return -EINVAL;
}
- ret = iommu_group_add_device(tbl->it_group, dev);
- if (ret < 0)
- pr_err("iommu_tce: %s has not been added, ret=%d\n",
- dev_name(dev), ret);
-
- return ret;
+ return iommu_group_add_device(tbl->it_group, dev);
}
EXPORT_SYMBOL_GPL(iommu_add_device);
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -462,7 +462,7 @@ static void pnv_pci_ioda_dma_dev_setup(s
pe = &phb->ioda.pe_array[pdn->pe_number];
WARN_ON(get_dma_ops(&pdev->dev) != &dma_iommu_ops);
- set_iommu_table_base(&pdev->dev, &pe->tce32_table);
+ set_iommu_table_base_and_group(&pdev->dev, &pe->tce32_table);
}
static int pnv_pci_ioda_dma_set_mask(struct pnv_phb *phb,
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 013/158] iommu/vt-d: Defer domain removal if device is assigned to a driver
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 012/158] powerpc/powernv: Fix IOMMU group lost Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 014/158] iommu/amd: Fix cleanup_domain for mass device removal Greg Kroah-Hartman
` (144 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiang Liu, David Woodhouse, Joerg Roedel
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <jroedel@suse.de>
commit e7f9fa5498d91fcdc63d93007ba43f36b1a30538 upstream.
When the BUS_NOTIFY_DEL_DEVICE event is received the device
might still be attached to a driver. In this case the domain
can't be released as the mappings might still be in use.
Defer the domain removal in this case until we receivce the
BUS_NOTIFY_UNBOUND_DRIVER event.
Cc: Jiang Liu <jiang.liu@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel-iommu.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3891,6 +3891,14 @@ static int device_notifier(struct notifi
action != BUS_NOTIFY_DEL_DEVICE)
return 0;
+ /*
+ * If the device is still attached to a device driver we can't
+ * tear down the domain yet as DMA mappings may still be in use.
+ * Wait for the BUS_NOTIFY_UNBOUND_DRIVER event to do that.
+ */
+ if (action == BUS_NOTIFY_DEL_DEVICE && dev->driver != NULL)
+ return 0;
+
domain = find_domain(dev);
if (!domain)
return 0;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 014/158] iommu/amd: Fix cleanup_domain for mass device removal
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 013/158] iommu/vt-d: Defer domain removal if device is assigned to a driver Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 015/158] spi: orion: fix incorrect handling of cell-index DT property Greg Kroah-Hartman
` (143 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marti Raudsepp, Joerg Roedel
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <jroedel@suse.de>
commit 9b29d3c6510407d91786c1cf9183ff4debb3473a upstream.
When multiple devices are detached in __detach_device, they
are also removed from the domains dev_list. This makes it
unsafe to use list_for_each_entry_safe, as the next pointer
might also not be in the list anymore after __detach_device
returns. So just repeatedly remove the first element of the
list until it is empty.
Tested-by: Marti Raudsepp <marti@juffo.org>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd_iommu.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3227,14 +3227,16 @@ free_domains:
static void cleanup_domain(struct protection_domain *domain)
{
- struct iommu_dev_data *dev_data, *next;
+ struct iommu_dev_data *entry;
unsigned long flags;
write_lock_irqsave(&amd_iommu_devtable_lock, flags);
- list_for_each_entry_safe(dev_data, next, &domain->dev_list, list) {
- __detach_device(dev_data);
- atomic_set(&dev_data->bind, 0);
+ while (!list_empty(&domain->dev_list)) {
+ entry = list_first_entry(&domain->dev_list,
+ struct iommu_dev_data, list);
+ __detach_device(entry);
+ atomic_set(&entry->bind, 0);
}
write_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 015/158] spi: orion: fix incorrect handling of cell-index DT property
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 014/158] iommu/amd: Fix cleanup_domain for mass device removal Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 016/158] spi: omap2-mcspi: Configure hardware when slave driver changes mode Greg Kroah-Hartman
` (142 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Petazzoni,
Sebastian Hesselbarth, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit e06871cd2c92e5c65d7ca1d32866b4ca5dd4ac30 upstream.
In commit f814f9ac5a81 ("spi/orion: add device tree binding"), Device
Tree support was added to the spi-orion driver. However, this commit
reads the "cell-index" property, without taking into account the fact
that DT properties are big-endian encoded.
Since most of the platforms using spi-orion with DT have apparently
not used anything but cell-index = <0>, the problem was not
visible. But as soon as one starts using cell-index = <1>, the problem
becomes clearly visible, as the master->bus_num gets a wrong value
(actually it gets the value 0, which conflicts with the first bus that
has cell-index = <0>).
This commit fixes that by using of_property_read_u32() to read the
property value, which does the appropriate endianness conversion when
needed.
Fixes: f814f9ac5a81 ("spi/orion: add device tree binding")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-orion.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
--- a/drivers/spi/spi-orion.c
+++ b/drivers/spi/spi-orion.c
@@ -346,8 +346,6 @@ static int orion_spi_probe(struct platfo
struct resource *r;
unsigned long tclk_hz;
int status = 0;
- const u32 *iprop;
- int size;
master = spi_alloc_master(&pdev->dev, sizeof(*spi));
if (master == NULL) {
@@ -358,10 +356,10 @@ static int orion_spi_probe(struct platfo
if (pdev->id != -1)
master->bus_num = pdev->id;
if (pdev->dev.of_node) {
- iprop = of_get_property(pdev->dev.of_node, "cell-index",
- &size);
- if (iprop && size == sizeof(*iprop))
- master->bus_num = *iprop;
+ u32 cell_index;
+ if (!of_property_read_u32(pdev->dev.of_node, "cell-index",
+ &cell_index))
+ master->bus_num = cell_index;
}
/* we support only mode 0, and no options */
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 016/158] spi: omap2-mcspi: Configure hardware when slave driver changes mode
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 015/158] spi: orion: fix incorrect handling of cell-index DT property Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 017/158] s390/locking: Reenable optimistic spinning Greg Kroah-Hartman
` (141 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark A. Greer, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Mark A. Greer" <mgreer@animalcreek.com>
commit 97ca0d6cc118716840ea443e010cb3d5f2d25eaf upstream.
Commit id 2bd16e3e23d9df41592c6b257c59b6860a9cc3ea
(spi: omap2-mcspi: Do not configure the controller
on each transfer unless needed) does its job too
well so omap2_mcspi_setup_transfer() isn't called
even when an SPI slave driver changes 'spi->mode'.
The result is that the mode requested by the SPI
slave driver never takes effect.
Fix this by adding the 'mode' member to the
omap2_mcspi_cs structure which holds the mode
value that the hardware is configured for.
When the SPI slave driver changes 'spi->mode'
it will be different than the value of this new
member and the SPI master driver will know that
the hardware must be reconfigured (by calling
omap2_mcspi_setup_transfer()).
Fixes: 2bd16e3e23 (spi: omap2-mcspi: Do not configure the controller on each transfer unless needed)
Signed-off-by: Mark A. Greer <mgreer@animalcreek.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-omap2-mcspi.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/drivers/spi/spi-omap2-mcspi.c
+++ b/drivers/spi/spi-omap2-mcspi.c
@@ -149,6 +149,7 @@ struct omap2_mcspi_cs {
void __iomem *base;
unsigned long phys;
int word_len;
+ u16 mode;
struct list_head node;
/* Context save and restore shadow register */
u32 chconf0, chctrl0;
@@ -926,6 +927,8 @@ static int omap2_mcspi_setup_transfer(st
mcspi_write_chconf0(spi, l);
+ cs->mode = spi->mode;
+
dev_dbg(&spi->dev, "setup: speed %d, sample %s edge, clk %s\n",
speed_hz,
(spi->mode & SPI_CPHA) ? "trailing" : "leading",
@@ -998,6 +1001,7 @@ static int omap2_mcspi_setup(struct spi_
return -ENOMEM;
cs->base = mcspi->base + spi->chip_select * 0x14;
cs->phys = mcspi->phys + spi->chip_select * 0x14;
+ cs->mode = 0;
cs->chconf0 = 0;
cs->chctrl0 = 0;
spi->controller_state = cs;
@@ -1079,6 +1083,16 @@ static void omap2_mcspi_work(struct omap
cs = spi->controller_state;
cd = spi->controller_data;
+ /*
+ * The slave driver could have changed spi->mode in which case
+ * it will be different from cs->mode (the current hardware setup).
+ * If so, set par_override (even though its not a parity issue) so
+ * omap2_mcspi_setup_transfer will be called to configure the hardware
+ * with the correct mode on the first iteration of the loop below.
+ */
+ if (spi->mode != cs->mode)
+ par_override = 1;
+
omap2_mcspi_set_enable(spi, 0);
list_for_each_entry(t, &m->transfers, transfer_list) {
if (t->tx_buf == NULL && t->rx_buf == NULL && t->len) {
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 017/158] s390/locking: Reenable optimistic spinning
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 016/158] spi: omap2-mcspi: Configure hardware when slave driver changes mode Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 018/158] powerpc/cpufreq: Add pr_warn() on OPAL firmware failures Greg Kroah-Hartman
` (140 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Borntraeger, Ingo Molnar,
Peter Zijlstra, Heiko Carstens, Martin Schwidefsky
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Borntraeger <borntraeger@de.ibm.com>
commit 36e7fdaa1a04fcf65b864232e1af56a51c7814d6 upstream.
commit 4badad352a6bb202ec68afa7a574c0bb961e5ebc (locking/mutex: Disable
optimistic spinning on some architectures) fenced spinning for
architectures without proper cmpxchg.
There is no need to disable mutex spinning on s390, though:
The instructions CS,CSG and friends provide the proper guarantees.
(We dont implement cmpxchg with locks).
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -92,6 +92,7 @@ config S390
select ARCH_INLINE_WRITE_UNLOCK_IRQ
select ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
select ARCH_SAVE_PAGE_KEYS if HIBERNATION
+ select ARCH_SUPPORTS_ATOMIC_RMW
select ARCH_USE_CMPXCHG_LOCKREF
select ARCH_WANT_IPC_PARSE_VERSION
select BUILDTIME_EXTABLE_SORT
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 018/158] powerpc/cpufreq: Add pr_warn() on OPAL firmware failures
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 017/158] s390/locking: Reenable optimistic spinning Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 020/158] firmware: Do not use WARN_ON(!spin_is_locked()) Greg Kroah-Hartman
` (139 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vaidyanathan Srinivasan,
Gautham R. Shenoy, Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
commit 6174bac8c7ff73a86ae9a967d1c9cadc478023ae upstream.
Cpufreq depends on platform firmware to implement PStates. In case of
platform firmware failure, cpufreq should not panic host kernel with
BUG_ON(). Less severe pr_warn() will suffice.
Add firmware_has_feature(FW_FEATURE_OPALv3) check to
skip probing for device-tree on non-powernv platforms.
Signed-off-by: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
Acked-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/powernv-cpufreq.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
--- a/drivers/cpufreq/powernv-cpufreq.c
+++ b/drivers/cpufreq/powernv-cpufreq.c
@@ -28,6 +28,7 @@
#include <linux/of.h>
#include <asm/cputhreads.h>
+#include <asm/firmware.h>
#include <asm/reg.h>
#include <asm/smp.h> /* Required for cpu_sibling_mask() in UP configs */
@@ -98,7 +99,11 @@ static int init_powernv_pstates(void)
return -ENODEV;
}
- WARN_ON(len_ids != len_freqs);
+ if (len_ids != len_freqs) {
+ pr_warn("Entries in ibm,pstate-ids and "
+ "ibm,pstate-frequencies-mhz does not match\n");
+ }
+
nr_pstates = min(len_ids, len_freqs) / sizeof(u32);
if (!nr_pstates) {
pr_warn("No PStates found\n");
@@ -131,7 +136,12 @@ static unsigned int pstate_id_to_freq(in
int i;
i = powernv_pstate_info.max - pstate_id;
- BUG_ON(i >= powernv_pstate_info.nr_pstates || i < 0);
+ if (i >= powernv_pstate_info.nr_pstates || i < 0) {
+ pr_warn("PState id %d outside of PState table, "
+ "reporting nominal id %d instead\n",
+ pstate_id, powernv_pstate_info.nominal);
+ i = powernv_pstate_info.max - powernv_pstate_info.nominal;
+ }
return powernv_freqs[i].frequency;
}
@@ -321,6 +331,10 @@ static int __init powernv_cpufreq_init(v
{
int rc = 0;
+ /* Don't probe on pseries (guest) platforms */
+ if (!firmware_has_feature(FW_FEATURE_OPALv3))
+ return -ENODEV;
+
/* Discover pstates from device tree and init */
rc = init_powernv_pstates();
if (rc) {
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 020/158] firmware: Do not use WARN_ON(!spin_is_locked())
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 018/158] powerpc/cpufreq: Add pr_warn() on OPAL firmware failures Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 021/158] tpm: missing tpm_chip_put in tpm_get_random() Greg Kroah-Hartman
` (138 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Guenter Roeck, Matt Fleming
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
commit aee530cfecf4f3ec83b78406bac618cec35853f8 upstream.
spin_is_locked() always returns false for uniprocessor configurations
in several architectures, so do not use WARN_ON with it.
Use lockdep_assert_held() instead to also reduce overhead in
non-debug kernels.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/efi/vars.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -481,7 +481,7 @@ EXPORT_SYMBOL_GPL(efivar_entry_remove);
*/
static void efivar_entry_list_del_unlock(struct efivar_entry *entry)
{
- WARN_ON(!spin_is_locked(&__efivars->lock));
+ lockdep_assert_held(&__efivars->lock);
list_del(&entry->list);
spin_unlock_irq(&__efivars->lock);
@@ -507,7 +507,7 @@ int __efivar_entry_delete(struct efivar_
const struct efivar_operations *ops = __efivars->ops;
efi_status_t status;
- WARN_ON(!spin_is_locked(&__efivars->lock));
+ lockdep_assert_held(&__efivars->lock);
status = ops->set_variable(entry->var.VariableName,
&entry->var.VendorGuid,
@@ -667,7 +667,7 @@ struct efivar_entry *efivar_entry_find(e
int strsize1, strsize2;
bool found = false;
- WARN_ON(!spin_is_locked(&__efivars->lock));
+ lockdep_assert_held(&__efivars->lock);
list_for_each_entry_safe(entry, n, head, list) {
strsize1 = ucs2_strsize(name, 1024);
@@ -739,7 +739,7 @@ int __efivar_entry_get(struct efivar_ent
const struct efivar_operations *ops = __efivars->ops;
efi_status_t status;
- WARN_ON(!spin_is_locked(&__efivars->lock));
+ lockdep_assert_held(&__efivars->lock);
status = ops->get_variable(entry->var.VariableName,
&entry->var.VendorGuid,
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 021/158] tpm: missing tpm_chip_put in tpm_get_random()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 020/158] firmware: Do not use WARN_ON(!spin_is_locked()) Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 022/158] tpm: Provide a generic means to override the chip returned timeouts Greg Kroah-Hartman
` (137 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jarkko Sakkinen, Peter Huewe
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
commit 3e14d83ef94a5806a865b85b513b4e891923c19b upstream.
Regression in 41ab999c. Call to tpm_chip_put is missing. This
will cause TPM device driver not to unload if tmp_get_random()
is called.
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm-interface.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -991,13 +991,13 @@ int tpm_get_random(u32 chip_num, u8 *out
int err, total = 0, retries = 5;
u8 *dest = out;
+ if (!out || !num_bytes || max > TPM_MAX_RNG_DATA)
+ return -EINVAL;
+
chip = tpm_chip_find_get(chip_num);
if (chip == NULL)
return -ENODEV;
- if (!out || !num_bytes || max > TPM_MAX_RNG_DATA)
- return -EINVAL;
-
do {
tpm_cmd.header.in = tpm_getrandom_header;
tpm_cmd.params.getrandom_in.num_bytes = cpu_to_be32(num_bytes);
@@ -1016,6 +1016,7 @@ int tpm_get_random(u32 chip_num, u8 *out
num_bytes -= recd;
} while (retries-- && total < max);
+ tpm_chip_put(chip);
return total ? total : -EIO;
}
EXPORT_SYMBOL_GPL(tpm_get_random);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 022/158] tpm: Provide a generic means to override the chip returned timeouts
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 021/158] tpm: missing tpm_chip_put in tpm_get_random() Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 023/158] tpm: Properly clean sysfs entries in error path Greg Kroah-Hartman
` (136 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Berg, Christopher, Jason Gunthorpe,
Peter Huewe
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
commit 8e54caf407b98efa05409e1fee0e5381abd2b088 upstream.
Some Atmel TPMs provide completely wrong timeouts from their
TPM_CAP_PROP_TIS_TIMEOUT query. This patch detects that and returns
new correct values via a DID/VID table in the TIS driver.
Tested on ARM using an AT97SC3204T FW version 37.16
[PHuewe: without this fix these 'broken' Atmel TPMs won't function on
older kernels]
Signed-off-by: "Berg, Christopher" <Christopher.Berg@atmel.com>
Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
---
drivers/char/tpm/tpm-interface.c | 62 +++++++++++++++++++++++++--------------
drivers/char/tpm/tpm_tis.c | 31 +++++++++++++++++++
include/linux/tpm.h | 3 +
3 files changed, 75 insertions(+), 21 deletions(-)
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -491,11 +491,10 @@ static int tpm_startup(struct tpm_chip *
int tpm_get_timeouts(struct tpm_chip *chip)
{
struct tpm_cmd_t tpm_cmd;
- struct timeout_t *timeout_cap;
+ unsigned long new_timeout[4];
+ unsigned long old_timeout[4];
struct duration_t *duration_cap;
ssize_t rc;
- u32 timeout;
- unsigned int scale = 1;
tpm_cmd.header.in = tpm_getcap_header;
tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
@@ -529,25 +528,46 @@ int tpm_get_timeouts(struct tpm_chip *ch
!= sizeof(tpm_cmd.header.out) + sizeof(u32) + 4 * sizeof(u32))
return -EINVAL;
- timeout_cap = &tpm_cmd.params.getcap_out.cap.timeout;
- /* Don't overwrite default if value is 0 */
- timeout = be32_to_cpu(timeout_cap->a);
- if (timeout && timeout < 1000) {
- /* timeouts in msec rather usec */
- scale = 1000;
- chip->vendor.timeout_adjusted = true;
+ old_timeout[0] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.a);
+ old_timeout[1] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.b);
+ old_timeout[2] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.c);
+ old_timeout[3] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.d);
+ memcpy(new_timeout, old_timeout, sizeof(new_timeout));
+
+ /*
+ * Provide ability for vendor overrides of timeout values in case
+ * of misreporting.
+ */
+ if (chip->ops->update_timeouts != NULL)
+ chip->vendor.timeout_adjusted =
+ chip->ops->update_timeouts(chip, new_timeout);
+
+ if (!chip->vendor.timeout_adjusted) {
+ /* Don't overwrite default if value is 0 */
+ if (new_timeout[0] != 0 && new_timeout[0] < 1000) {
+ int i;
+
+ /* timeouts in msec rather usec */
+ for (i = 0; i != ARRAY_SIZE(new_timeout); i++)
+ new_timeout[i] *= 1000;
+ chip->vendor.timeout_adjusted = true;
+ }
}
- if (timeout)
- chip->vendor.timeout_a = usecs_to_jiffies(timeout * scale);
- timeout = be32_to_cpu(timeout_cap->b);
- if (timeout)
- chip->vendor.timeout_b = usecs_to_jiffies(timeout * scale);
- timeout = be32_to_cpu(timeout_cap->c);
- if (timeout)
- chip->vendor.timeout_c = usecs_to_jiffies(timeout * scale);
- timeout = be32_to_cpu(timeout_cap->d);
- if (timeout)
- chip->vendor.timeout_d = usecs_to_jiffies(timeout * scale);
+
+ /* Report adjusted timeouts */
+ if (chip->vendor.timeout_adjusted) {
+ dev_info(chip->dev,
+ HW_ERR "Adjusting reported timeouts: A %lu->%luus B %lu->%luus C %lu->%luus D %lu->%luus\n",
+ old_timeout[0], new_timeout[0],
+ old_timeout[1], new_timeout[1],
+ old_timeout[2], new_timeout[2],
+ old_timeout[3], new_timeout[3]);
+ }
+
+ chip->vendor.timeout_a = usecs_to_jiffies(new_timeout[0]);
+ chip->vendor.timeout_b = usecs_to_jiffies(new_timeout[1]);
+ chip->vendor.timeout_c = usecs_to_jiffies(new_timeout[2]);
+ chip->vendor.timeout_d = usecs_to_jiffies(new_timeout[3]);
duration:
tpm_cmd.header.in = tpm_getcap_header;
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -373,6 +373,36 @@ out_err:
return rc;
}
+struct tis_vendor_timeout_override {
+ u32 did_vid;
+ unsigned long timeout_us[4];
+};
+
+static const struct tis_vendor_timeout_override vendor_timeout_overrides[] = {
+ /* Atmel 3204 */
+ { 0x32041114, { (TIS_SHORT_TIMEOUT*1000), (TIS_LONG_TIMEOUT*1000),
+ (TIS_SHORT_TIMEOUT*1000), (TIS_SHORT_TIMEOUT*1000) } },
+};
+
+static bool tpm_tis_update_timeouts(struct tpm_chip *chip,
+ unsigned long *timeout_cap)
+{
+ int i;
+ u32 did_vid;
+
+ did_vid = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
+
+ for (i = 0; i != ARRAY_SIZE(vendor_timeout_overrides); i++) {
+ if (vendor_timeout_overrides[i].did_vid != did_vid)
+ continue;
+ memcpy(timeout_cap, vendor_timeout_overrides[i].timeout_us,
+ sizeof(vendor_timeout_overrides[i].timeout_us));
+ return true;
+ }
+
+ return false;
+}
+
/*
* Early probing for iTPM with STS_DATA_EXPECT flaw.
* Try sending command without itpm flag set and if that
@@ -437,6 +467,7 @@ static const struct tpm_class_ops tpm_ti
.recv = tpm_tis_recv,
.send = tpm_tis_send,
.cancel = tpm_tis_ready,
+ .update_timeouts = tpm_tis_update_timeouts,
.req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
.req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
.req_canceled = tpm_tis_req_canceled,
--- a/include/linux/tpm.h
+++ b/include/linux/tpm.h
@@ -39,6 +39,9 @@ struct tpm_class_ops {
int (*send) (struct tpm_chip *chip, u8 *buf, size_t len);
void (*cancel) (struct tpm_chip *chip);
u8 (*status) (struct tpm_chip *chip);
+ bool (*update_timeouts)(struct tpm_chip *chip,
+ unsigned long *timeout_cap);
+
};
#if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE)
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 023/158] tpm: Properly clean sysfs entries in error path
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 022/158] tpm: Provide a generic means to override the chip returned timeouts Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 024/158] CAPABILITIES: remove undefined caps from all processes Greg Kroah-Hartman
` (135 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Kasatkin, Stefan Berger,
Jason Gunthorpe, Peter Huewe
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
commit b49e1043c48dac23f64fba684d31c4a96c1ffaa0 upstream.
Properly clean the sysfs entries in the error path
Reported-by: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm-interface.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -1116,7 +1116,7 @@ struct tpm_chip *tpm_register_hardware(s
goto del_misc;
if (tpm_add_ppi(&dev->kobj))
- goto del_misc;
+ goto del_sysfs;
chip->bios_dir = tpm_bios_log_setup(chip->devname);
@@ -1127,6 +1127,8 @@ struct tpm_chip *tpm_register_hardware(s
return chip;
+del_sysfs:
+ tpm_sysfs_del_device(chip);
del_misc:
tpm_dev_del_device(chip);
put_device:
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 024/158] CAPABILITIES: remove undefined caps from all processes
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 023/158] tpm: Properly clean sysfs entries in error path Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 025/158] fanotify: fix double free of pending permission events Greg Kroah-Hartman
` (134 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Paris, Kees Cook, Andrew Vagin,
Andrew G. Morgan, Serge E. Hallyn, Steve Grubb, Dan Walsh,
James Morris
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Paris <eparis@redhat.com>
commit 7d8b6c63751cfbbe5eef81a48c22978b3407a3ad upstream.
This is effectively a revert of 7b9a7ec565505699f503b4fcf61500dceb36e744
plus fixing it a different way...
We found, when trying to run an application from an application which
had dropped privs that the kernel does security checks on undefined
capability bits. This was ESPECIALLY difficult to debug as those
undefined bits are hidden from /proc/$PID/status.
Consider a root application which drops all capabilities from ALL 4
capability sets. We assume, since the application is going to set
eff/perm/inh from an array that it will clear not only the defined caps
less than CAP_LAST_CAP, but also the higher 28ish bits which are
undefined future capabilities.
The BSET gets cleared differently. Instead it is cleared one bit at a
time. The problem here is that in security/commoncap.c::cap_task_prctl()
we actually check the validity of a capability being read. So any task
which attempts to 'read all things set in bset' followed by 'unset all
things set in bset' will not even attempt to unset the undefined bits
higher than CAP_LAST_CAP.
So the 'parent' will look something like:
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: ffffffc000000000
All of this 'should' be fine. Given that these are undefined bits that
aren't supposed to have anything to do with permissions. But they do...
So lets now consider a task which cleared the eff/perm/inh completely
and cleared all of the valid caps in the bset (but not the invalid caps
it couldn't read out of the kernel). We know that this is exactly what
the libcap-ng library does and what the go capabilities library does.
They both leave you in that above situation if you try to clear all of
you capapabilities from all 4 sets. If that root task calls execve()
the child task will pick up all caps not blocked by the bset. The bset
however does not block bits higher than CAP_LAST_CAP. So now the child
task has bits in eff which are not in the parent. These are
'meaningless' undefined bits, but still bits which the parent doesn't
have.
The problem is now in cred_cap_issubset() (or any operation which does a
subset test) as the child, while a subset for valid cap bits, is not a
subset for invalid cap bits! So now we set durring commit creds that
the child is not dumpable. Given it is 'more priv' than its parent. It
also means the parent cannot ptrace the child and other stupidity.
The solution here:
1) stop hiding capability bits in status
This makes debugging easier!
2) stop giving any task undefined capability bits. it's simple, it you
don't put those invalid bits in CAP_FULL_SET you won't get them in init
and you won't get them in any other task either.
This fixes the cap_issubset() tests and resulting fallout (which
made the init task in a docker container untraceable among other
things)
3) mask out undefined bits when sys_capset() is called as it might use
~0, ~0 to denote 'all capabilities' for backward/forward compatibility.
This lets 'capsh --caps="all=eip" -- -c /bin/bash' run.
4) mask out undefined bit when we read a file capability off of disk as
again likely all bits are set in the xattr for forward/backward
compatibility.
This lets 'setcap all+pe /bin/bash; /bin/bash' run
Signed-off-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Andrew Vagin <avagin@openvz.org>
Cc: Andrew G. Morgan <morgan@kernel.org>
Cc: Serge E. Hallyn <serge.hallyn@canonical.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Steve Grubb <sgrubb@redhat.com>
Cc: Dan Walsh <dwalsh@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/array.c | 11 +----------
include/linux/capability.h | 5 ++++-
kernel/audit.c | 2 +-
kernel/capability.c | 4 ++++
security/commoncap.c | 3 +++
5 files changed, 13 insertions(+), 12 deletions(-)
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -297,15 +297,11 @@ static void render_cap_t(struct seq_file
seq_puts(m, header);
CAP_FOR_EACH_U32(__capi) {
seq_printf(m, "%08x",
- a->cap[(_KERNEL_CAPABILITY_U32S-1) - __capi]);
+ a->cap[CAP_LAST_U32 - __capi]);
}
seq_putc(m, '\n');
}
-/* Remove non-existent capabilities */
-#define NORM_CAPS(v) (v.cap[CAP_TO_INDEX(CAP_LAST_CAP)] &= \
- CAP_TO_MASK(CAP_LAST_CAP + 1) - 1)
-
static inline void task_cap(struct seq_file *m, struct task_struct *p)
{
const struct cred *cred;
@@ -319,11 +315,6 @@ static inline void task_cap(struct seq_f
cap_bset = cred->cap_bset;
rcu_read_unlock();
- NORM_CAPS(cap_inheritable);
- NORM_CAPS(cap_permitted);
- NORM_CAPS(cap_effective);
- NORM_CAPS(cap_bset);
-
render_cap_t(m, "CapInh:\t", &cap_inheritable);
render_cap_t(m, "CapPrm:\t", &cap_permitted);
render_cap_t(m, "CapEff:\t", &cap_effective);
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -78,8 +78,11 @@ extern const kernel_cap_t __cap_init_eff
# error Fix up hand-coded capability macro initializers
#else /* HAND-CODED capability initializers */
+#define CAP_LAST_U32 ((_KERNEL_CAPABILITY_U32S) - 1)
+#define CAP_LAST_U32_VALID_MASK (CAP_TO_MASK(CAP_LAST_CAP + 1) -1)
+
# define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }})
-# define CAP_FULL_SET ((kernel_cap_t){{ ~0, ~0 }})
+# define CAP_FULL_SET ((kernel_cap_t){{ ~0, CAP_LAST_U32_VALID_MASK }})
# define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \
| CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \
CAP_FS_MASK_B1 } })
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1677,7 +1677,7 @@ void audit_log_cap(struct audit_buffer *
audit_log_format(ab, " %s=", prefix);
CAP_FOR_EACH_U32(i) {
audit_log_format(ab, "%08x",
- cap->cap[(_KERNEL_CAPABILITY_U32S-1) - i]);
+ cap->cap[CAP_LAST_U32 - i]);
}
}
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -258,6 +258,10 @@ SYSCALL_DEFINE2(capset, cap_user_header_
i++;
}
+ effective.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+ permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+ inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+
new = prepare_creds();
if (!new)
return -ENOMEM;
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -421,6 +421,9 @@ int get_vfs_caps_from_disk(const struct
cpu_caps->inheritable.cap[i] = le32_to_cpu(caps.data[i].inheritable);
}
+ cpu_caps->permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+ cpu_caps->inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
+
return 0;
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 025/158] fanotify: fix double free of pending permission events
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 024/158] CAPABILITIES: remove undefined caps from all processes Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 026/158] ocfs2: do not write error flag to user structure we cannot copy from/to Greg Kroah-Hartman
` (133 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Kara, Douglas Leeder,
Heinrich Schuchard, Andrew Morton, Linus Torvalds
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 5838d4442bd5971687b72221736222637e03140d upstream.
Commit 85816794240b ("fanotify: Fix use after free for permission
events") introduced a double free issue for permission events which are
pending in group's notification queue while group is being destroyed.
These events are freed from fanotify_handle_event() but they are not
removed from groups notification queue and thus they get freed again
from fsnotify_flush_notify().
Fix the problem by removing permission events from notification queue
before freeing them if we skip processing access response. Also expand
comments in fanotify_release() to explain group shutdown in detail.
Fixes: 85816794240b9659e66e4d9b0df7c6e814e5f603
Signed-off-by: Jan Kara <jack@suse.cz>
Reported-by: Douglas Leeder <douglas.leeder@sophos.com>
Tested-by: Douglas Leeder <douglas.leeder@sophos.com>
Reported-by: Heinrich Schuchard <xypron.glpk@gmx.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/notify/fanotify/fanotify.c | 9 ++++++++-
fs/notify/fanotify/fanotify_user.c | 12 ++++++++++++
fs/notify/notification.c | 18 +++++++++++++++++-
include/linux/fsnotify_backend.h | 2 ++
4 files changed, 39 insertions(+), 2 deletions(-)
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -70,8 +70,15 @@ static int fanotify_get_response(struct
wait_event(group->fanotify_data.access_waitq, event->response ||
atomic_read(&group->fanotify_data.bypass_perm));
- if (!event->response) /* bypass_perm set */
+ if (!event->response) { /* bypass_perm set */
+ /*
+ * Event was canceled because group is being destroyed. Remove
+ * it from group's event list because we are responsible for
+ * freeing the permission event.
+ */
+ fsnotify_remove_event(group, &event->fae.fse);
return 0;
+ }
/* userspace responded, convert to something usable */
switch (event->response) {
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -359,6 +359,11 @@ static int fanotify_release(struct inode
#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
struct fanotify_perm_event_info *event, *next;
+ /*
+ * There may be still new events arriving in the notification queue
+ * but since userspace cannot use fanotify fd anymore, no event can
+ * enter or leave access_list by now.
+ */
spin_lock(&group->fanotify_data.access_lock);
atomic_inc(&group->fanotify_data.bypass_perm);
@@ -373,6 +378,13 @@ static int fanotify_release(struct inode
}
spin_unlock(&group->fanotify_data.access_lock);
+ /*
+ * Since bypass_perm is set, newly queued events will not wait for
+ * access response. Wake up the already sleeping ones now.
+ * synchronize_srcu() in fsnotify_destroy_group() will wait for all
+ * processes sleeping in fanotify_handle_event() waiting for access
+ * response and thus also for all permission events to be freed.
+ */
wake_up(&group->fanotify_data.access_waitq);
#endif
--- a/fs/notify/notification.c
+++ b/fs/notify/notification.c
@@ -73,7 +73,8 @@ void fsnotify_destroy_event(struct fsnot
/* Overflow events are per-group and we don't want to free them */
if (!event || event->mask == FS_Q_OVERFLOW)
return;
-
+ /* If the event is still queued, we have a problem... */
+ WARN_ON(!list_empty(&event->list));
group->ops->free_event(event);
}
@@ -125,6 +126,21 @@ queue:
}
/*
+ * Remove @event from group's notification queue. It is the responsibility of
+ * the caller to destroy the event.
+ */
+void fsnotify_remove_event(struct fsnotify_group *group,
+ struct fsnotify_event *event)
+{
+ mutex_lock(&group->notification_mutex);
+ if (!list_empty(&event->list)) {
+ list_del_init(&event->list);
+ group->q_len--;
+ }
+ mutex_unlock(&group->notification_mutex);
+}
+
+/*
* Remove and return the first event from the notification list. It is the
* responsibility of the caller to destroy the obtained event
*/
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -326,6 +326,8 @@ extern int fsnotify_add_notify_event(str
struct fsnotify_event *event,
int (*merge)(struct list_head *,
struct fsnotify_event *));
+/* Remove passed event from groups notification queue */
+extern void fsnotify_remove_event(struct fsnotify_group *group, struct fsnotify_event *event);
/* true if the group notification queue is empty */
extern bool fsnotify_notify_queue_is_empty(struct fsnotify_group *group);
/* return, but do not dequeue the first event on the notification queue */
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 026/158] ocfs2: do not write error flag to user structure we cannot copy from/to
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 025/158] fanotify: fix double free of pending permission events Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 027/158] sh: fix build error by adding generic ioport_{map/unmap}() Greg Kroah-Hartman
` (132 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Joel Becker,
Mark Fasheh, Andrew Morton, Linus Torvalds
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 2b462638e41ea62230297c21c4da9955937b7a3c upstream.
If we failed to copy from the structure, writing back the flags leaks 31
bits of kernel memory (the rest of the ir_flags field).
In any case, if we cannot copy from/to the structure, why should we
expect putting just the flags to work?
Also make sure ocfs2_info_handle_freeinode() returns the right error
code if the copy_to_user() fails.
Fixes: ddee5cdb70e6 ('Ocfs2: Add new OCFS2_IOC_INFO ioctl for ocfs2 v8.')
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Joel Becker <jlbec@evilplan.org>
Acked-by: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/ioctl.c | 129 ++++++++++++++++++-------------------------------------
1 file changed, 43 insertions(+), 86 deletions(-)
--- a/fs/ocfs2/ioctl.c
+++ b/fs/ocfs2/ioctl.c
@@ -35,9 +35,8 @@
copy_to_user((typeof(a) __user *)b, &(a), sizeof(a))
/*
- * This call is void because we are already reporting an error that may
- * be -EFAULT. The error will be returned from the ioctl(2) call. It's
- * just a best-effort to tell userspace that this request caused the error.
+ * This is just a best-effort to tell userspace that this request
+ * caused the error.
*/
static inline void o2info_set_request_error(struct ocfs2_info_request *kreq,
struct ocfs2_info_request __user *req)
@@ -146,136 +145,105 @@ bail:
static int ocfs2_info_handle_blocksize(struct inode *inode,
struct ocfs2_info_request __user *req)
{
- int status = -EFAULT;
struct ocfs2_info_blocksize oib;
if (o2info_from_user(oib, req))
- goto bail;
+ return -EFAULT;
oib.ib_blocksize = inode->i_sb->s_blocksize;
o2info_set_request_filled(&oib.ib_req);
if (o2info_to_user(oib, req))
- goto bail;
+ return -EFAULT;
- status = 0;
-bail:
- if (status)
- o2info_set_request_error(&oib.ib_req, req);
-
- return status;
+ return 0;
}
static int ocfs2_info_handle_clustersize(struct inode *inode,
struct ocfs2_info_request __user *req)
{
- int status = -EFAULT;
struct ocfs2_info_clustersize oic;
struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
if (o2info_from_user(oic, req))
- goto bail;
+ return -EFAULT;
oic.ic_clustersize = osb->s_clustersize;
o2info_set_request_filled(&oic.ic_req);
if (o2info_to_user(oic, req))
- goto bail;
+ return -EFAULT;
- status = 0;
-bail:
- if (status)
- o2info_set_request_error(&oic.ic_req, req);
-
- return status;
+ return 0;
}
static int ocfs2_info_handle_maxslots(struct inode *inode,
struct ocfs2_info_request __user *req)
{
- int status = -EFAULT;
struct ocfs2_info_maxslots oim;
struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
if (o2info_from_user(oim, req))
- goto bail;
+ return -EFAULT;
oim.im_max_slots = osb->max_slots;
o2info_set_request_filled(&oim.im_req);
if (o2info_to_user(oim, req))
- goto bail;
-
- status = 0;
-bail:
- if (status)
- o2info_set_request_error(&oim.im_req, req);
+ return -EFAULT;
- return status;
+ return 0;
}
static int ocfs2_info_handle_label(struct inode *inode,
struct ocfs2_info_request __user *req)
{
- int status = -EFAULT;
struct ocfs2_info_label oil;
struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
if (o2info_from_user(oil, req))
- goto bail;
+ return -EFAULT;
memcpy(oil.il_label, osb->vol_label, OCFS2_MAX_VOL_LABEL_LEN);
o2info_set_request_filled(&oil.il_req);
if (o2info_to_user(oil, req))
- goto bail;
+ return -EFAULT;
- status = 0;
-bail:
- if (status)
- o2info_set_request_error(&oil.il_req, req);
-
- return status;
+ return 0;
}
static int ocfs2_info_handle_uuid(struct inode *inode,
struct ocfs2_info_request __user *req)
{
- int status = -EFAULT;
struct ocfs2_info_uuid oiu;
struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
if (o2info_from_user(oiu, req))
- goto bail;
+ return -EFAULT;
memcpy(oiu.iu_uuid_str, osb->uuid_str, OCFS2_TEXT_UUID_LEN + 1);
o2info_set_request_filled(&oiu.iu_req);
if (o2info_to_user(oiu, req))
- goto bail;
-
- status = 0;
-bail:
- if (status)
- o2info_set_request_error(&oiu.iu_req, req);
+ return -EFAULT;
- return status;
+ return 0;
}
static int ocfs2_info_handle_fs_features(struct inode *inode,
struct ocfs2_info_request __user *req)
{
- int status = -EFAULT;
struct ocfs2_info_fs_features oif;
struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
if (o2info_from_user(oif, req))
- goto bail;
+ return -EFAULT;
oif.if_compat_features = osb->s_feature_compat;
oif.if_incompat_features = osb->s_feature_incompat;
@@ -284,39 +252,28 @@ static int ocfs2_info_handle_fs_features
o2info_set_request_filled(&oif.if_req);
if (o2info_to_user(oif, req))
- goto bail;
+ return -EFAULT;
- status = 0;
-bail:
- if (status)
- o2info_set_request_error(&oif.if_req, req);
-
- return status;
+ return 0;
}
static int ocfs2_info_handle_journal_size(struct inode *inode,
struct ocfs2_info_request __user *req)
{
- int status = -EFAULT;
struct ocfs2_info_journal_size oij;
struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
if (o2info_from_user(oij, req))
- goto bail;
+ return -EFAULT;
oij.ij_journal_size = i_size_read(osb->journal->j_inode);
o2info_set_request_filled(&oij.ij_req);
if (o2info_to_user(oij, req))
- goto bail;
-
- status = 0;
-bail:
- if (status)
- o2info_set_request_error(&oij.ij_req, req);
+ return -EFAULT;
- return status;
+ return 0;
}
static int ocfs2_info_scan_inode_alloc(struct ocfs2_super *osb,
@@ -373,7 +330,7 @@ static int ocfs2_info_handle_freeinode(s
u32 i;
u64 blkno = -1;
char namebuf[40];
- int status = -EFAULT, type = INODE_ALLOC_SYSTEM_INODE;
+ int status, type = INODE_ALLOC_SYSTEM_INODE;
struct ocfs2_info_freeinode *oifi = NULL;
struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
struct inode *inode_alloc = NULL;
@@ -385,8 +342,10 @@ static int ocfs2_info_handle_freeinode(s
goto out_err;
}
- if (o2info_from_user(*oifi, req))
- goto bail;
+ if (o2info_from_user(*oifi, req)) {
+ status = -EFAULT;
+ goto out_free;
+ }
oifi->ifi_slotnum = osb->max_slots;
@@ -424,14 +383,16 @@ static int ocfs2_info_handle_freeinode(s
o2info_set_request_filled(&oifi->ifi_req);
- if (o2info_to_user(*oifi, req))
- goto bail;
+ if (o2info_to_user(*oifi, req)) {
+ status = -EFAULT;
+ goto out_free;
+ }
status = 0;
bail:
if (status)
o2info_set_request_error(&oifi->ifi_req, req);
-
+out_free:
kfree(oifi);
out_err:
return status;
@@ -658,7 +619,7 @@ static int ocfs2_info_handle_freefrag(st
{
u64 blkno = -1;
char namebuf[40];
- int status = -EFAULT, type = GLOBAL_BITMAP_SYSTEM_INODE;
+ int status, type = GLOBAL_BITMAP_SYSTEM_INODE;
struct ocfs2_info_freefrag *oiff;
struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
@@ -671,8 +632,10 @@ static int ocfs2_info_handle_freefrag(st
goto out_err;
}
- if (o2info_from_user(*oiff, req))
- goto bail;
+ if (o2info_from_user(*oiff, req)) {
+ status = -EFAULT;
+ goto out_free;
+ }
/*
* chunksize from userspace should be power of 2.
*/
@@ -711,14 +674,14 @@ static int ocfs2_info_handle_freefrag(st
if (o2info_to_user(*oiff, req)) {
status = -EFAULT;
- goto bail;
+ goto out_free;
}
status = 0;
bail:
if (status)
o2info_set_request_error(&oiff->iff_req, req);
-
+out_free:
kfree(oiff);
out_err:
return status;
@@ -727,23 +690,17 @@ out_err:
static int ocfs2_info_handle_unknown(struct inode *inode,
struct ocfs2_info_request __user *req)
{
- int status = -EFAULT;
struct ocfs2_info_request oir;
if (o2info_from_user(oir, req))
- goto bail;
+ return -EFAULT;
o2info_clear_request_filled(&oir);
if (o2info_to_user(oir, req))
- goto bail;
-
- status = 0;
-bail:
- if (status)
- o2info_set_request_error(&oir, req);
+ return -EFAULT;
- return status;
+ return 0;
}
/*
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 027/158] sh: fix build error by adding generic ioport_{map/unmap}()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 026/158] ocfs2: do not write error flag to user structure we cannot copy from/to Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 028/158] mm: fix potential infinite loop in dissolve_free_huge_pages() Greg Kroah-Hartman
` (131 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pranith Kumar, Geert Uytterhoeven,
Andrew Morton, Linus Torvalds
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pranith Kumar <bobby.prani@gmail.com>
commit e04aca4a769e16cf4f9b8a4bd3e761711640dc46 upstream.
Fix build error as reported by Geert Uytterhoeven here:
http://kisskb.ellerman.id.au/kisskb/buildresult/11607865/
The error happens when CONFIG_HAS_IOPORT_MAP=n because of which there
are missing definitions of ioport_map/unmap(). Fix this build error by
adding these prototypes.
Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/sh/include/asm/io_noioport.h | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/arch/sh/include/asm/io_noioport.h
+++ b/arch/sh/include/asm/io_noioport.h
@@ -34,6 +34,17 @@ static inline void outl(unsigned int x,
BUG();
}
+static inline void __iomem *ioport_map(unsigned long port, unsigned int size)
+{
+ BUG();
+ return NULL;
+}
+
+static inline void ioport_unmap(void __iomem *addr)
+{
+ BUG();
+}
+
#define inb_p(addr) inb(addr)
#define inw_p(addr) inw(addr)
#define inl_p(addr) inl(addr)
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 028/158] mm: fix potential infinite loop in dissolve_free_huge_pages()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 027/158] sh: fix build error by adding generic ioport_{map/unmap}() Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 029/158] kernel/smp.c:on_each_cpu_cond(): fix warning in fallback path Greg Kroah-Hartman
` (130 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Li Zhong, Naoya Horiguchi,
David Rientjes, Andrew Morton, Linus Torvalds
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhong <zhong@linux.vnet.ibm.com>
commit d0177639310d23c7739500df3c6ce6fdfe34acec upstream.
It is possible for some platforms, such as powerpc to set HPAGE_SHIFT to
0 to indicate huge pages not supported.
When this is the case, hugetlbfs could be disabled during boot time:
hugetlbfs: disabling because there are no supported hugepage sizes
Then in dissolve_free_huge_pages(), order is kept maximum (64 for
64bits), and the for loop below won't end: for (pfn = start_pfn; pfn <
end_pfn; pfn += 1 << order)
As suggested by Naoya, below fix checks hugepages_supported() before
calling dissolve_free_huge_pages().
[rientjes@google.com: no legitimate reason to call dissolve_free_huge_pages() when !hugepages_supported()]
Signed-off-by: Li Zhong <zhong@linux.vnet.ibm.com>
Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 3 +++
1 file changed, 3 insertions(+)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1089,6 +1089,9 @@ void dissolve_free_huge_pages(unsigned l
unsigned long pfn;
struct hstate *h;
+ if (!hugepages_supported())
+ return;
+
/* Set scan step to minimum hugepage size */
for_each_hstate(h)
if (order > huge_page_order(h))
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 029/158] kernel/smp.c:on_each_cpu_cond(): fix warning in fallback path
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 028/158] mm: fix potential infinite loop in dissolve_free_huge_pages() Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 030/158] mfd: omap-usb-host: Fix improper mask use Greg Kroah-Hartman
` (129 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sasha Levin, Christoph Lameter,
Gilad Ben-Yossef, David Rientjes, Joonsoo Kim, Tejun Heo,
Andrew Morton, Linus Torvalds
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <sasha.levin@oracle.com>
commit 618fde872163e782183ce574c77f1123e2be8887 upstream.
The rarely-executed memry-allocation-failed callback path generates a
WARN_ON_ONCE() when smp_call_function_single() succeeds. Presumably
it's supposed to warn on failures.
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Christoph Lameter <cl@gentwo.org>
Cc: Gilad Ben-Yossef <gilad@benyossef.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Tejun Heo <htejun@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/smp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -661,7 +661,7 @@ void on_each_cpu_cond(bool (*cond_func)(
if (cond_func(cpu, info)) {
ret = smp_call_function_single(cpu, func,
info, wait);
- WARN_ON_ONCE(!ret);
+ WARN_ON_ONCE(ret);
}
preempt_enable();
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 030/158] mfd: omap-usb-host: Fix improper mask use.
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 029/158] kernel/smp.c:on_each_cpu_cond(): fix warning in fallback path Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 031/158] drivers/mfd/rtsx_usb.c: export device table Greg Kroah-Hartman
` (128 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Michael Welling, Lee Jones
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Welling <mwelling@emacinc.com>
commit 46de8ff8e80a6546aa3d2fdf58c6776666301a0c upstream.
single-ulpi-bypass is a flag used for older OMAP3 silicon.
The flag when set, can excite code that improperly uses the
OMAP_UHH_HOSTCONFIG_UPLI_BYPASS define to clear the corresponding bit.
Instead it clears all of the other bits disabling all of the ports in
the process.
Signed-off-by: Michael Welling <mwelling@emacinc.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/omap-usb-host.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -445,7 +445,7 @@ static unsigned omap_usbhs_rev1_hostconf
for (i = 0; i < omap->nports; i++) {
if (is_ehci_phy_mode(pdata->port_mode[i])) {
- reg &= OMAP_UHH_HOSTCONFIG_ULPI_BYPASS;
+ reg &= ~OMAP_UHH_HOSTCONFIG_ULPI_BYPASS;
break;
}
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 031/158] drivers/mfd/rtsx_usb.c: export device table
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 030/158] mfd: omap-usb-host: Fix improper mask use Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 032/158] mfd: twl4030-power: Fix PM idle pin configuration to not conflict with regulators Greg Kroah-Hartman
` (127 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jeff Mahoney, Marcel Witte,
Roger Tseng, Andrew Morton, Linus Torvalds
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <jeffm@suse.com>
commit 1813908986e36119228c158aae1c6a0267c99e77 upstream.
The rtsx_usb driver contains the table for the devices it supports but
doesn't export it. As a result, no alias is generated and it doesn't
get loaded automatically.
Via https://bugzilla.novell.com/show_bug.cgi?id=890096
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Reported-by: Marcel Witte <wittemar@googlemail.com>
Cc: Roger Tseng <rogerable@realtek.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/rtsx_usb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/mfd/rtsx_usb.c
+++ b/drivers/mfd/rtsx_usb.c
@@ -744,6 +744,7 @@ static struct usb_device_id rtsx_usb_usb
{ USB_DEVICE(0x0BDA, 0x0140) },
{ }
};
+MODULE_DEVICE_TABLE(usb, rtsx_usb_usb_ids);
static struct usb_driver rtsx_usb_driver = {
.name = "rtsx_usb",
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 032/158] mfd: twl4030-power: Fix PM idle pin configuration to not conflict with regulators
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 031/158] drivers/mfd/rtsx_usb.c: export device table Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 033/158] regulator: arizona-ldo1: remove bypass functionality Greg Kroah-Hartman
` (126 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Aaro Koskinen, Lee Jones
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
commit daebabd578647440d41fc9b48d8c7a88dc2f7ab5 upstream.
Commit 43fef47f94a1 (mfd: twl4030-power: Add a configuration to turn
off oscillator during off-idle) added support for configuring the PMIC
to cut off resources during deeper idle states to save power.
This however caused regression for n900 display power that needed the
PMIC configuration to be disabled with commit d937678ab625 (ARM: dts:
Revert enabling of twl configuration for n900).
Turns out the root cause of the problem is that we must use
TWL4030_RESCONFIG_UNDEF instead of DEV_GRP_NULL to avoid disabling
regulators that may have been enabled before the init function
for twl4030-power.c runs. With TWL4030_RESCONFIG_UNDEF we let the
regulator framework control the regulators like it should. Here we
need to only configure the sys_clken and sys_off_mode triggers for
the regulators that cannot be done by the regulator framework as
it's not running at that point.
This allows us to enable the PMIC configuration for n900.
Fixes: 43fef47f94a1 (mfd: twl4030-power: Add a configuration to turn off oscillator during off-idle)
Signed-off-by: Tony Lindgren <tony@atomide.com>
Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/omap3-n900.dts | 2 +-
drivers/mfd/twl4030-power.c | 20 ++++++++++----------
2 files changed, 11 insertions(+), 11 deletions(-)
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -353,7 +353,7 @@
};
twl_power: power {
- compatible = "ti,twl4030-power-n900";
+ compatible = "ti,twl4030-power-n900", "ti,twl4030-power-idle-osc-off";
ti,use_poweroff;
};
};
--- a/drivers/mfd/twl4030-power.c
+++ b/drivers/mfd/twl4030-power.c
@@ -724,24 +724,24 @@ static struct twl4030_script *omap3_idle
* above.
*/
static struct twl4030_resconfig omap3_idle_rconfig[] = {
- TWL_REMAP_SLEEP(RES_VAUX1, DEV_GRP_NULL, 0, 0),
- TWL_REMAP_SLEEP(RES_VAUX2, DEV_GRP_NULL, 0, 0),
- TWL_REMAP_SLEEP(RES_VAUX3, DEV_GRP_NULL, 0, 0),
- TWL_REMAP_SLEEP(RES_VAUX4, DEV_GRP_NULL, 0, 0),
- TWL_REMAP_SLEEP(RES_VMMC1, DEV_GRP_NULL, 0, 0),
- TWL_REMAP_SLEEP(RES_VMMC2, DEV_GRP_NULL, 0, 0),
+ TWL_REMAP_SLEEP(RES_VAUX1, TWL4030_RESCONFIG_UNDEF, 0, 0),
+ TWL_REMAP_SLEEP(RES_VAUX2, TWL4030_RESCONFIG_UNDEF, 0, 0),
+ TWL_REMAP_SLEEP(RES_VAUX3, TWL4030_RESCONFIG_UNDEF, 0, 0),
+ TWL_REMAP_SLEEP(RES_VAUX4, TWL4030_RESCONFIG_UNDEF, 0, 0),
+ TWL_REMAP_SLEEP(RES_VMMC1, TWL4030_RESCONFIG_UNDEF, 0, 0),
+ TWL_REMAP_SLEEP(RES_VMMC2, TWL4030_RESCONFIG_UNDEF, 0, 0),
TWL_REMAP_OFF(RES_VPLL1, DEV_GRP_P1, 3, 1),
TWL_REMAP_SLEEP(RES_VPLL2, DEV_GRP_P1, 0, 0),
- TWL_REMAP_SLEEP(RES_VSIM, DEV_GRP_NULL, 0, 0),
- TWL_REMAP_SLEEP(RES_VDAC, DEV_GRP_NULL, 0, 0),
+ TWL_REMAP_SLEEP(RES_VSIM, TWL4030_RESCONFIG_UNDEF, 0, 0),
+ TWL_REMAP_SLEEP(RES_VDAC, TWL4030_RESCONFIG_UNDEF, 0, 0),
TWL_REMAP_SLEEP(RES_VINTANA1, TWL_DEV_GRP_P123, 1, 2),
TWL_REMAP_SLEEP(RES_VINTANA2, TWL_DEV_GRP_P123, 0, 2),
TWL_REMAP_SLEEP(RES_VINTDIG, TWL_DEV_GRP_P123, 1, 2),
TWL_REMAP_SLEEP(RES_VIO, TWL_DEV_GRP_P123, 2, 2),
TWL_REMAP_OFF(RES_VDD1, DEV_GRP_P1, 4, 1),
TWL_REMAP_OFF(RES_VDD2, DEV_GRP_P1, 3, 1),
- TWL_REMAP_SLEEP(RES_VUSB_1V5, DEV_GRP_NULL, 0, 0),
- TWL_REMAP_SLEEP(RES_VUSB_1V8, DEV_GRP_NULL, 0, 0),
+ TWL_REMAP_SLEEP(RES_VUSB_1V5, TWL4030_RESCONFIG_UNDEF, 0, 0),
+ TWL_REMAP_SLEEP(RES_VUSB_1V8, TWL4030_RESCONFIG_UNDEF, 0, 0),
TWL_REMAP_SLEEP(RES_VUSB_3V1, TWL_DEV_GRP_P123, 0, 0),
/* Resource #20 USB charge pump skipped */
TWL_REMAP_SLEEP(RES_REGEN, TWL_DEV_GRP_P123, 2, 1),
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 033/158] regulator: arizona-ldo1: remove bypass functionality
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 032/158] mfd: twl4030-power: Fix PM idle pin configuration to not conflict with regulators Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 034/158] regulator: tps65218: fix DCDC4 linear voltage range Greg Kroah-Hartman
` (125 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nikesh Oswal, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikesh Oswal <nikesh@opensource.wolfsonmicro.com>
commit 5b919f3ebb533cbe400664837e24f66a0836b907 upstream.
WM5110/8280 devices do not support bypass mode for LDO1 so remove
the bypass callbacks registered with regulator core.
Signed-off-by: Nikesh Oswal <nikesh@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/arizona-ldo1.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/regulator/arizona-ldo1.c
+++ b/drivers/regulator/arizona-ldo1.c
@@ -143,8 +143,6 @@ static struct regulator_ops arizona_ldo1
.map_voltage = regulator_map_voltage_linear,
.get_voltage_sel = regulator_get_voltage_sel_regmap,
.set_voltage_sel = regulator_set_voltage_sel_regmap,
- .get_bypass = regulator_get_bypass_regmap,
- .set_bypass = regulator_set_bypass_regmap,
};
static const struct regulator_desc arizona_ldo1 = {
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 034/158] regulator: tps65218: fix DCDC4 linear voltage range
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 033/158] regulator: arizona-ldo1: remove bypass functionality Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 035/158] powerpc/cpuidle: Fix parsing of idle state flags from device-tree Greg Kroah-Hartman
` (124 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <balbi@ti.com>
commit 42ab0f3915f22728f54bb1f3c0dcf38ab2335b5b upstream.
The second range of this particular regulator,
starts at 1.60V, not as 1.55V as it was originally
implied by code.
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/tps65218-regulator.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/regulator/tps65218-regulator.c
+++ b/drivers/regulator/tps65218-regulator.c
@@ -68,7 +68,7 @@ static const struct regulator_linear_ran
static const struct regulator_linear_range dcdc4_ranges[] = {
REGULATOR_LINEAR_RANGE(1175000, 0x0, 0xf, 25000),
- REGULATOR_LINEAR_RANGE(1550000, 0x10, 0x34, 50000),
+ REGULATOR_LINEAR_RANGE(1600000, 0x10, 0x34, 50000),
};
static struct tps_info tps65218_pmic_regs[] = {
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 035/158] powerpc/cpuidle: Fix parsing of idle state flags from device-tree
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 034/158] regulator: tps65218: fix DCDC4 linear voltage range Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 036/158] powerpc/mm/numa: Fix break placement Greg Kroah-Hartman
` (123 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vaidyanathan Srinivasan,
Preeti U. Murthy, Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
commit 95707d852856aec1cbdad1873ff2dc5161a5cb91 upstream.
Flags from device-tree need to be parsed with accessors for
interpreting correct value in little-endian.
Signed-off-by: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
Reviewed-by: Preeti U. Murthy <preeti@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpuidle/cpuidle-powernv.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/cpuidle/cpuidle-powernv.c
+++ b/drivers/cpuidle/cpuidle-powernv.c
@@ -160,10 +160,10 @@ static int powernv_cpuidle_driver_init(v
static int powernv_add_idle_states(void)
{
struct device_node *power_mgt;
- struct property *prop;
int nr_idle_states = 1; /* Snooze */
int dt_idle_states;
- u32 *flags;
+ const __be32 *idle_state_flags;
+ u32 len_flags, flags;
int i;
/* Currently we have snooze statically defined */
@@ -174,18 +174,18 @@ static int powernv_add_idle_states(void)
return nr_idle_states;
}
- prop = of_find_property(power_mgt, "ibm,cpu-idle-state-flags", NULL);
- if (!prop) {
+ idle_state_flags = of_get_property(power_mgt, "ibm,cpu-idle-state-flags", &len_flags);
+ if (!idle_state_flags) {
pr_warn("DT-PowerMgmt: missing ibm,cpu-idle-state-flags\n");
return nr_idle_states;
}
- dt_idle_states = prop->length / sizeof(u32);
- flags = (u32 *) prop->value;
+ dt_idle_states = len_flags / sizeof(u32);
for (i = 0; i < dt_idle_states; i++) {
- if (flags[i] & IDLE_USE_INST_NAP) {
+ flags = be32_to_cpu(idle_state_flags[i]);
+ if (flags & IDLE_USE_INST_NAP) {
/* Add NAP state */
strcpy(powernv_states[nr_idle_states].name, "Nap");
strcpy(powernv_states[nr_idle_states].desc, "Nap");
@@ -196,7 +196,7 @@ static int powernv_add_idle_states(void)
nr_idle_states++;
}
- if (flags[i] & IDLE_USE_INST_SLEEP) {
+ if (flags & IDLE_USE_INST_SLEEP) {
/* Add FASTSLEEP state */
strcpy(powernv_states[nr_idle_states].name, "FastSleep");
strcpy(powernv_states[nr_idle_states].desc, "FastSleep");
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 036/158] powerpc/mm/numa: Fix break placement
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 035/158] powerpc/cpuidle: Fix parsing of idle state flags from device-tree Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 037/158] powerpc/mm: Use read barrier when creating real_pte Greg Kroah-Hartman
` (122 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Binderman, Andrey Utkin,
Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Utkin <andrey.krieger.utkin@gmail.com>
commit b00fc6ec1f24f9d7af9b8988b6a198186eb3408c upstream.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81631
Reported-by: David Binderman <dcb314@hotmail.com>
Signed-off-by: Andrey Utkin <andrey.krieger.utkin@gmail.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/mm/numa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -611,8 +611,8 @@ static int cpu_numa_callback(struct noti
case CPU_UP_CANCELED:
case CPU_UP_CANCELED_FROZEN:
unmap_cpu_from_node(lcpu);
- break;
ret = NOTIFY_OK;
+ break;
#endif
}
return ret;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 037/158] powerpc/mm: Use read barrier when creating real_pte
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 036/158] powerpc/mm/numa: Fix break placement Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 038/158] powerpc/pseries: Failure on removing device node Greg Kroah-Hartman
` (121 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aneesh Kumar K.V, Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
commit 85c1fafd7262e68ad821ee1808686b1392b1167d upstream.
On ppc64 we support 4K hash pte with 64K page size. That requires
us to track the hash pte slot information on a per 4k basis. We do that
by storing the slot details in the second half of pte page. The pte bit
_PAGE_COMBO is used to indicate whether the second half need to be
looked while building real_pte. We need to use read memory barrier while
doing that so that load of hidx is not reordered w.r.t _PAGE_COMBO
check. On the store side we already do a lwsync in __hash_page_4K
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/pte-hash64-64k.h | 30 +++++++++++++++++++++++++-----
1 file changed, 25 insertions(+), 5 deletions(-)
--- a/arch/powerpc/include/asm/pte-hash64-64k.h
+++ b/arch/powerpc/include/asm/pte-hash64-64k.h
@@ -46,11 +46,31 @@
* in order to deal with 64K made of 4K HW pages. Thus we override the
* generic accessors and iterators here
*/
-#define __real_pte(e,p) ((real_pte_t) { \
- (e), (pte_val(e) & _PAGE_COMBO) ? \
- (pte_val(*((p) + PTRS_PER_PTE))) : 0 })
-#define __rpte_to_hidx(r,index) ((pte_val((r).pte) & _PAGE_COMBO) ? \
- (((r).hidx >> ((index)<<2)) & 0xf) : ((pte_val((r).pte) >> 12) & 0xf))
+#define __real_pte __real_pte
+static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep)
+{
+ real_pte_t rpte;
+
+ rpte.pte = pte;
+ rpte.hidx = 0;
+ if (pte_val(pte) & _PAGE_COMBO) {
+ /*
+ * Make sure we order the hidx load against the _PAGE_COMBO
+ * check. The store side ordering is done in __hash_page_4K
+ */
+ smp_rmb();
+ rpte.hidx = pte_val(*((ptep) + PTRS_PER_PTE));
+ }
+ return rpte;
+}
+
+static inline unsigned long __rpte_to_hidx(real_pte_t rpte, unsigned long index)
+{
+ if ((pte_val(rpte.pte) & _PAGE_COMBO))
+ return (rpte.hidx >> (index<<2)) & 0xf;
+ return (pte_val(rpte.pte) >> 12) & 0xf;
+}
+
#define __rpte_to_pte(r) ((r).pte)
#define __rpte_sub_valid(rpte, index) \
(pte_val(rpte.pte) & (_PAGE_HPTE_SUB0 >> (index)))
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 038/158] powerpc/pseries: Failure on removing device node
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 037/158] powerpc/mm: Use read barrier when creating real_pte Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 039/158] powerpc/pseries: Avoid deadlock on removing ddw Greg Kroah-Hartman
` (120 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gavin Shan, Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Shan <gwshan@linux.vnet.ibm.com>
commit f1b3929c232784580e5d8ee324b6bc634e709575 upstream.
While running command "drmgr -c phb -r -s 'PHB 528'", following
backtrace jumped out because the target device node isn't marked
with OF_DETACHED by of_detach_node(), which caused by error
returned from memory hotplug related reconfig notifier when
disabling CONFIG_MEMORY_HOTREMOVE. The patch fixes it.
ERROR: Bad of_node_put() on /pci@800000020000210/ethernet@0
CPU: 14 PID: 2252 Comm: drmgr Tainted: G W 3.16.0+ #427
Call Trace:
[c000000012a776a0] [c000000000013d9c] .show_stack+0x88/0x148 (unreliable)
[c000000012a77750] [c00000000083cd34] .dump_stack+0x7c/0x9c
[c000000012a777d0] [c0000000006807c4] .of_node_release+0x58/0xe0
[c000000012a77860] [c00000000038a7d0] .kobject_release+0x174/0x1b8
[c000000012a77900] [c00000000038a884] .kobject_put+0x70/0x78
[c000000012a77980] [c000000000681680] .of_node_put+0x28/0x34
[c000000012a77a00] [c000000000681ea8] .__of_get_next_child+0x64/0x70
[c000000012a77a90] [c000000000682138] .of_find_node_by_path+0x1b8/0x20c
[c000000012a77b40] [c000000000051840] .ofdt_write+0x308/0x688
[c000000012a77c20] [c000000000238430] .proc_reg_write+0xb8/0xd4
[c000000012a77cd0] [c0000000001cbeac] .vfs_write+0xec/0x1f8
[c000000012a77d70] [c0000000001cc3b0] .SyS_write+0x58/0xa0
[c000000012a77e30] [c00000000000a064] syscall_exit+0x0/0x98
Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/hotplug-memory.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -146,7 +146,7 @@ static inline int pseries_remove_membloc
}
static inline int pseries_remove_mem_node(struct device_node *np)
{
- return -EOPNOTSUPP;
+ return 0;
}
#endif /* CONFIG_MEMORY_HOTREMOVE */
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 039/158] powerpc/pseries: Avoid deadlock on removing ddw
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 038/158] powerpc/pseries: Failure on removing device node Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 040/158] powerpc/thp: Add write barrier after updating the valid bit Greg Kroah-Hartman
` (119 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gavin Shan, Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Shan <gwshan@linux.vnet.ibm.com>
commit 5efbabe09d986f25c02d19954660238fcd7f008a upstream.
Function remove_ddw() could be called in of_reconfig_notifier and
we potentially remove the dynamic DMA window property, which invokes
of_reconfig_notifier again. Eventually, it leads to the deadlock as
following backtrace shows.
The patch fixes the above issue by deferring releasing the dynamic
DMA window property while releasing the device node.
=============================================
[ INFO: possible recursive locking detected ]
3.16.0+ #428 Tainted: G W
---------------------------------------------
drmgr/2273 is trying to acquire lock:
((of_reconfig_chain).rwsem){.+.+..}, at: [<c000000000091890>] \
.__blocking_notifier_call_chain+0x40/0x78
but task is already holding lock:
((of_reconfig_chain).rwsem){.+.+..}, at: [<c000000000091890>] \
.__blocking_notifier_call_chain+0x40/0x78
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock((of_reconfig_chain).rwsem);
lock((of_reconfig_chain).rwsem);
*** DEADLOCK ***
May be due to missing lock nesting notation
2 locks held by drmgr/2273:
#0: (sb_writers#4){.+.+.+}, at: [<c0000000001cbe70>] \
.vfs_write+0xb0/0x1f8
#1: ((of_reconfig_chain).rwsem){.+.+..}, at: [<c000000000091890>] \
.__blocking_notifier_call_chain+0x40/0x78
stack backtrace:
CPU: 17 PID: 2273 Comm: drmgr Tainted: G W 3.16.0+ #428
Call Trace:
[c0000000137e7000] [c000000000013d9c] .show_stack+0x88/0x148 (unreliable)
[c0000000137e70b0] [c00000000083cd34] .dump_stack+0x7c/0x9c
[c0000000137e7130] [c0000000000b8afc] .__lock_acquire+0x128c/0x1c68
[c0000000137e7280] [c0000000000b9a4c] .lock_acquire+0xe8/0x104
[c0000000137e7350] [c00000000083588c] .down_read+0x4c/0x90
[c0000000137e73e0] [c000000000091890] .__blocking_notifier_call_chain+0x40/0x78
[c0000000137e7490] [c000000000091900] .blocking_notifier_call_chain+0x38/0x48
[c0000000137e7520] [c000000000682a28] .of_reconfig_notify+0x34/0x5c
[c0000000137e75b0] [c000000000682a9c] .of_property_notify+0x4c/0x54
[c0000000137e7650] [c000000000682bf0] .of_remove_property+0x30/0xd4
[c0000000137e76f0] [c000000000052a44] .remove_ddw+0x144/0x168
[c0000000137e7790] [c000000000053204] .iommu_reconfig_notifier+0x30/0xe0
[c0000000137e7820] [c00000000009137c] .notifier_call_chain+0x6c/0xb4
[c0000000137e78c0] [c0000000000918ac] .__blocking_notifier_call_chain+0x5c/0x78
[c0000000137e7970] [c000000000091900] .blocking_notifier_call_chain+0x38/0x48
[c0000000137e7a00] [c000000000682a28] .of_reconfig_notify+0x34/0x5c
[c0000000137e7a90] [c000000000682e14] .of_detach_node+0x44/0x1fc
[c0000000137e7b40] [c0000000000518e4] .ofdt_write+0x3ac/0x688
[c0000000137e7c20] [c000000000238430] .proc_reg_write+0xb8/0xd4
[c0000000137e7cd0] [c0000000001cbeac] .vfs_write+0xec/0x1f8
[c0000000137e7d70] [c0000000001cc3b0] .SyS_write+0x58/0xa0
[c0000000137e7e30] [c00000000000a064] syscall_exit+0x0/0x98
Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/iommu.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -721,13 +721,13 @@ static int __init disable_ddw_setup(char
early_param("disable_ddw", disable_ddw_setup);
-static void remove_ddw(struct device_node *np)
+static void remove_ddw(struct device_node *np, bool remove_prop)
{
struct dynamic_dma_window_prop *dwp;
struct property *win64;
const u32 *ddw_avail;
u64 liobn;
- int len, ret;
+ int len, ret = 0;
ddw_avail = of_get_property(np, "ibm,ddw-applicable", &len);
win64 = of_find_property(np, DIRECT64_PROPNAME, NULL);
@@ -761,7 +761,8 @@ static void remove_ddw(struct device_nod
np->full_name, ret, ddw_avail[2], liobn);
delprop:
- ret = of_remove_property(np, win64);
+ if (remove_prop)
+ ret = of_remove_property(np, win64);
if (ret)
pr_warning("%s: failed to remove direct window property: %d\n",
np->full_name, ret);
@@ -805,7 +806,7 @@ static int find_existing_ddw_windows(voi
window = kzalloc(sizeof(*window), GFP_KERNEL);
if (!window || len < sizeof(struct dynamic_dma_window_prop)) {
kfree(window);
- remove_ddw(pdn);
+ remove_ddw(pdn, true);
continue;
}
@@ -1045,7 +1046,7 @@ out_free_window:
kfree(window);
out_clear_window:
- remove_ddw(pdn);
+ remove_ddw(pdn, true);
out_free_prop:
kfree(win64->name);
@@ -1255,7 +1256,14 @@ static int iommu_reconfig_notifier(struc
switch (action) {
case OF_RECONFIG_DETACH_NODE:
- remove_ddw(np);
+ /*
+ * Removing the property will invoke the reconfig
+ * notifier again, which causes dead-lock on the
+ * read-write semaphore of the notifier chain. So
+ * we have to remove the property when releasing
+ * the device node.
+ */
+ remove_ddw(np, false);
if (pci && pci->iommu_table)
iommu_free_table(pci->iommu_table, np->full_name);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 040/158] powerpc/thp: Add write barrier after updating the valid bit
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 039/158] powerpc/pseries: Avoid deadlock on removing ddw Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 041/158] powerpc/thp: Dont recompute vsid and ssize in loop on invalidate Greg Kroah-Hartman
` (118 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aneesh Kumar K.V, Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
commit b0aa44a3dfae3d8f45bd1264349aa87f87b7774f upstream.
With hugepages, we store the hpte valid information in the pte page
whose address is stored in the second half of the PMD. Use a
write barrier to make sure clearing pmd busy bit and updating
hpte valid info are ordered properly.
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/mm/hugepage-hash64.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/arch/powerpc/mm/hugepage-hash64.c
+++ b/arch/powerpc/mm/hugepage-hash64.c
@@ -172,8 +172,11 @@ repeat:
mark_hpte_slot_valid(hpte_slot_array, index, slot);
}
/*
- * No need to use ldarx/stdcx here
+ * The hpte valid is stored in the pgtable whose address is in the
+ * second half of the PMD. Order this against clearing of the busy bit in
+ * huge pmd.
*/
+ smp_wmb();
*pmdp = __pmd(new_pmd & ~_PAGE_BUSY);
return 0;
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 041/158] powerpc/thp: Dont recompute vsid and ssize in loop on invalidate
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 040/158] powerpc/thp: Add write barrier after updating the valid bit Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 042/158] powerpc/thp: Invalidate old 64K based hash page mapping before insert of 4k pte Greg Kroah-Hartman
` (117 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aneesh Kumar K.V, Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
commit fa1f8ae80f8bb996594167ff4750a0b0a5a5bb5d upstream.
The segment identifier and segment size will remain the same in
the loop, So we can compute it outside. We also change the
hugepage_invalidate interface so that we can use it the later patch
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/machdep.h | 6 +++---
arch/powerpc/mm/hash_native_64.c | 19 +++++--------------
arch/powerpc/mm/pgtable_64.c | 24 ++++++++++++------------
arch/powerpc/platforms/pseries/lpar.c | 20 ++++++--------------
4 files changed, 26 insertions(+), 43 deletions(-)
--- a/arch/powerpc/include/asm/machdep.h
+++ b/arch/powerpc/include/asm/machdep.h
@@ -57,10 +57,10 @@ struct machdep_calls {
void (*hpte_removebolted)(unsigned long ea,
int psize, int ssize);
void (*flush_hash_range)(unsigned long number, int local);
- void (*hugepage_invalidate)(struct mm_struct *mm,
+ void (*hugepage_invalidate)(unsigned long vsid,
+ unsigned long addr,
unsigned char *hpte_slot_array,
- unsigned long addr, int psize);
-
+ int psize, int ssize);
/* special for kexec, to be called in real mode, linear mapping is
* destroyed as well */
void (*hpte_clear_all)(void);
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -412,18 +412,18 @@ static void native_hpte_invalidate(unsig
local_irq_restore(flags);
}
-static void native_hugepage_invalidate(struct mm_struct *mm,
+static void native_hugepage_invalidate(unsigned long vsid,
+ unsigned long addr,
unsigned char *hpte_slot_array,
- unsigned long addr, int psize)
+ int psize, int ssize)
{
- int ssize = 0, i;
- int lock_tlbie;
+ int i, lock_tlbie;
struct hash_pte *hptep;
int actual_psize = MMU_PAGE_16M;
unsigned int max_hpte_count, valid;
unsigned long flags, s_addr = addr;
unsigned long hpte_v, want_v, shift;
- unsigned long hidx, vpn = 0, vsid, hash, slot;
+ unsigned long hidx, vpn = 0, hash, slot;
shift = mmu_psize_defs[psize].shift;
max_hpte_count = 1U << (PMD_SHIFT - shift);
@@ -437,15 +437,6 @@ static void native_hugepage_invalidate(s
/* get the vpn */
addr = s_addr + (i * (1ul << shift));
- if (!is_kernel_addr(addr)) {
- ssize = user_segment_size(addr);
- vsid = get_vsid(mm->context.id, addr, ssize);
- WARN_ON(vsid == 0);
- } else {
- vsid = get_kernel_vsid(addr, mmu_kernel_ssize);
- ssize = mmu_kernel_ssize;
- }
-
vpn = hpt_vpn(addr, vsid, ssize);
hash = hpt_hash(vpn, shift, ssize);
if (hidx & _PTEIDX_SECONDARY)
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -745,12 +745,21 @@ void hpte_do_hugepage_flush(struct mm_st
if (!hpte_slot_array)
return;
- /* get the base page size */
+ /* get the base page size,vsid and segment size */
psize = get_slice_psize(mm, s_addr);
+ if (!is_kernel_addr(s_addr)) {
+ ssize = user_segment_size(s_addr);
+ vsid = get_vsid(mm->context.id, s_addr, ssize);
+ WARN_ON(vsid == 0);
+ } else {
+ vsid = get_kernel_vsid(s_addr, mmu_kernel_ssize);
+ ssize = mmu_kernel_ssize;
+ }
if (ppc_md.hugepage_invalidate)
- return ppc_md.hugepage_invalidate(mm, hpte_slot_array,
- s_addr, psize);
+ return ppc_md.hugepage_invalidate(vsid, s_addr,
+ hpte_slot_array,
+ psize, ssize);
/*
* No bluk hpte removal support, invalidate each entry
*/
@@ -768,15 +777,6 @@ void hpte_do_hugepage_flush(struct mm_st
/* get the vpn */
addr = s_addr + (i * (1ul << shift));
- if (!is_kernel_addr(addr)) {
- ssize = user_segment_size(addr);
- vsid = get_vsid(mm->context.id, addr, ssize);
- WARN_ON(vsid == 0);
- } else {
- vsid = get_kernel_vsid(addr, mmu_kernel_ssize);
- ssize = mmu_kernel_ssize;
- }
-
vpn = hpt_vpn(addr, vsid, ssize);
hash = hpt_hash(vpn, shift, ssize);
if (hidx & _PTEIDX_SECONDARY)
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -430,16 +430,17 @@ static void __pSeries_lpar_hugepage_inva
spin_unlock_irqrestore(&pSeries_lpar_tlbie_lock, flags);
}
-static void pSeries_lpar_hugepage_invalidate(struct mm_struct *mm,
- unsigned char *hpte_slot_array,
- unsigned long addr, int psize)
+static void pSeries_lpar_hugepage_invalidate(unsigned long vsid,
+ unsigned long addr,
+ unsigned char *hpte_slot_array,
+ int psize, int ssize)
{
- int ssize = 0, i, index = 0;
+ int i, index = 0;
unsigned long s_addr = addr;
unsigned int max_hpte_count, valid;
unsigned long vpn_array[PPC64_HUGE_HPTE_BATCH];
unsigned long slot_array[PPC64_HUGE_HPTE_BATCH];
- unsigned long shift, hidx, vpn = 0, vsid, hash, slot;
+ unsigned long shift, hidx, vpn = 0, hash, slot;
shift = mmu_psize_defs[psize].shift;
max_hpte_count = 1U << (PMD_SHIFT - shift);
@@ -452,15 +453,6 @@ static void pSeries_lpar_hugepage_invali
/* get the vpn */
addr = s_addr + (i * (1ul << shift));
- if (!is_kernel_addr(addr)) {
- ssize = user_segment_size(addr);
- vsid = get_vsid(mm->context.id, addr, ssize);
- WARN_ON(vsid == 0);
- } else {
- vsid = get_kernel_vsid(addr, mmu_kernel_ssize);
- ssize = mmu_kernel_ssize;
- }
-
vpn = hpt_vpn(addr, vsid, ssize);
hash = hpt_hash(vpn, shift, ssize);
if (hidx & _PTEIDX_SECONDARY)
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 042/158] powerpc/thp: Invalidate old 64K based hash page mapping before insert of 4k pte
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 041/158] powerpc/thp: Dont recompute vsid and ssize in loop on invalidate Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 043/158] powerpc/thp: Handle combo pages in invalidate Greg Kroah-Hartman
` (116 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aneesh Kumar K.V, Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
commit 629149fae478f0ac6bf705a535708b192e9c6b59 upstream.
If we changed base page size of the segment, either via sub_page_protect
or via remap_4k_pfn, we do a demote_segment which doesn't flush the hash
table entries. We do a lazy hash page table flush for all mapped pages
in the demoted segment. This happens when we handle hash page fault
for these pages.
We use _PAGE_COMBO bit along with _PAGE_HASHPTE to indicate whether a
pte is backed by 4K hash pte. If we find _PAGE_COMBO not set on the pte,
that implies that we could possibly have older 64K hash pte entries in
the hash page table and we need to invalidate those entries.
Handle this correctly for 16M pages
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/mm/hugepage-hash64.c | 79 +++++++++++++++++++++++++++++++++-----
1 file changed, 70 insertions(+), 9 deletions(-)
--- a/arch/powerpc/mm/hugepage-hash64.c
+++ b/arch/powerpc/mm/hugepage-hash64.c
@@ -18,6 +18,57 @@
#include <linux/mm.h>
#include <asm/machdep.h>
+static void invalidate_old_hpte(unsigned long vsid, unsigned long addr,
+ pmd_t *pmdp, unsigned int psize, int ssize)
+{
+ int i, max_hpte_count, valid;
+ unsigned long s_addr;
+ unsigned char *hpte_slot_array;
+ unsigned long hidx, shift, vpn, hash, slot;
+
+ s_addr = addr & HPAGE_PMD_MASK;
+ hpte_slot_array = get_hpte_slot_array(pmdp);
+ /*
+ * IF we try to do a HUGE PTE update after a withdraw is done.
+ * we will find the below NULL. This happens when we do
+ * split_huge_page_pmd
+ */
+ if (!hpte_slot_array)
+ return;
+
+ if (ppc_md.hugepage_invalidate)
+ return ppc_md.hugepage_invalidate(vsid, s_addr, hpte_slot_array,
+ psize, ssize);
+ /*
+ * No bluk hpte removal support, invalidate each entry
+ */
+ shift = mmu_psize_defs[psize].shift;
+ max_hpte_count = HPAGE_PMD_SIZE >> shift;
+ for (i = 0; i < max_hpte_count; i++) {
+ /*
+ * 8 bits per each hpte entries
+ * 000| [ secondary group (one bit) | hidx (3 bits) | valid bit]
+ */
+ valid = hpte_valid(hpte_slot_array, i);
+ if (!valid)
+ continue;
+ hidx = hpte_hash_index(hpte_slot_array, i);
+
+ /* get the vpn */
+ addr = s_addr + (i * (1ul << shift));
+ vpn = hpt_vpn(addr, vsid, ssize);
+ hash = hpt_hash(vpn, shift, ssize);
+ if (hidx & _PTEIDX_SECONDARY)
+ hash = ~hash;
+
+ slot = (hash & htab_hash_mask) * HPTES_PER_GROUP;
+ slot += hidx & _PTEIDX_GROUP_IX;
+ ppc_md.hpte_invalidate(slot, vpn, psize,
+ MMU_PAGE_16M, ssize, 0);
+ }
+}
+
+
int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
pmd_t *pmdp, unsigned long trap, int local, int ssize,
unsigned int psize)
@@ -85,6 +136,15 @@ int __hash_page_thp(unsigned long ea, un
vpn = hpt_vpn(ea, vsid, ssize);
hash = hpt_hash(vpn, shift, ssize);
hpte_slot_array = get_hpte_slot_array(pmdp);
+ if (psize == MMU_PAGE_4K) {
+ /*
+ * invalidate the old hpte entry if we have that mapped via 64K
+ * base page size. This is because demote_segment won't flush
+ * hash page table entries.
+ */
+ if ((old_pmd & _PAGE_HASHPTE) && !(old_pmd & _PAGE_COMBO))
+ invalidate_old_hpte(vsid, ea, pmdp, MMU_PAGE_64K, ssize);
+ }
valid = hpte_valid(hpte_slot_array, index);
if (valid) {
@@ -107,11 +167,8 @@ int __hash_page_thp(unsigned long ea, un
* safely update this here.
*/
valid = 0;
- new_pmd &= ~_PAGE_HPTEFLAGS;
hpte_slot_array[index] = 0;
- } else
- /* clear the busy bits and set the hash pte bits */
- new_pmd = (new_pmd & ~_PAGE_HPTEFLAGS) | _PAGE_HASHPTE;
+ }
}
if (!valid) {
@@ -119,11 +176,7 @@ int __hash_page_thp(unsigned long ea, un
/* insert new entry */
pa = pmd_pfn(__pmd(old_pmd)) << PAGE_SHIFT;
-repeat:
- hpte_group = ((hash & htab_hash_mask) * HPTES_PER_GROUP) & ~0x7UL;
-
- /* clear the busy bits and set the hash pte bits */
- new_pmd = (new_pmd & ~_PAGE_HPTEFLAGS) | _PAGE_HASHPTE;
+ new_pmd |= _PAGE_HASHPTE;
/* Add in WIMG bits */
rflags |= (new_pmd & (_PAGE_WRITETHRU | _PAGE_NO_CACHE |
@@ -132,6 +185,8 @@ repeat:
* enable the memory coherence always
*/
rflags |= HPTE_R_M;
+repeat:
+ hpte_group = ((hash & htab_hash_mask) * HPTES_PER_GROUP) & ~0x7UL;
/* Insert into the hash table, primary slot */
slot = ppc_md.hpte_insert(hpte_group, vpn, pa, rflags, 0,
@@ -172,6 +227,12 @@ repeat:
mark_hpte_slot_valid(hpte_slot_array, index, slot);
}
/*
+ * Mark the pte with _PAGE_COMBO, if we are trying to hash it with
+ * base page size 4k.
+ */
+ if (psize == MMU_PAGE_4K)
+ new_pmd |= _PAGE_COMBO;
+ /*
* The hpte valid is stored in the pgtable whose address is in the
* second half of the PMD. Order this against clearing of the busy bit in
* huge pmd.
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 043/158] powerpc/thp: Handle combo pages in invalidate
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 042/158] powerpc/thp: Invalidate old 64K based hash page mapping before insert of 4k pte Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 044/158] powerpc/thp: Invalidate with vpn in loop Greg Kroah-Hartman
` (115 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aneesh Kumar K.V, Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
commit fc0479557572375100ef16c71170b29a98e0d69a upstream.
If we changed base page size of the segment, either via sub_page_protect
or via remap_4k_pfn, we do a demote_segment which doesn't flush the hash
table entries. We do a lazy hash page table flush for all mapped pages
in the demoted segment. This happens when we handle hash page fault for
these pages.
We use _PAGE_COMBO bit along with _PAGE_HASHPTE to indicate whether a
pte is backed by 4K hash pte. If we find _PAGE_COMBO not set on the pte,
that implies that we could possibly have older 64K hash pte entries in
the hash page table and we need to invalidate those entries.
Use _PAGE_COMBO to determine the page size with which we should
invalidate the hash table entries on unmap.
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/pgtable-ppc64.h | 2 +-
arch/powerpc/mm/pgtable_64.c | 14 +++++++++++---
arch/powerpc/mm/tlb_hash64.c | 2 +-
3 files changed, 13 insertions(+), 5 deletions(-)
--- a/arch/powerpc/include/asm/pgtable-ppc64.h
+++ b/arch/powerpc/include/asm/pgtable-ppc64.h
@@ -413,7 +413,7 @@ static inline char *get_hpte_slot_array(
}
extern void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr,
- pmd_t *pmdp);
+ pmd_t *pmdp, unsigned long old_pmd);
#ifdef CONFIG_TRANSPARENT_HUGEPAGE
extern pmd_t pfn_pmd(unsigned long pfn, pgprot_t pgprot);
extern pmd_t mk_pmd(struct page *page, pgprot_t pgprot);
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -538,7 +538,7 @@ unsigned long pmd_hugepage_update(struct
*pmdp = __pmd((old & ~clr) | set);
#endif
if (old & _PAGE_HASHPTE)
- hpte_do_hugepage_flush(mm, addr, pmdp);
+ hpte_do_hugepage_flush(mm, addr, pmdp, old);
return old;
}
@@ -645,7 +645,7 @@ void pmdp_splitting_flush(struct vm_area
if (!(old & _PAGE_SPLITTING)) {
/* We need to flush the hpte */
if (old & _PAGE_HASHPTE)
- hpte_do_hugepage_flush(vma->vm_mm, address, pmdp);
+ hpte_do_hugepage_flush(vma->vm_mm, address, pmdp, old);
}
/*
* This ensures that generic code that rely on IRQ disabling
@@ -723,7 +723,7 @@ void pmdp_invalidate(struct vm_area_stru
* neesd to be flushed.
*/
void hpte_do_hugepage_flush(struct mm_struct *mm, unsigned long addr,
- pmd_t *pmdp)
+ pmd_t *pmdp, unsigned long old_pmd)
{
int ssize, i;
unsigned long s_addr;
@@ -746,7 +746,15 @@ void hpte_do_hugepage_flush(struct mm_st
return;
/* get the base page size,vsid and segment size */
+#ifdef CONFIG_DEBUG_VM
psize = get_slice_psize(mm, s_addr);
+ BUG_ON(psize == MMU_PAGE_16M);
+#endif
+ if (old_pmd & _PAGE_COMBO)
+ psize = MMU_PAGE_4K;
+ else
+ psize = MMU_PAGE_64K;
+
if (!is_kernel_addr(s_addr)) {
ssize = user_segment_size(s_addr);
vsid = get_vsid(mm->context.id, s_addr, ssize);
--- a/arch/powerpc/mm/tlb_hash64.c
+++ b/arch/powerpc/mm/tlb_hash64.c
@@ -216,7 +216,7 @@ void __flush_hash_table_range(struct mm_
if (!(pte & _PAGE_HASHPTE))
continue;
if (unlikely(hugepage_shift && pmd_trans_huge(*(pmd_t *)pte)))
- hpte_do_hugepage_flush(mm, start, (pmd_t *)pte);
+ hpte_do_hugepage_flush(mm, start, (pmd_t *)ptep, pte);
else
hpte_need_flush(mm, start, ptep, pte, 0);
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 044/158] powerpc/thp: Invalidate with vpn in loop
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 043/158] powerpc/thp: Handle combo pages in invalidate Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 045/158] powerpc/thp: Use ACCESS_ONCE when loading pmdp Greg Kroah-Hartman
` (114 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aneesh Kumar K.V, Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
commit 969b7b208f7408712a3526856e4ae60ad13f6928 upstream.
As per ISA, for 4k base page size we compare 14..65 bits of VA specified
with the entry_VA in tlb. That implies we need to make sure we do a
tlbie with all the possible 4k va we used to access the 16MB hugepage.
With 64k base page size we compare 14..57 bits of VA. Hence we cannot
ignore the lower 24 bits of va while tlbie .We also cannot tlb
invalidate a 16MB entry with just one tlbie instruction because
we don't track which va was used to instantiate the tlb entry.
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/mm/hash_native_64.c | 23 +++++++----------------
1 file changed, 7 insertions(+), 16 deletions(-)
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -417,7 +417,7 @@ static void native_hugepage_invalidate(u
unsigned char *hpte_slot_array,
int psize, int ssize)
{
- int i, lock_tlbie;
+ int i;
struct hash_pte *hptep;
int actual_psize = MMU_PAGE_16M;
unsigned int max_hpte_count, valid;
@@ -456,22 +456,13 @@ static void native_hugepage_invalidate(u
else
/* Invalidate the hpte. NOTE: this also unlocks it */
hptep->v = 0;
+ /*
+ * We need to do tlb invalidate for all the address, tlbie
+ * instruction compares entry_VA in tlb with the VA specified
+ * here
+ */
+ tlbie(vpn, psize, actual_psize, ssize, 0);
}
- /*
- * Since this is a hugepage, we just need a single tlbie.
- * use the last vpn.
- */
- lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
- if (lock_tlbie)
- raw_spin_lock(&native_tlbie_lock);
-
- asm volatile("ptesync":::"memory");
- __tlbie(vpn, psize, actual_psize, ssize);
- asm volatile("eieio; tlbsync; ptesync":::"memory");
-
- if (lock_tlbie)
- raw_spin_unlock(&native_tlbie_lock);
-
local_irq_restore(flags);
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 045/158] powerpc/thp: Use ACCESS_ONCE when loading pmdp
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 044/158] powerpc/thp: Invalidate with vpn in loop Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 046/158] scsi: use short driver name for per-driver cmd slab caches Greg Kroah-Hartman
` (113 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aneesh Kumar K.V, Benjamin Herrenschmidt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
commit 7e467245bf5226db34c4b12d3cbacfa2f7a15a8b upstream.
We would get wrong results in compiler recomputed old_pmd. Avoid
that by using ACCESS_ONCE
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/mm/hugepage-hash64.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/powerpc/mm/hugepage-hash64.c
+++ b/arch/powerpc/mm/hugepage-hash64.c
@@ -84,7 +84,9 @@ int __hash_page_thp(unsigned long ea, un
* atomically mark the linux large page PMD busy and dirty
*/
do {
- old_pmd = pmd_val(*pmdp);
+ pmd_t pmd = ACCESS_ONCE(*pmdp);
+
+ old_pmd = pmd_val(pmd);
/* If PMD busy, retry the access */
if (unlikely(old_pmd & _PAGE_BUSY))
return 0;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 046/158] scsi: use short driver name for per-driver cmd slab caches
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 045/158] powerpc/thp: Use ACCESS_ONCE when loading pmdp Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 047/158] Drivers: scsi: storvsc: Implement a eh_timed_out handler Greg Kroah-Hartman
` (112 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Bottomley, poma,
Vladimir Davydov, Martin K. Petersen, Christoph Hellwig
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Bottomley <JBottomley@Parallels.com>
commit 884ffee01ddde5af260c7a5d1359c658aa1f0a11 upstream.
hostt->name might contain space, so use the ->proc_name short name instead
when creating per-driver command slabs.
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Reported-by: poma <pomidorabelisima@gmail.com>
Tested-by: poma <pomidorabelisima@gmail.com>
Reviewed-by: Vladimir Davydov <vdavydov@parallels.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -368,8 +368,8 @@ scsi_alloc_host_cmd_pool(struct Scsi_Hos
if (!pool)
return NULL;
- pool->cmd_name = kasprintf(GFP_KERNEL, "%s_cmd", hostt->name);
- pool->sense_name = kasprintf(GFP_KERNEL, "%s_sense", hostt->name);
+ pool->cmd_name = kasprintf(GFP_KERNEL, "%s_cmd", hostt->proc_name);
+ pool->sense_name = kasprintf(GFP_KERNEL, "%s_sense", hostt->proc_name);
if (!pool->cmd_name || !pool->sense_name) {
scsi_free_host_cmd_pool(pool);
return NULL;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 047/158] Drivers: scsi: storvsc: Implement a eh_timed_out handler
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 046/158] scsi: use short driver name for per-driver cmd slab caches Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 048/158] Drivers: scsi: storvsc: Filter commands based on the storage protocol version Greg Kroah-Hartman
` (111 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, K. Y. Srinivasan, Hannes Reinecke,
Christoph Hellwig
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "K. Y. Srinivasan" <kys@microsoft.com>
commit 56b26e69c8283121febedd12b3cc193384af46b9 upstream.
On Azure, we have seen instances of unbounded I/O latencies. To deal with
this issue, implement handler that can reset the timeout. Note that the
host gaurantees that it will respond to each command that has been issued.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
[hch: added a better comment explaining the issue]
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/storvsc_drv.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -33,6 +33,7 @@
#include <linux/device.h>
#include <linux/hyperv.h>
#include <linux/mempool.h>
+#include <linux/blkdev.h>
#include <scsi/scsi.h>
#include <scsi/scsi_cmnd.h>
#include <scsi/scsi_host.h>
@@ -1518,6 +1519,16 @@ static int storvsc_host_reset_handler(st
return SUCCESS;
}
+/*
+ * The host guarantees to respond to each command, although I/O latencies might
+ * be unbounded on Azure. Reset the timer unconditionally to give the host a
+ * chance to perform EH.
+ */
+static enum blk_eh_timer_return storvsc_eh_timed_out(struct scsi_cmnd *scmnd)
+{
+ return BLK_EH_RESET_TIMER;
+}
+
static bool storvsc_scsi_cmd_ok(struct scsi_cmnd *scmnd)
{
bool allowed = true;
@@ -1687,6 +1698,7 @@ static struct scsi_host_template scsi_dr
.bios_param = storvsc_get_chs,
.queuecommand = storvsc_queuecommand,
.eh_host_reset_handler = storvsc_host_reset_handler,
+ .eh_timed_out = storvsc_eh_timed_out,
.slave_alloc = storvsc_device_alloc,
.slave_destroy = storvsc_device_destroy,
.slave_configure = storvsc_device_configure,
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 048/158] Drivers: scsi: storvsc: Filter commands based on the storage protocol version
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 047/158] Drivers: scsi: storvsc: Implement a eh_timed_out handler Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 049/158] Drivers: scsi: storvsc: Change the limits to reflect the values on the host Greg Kroah-Hartman
` (110 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, K. Y. Srinivasan, Hannes Reinecke,
Christoph Hellwig
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "K. Y. Srinivasan" <kys@microsoft.com>
commit 8caf92d80526f3d7cc96831ec18b384ebcaccdf0 upstream.
Going forward it is possible that some of the commands that are not currently
implemented will be implemented on future Windows hosts. Even if they are not
implemented, we are told the host will corrrectly handle unsupported
commands (by returning appropriate return code and sense information).
Make command filtering depend on the host version.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/storvsc_drv.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1564,9 +1564,19 @@ static int storvsc_queuecommand(struct S
struct vmscsi_request *vm_srb;
struct stor_mem_pools *memp = scmnd->device->hostdata;
- if (!storvsc_scsi_cmd_ok(scmnd)) {
- scmnd->scsi_done(scmnd);
- return 0;
+ if (vmstor_current_major <= VMSTOR_WIN8_MAJOR) {
+ /*
+ * On legacy hosts filter unimplemented commands.
+ * Future hosts are expected to correctly handle
+ * unsupported commands. Furthermore, it is
+ * possible that some of the currently
+ * unsupported commands maybe supported in
+ * future versions of the host.
+ */
+ if (!storvsc_scsi_cmd_ok(scmnd)) {
+ scmnd->scsi_done(scmnd);
+ return 0;
+ }
}
request_size = sizeof(struct storvsc_cmd_request);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 049/158] Drivers: scsi: storvsc: Change the limits to reflect the values on the host
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 048/158] Drivers: scsi: storvsc: Filter commands based on the storage protocol version Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 050/158] Drivers: scsi: storvsc: Set cmd_per_lun to reflect value supported by the Host Greg Kroah-Hartman
` (109 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, K. Y. Srinivasan, Hannes Reinecke,
Christoph Hellwig
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "K. Y. Srinivasan" <kys@microsoft.com>
commit 4cd83ecdac20d30725b4f96e5d7814a1e290bc7e upstream.
Hyper-V hosts can support multiple targets and multiple channels and larger number of
LUNs per target. Update the code to reflect this. With this patch we can correctly
enumerate all the paths in a multi-path storage environment.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/storvsc_drv.c | 51 +++++++++++++++++++++++++++++----------------
1 file changed, 33 insertions(+), 18 deletions(-)
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -331,17 +331,17 @@ static int storvsc_timeout = 180;
static void storvsc_on_channel_callback(void *context);
-/*
- * In Hyper-V, each port/path/target maps to 1 scsi host adapter. In
- * reality, the path/target is not used (ie always set to 0) so our
- * scsi host adapter essentially has 1 bus with 1 target that contains
- * up to 256 luns.
- */
-#define STORVSC_MAX_LUNS_PER_TARGET 64
-#define STORVSC_MAX_TARGETS 1
-#define STORVSC_MAX_CHANNELS 1
-
-
+#define STORVSC_MAX_LUNS_PER_TARGET 255
+#define STORVSC_MAX_TARGETS 2
+#define STORVSC_MAX_CHANNELS 8
+
+#define STORVSC_FC_MAX_LUNS_PER_TARGET 255
+#define STORVSC_FC_MAX_TARGETS 128
+#define STORVSC_FC_MAX_CHANNELS 8
+
+#define STORVSC_IDE_MAX_LUNS_PER_TARGET 64
+#define STORVSC_IDE_MAX_TARGETS 1
+#define STORVSC_IDE_MAX_CHANNELS 1
struct storvsc_cmd_request {
struct list_head entry;
@@ -1713,7 +1713,6 @@ static struct scsi_host_template scsi_dr
.slave_destroy = storvsc_device_destroy,
.slave_configure = storvsc_device_configure,
.cmd_per_lun = 1,
- /* 64 max_queue * 1 target */
.can_queue = STORVSC_MAX_IO_REQUESTS*STORVSC_MAX_TARGETS,
.this_id = -1,
/* no use setting to 0 since ll_blk_rw reset it to 1 */
@@ -1778,6 +1777,9 @@ static int storvsc_probe(struct hv_devic
}
+ if (dev_id->driver_data == SFC_GUID)
+ scsi_driver.can_queue = (STORVSC_MAX_IO_REQUESTS *
+ STORVSC_FC_MAX_TARGETS);
host = scsi_host_alloc(&scsi_driver,
sizeof(struct hv_host_device));
if (!host)
@@ -1811,12 +1813,25 @@ static int storvsc_probe(struct hv_devic
host_dev->path = stor_device->path_id;
host_dev->target = stor_device->target_id;
- /* max # of devices per target */
- host->max_lun = STORVSC_MAX_LUNS_PER_TARGET;
- /* max # of targets per channel */
- host->max_id = STORVSC_MAX_TARGETS;
- /* max # of channels */
- host->max_channel = STORVSC_MAX_CHANNELS - 1;
+ switch (dev_id->driver_data) {
+ case SFC_GUID:
+ host->max_lun = STORVSC_FC_MAX_LUNS_PER_TARGET;
+ host->max_id = STORVSC_FC_MAX_TARGETS;
+ host->max_channel = STORVSC_FC_MAX_CHANNELS - 1;
+ break;
+
+ case SCSI_GUID:
+ host->max_lun = STORVSC_MAX_LUNS_PER_TARGET;
+ host->max_id = STORVSC_MAX_TARGETS;
+ host->max_channel = STORVSC_MAX_CHANNELS - 1;
+ break;
+
+ default:
+ host->max_lun = STORVSC_IDE_MAX_LUNS_PER_TARGET;
+ host->max_id = STORVSC_IDE_MAX_TARGETS;
+ host->max_channel = STORVSC_IDE_MAX_CHANNELS - 1;
+ break;
+ }
/* max cmd length */
host->max_cmd_len = STORVSC_MAX_CMD_LEN;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 050/158] Drivers: scsi: storvsc: Set cmd_per_lun to reflect value supported by the Host
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 049/158] Drivers: scsi: storvsc: Change the limits to reflect the values on the host Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 051/158] Drivers: scsi: storvsc: Fix a bug in handling VMBUS protocol version Greg Kroah-Hartman
` (108 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, K. Y. Srinivasan, Hannes Reinecke,
Christoph Hellwig
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "K. Y. Srinivasan" <kys@microsoft.com>
commit 52f9614dd8294e95d2c0929c2d4f64b077ae486f upstream.
Set cmd_per_lun to reflect value supported by the Host.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/storvsc_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1712,7 +1712,7 @@ static struct scsi_host_template scsi_dr
.slave_alloc = storvsc_device_alloc,
.slave_destroy = storvsc_device_destroy,
.slave_configure = storvsc_device_configure,
- .cmd_per_lun = 1,
+ .cmd_per_lun = 255,
.can_queue = STORVSC_MAX_IO_REQUESTS*STORVSC_MAX_TARGETS,
.this_id = -1,
/* no use setting to 0 since ll_blk_rw reset it to 1 */
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 051/158] Drivers: scsi: storvsc: Fix a bug in handling VMBUS protocol version
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 050/158] Drivers: scsi: storvsc: Set cmd_per_lun to reflect value supported by the Host Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 052/158] drivers: scsi: storvsc: Set srb_flags in all cases Greg Kroah-Hartman
` (107 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, K. Y. Srinivasan, Hannes Reinecke,
Christoph Hellwig
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "K. Y. Srinivasan" <kys@microsoft.com>
commit adb6f9e1a8c6af1037232b59edb11277471537ea upstream.
Based on the negotiated VMBUS protocol version, we adjust the size of the storage
protocol messages. The two sizes we currently handle are pre-win8 and post-win8.
In WS2012 R2, we are negotiating higher VMBUS protocol version than the win8
version. Make adjustments to correctly handle this.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/storvsc_drv.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1764,19 +1764,22 @@ static int storvsc_probe(struct hv_devic
* set state to properly communicate with the host.
*/
- if (vmbus_proto_version == VERSION_WIN8) {
- sense_buffer_size = POST_WIN7_STORVSC_SENSE_BUFFER_SIZE;
- vmscsi_size_delta = 0;
- vmstor_current_major = VMSTOR_WIN8_MAJOR;
- vmstor_current_minor = VMSTOR_WIN8_MINOR;
- } else {
+ switch (vmbus_proto_version) {
+ case VERSION_WS2008:
+ case VERSION_WIN7:
sense_buffer_size = PRE_WIN8_STORVSC_SENSE_BUFFER_SIZE;
vmscsi_size_delta = sizeof(struct vmscsi_win8_extension);
vmstor_current_major = VMSTOR_WIN7_MAJOR;
vmstor_current_minor = VMSTOR_WIN7_MINOR;
+ break;
+ default:
+ sense_buffer_size = POST_WIN7_STORVSC_SENSE_BUFFER_SIZE;
+ vmscsi_size_delta = 0;
+ vmstor_current_major = VMSTOR_WIN8_MAJOR;
+ vmstor_current_minor = VMSTOR_WIN8_MINOR;
+ break;
}
-
if (dev_id->driver_data == SFC_GUID)
scsi_driver.can_queue = (STORVSC_MAX_IO_REQUESTS *
STORVSC_FC_MAX_TARGETS);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 052/158] drivers: scsi: storvsc: Set srb_flags in all cases
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 051/158] Drivers: scsi: storvsc: Fix a bug in handling VMBUS protocol version Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 053/158] drivers: scsi: storvsc: Correctly handle TEST_UNIT_READY failure Greg Kroah-Hartman
` (106 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, K. Y. Srinivasan, Hannes Reinecke,
Christoph Hellwig
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "K. Y. Srinivasan" <kys@microsoft.com>
commit f885fb73f64154690c2158e813de56363389ffec upstream.
Correctly set SRB flags for all valid I/O directions. Some IHV drivers on the
Windows host require this. The host validates the command and SRB flags
prior to passing the command down to native driver stack.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/storvsc_drv.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1601,26 +1601,24 @@ static int storvsc_queuecommand(struct S
vm_srb = &cmd_request->vstor_packet.vm_srb;
vm_srb->win8_extension.time_out_value = 60;
+ vm_srb->win8_extension.srb_flags |=
+ (SRB_FLAGS_QUEUE_ACTION_ENABLE |
+ SRB_FLAGS_DISABLE_SYNCH_TRANSFER);
/* Build the SRB */
switch (scmnd->sc_data_direction) {
case DMA_TO_DEVICE:
vm_srb->data_in = WRITE_TYPE;
vm_srb->win8_extension.srb_flags |= SRB_FLAGS_DATA_OUT;
- vm_srb->win8_extension.srb_flags |=
- (SRB_FLAGS_QUEUE_ACTION_ENABLE |
- SRB_FLAGS_DISABLE_SYNCH_TRANSFER);
break;
case DMA_FROM_DEVICE:
vm_srb->data_in = READ_TYPE;
vm_srb->win8_extension.srb_flags |= SRB_FLAGS_DATA_IN;
- vm_srb->win8_extension.srb_flags |=
- (SRB_FLAGS_QUEUE_ACTION_ENABLE |
- SRB_FLAGS_DISABLE_SYNCH_TRANSFER);
break;
default:
vm_srb->data_in = UNKNOWN_TYPE;
- vm_srb->win8_extension.srb_flags = 0;
+ vm_srb->win8_extension.srb_flags |= (SRB_FLAGS_DATA_IN |
+ SRB_FLAGS_DATA_OUT);
break;
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 053/158] drivers: scsi: storvsc: Correctly handle TEST_UNIT_READY failure
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 052/158] drivers: scsi: storvsc: Set srb_flags in all cases Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 054/158] scsi_scan: Restrict sequential scan to 256 LUNs Greg Kroah-Hartman
` (105 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, K. Y. Srinivasan, Hannes Reinecke,
Christoph Hellwig
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "K. Y. Srinivasan" <kys@microsoft.com>
commit 3533f8603d28b77c62d75ec899449a99bc6b77a1 upstream.
On some Windows hosts on FC SANs, TEST_UNIT_READY can return SRB_STATUS_ERROR.
Correctly handle this. Note that there is sufficient sense information to
support scsi error handling even in this case.
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/storvsc_drv.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1018,6 +1018,13 @@ static void storvsc_handle_error(struct
case ATA_12:
set_host_byte(scmnd, DID_PASSTHROUGH);
break;
+ /*
+ * On Some Windows hosts TEST_UNIT_READY command can return
+ * SRB_STATUS_ERROR, let the upper level code deal with it
+ * based on the sense information.
+ */
+ case TEST_UNIT_READY:
+ break;
default:
set_host_byte(scmnd, DID_TARGET_FAILURE);
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 054/158] scsi_scan: Restrict sequential scan to 256 LUNs
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 053/158] drivers: scsi: storvsc: Correctly handle TEST_UNIT_READY failure Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 055/158] scsi: add a blacklist flag which enables VPD page inquiries Greg Kroah-Hartman
` (104 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hannes Reinecke, Ewan Milne,
Christoph Hellwig
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <hare@suse.de>
commit 22ffeb48b7584d6cd50f2a595ed6065d86a87459 upstream.
Sequential scan for more than 256 LUNs is very fragile as
LUNs might not be numbered sequentially after that point.
SAM revisions later than SCSI-3 impose a structure on
LUNs larger than 256, making LUN numbers between 256
and 16384 illegal.
SCSI-3, however allows for plain 64-bit numbers with
no internal structure.
So restrict sequential LUN scan to 256 LUNs and add a
new blacklist flag 'BLIST_SCSI3LUN' to scan up to
max_lun devices.
Signed-off-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Ewan Milne <emilne@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_scan.c | 6 ++++++
include/scsi/scsi_devinfo.h | 2 ++
2 files changed, 8 insertions(+)
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1239,6 +1239,12 @@ static void scsi_sequential_lun_scan(str
max_dev_lun = min(8U, max_dev_lun);
/*
+ * Stop scanning at 255 unless BLIST_SCSI3LUN
+ */
+ if (!(bflags & BLIST_SCSI3LUN))
+ max_dev_lun = min(256U, max_dev_lun);
+
+ /*
* We have already scanned LUN 0, so start at LUN 1. Keep scanning
* until we reach the max, or no LUN is found and we are not
* sparse_lun.
--- a/include/scsi/scsi_devinfo.h
+++ b/include/scsi/scsi_devinfo.h
@@ -32,4 +32,6 @@
#define BLIST_ATTACH_PQ3 0x1000000 /* Scan: Attach to PQ3 devices */
#define BLIST_NO_DIF 0x2000000 /* Disable T10 PI (DIF) */
#define BLIST_SKIP_VPD_PAGES 0x4000000 /* Ignore SBC-3 VPD pages */
+#define BLIST_SCSI3LUN 0x8000000 /* Scan more than 256 LUNs
+ for sequential scan */
#endif
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 055/158] scsi: add a blacklist flag which enables VPD page inquiries
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 054/158] scsi_scan: Restrict sequential scan to 256 LUNs Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 056/158] scsi: do not issue SCSI RSOC command to Promise Vtrak E610f Greg Kroah-Hartman
` (103 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, KY Srinivasan, Martin K. Petersen,
Christoph Hellwig
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Martin K. Petersen" <martin.petersen@oracle.com>
commit c1d40a527e885a40bb9ea6c46a1b1145d42b66a0 upstream.
Despite supporting modern SCSI features some storage devices continue to
claim conformance to an older version of the SPC spec. This is done for
compatibility with legacy operating systems.
Linux by default will not attempt to read VPD pages on devices that
claim SPC-2 or older. Introduce a blacklist flag that can be used to
trigger VPD page inquiries on devices that are known to support them.
Reported-by: KY Srinivasan <kys@microsoft.com>
Tested-by: KY Srinivasan <kys@microsoft.com>
Reviewed-by: KY Srinivasan <kys@microsoft.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_scan.c | 4 +++-
drivers/scsi/sd.c | 5 +++++
include/scsi/scsi_device.h | 1 +
include/scsi/scsi_devinfo.h | 1 +
4 files changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -950,7 +950,9 @@ static int scsi_add_lun(struct scsi_devi
sdev->eh_timeout = SCSI_DEFAULT_EH_TIMEOUT;
- if (*bflags & BLIST_SKIP_VPD_PAGES)
+ if (*bflags & BLIST_TRY_VPD_PAGES)
+ sdev->try_vpd_pages = 1;
+ else if (*bflags & BLIST_SKIP_VPD_PAGES)
sdev->skip_vpd_pages = 1;
transport_configure_device(&sdev->sdev_gendev);
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2681,6 +2681,11 @@ static void sd_read_write_same(struct sc
static int sd_try_extended_inquiry(struct scsi_device *sdp)
{
+ /* Attempt VPD inquiry if the device blacklist explicitly calls
+ * for it.
+ */
+ if (sdp->try_vpd_pages)
+ return 1;
/*
* Although VPD inquiries can go to SCSI-2 type devices,
* some USB ones crash on receiving them, and the pages
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -155,6 +155,7 @@ struct scsi_device {
unsigned skip_ms_page_8:1; /* do not use MODE SENSE page 0x08 */
unsigned skip_ms_page_3f:1; /* do not use MODE SENSE page 0x3f */
unsigned skip_vpd_pages:1; /* do not read VPD pages */
+ unsigned try_vpd_pages:1; /* attempt to read VPD pages */
unsigned use_192_bytes_for_3f:1; /* ask for 192 bytes from page 0x3f */
unsigned no_start_on_add:1; /* do not issue start on add */
unsigned allow_restart:1; /* issue START_UNIT in error handler */
--- a/include/scsi/scsi_devinfo.h
+++ b/include/scsi/scsi_devinfo.h
@@ -34,4 +34,5 @@
#define BLIST_SKIP_VPD_PAGES 0x4000000 /* Ignore SBC-3 VPD pages */
#define BLIST_SCSI3LUN 0x8000000 /* Scan more than 256 LUNs
for sequential scan */
+#define BLIST_TRY_VPD_PAGES 0x10000000 /* Attempt to read VPD pages */
#endif
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 056/158] scsi: do not issue SCSI RSOC command to Promise Vtrak E610f
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 055/158] scsi: add a blacklist flag which enables VPD page inquiries Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 057/158] scsi_transport_srp: Fix fast_io_fail_tmo=dev_loss_tmo=off behavior Greg Kroah-Hartman
` (102 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Janusz Dziemidowicz,
Martin K. Petersen, Christoph Hellwig
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janusz Dziemidowicz <rraptorr@nails.eu.org>
commit 0213436a2cc5e4a5ca2fabfaa4d3877097f3b13f upstream.
Some devices don't like REPORT SUPPORTED OPERATION CODES and will
simply timeout causing sd_mod init to take a very very long time.
Introduce BLIST_NO_RSOC scsi scan flag, that stops RSOC from being
issued. Add it to Promise Vtrak E610f entry in scsi scan
blacklist. Fixes bug #79901 reported at
https://bugzilla.kernel.org/show_bug.cgi?id=79901
Fixes: 98dcc2946adb ("SCSI: sd: Update WRITE SAME heuristics")
Signed-off-by: Janusz Dziemidowicz <rraptorr@nails.eu.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_devinfo.c | 1 +
drivers/scsi/scsi_scan.c | 6 ++++++
include/scsi/scsi_devinfo.h | 2 ++
3 files changed, 9 insertions(+)
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -222,6 +222,7 @@ static struct {
{"PIONEER", "CD-ROM DRM-602X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
{"PIONEER", "CD-ROM DRM-604X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
{"PIONEER", "CD-ROM DRM-624X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
+ {"Promise", "VTrak E610f", NULL, BLIST_SPARSELUN | BLIST_NO_RSOC},
{"Promise", "", NULL, BLIST_SPARSELUN},
{"QUANTUM", "XP34301", "1071", BLIST_NOTQ},
{"REGAL", "CDC-4X", NULL, BLIST_MAX5LUN | BLIST_SINGLELUN},
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -922,6 +922,12 @@ static int scsi_add_lun(struct scsi_devi
if (*bflags & BLIST_USE_10_BYTE_MS)
sdev->use_10_for_ms = 1;
+ /* some devices don't like REPORT SUPPORTED OPERATION CODES
+ * and will simply timeout causing sd_mod init to take a very
+ * very long time */
+ if (*bflags & BLIST_NO_RSOC)
+ sdev->no_report_opcodes = 1;
+
/* set the device running here so that slave configure
* may do I/O */
ret = scsi_device_set_state(sdev, SDEV_RUNNING);
--- a/include/scsi/scsi_devinfo.h
+++ b/include/scsi/scsi_devinfo.h
@@ -35,4 +35,6 @@
#define BLIST_SCSI3LUN 0x8000000 /* Scan more than 256 LUNs
for sequential scan */
#define BLIST_TRY_VPD_PAGES 0x10000000 /* Attempt to read VPD pages */
+#define BLIST_NO_RSOC 0x20000000 /* don't try to issue RSOC */
+
#endif
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 057/158] scsi_transport_srp: Fix fast_io_fail_tmo=dev_loss_tmo=off behavior
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 056/158] scsi: do not issue SCSI RSOC command to Promise Vtrak E610f Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 058/158] SCSI: save command pool address of Scsi_Host Greg Kroah-Hartman
` (101 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Sagi Grimberg,
David Dillow, Roland Dreier
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
commit cd53eb686d2418eda938aad3c9da42b7dfa9351f upstream.
If scsi_remove_host() is called while an rport is in the blocked state
then scsi_remove_host() will only finish if the rport is unblocked
from inside a timer function. Make sure that an rport only enters the
blocked state if a timer will be started that will unblock it. This
avoids that unloading the ib_srp kernel module after having
disconnected the initiator from the target system results in a
deadlock if both the fast_io_fail_tmo and dev_loss_tmo parameters have
been set to "off".
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
Reviewed-by: David Dillow <dave@thedillows.org>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_transport_srp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/scsi/scsi_transport_srp.c
+++ b/drivers/scsi/scsi_transport_srp.c
@@ -473,7 +473,8 @@ static void __srp_start_tl_fail_timers(s
if (delay > 0)
queue_delayed_work(system_long_wq, &rport->reconnect_work,
1UL * delay * HZ);
- if (srp_rport_set_state(rport, SRP_RPORT_BLOCKED) == 0) {
+ if ((fast_io_fail_tmo >= 0 || dev_loss_tmo >= 0) &&
+ srp_rport_set_state(rport, SRP_RPORT_BLOCKED) == 0) {
pr_debug("%s new state: %d\n", dev_name(&shost->shost_gendev),
rport->state);
scsi_target_block(&shost->shost_gendev);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 058/158] SCSI: save command pool address of Scsi_Host
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 057/158] scsi_transport_srp: Fix fast_io_fail_tmo=dev_loss_tmo=off behavior Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 059/158] fix regression in SCSI_IOCTL_SEND_COMMAND Greg Kroah-Hartman
` (100 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Juergen Gross, Hannes Reinecke,
Christoph Hellwig, James Bottomley
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <jgross@suse.com>
commit f6105c0808880c2c432b79bc81b37cc244c300c8 upstream.
If a scsi host driver specifies .cmd_len in it's scsi_host_template, a driver's
private command pool is needed. scsi_find_host_cmd_pool() will locate it, but
scsi_alloc_host_cmd_pool() isn't saving the pool address in the host template.
This will result in an access error when the host is removed.
Avoid the problem by saving the address of a new allocated command pool where
it is expected.
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Fixes: 89d9a567952baec13e26ada3e438f1b642d66b6e
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -380,6 +380,10 @@ scsi_alloc_host_cmd_pool(struct Scsi_Hos
pool->slab_flags |= SLAB_CACHE_DMA;
pool->gfp_mask = __GFP_DMA;
}
+
+ if (hostt->cmd_size)
+ hostt->cmd_pool = pool;
+
return pool;
}
@@ -424,8 +428,10 @@ out:
out_free_slab:
kmem_cache_destroy(pool->cmd_slab);
out_free_pool:
- if (hostt->cmd_size)
+ if (hostt->cmd_size) {
scsi_free_host_cmd_pool(pool);
+ hostt->cmd_pool = NULL;
+ }
goto out;
}
@@ -447,8 +453,10 @@ static void scsi_put_host_cmd_pool(struc
if (!--pool->users) {
kmem_cache_destroy(pool->cmd_slab);
kmem_cache_destroy(pool->sense_slab);
- if (hostt->cmd_size)
+ if (hostt->cmd_size) {
scsi_free_host_cmd_pool(pool);
+ hostt->cmd_pool = NULL;
+ }
}
mutex_unlock(&host_cmd_pool_mutex);
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 059/158] fix regression in SCSI_IOCTL_SEND_COMMAND
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 058/158] SCSI: save command pool address of Scsi_Host Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:24 ` [PATCH 3.16 060/158] MIPS: GIC: Prevent array overrun Greg Kroah-Hartman
` (99 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tony Battersby, Jens Axboe
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Battersby <tonyb@cybernetics.com>
commit 2ba136daa3ae1e881c9f586f283fcaa164767dce upstream.
blk_rq_set_block_pc() memsets rq->cmd to 0, so it should come
immediately after blk_get_request() to avoid overwriting the
user-supplied CDB. Also check for failure to allocate rq.
Fixes: f27b087b81b7 ("block: add blk_rq_set_block_pc()")
Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/scsi_ioctl.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -438,6 +438,11 @@ int sg_scsi_ioctl(struct request_queue *
}
rq = blk_get_request(q, in_len ? WRITE : READ, __GFP_WAIT);
+ if (!rq) {
+ err = -ENOMEM;
+ goto error;
+ }
+ blk_rq_set_block_pc(rq);
cmdlen = COMMAND_SIZE(opcode);
@@ -491,7 +496,6 @@ int sg_scsi_ioctl(struct request_queue *
memset(sense, 0, sizeof(sense));
rq->sense = sense;
rq->sense_len = 0;
- blk_rq_set_block_pc(rq);
blk_execute_rq(q, disk, rq, 0);
@@ -511,7 +515,8 @@ out:
error:
kfree(buffer);
- blk_put_request(rq);
+ if (rq)
+ blk_put_request(rq);
return err;
}
EXPORT_SYMBOL_GPL(sg_scsi_ioctl);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 060/158] MIPS: GIC: Prevent array overrun
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 059/158] fix regression in SCSI_IOCTL_SEND_COMMAND Greg Kroah-Hartman
@ 2014-09-15 19:24 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 061/158] MIPS: O32/32-bit: Fix bug which can cause incorrect system call restarts Greg Kroah-Hartman
` (98 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:24 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jeffrey Deans, Markos Chandras,
linux-mips, Ralf Baechle
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffrey Deans <jeffrey.deans@imgtec.com>
commit ffc8415afab20bd97754efae6aad1f67b531132b upstream.
A GIC interrupt which is declared as having a GIC_MAP_TO_NMI_MSK
mapping causes the cpu parameter to gic_setup_intr() to be increased
to 32, causing memory corruption when pcpu_masks[] is written to again
later in the function.
Signed-off-by: Jeffrey Deans <jeffrey.deans@imgtec.com>
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7375/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/irq-gic.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/arch/mips/kernel/irq-gic.c
+++ b/arch/mips/kernel/irq-gic.c
@@ -269,11 +269,13 @@ static void __init gic_setup_intr(unsign
/* Setup Intr to Pin mapping */
if (pin & GIC_MAP_TO_NMI_MSK) {
+ int i;
+
GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_MAP_TO_PIN(intr)), pin);
/* FIXME: hack to route NMI to all cpu's */
- for (cpu = 0; cpu < NR_CPUS; cpu += 32) {
+ for (i = 0; i < NR_CPUS; i += 32) {
GICWRITE(GIC_REG_ADDR(SHARED,
- GIC_SH_MAP_TO_VPE_REG_OFF(intr, cpu)),
+ GIC_SH_MAP_TO_VPE_REG_OFF(intr, i)),
0xffffffff);
}
} else {
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 061/158] MIPS: O32/32-bit: Fix bug which can cause incorrect system call restarts
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2014-09-15 19:24 ` [PATCH 3.16 060/158] MIPS: GIC: Prevent array overrun Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 062/158] MIPS: ptrace: Test correct tasks flags in task_user_regset_view() Greg Kroah-Hartman
` (97 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Smith, Aurelien Jarno,
linux-mips, Ralf Baechle
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Smith <alex.smith@imgtec.com>
commit e90e6fddc57055c4c6b57f92787fea1c065d440b upstream.
On 32-bit/O32, pt_regs has a padding area at the beginning into which the
syscall arguments passed via the user stack are copied. 4 arguments
totalling 16 bytes are copied to offset 16 bytes into this area, however
the area is only 24 bytes long. This means the last 2 arguments overwrite
pt_regs->regs[{0,1}].
If a syscall function returns an error, handle_sys stores the original
syscall number in pt_regs->regs[0] for syscall restart. signal.c checks
whether regs[0] is non-zero, if it is it will check whether the syscall
return value is one of the ERESTART* codes to see if it must be
restarted.
Should a syscall be made that results in a non-zero value being copied
off the user stack into regs[0], and then returns a positive (non-error)
value that matches one of the ERESTART* error codes, this can be mistaken
for requiring a syscall restart.
While the possibility for this to occur has always existed, it is made
much more likely to occur by commit 46e12c07b3b9 ("MIPS: O32 / 32-bit:
Always copy 4 stack arguments."), since now every syscall will copy 4
arguments and overwrite regs[0], rather than just those with 7 or 8
arguments.
Since that commit, booting Debian under a 32-bit MIPS kernel almost
always results in a hang early in boot, due to a wait4 syscall returning
a PID that matches one of the ERESTART* codes, which then causes an
incorrect restart of the syscall.
The problem is fixed by increasing the size of the padding area so that
arguments copied off the stack will not overwrite pt_regs->regs[{0,1}].
Signed-off-by: Alex Smith <alex.smith@imgtec.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Tested-by: Aurelien Jarno <aurelien@aurel32.net>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7454/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/include/asm/ptrace.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/mips/include/asm/ptrace.h
+++ b/arch/mips/include/asm/ptrace.h
@@ -23,7 +23,7 @@
struct pt_regs {
#ifdef CONFIG_32BIT
/* Pad bytes for argument save space on the stack. */
- unsigned long pad0[6];
+ unsigned long pad0[8];
#endif
/* Saved main processor registers. */
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 062/158] MIPS: ptrace: Test correct tasks flags in task_user_regset_view()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 061/158] MIPS: O32/32-bit: Fix bug which can cause incorrect system call restarts Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 063/158] MIPS: ptrace: Change GP regset to use correct core dump register layout Greg Kroah-Hartman
` (96 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Smith, linux-mips, Ralf Baechle
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Smith <alex@alex-smith.me.uk>
commit 65768a1a92cb12cbba87588927cf597a65d560aa upstream.
task_user_regset_view() should test for TIF_32BIT_REGS in the flags of
the specified task, not of the current task.
Signed-off-by: Alex Smith <alex@alex-smith.me.uk>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7450/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/ptrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -398,7 +398,7 @@ const struct user_regset_view *task_user
#endif
#ifdef CONFIG_MIPS32_O32
- if (test_thread_flag(TIF_32BIT_REGS))
+ if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
return &user_mips_view;
#endif
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 063/158] MIPS: ptrace: Change GP regset to use correct core dump register layout
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 062/158] MIPS: ptrace: Test correct tasks flags in task_user_regset_view() Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 064/158] MIPS: ptrace: Avoid smp_processor_id() when retrieving FPU IR Greg Kroah-Hartman
` (95 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Smith, linux-mips, Ralf Baechle
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Smith <alex@alex-smith.me.uk>
commit c23b3d1a53119849dc3c23c417124deb067aa33d upstream.
Commit 6a9c001b7ec3 ("MIPS: Switch ELF core dumper to use regsets.")
switched the core dumper to use regsets, however the GP regset code
simply makes a direct copy of the kernel's pt_regs, which does not
match the original core dump register layout as defined in asm/reg.h.
Furthermore, the definition of pt_regs can vary with certain Kconfig
variables, therefore the GP regset can never be relied upon to return
registers in the same layout.
Therefore, this patch changes the GP regset to match the original core
dump layout. The layout differs for 32- and 64-bit processes, so
separate implementations of the get/set functions are added for the
32- and 64-bit regsets.
Signed-off-by: Alex Smith <alex@alex-smith.me.uk>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7452/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/ptrace.c | 189 ++++++++++++++++++++++++++++++++++++++--------
1 file changed, 160 insertions(+), 29 deletions(-)
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -246,36 +246,160 @@ int ptrace_set_watch_regs(struct task_st
/* regset get/set implementations */
-static int gpr_get(struct task_struct *target,
- const struct user_regset *regset,
- unsigned int pos, unsigned int count,
- void *kbuf, void __user *ubuf)
+#if defined(CONFIG_32BIT) || defined(CONFIG_MIPS32_O32)
+
+static int gpr32_get(struct task_struct *target,
+ const struct user_regset *regset,
+ unsigned int pos, unsigned int count,
+ void *kbuf, void __user *ubuf)
{
struct pt_regs *regs = task_pt_regs(target);
+ u32 uregs[ELF_NGREG] = {};
+ unsigned i;
+
+ for (i = MIPS32_EF_R1; i <= MIPS32_EF_R31; i++) {
+ /* k0/k1 are copied as zero. */
+ if (i == MIPS32_EF_R26 || i == MIPS32_EF_R27)
+ continue;
- return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
- regs, 0, sizeof(*regs));
+ uregs[i] = regs->regs[i - MIPS32_EF_R0];
+ }
+
+ uregs[MIPS32_EF_LO] = regs->lo;
+ uregs[MIPS32_EF_HI] = regs->hi;
+ uregs[MIPS32_EF_CP0_EPC] = regs->cp0_epc;
+ uregs[MIPS32_EF_CP0_BADVADDR] = regs->cp0_badvaddr;
+ uregs[MIPS32_EF_CP0_STATUS] = regs->cp0_status;
+ uregs[MIPS32_EF_CP0_CAUSE] = regs->cp0_cause;
+
+ return user_regset_copyout(&pos, &count, &kbuf, &ubuf, uregs, 0,
+ sizeof(uregs));
}
-static int gpr_set(struct task_struct *target,
- const struct user_regset *regset,
- unsigned int pos, unsigned int count,
- const void *kbuf, const void __user *ubuf)
+static int gpr32_set(struct task_struct *target,
+ const struct user_regset *regset,
+ unsigned int pos, unsigned int count,
+ const void *kbuf, const void __user *ubuf)
+{
+ struct pt_regs *regs = task_pt_regs(target);
+ u32 uregs[ELF_NGREG];
+ unsigned start, num_regs, i;
+ int err;
+
+ start = pos / sizeof(u32);
+ num_regs = count / sizeof(u32);
+
+ if (start + num_regs > ELF_NGREG)
+ return -EIO;
+
+ err = user_regset_copyin(&pos, &count, &kbuf, &ubuf, uregs, 0,
+ sizeof(uregs));
+ if (err)
+ return err;
+
+ for (i = start; i < num_regs; i++) {
+ /*
+ * Cast all values to signed here so that if this is a 64-bit
+ * kernel, the supplied 32-bit values will be sign extended.
+ */
+ switch (i) {
+ case MIPS32_EF_R1 ... MIPS32_EF_R25:
+ /* k0/k1 are ignored. */
+ case MIPS32_EF_R28 ... MIPS32_EF_R31:
+ regs->regs[i - MIPS32_EF_R0] = (s32)uregs[i];
+ break;
+ case MIPS32_EF_LO:
+ regs->lo = (s32)uregs[i];
+ break;
+ case MIPS32_EF_HI:
+ regs->hi = (s32)uregs[i];
+ break;
+ case MIPS32_EF_CP0_EPC:
+ regs->cp0_epc = (s32)uregs[i];
+ break;
+ }
+ }
+
+ return 0;
+}
+
+#endif /* CONFIG_32BIT || CONFIG_MIPS32_O32 */
+
+#ifdef CONFIG_64BIT
+
+static int gpr64_get(struct task_struct *target,
+ const struct user_regset *regset,
+ unsigned int pos, unsigned int count,
+ void *kbuf, void __user *ubuf)
{
- struct pt_regs newregs;
- int ret;
+ struct pt_regs *regs = task_pt_regs(target);
+ u64 uregs[ELF_NGREG] = {};
+ unsigned i;
- ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
- &newregs,
- 0, sizeof(newregs));
- if (ret)
- return ret;
+ for (i = MIPS64_EF_R1; i <= MIPS64_EF_R31; i++) {
+ /* k0/k1 are copied as zero. */
+ if (i == MIPS64_EF_R26 || i == MIPS64_EF_R27)
+ continue;
+
+ uregs[i] = regs->regs[i - MIPS64_EF_R0];
+ }
- *task_pt_regs(target) = newregs;
+ uregs[MIPS64_EF_LO] = regs->lo;
+ uregs[MIPS64_EF_HI] = regs->hi;
+ uregs[MIPS64_EF_CP0_EPC] = regs->cp0_epc;
+ uregs[MIPS64_EF_CP0_BADVADDR] = regs->cp0_badvaddr;
+ uregs[MIPS64_EF_CP0_STATUS] = regs->cp0_status;
+ uregs[MIPS64_EF_CP0_CAUSE] = regs->cp0_cause;
+
+ return user_regset_copyout(&pos, &count, &kbuf, &ubuf, uregs, 0,
+ sizeof(uregs));
+}
+
+static int gpr64_set(struct task_struct *target,
+ const struct user_regset *regset,
+ unsigned int pos, unsigned int count,
+ const void *kbuf, const void __user *ubuf)
+{
+ struct pt_regs *regs = task_pt_regs(target);
+ u64 uregs[ELF_NGREG];
+ unsigned start, num_regs, i;
+ int err;
+
+ start = pos / sizeof(u64);
+ num_regs = count / sizeof(u64);
+
+ if (start + num_regs > ELF_NGREG)
+ return -EIO;
+
+ err = user_regset_copyin(&pos, &count, &kbuf, &ubuf, uregs, 0,
+ sizeof(uregs));
+ if (err)
+ return err;
+
+ for (i = start; i < num_regs; i++) {
+ switch (i) {
+ case MIPS64_EF_R1 ... MIPS64_EF_R25:
+ /* k0/k1 are ignored. */
+ case MIPS64_EF_R28 ... MIPS64_EF_R31:
+ regs->regs[i - MIPS64_EF_R0] = uregs[i];
+ break;
+ case MIPS64_EF_LO:
+ regs->lo = uregs[i];
+ break;
+ case MIPS64_EF_HI:
+ regs->hi = uregs[i];
+ break;
+ case MIPS64_EF_CP0_EPC:
+ regs->cp0_epc = uregs[i];
+ break;
+ }
+ }
return 0;
}
+#endif /* CONFIG_64BIT */
+
static int fpr_get(struct task_struct *target,
const struct user_regset *regset,
unsigned int pos, unsigned int count,
@@ -337,14 +461,16 @@ enum mips_regset {
REGSET_FPR,
};
+#if defined(CONFIG_32BIT) || defined(CONFIG_MIPS32_O32)
+
static const struct user_regset mips_regsets[] = {
[REGSET_GPR] = {
.core_note_type = NT_PRSTATUS,
.n = ELF_NGREG,
.size = sizeof(unsigned int),
.align = sizeof(unsigned int),
- .get = gpr_get,
- .set = gpr_set,
+ .get = gpr32_get,
+ .set = gpr32_set,
},
[REGSET_FPR] = {
.core_note_type = NT_PRFPREG,
@@ -364,14 +490,18 @@ static const struct user_regset_view use
.n = ARRAY_SIZE(mips_regsets),
};
+#endif /* CONFIG_32BIT || CONFIG_MIPS32_O32 */
+
+#ifdef CONFIG_64BIT
+
static const struct user_regset mips64_regsets[] = {
[REGSET_GPR] = {
.core_note_type = NT_PRSTATUS,
.n = ELF_NGREG,
.size = sizeof(unsigned long),
.align = sizeof(unsigned long),
- .get = gpr_get,
- .set = gpr_set,
+ .get = gpr64_get,
+ .set = gpr64_set,
},
[REGSET_FPR] = {
.core_note_type = NT_PRFPREG,
@@ -384,25 +514,26 @@ static const struct user_regset mips64_r
};
static const struct user_regset_view user_mips64_view = {
- .name = "mips",
+ .name = "mips64",
.e_machine = ELF_ARCH,
.ei_osabi = ELF_OSABI,
.regsets = mips64_regsets,
- .n = ARRAY_SIZE(mips_regsets),
+ .n = ARRAY_SIZE(mips64_regsets),
};
+#endif /* CONFIG_64BIT */
+
const struct user_regset_view *task_user_regset_view(struct task_struct *task)
{
#ifdef CONFIG_32BIT
return &user_mips_view;
-#endif
-
+#else
#ifdef CONFIG_MIPS32_O32
- if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
- return &user_mips_view;
+ if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
+ return &user_mips_view;
#endif
-
return &user_mips64_view;
+#endif
}
long arch_ptrace(struct task_struct *child, long request,
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 064/158] MIPS: ptrace: Avoid smp_processor_id() when retrieving FPU IR
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 063/158] MIPS: ptrace: Change GP regset to use correct core dump register layout Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 065/158] MIPS: smp-mt: Fix link error when PROC_FS=n Greg Kroah-Hartman
` (94 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Smith, linux-mips, Ralf Baechle
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Smith <alex@alex-smith.me.uk>
commit 656ff9bef08c19a6471b49528dacb4cbbeb1e537 upstream.
Whenever ptrace attempts to retrieve the FPU implementation register it
accesses it through current_cpu_data, which calls smp_processor_id().
Since the code may execute with preemption enabled, this can trigger
a warning. Fix this by using boot_cpu_data to get the IR instead.
Signed-off-by: Alex Smith <alex@alex-smith.me.uk>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7449/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/ptrace.c | 4 ++--
arch/mips/kernel/ptrace32.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -129,7 +129,7 @@ int ptrace_getfpregs(struct task_struct
}
__put_user(child->thread.fpu.fcr31, data + 64);
- __put_user(current_cpu_data.fpu_id, data + 65);
+ __put_user(boot_cpu_data.fpu_id, data + 65);
return 0;
}
@@ -611,7 +611,7 @@ long arch_ptrace(struct task_struct *chi
break;
case FPC_EIR:
/* implementation / version register */
- tmp = current_cpu_data.fpu_id;
+ tmp = boot_cpu_data.fpu_id;
break;
case DSP_BASE ... DSP_BASE + 5: {
dspreg_t *dregs;
--- a/arch/mips/kernel/ptrace32.c
+++ b/arch/mips/kernel/ptrace32.c
@@ -129,7 +129,7 @@ long compat_arch_ptrace(struct task_stru
break;
case FPC_EIR:
/* implementation / version register */
- tmp = current_cpu_data.fpu_id;
+ tmp = boot_cpu_data.fpu_id;
break;
case DSP_BASE ... DSP_BASE + 5: {
dspreg_t *dregs;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 065/158] MIPS: smp-mt: Fix link error when PROC_FS=n
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 064/158] MIPS: ptrace: Avoid smp_processor_id() when retrieving FPU IR Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 066/158] MIPS: Prevent user from setting FCSR cause bits Greg Kroah-Hartman
` (93 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Hogan, Markos Chandras,
Ralf Baechle, linux-mips
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <james.hogan@imgtec.com>
commit 7d907fa1c6ccb64c7f64cc7d3dcc7f6fe30a67b4 upstream.
Commit d6d3c9afaab4 (MIPS: MT: proc: Add support for printing VPE and TC
ids) causes a link error when CONFIG_PROC_FS=n:
arch/mips/built-in.o: In function `proc_cpuinfo_notifier_init':
smp-mt.c: undefined reference to `register_proc_cpuinfo_notifier'
This is fixed by adding an ifdef around the procfs handling code
in smp-mt.c.
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Reported-by: Markos Chandras <markos.chandras@imgtec.com>
Reviewed-by: Markos Chandras <markos.chandras@imgtec.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7244/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/smp-mt.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/mips/kernel/smp-mt.c
+++ b/arch/mips/kernel/smp-mt.c
@@ -288,6 +288,7 @@ struct plat_smp_ops vsmp_smp_ops = {
.prepare_cpus = vsmp_prepare_cpus,
};
+#ifdef CONFIG_PROC_FS
static int proc_cpuinfo_chain_call(struct notifier_block *nfb,
unsigned long action_unused, void *data)
{
@@ -309,3 +310,4 @@ static int __init proc_cpuinfo_notifier_
}
subsys_initcall(proc_cpuinfo_notifier_init);
+#endif
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 066/158] MIPS: Prevent user from setting FCSR cause bits
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 065/158] MIPS: smp-mt: Fix link error when PROC_FS=n Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 067/158] MIPS: tlbex: Fix a missing statement for HUGETLB Greg Kroah-Hartman
` (92 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Burton, linux-mips, Ralf Baechle
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Burton <paul.burton@imgtec.com>
commit b1442d39fac2fcfbe6a4814979020e993ca59c9e upstream.
If one or more matching FCSR cause & enable bits are set in saved thread
context then when that context is restored the kernel will take an FP
exception. This is of course undesirable and considered an oops, leading
to the kernel writing a backtrace to the console and potentially
rebooting depending upon the configuration. Thus the kernel avoids this
situation by clearing the cause bits of the FCSR register when handling
FP exceptions and after emulating FP instructions.
However the kernel does not prevent userland from setting arbitrary FCSR
cause & enable bits via ptrace, using either the PTRACE_POKEUSR or
PTRACE_SETFPREGS requests. This means userland can trivially cause the
kernel to oops on any system with an FPU. Prevent this from happening
by clearing the cause bits when writing to the saved FCSR context via
ptrace.
This problem appears to exist at least back to the beginning of the git
era in the PTRACE_POKEUSR case.
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: stable@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/7438/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/ptrace.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -151,6 +151,7 @@ int ptrace_setfpregs(struct task_struct
}
__get_user(child->thread.fpu.fcr31, data + 64);
+ child->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
/* FIR may not be written. */
@@ -696,7 +697,7 @@ long arch_ptrace(struct task_struct *chi
break;
#endif
case FPC_CSR:
- child->thread.fpu.fcr31 = data;
+ child->thread.fpu.fcr31 = data & ~FPU_CSR_ALL_X;
break;
case DSP_BASE ... DSP_BASE + 5: {
dspreg_t *dregs;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 067/158] MIPS: tlbex: Fix a missing statement for HUGETLB
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 066/158] MIPS: Prevent user from setting FCSR cause bits Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 068/158] MIPS: Remove BUG_ON(!is_fpu_owner()) in do_ade() Greg Kroah-Hartman
` (91 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Huacai Chen, Binbin Zhou,
John Crispin, Steven J. Hill, linux-mips, Fuxin Zhang,
Zhangjin Wu, Ralf Baechle
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhc@lemote.com>
commit 8393c524a25609a30129e4a8975cf3b91f6c16a5 upstream.
In commit 2c8c53e28f1 (MIPS: Optimize TLB handlers for Octeon CPUs)
build_r4000_tlb_refill_handler() is modified. But it doesn't compatible
with the original code in HUGETLB case. Because there is a copy & paste
error and one line of code is missing. It is very easy to produce a bug
with LTP's hugemmap05 test.
Signed-off-by: Huacai Chen <chenhc@lemote.com>
Signed-off-by: Binbin Zhou <zhoubb@lemote.com>
Cc: John Crispin <john@phrozen.org>
Cc: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: Fuxin Zhang <zhangfx@lemote.com>
Cc: Zhangjin Wu <wuzhangjin@gmail.com>
Patchwork: https://patchwork.linux-mips.org/patch/7496/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/mm/tlbex.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -1299,6 +1299,7 @@ static void build_r4000_tlb_refill_handl
}
#ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
uasm_l_tlb_huge_update(&l, p);
+ UASM_i_LW(&p, K0, 0, K1);
build_huge_update_entries(&p, htlb_info.huge_pte, K1);
build_huge_tlb_write_entry(&p, &l, &r, K0, tlb_random,
htlb_info.restore_scratch);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 068/158] MIPS: Remove BUG_ON(!is_fpu_owner()) in do_ade()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 067/158] MIPS: tlbex: Fix a missing statement for HUGETLB Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 069/158] MIPS: asm/reg.h: Make 32- and 64-bit definitions available at the same time Greg Kroah-Hartman
` (90 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Huacai Chen, Jie Chen, Rui Wang,
John Crispin, Steven J. Hill, linux-mips, Fuxin Zhang,
Zhangjin Wu, Ralf Baechle
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhc@lemote.com>
commit 2e5767a27337812f6850b3fa362419e2f085e5c3 upstream.
In do_ade(), is_fpu_owner() isn't preempt-safe. For example, when an
unaligned ldc1 is executed, do_cpu() is called and then FPU will be
enabled (and TIF_USEDFPU will be set for the current process). Then,
do_ade() is called because the access is unaligned. If the current
process is preempted at this time, TIF_USEDFPU will be cleard. So when
the process is scheduled again, BUG_ON(!is_fpu_owner()) is triggered.
This small program can trigger this BUG in a preemptible kernel:
int main (int argc, char *argv[])
{
double u64[2];
while (1) {
asm volatile (
".set push \n\t"
".set noreorder \n\t"
"ldc1 $f3, 4(%0) \n\t"
".set pop \n\t"
::"r"(u64):
);
}
return 0;
}
V2: Remove the BUG_ON() unconditionally due to Paul's suggestion.
Signed-off-by: Huacai Chen <chenhc@lemote.com>
Signed-off-by: Jie Chen <chenj@lemote.com>
Signed-off-by: Rui Wang <wangr@lemote.com>
Cc: John Crispin <john@phrozen.org>
Cc: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: Fuxin Zhang <zhangfx@lemote.com>
Cc: Zhangjin Wu <wuzhangjin@gmail.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/unaligned.c | 1 -
1 file changed, 1 deletion(-)
--- a/arch/mips/kernel/unaligned.c
+++ b/arch/mips/kernel/unaligned.c
@@ -690,7 +690,6 @@ static void emulate_load_store_insn(stru
case sdc1_op:
die_if_kernel("Unaligned FP access in kernel code", regs);
BUG_ON(!used_math());
- BUG_ON(!is_fpu_owner());
lose_fpu(1); /* Save FPU state for the emulator. */
res = fpu_emulator_cop1Handler(regs, ¤t->thread.fpu, 1,
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 069/158] MIPS: asm/reg.h: Make 32- and 64-bit definitions available at the same time
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 068/158] MIPS: Remove BUG_ON(!is_fpu_owner()) in do_ade() Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 070/158] MIPS: syscall: Fix AUDIT value for O32 processes on MIPS64 Greg Kroah-Hartman
` (89 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Smith, linux-mips, Ralf Baechle
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Smith <alex@alex-smith.me.uk>
commit bcec7c8da6b092b1ff3327fd83c2193adb12f684 upstream.
Get rid of the WANT_COMPAT_REG_H test and instead define both the 32-
and 64-bit register offset definitions at the same time with
MIPS{32,64}_ prefixes, then define the existing EF_* names to the
correct definitions for the kernel's bitness.
This patch is a prerequisite of the following bug fix patch.
Signed-off-by: Alex Smith <alex@alex-smith.me.uk>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7451/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/include/asm/reg.h | 256 +++++++++++++++++++++++++--------------
arch/mips/kernel/binfmt_elfo32.c | 32 +---
2 files changed, 180 insertions(+), 108 deletions(-)
--- a/arch/mips/include/asm/reg.h
+++ b/arch/mips/include/asm/reg.h
@@ -12,116 +12,194 @@
#ifndef __ASM_MIPS_REG_H
#define __ASM_MIPS_REG_H
-
-#if defined(CONFIG_32BIT) || defined(WANT_COMPAT_REG_H)
-
-#define EF_R0 6
-#define EF_R1 7
-#define EF_R2 8
-#define EF_R3 9
-#define EF_R4 10
-#define EF_R5 11
-#define EF_R6 12
-#define EF_R7 13
-#define EF_R8 14
-#define EF_R9 15
-#define EF_R10 16
-#define EF_R11 17
-#define EF_R12 18
-#define EF_R13 19
-#define EF_R14 20
-#define EF_R15 21
-#define EF_R16 22
-#define EF_R17 23
-#define EF_R18 24
-#define EF_R19 25
-#define EF_R20 26
-#define EF_R21 27
-#define EF_R22 28
-#define EF_R23 29
-#define EF_R24 30
-#define EF_R25 31
+#define MIPS32_EF_R0 6
+#define MIPS32_EF_R1 7
+#define MIPS32_EF_R2 8
+#define MIPS32_EF_R3 9
+#define MIPS32_EF_R4 10
+#define MIPS32_EF_R5 11
+#define MIPS32_EF_R6 12
+#define MIPS32_EF_R7 13
+#define MIPS32_EF_R8 14
+#define MIPS32_EF_R9 15
+#define MIPS32_EF_R10 16
+#define MIPS32_EF_R11 17
+#define MIPS32_EF_R12 18
+#define MIPS32_EF_R13 19
+#define MIPS32_EF_R14 20
+#define MIPS32_EF_R15 21
+#define MIPS32_EF_R16 22
+#define MIPS32_EF_R17 23
+#define MIPS32_EF_R18 24
+#define MIPS32_EF_R19 25
+#define MIPS32_EF_R20 26
+#define MIPS32_EF_R21 27
+#define MIPS32_EF_R22 28
+#define MIPS32_EF_R23 29
+#define MIPS32_EF_R24 30
+#define MIPS32_EF_R25 31
/*
* k0/k1 unsaved
*/
-#define EF_R26 32
-#define EF_R27 33
+#define MIPS32_EF_R26 32
+#define MIPS32_EF_R27 33
-#define EF_R28 34
-#define EF_R29 35
-#define EF_R30 36
-#define EF_R31 37
+#define MIPS32_EF_R28 34
+#define MIPS32_EF_R29 35
+#define MIPS32_EF_R30 36
+#define MIPS32_EF_R31 37
/*
* Saved special registers
*/
-#define EF_LO 38
-#define EF_HI 39
+#define MIPS32_EF_LO 38
+#define MIPS32_EF_HI 39
-#define EF_CP0_EPC 40
-#define EF_CP0_BADVADDR 41
-#define EF_CP0_STATUS 42
-#define EF_CP0_CAUSE 43
-#define EF_UNUSED0 44
-
-#define EF_SIZE 180
-
-#endif
-
-#if defined(CONFIG_64BIT) && !defined(WANT_COMPAT_REG_H)
-
-#define EF_R0 0
-#define EF_R1 1
-#define EF_R2 2
-#define EF_R3 3
-#define EF_R4 4
-#define EF_R5 5
-#define EF_R6 6
-#define EF_R7 7
-#define EF_R8 8
-#define EF_R9 9
-#define EF_R10 10
-#define EF_R11 11
-#define EF_R12 12
-#define EF_R13 13
-#define EF_R14 14
-#define EF_R15 15
-#define EF_R16 16
-#define EF_R17 17
-#define EF_R18 18
-#define EF_R19 19
-#define EF_R20 20
-#define EF_R21 21
-#define EF_R22 22
-#define EF_R23 23
-#define EF_R24 24
-#define EF_R25 25
+#define MIPS32_EF_CP0_EPC 40
+#define MIPS32_EF_CP0_BADVADDR 41
+#define MIPS32_EF_CP0_STATUS 42
+#define MIPS32_EF_CP0_CAUSE 43
+#define MIPS32_EF_UNUSED0 44
+
+#define MIPS32_EF_SIZE 180
+
+#define MIPS64_EF_R0 0
+#define MIPS64_EF_R1 1
+#define MIPS64_EF_R2 2
+#define MIPS64_EF_R3 3
+#define MIPS64_EF_R4 4
+#define MIPS64_EF_R5 5
+#define MIPS64_EF_R6 6
+#define MIPS64_EF_R7 7
+#define MIPS64_EF_R8 8
+#define MIPS64_EF_R9 9
+#define MIPS64_EF_R10 10
+#define MIPS64_EF_R11 11
+#define MIPS64_EF_R12 12
+#define MIPS64_EF_R13 13
+#define MIPS64_EF_R14 14
+#define MIPS64_EF_R15 15
+#define MIPS64_EF_R16 16
+#define MIPS64_EF_R17 17
+#define MIPS64_EF_R18 18
+#define MIPS64_EF_R19 19
+#define MIPS64_EF_R20 20
+#define MIPS64_EF_R21 21
+#define MIPS64_EF_R22 22
+#define MIPS64_EF_R23 23
+#define MIPS64_EF_R24 24
+#define MIPS64_EF_R25 25
/*
* k0/k1 unsaved
*/
-#define EF_R26 26
-#define EF_R27 27
+#define MIPS64_EF_R26 26
+#define MIPS64_EF_R27 27
-#define EF_R28 28
-#define EF_R29 29
-#define EF_R30 30
-#define EF_R31 31
+#define MIPS64_EF_R28 28
+#define MIPS64_EF_R29 29
+#define MIPS64_EF_R30 30
+#define MIPS64_EF_R31 31
/*
* Saved special registers
*/
-#define EF_LO 32
-#define EF_HI 33
-
-#define EF_CP0_EPC 34
-#define EF_CP0_BADVADDR 35
-#define EF_CP0_STATUS 36
-#define EF_CP0_CAUSE 37
+#define MIPS64_EF_LO 32
+#define MIPS64_EF_HI 33
-#define EF_SIZE 304 /* size in bytes */
+#define MIPS64_EF_CP0_EPC 34
+#define MIPS64_EF_CP0_BADVADDR 35
+#define MIPS64_EF_CP0_STATUS 36
+#define MIPS64_EF_CP0_CAUSE 37
+
+#define MIPS64_EF_SIZE 304 /* size in bytes */
+
+#if defined(CONFIG_32BIT)
+
+#define EF_R0 MIPS32_EF_R0
+#define EF_R1 MIPS32_EF_R1
+#define EF_R2 MIPS32_EF_R2
+#define EF_R3 MIPS32_EF_R3
+#define EF_R4 MIPS32_EF_R4
+#define EF_R5 MIPS32_EF_R5
+#define EF_R6 MIPS32_EF_R6
+#define EF_R7 MIPS32_EF_R7
+#define EF_R8 MIPS32_EF_R8
+#define EF_R9 MIPS32_EF_R9
+#define EF_R10 MIPS32_EF_R10
+#define EF_R11 MIPS32_EF_R11
+#define EF_R12 MIPS32_EF_R12
+#define EF_R13 MIPS32_EF_R13
+#define EF_R14 MIPS32_EF_R14
+#define EF_R15 MIPS32_EF_R15
+#define EF_R16 MIPS32_EF_R16
+#define EF_R17 MIPS32_EF_R17
+#define EF_R18 MIPS32_EF_R18
+#define EF_R19 MIPS32_EF_R19
+#define EF_R20 MIPS32_EF_R20
+#define EF_R21 MIPS32_EF_R21
+#define EF_R22 MIPS32_EF_R22
+#define EF_R23 MIPS32_EF_R23
+#define EF_R24 MIPS32_EF_R24
+#define EF_R25 MIPS32_EF_R25
+#define EF_R26 MIPS32_EF_R26
+#define EF_R27 MIPS32_EF_R27
+#define EF_R28 MIPS32_EF_R28
+#define EF_R29 MIPS32_EF_R29
+#define EF_R30 MIPS32_EF_R30
+#define EF_R31 MIPS32_EF_R31
+#define EF_LO MIPS32_EF_LO
+#define EF_HI MIPS32_EF_HI
+#define EF_CP0_EPC MIPS32_EF_CP0_EPC
+#define EF_CP0_BADVADDR MIPS32_EF_CP0_BADVADDR
+#define EF_CP0_STATUS MIPS32_EF_CP0_STATUS
+#define EF_CP0_CAUSE MIPS32_EF_CP0_CAUSE
+#define EF_UNUSED0 MIPS32_EF_UNUSED0
+#define EF_SIZE MIPS32_EF_SIZE
+
+#elif defined(CONFIG_64BIT)
+
+#define EF_R0 MIPS64_EF_R0
+#define EF_R1 MIPS64_EF_R1
+#define EF_R2 MIPS64_EF_R2
+#define EF_R3 MIPS64_EF_R3
+#define EF_R4 MIPS64_EF_R4
+#define EF_R5 MIPS64_EF_R5
+#define EF_R6 MIPS64_EF_R6
+#define EF_R7 MIPS64_EF_R7
+#define EF_R8 MIPS64_EF_R8
+#define EF_R9 MIPS64_EF_R9
+#define EF_R10 MIPS64_EF_R10
+#define EF_R11 MIPS64_EF_R11
+#define EF_R12 MIPS64_EF_R12
+#define EF_R13 MIPS64_EF_R13
+#define EF_R14 MIPS64_EF_R14
+#define EF_R15 MIPS64_EF_R15
+#define EF_R16 MIPS64_EF_R16
+#define EF_R17 MIPS64_EF_R17
+#define EF_R18 MIPS64_EF_R18
+#define EF_R19 MIPS64_EF_R19
+#define EF_R20 MIPS64_EF_R20
+#define EF_R21 MIPS64_EF_R21
+#define EF_R22 MIPS64_EF_R22
+#define EF_R23 MIPS64_EF_R23
+#define EF_R24 MIPS64_EF_R24
+#define EF_R25 MIPS64_EF_R25
+#define EF_R26 MIPS64_EF_R26
+#define EF_R27 MIPS64_EF_R27
+#define EF_R28 MIPS64_EF_R28
+#define EF_R29 MIPS64_EF_R29
+#define EF_R30 MIPS64_EF_R30
+#define EF_R31 MIPS64_EF_R31
+#define EF_LO MIPS64_EF_LO
+#define EF_HI MIPS64_EF_HI
+#define EF_CP0_EPC MIPS64_EF_CP0_EPC
+#define EF_CP0_BADVADDR MIPS64_EF_CP0_BADVADDR
+#define EF_CP0_STATUS MIPS64_EF_CP0_STATUS
+#define EF_CP0_CAUSE MIPS64_EF_CP0_CAUSE
+#define EF_SIZE MIPS64_EF_SIZE
#endif /* CONFIG_64BIT */
--- a/arch/mips/kernel/binfmt_elfo32.c
+++ b/arch/mips/kernel/binfmt_elfo32.c
@@ -72,12 +72,6 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
#include <asm/processor.h>
-/*
- * When this file is selected, we are definitely running a 64bit kernel.
- * So using the right regs define in asm/reg.h
- */
-#define WANT_COMPAT_REG_H
-
/* These MUST be defined before elf.h gets included */
extern void elf32_core_copy_regs(elf_gregset_t grp, struct pt_regs *regs);
#define ELF_CORE_COPY_REGS(_dest, _regs) elf32_core_copy_regs(_dest, _regs);
@@ -149,21 +143,21 @@ void elf32_core_copy_regs(elf_gregset_t
{
int i;
- for (i = 0; i < EF_R0; i++)
+ for (i = 0; i < MIPS32_EF_R0; i++)
grp[i] = 0;
- grp[EF_R0] = 0;
+ grp[MIPS32_EF_R0] = 0;
for (i = 1; i <= 31; i++)
- grp[EF_R0 + i] = (elf_greg_t) regs->regs[i];
- grp[EF_R26] = 0;
- grp[EF_R27] = 0;
- grp[EF_LO] = (elf_greg_t) regs->lo;
- grp[EF_HI] = (elf_greg_t) regs->hi;
- grp[EF_CP0_EPC] = (elf_greg_t) regs->cp0_epc;
- grp[EF_CP0_BADVADDR] = (elf_greg_t) regs->cp0_badvaddr;
- grp[EF_CP0_STATUS] = (elf_greg_t) regs->cp0_status;
- grp[EF_CP0_CAUSE] = (elf_greg_t) regs->cp0_cause;
-#ifdef EF_UNUSED0
- grp[EF_UNUSED0] = 0;
+ grp[MIPS32_EF_R0 + i] = (elf_greg_t) regs->regs[i];
+ grp[MIPS32_EF_R26] = 0;
+ grp[MIPS32_EF_R27] = 0;
+ grp[MIPS32_EF_LO] = (elf_greg_t) regs->lo;
+ grp[MIPS32_EF_HI] = (elf_greg_t) regs->hi;
+ grp[MIPS32_EF_CP0_EPC] = (elf_greg_t) regs->cp0_epc;
+ grp[MIPS32_EF_CP0_BADVADDR] = (elf_greg_t) regs->cp0_badvaddr;
+ grp[MIPS32_EF_CP0_STATUS] = (elf_greg_t) regs->cp0_status;
+ grp[MIPS32_EF_CP0_CAUSE] = (elf_greg_t) regs->cp0_cause;
+#ifdef MIPS32_EF_UNUSED0
+ grp[MIPS32_EF_UNUSED0] = 0;
#endif
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 070/158] MIPS: syscall: Fix AUDIT value for O32 processes on MIPS64
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 069/158] MIPS: asm/reg.h: Make 32- and 64-bit definitions available at the same time Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 071/158] MIPS: scall64-o32: Fix indirect syscall detection Greg Kroah-Hartman
` (88 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Markos Chandras, James Hogan
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markos Chandras <markos.chandras@imgtec.com>
commit 40381529f84c4cda3bd2d20cab6a707508856b21 upstream.
On MIPS64, O32 processes set both TIF_32BIT_ADDR and
TIF_32BIT_REGS so the previous condition treated O32 applications
as N32 when evaluating seccomp filters. Fix the condition to check
both TIF_32BIT_{REGS, ADDR} for the N32 AUDIT flag.
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Patchwork: http://patchwork.linux-mips.org/patch/7480/
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/include/asm/syscall.h | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -131,10 +131,12 @@ static inline int syscall_get_arch(void)
{
int arch = EM_MIPS;
#ifdef CONFIG_64BIT
- if (!test_thread_flag(TIF_32BIT_REGS))
+ if (!test_thread_flag(TIF_32BIT_REGS)) {
arch |= __AUDIT_ARCH_64BIT;
- if (test_thread_flag(TIF_32BIT_ADDR))
- arch |= __AUDIT_ARCH_CONVENTION_MIPS64_N32;
+ /* N32 sets only TIF_32BIT_ADDR */
+ if (test_thread_flag(TIF_32BIT_ADDR))
+ arch |= __AUDIT_ARCH_CONVENTION_MIPS64_N32;
+ }
#endif
#if defined(__LITTLE_ENDIAN)
arch |= __AUDIT_ARCH_LE;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 071/158] MIPS: scall64-o32: Fix indirect syscall detection
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 070/158] MIPS: syscall: Fix AUDIT value for O32 processes on MIPS64 Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 072/158] MIPS: Malta: Improve system memory detection for {e, }memsize >= 2G Greg Kroah-Hartman
` (87 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Markos Chandras, James Hogan
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markos Chandras <markos.chandras@imgtec.com>
commit 5245689900804604fdc349c8d9b8985b0e401ae2 upstream.
Commit 4c21b8fd8f14 (MIPS: seccomp: Handle indirect system calls (o32))
added indirect syscall detection for O32 processes running on MIPS64
but it did not work as expected. The reason is the the scall64-o32
implementation differs compared to scall32-o32. In the former, the v0
(syscall number) register contains the absolute syscall number
(4000 + X) whereas in the latter it contains the relative syscall
number (X). Fix the code to avoid doing an extra addition, and load
the v0 register directly to the first argument for syscall_trace_enter.
Moreover, set the .reorder assembler option in order to have better
control on this part of the assembly code.
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Patchwork: http://patchwork.linux-mips.org/patch/7481/
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/scall64-o32.S | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -113,15 +113,19 @@ trace_a_syscall:
move s0, t2 # Save syscall pointer
move a0, sp
/*
- * syscall number is in v0 unless we called syscall(__NR_###)
+ * absolute syscall number is in v0 unless we called syscall(__NR_###)
* where the real syscall number is in a0
* note: NR_syscall is the first O32 syscall but the macro is
* only defined when compiling with -mabi=32 (CONFIG_32BIT)
* therefore __NR_O32_Linux is used (4000)
*/
- addiu a1, v0, __NR_O32_Linux
- bnez v0, 1f /* __NR_syscall at offset 0 */
- lw a1, PT_R4(sp)
+ .set push
+ .set reorder
+ subu t1, v0, __NR_O32_Linux
+ move a1, v0
+ bnez t1, 1f /* __NR_syscall at offset 0 */
+ lw a1, PT_R4(sp) /* Arg1 for __NR_syscall case */
+ .set pop
1: jal syscall_trace_enter
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 072/158] MIPS: Malta: Improve system memory detection for {e, }memsize >= 2G
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 071/158] MIPS: scall64-o32: Fix indirect syscall detection Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 073/158] MIPS: OCTEON: make get_system_type() thread-safe Greg Kroah-Hartman
` (86 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Markos Chandras, linux-mips, Ralf Baechle
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markos Chandras <markos.chandras@imgtec.com>
commit 64615682658373516863b5b5971ff1d922d0ae7b upstream.
Using kstrtol to parse the "{e,}memsize" variables was wrong because this
parses signed long numbers. In case of '{e,}memsize' >= 2G, the top bit
is set, resulting to -ERANGE errors and possibly random system memory
boundaries. We fix this by replacing "kstrtol" with "kstrtoul".
We also improve the code to check the kstrtoul return value and
print a warning if an error was returned.
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7543/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/mti-malta/malta-memory.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/arch/mips/mti-malta/malta-memory.c
+++ b/arch/mips/mti-malta/malta-memory.c
@@ -34,13 +34,19 @@ fw_memblock_t * __init fw_getmdesc(int e
/* otherwise look in the environment */
memsize_str = fw_getenv("memsize");
- if (memsize_str)
- tmp = kstrtol(memsize_str, 0, &memsize);
+ if (memsize_str) {
+ tmp = kstrtoul(memsize_str, 0, &memsize);
+ if (tmp)
+ pr_warn("Failed to read the 'memsize' env variable.\n");
+ }
if (eva) {
/* Look for ememsize for EVA */
ememsize_str = fw_getenv("ememsize");
- if (ememsize_str)
- tmp = kstrtol(ememsize_str, 0, &ememsize);
+ if (ememsize_str) {
+ tmp = kstrtoul(ememsize_str, 0, &ememsize);
+ if (tmp)
+ pr_warn("Failed to read the 'ememsize' env variable.\n");
+ }
}
if (!memsize && !ememsize) {
pr_warn("memsize not set in YAMON, set to default (32Mb)\n");
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 073/158] MIPS: OCTEON: make get_system_type() thread-safe
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 072/158] MIPS: Malta: Improve system memory detection for {e, }memsize >= 2G Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 074/158] MIPS: EVA: Add new EVA header Greg Kroah-Hartman
` (85 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aaro Koskinen, Markos Chandras, James Hogan
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaro Koskinen <aaro.koskinen@nsn.com>
commit 608308682addfdc7b8e2aee88f0e028331d88e4d upstream.
get_system_type() is not thread-safe on OCTEON. It uses static data,
also more dangerous issue is that it's calling cvmx_fuse_read_byte()
every time without any synchronization. Currently it's possible to get
processes stuck looping forever in kernel simply by launching multiple
readers of /proc/cpuinfo:
(while true; do cat /proc/cpuinfo > /dev/null; done) &
(while true; do cat /proc/cpuinfo > /dev/null; done) &
...
Fix by initializing the system type string only once during the early
boot.
Signed-off-by: Aaro Koskinen <aaro.koskinen@nsn.com>
Reviewed-by: Markos Chandras <markos.chandras@imgtec.com>
Patchwork: http://patchwork.linux-mips.org/patch/7437/
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/cavium-octeon/setup.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
--- a/arch/mips/cavium-octeon/setup.c
+++ b/arch/mips/cavium-octeon/setup.c
@@ -458,6 +458,18 @@ static void octeon_halt(void)
octeon_kill_core(NULL);
}
+static char __read_mostly octeon_system_type[80];
+
+static int __init init_octeon_system_type(void)
+{
+ snprintf(octeon_system_type, sizeof(octeon_system_type), "%s (%s)",
+ cvmx_board_type_to_string(octeon_bootinfo->board_type),
+ octeon_model_get_string(read_c0_prid()));
+
+ return 0;
+}
+early_initcall(init_octeon_system_type);
+
/**
* Return a string representing the system type
*
@@ -465,11 +477,7 @@ static void octeon_halt(void)
*/
const char *octeon_board_type_string(void)
{
- static char name[80];
- sprintf(name, "%s (%s)",
- cvmx_board_type_to_string(octeon_bootinfo->board_type),
- octeon_model_get_string(read_c0_prid()));
- return name;
+ return octeon_system_type;
}
const char *get_system_type(void)
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 074/158] MIPS: EVA: Add new EVA header
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 073/158] MIPS: OCTEON: make get_system_type() thread-safe Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 075/158] MIPS: Malta: EVA: Rename eva_entry to platform_eva_init Greg Kroah-Hartman
` (84 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Burton, Markos Chandras, James Hogan
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markos Chandras <markos.chandras@imgtec.com>
commit f85b71ceabb9d8d8a9e34b045b5c43ffde3623b3 upstream.
Generic code may need to perform certain operations when EVA is
enabled, for example, configure the segmentation registers during
boot. In order to avoid using more CONFIG_EVA ifdefs in the arch code,
such functions will be added in this header instead.
Initially this header contains a macro which will be used by generic
code later on during VPEs configuration on secondary cores.
All it does is to call the platform specific EVA init code in case
EVA is enabled.
Reviewed-by: Paul Burton <paul.burton@imgtec.com>
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Patchwork: http://patchwork.linux-mips.org/patch/7422/
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/include/asm/eva.h | 43 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 43 insertions(+)
--- /dev/null
+++ b/arch/mips/include/asm/eva.h
@@ -0,0 +1,43 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License. See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2014, Imagination Technologies Ltd.
+ *
+ * EVA functions for generic code
+ */
+
+#ifndef _ASM_EVA_H
+#define _ASM_EVA_H
+
+#include <kernel-entry-init.h>
+
+#ifdef __ASSEMBLY__
+
+#ifdef CONFIG_EVA
+
+/*
+ * EVA early init code
+ *
+ * Platforms must define their own 'platform_eva_init' macro in
+ * their kernel-entry-init.h header. This macro usually does the
+ * platform specific configuration of the segmentation registers,
+ * and it is normally called from assembly code.
+ *
+ */
+
+.macro eva_init
+platform_eva_init
+.endm
+
+#else
+
+.macro eva_init
+.endm
+
+#endif /* CONFIG_EVA */
+
+#endif /* __ASSEMBLY__ */
+
+#endif
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 075/158] MIPS: Malta: EVA: Rename eva_entry to platform_eva_init
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 074/158] MIPS: EVA: Add new EVA header Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 076/158] MIPS: CPS: Initialize EVA before bringing up VPEs from secondary cores Greg Kroah-Hartman
` (83 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Burton, Markos Chandras, James Hogan
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markos Chandras <markos.chandras@imgtec.com>
commit ca4d24f7954f3746742ba350c2276ff777f21173 upstream.
Rename 'eva_entry' to 'platform_eva_init' as required by the new
'eva_init' macro in the eva.h header. Since this macro is now used
in a platform dependent way, it must not depend on its caller so move
the t1 register initialization inside this macro. Also set the .reorder
assembler option in case the caller may have previously set .noreorder.
This may allow a few assembler optimizations. Finally include missing
headers and document the register usage for this macro.
Reviewed-by: Paul Burton <paul.burton@imgtec.com>
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Patchwork: http://patchwork.linux-mips.org/patch/7423/
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/include/asm/mach-malta/kernel-entry-init.h | 22 +++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
--- a/arch/mips/include/asm/mach-malta/kernel-entry-init.h
+++ b/arch/mips/include/asm/mach-malta/kernel-entry-init.h
@@ -10,14 +10,15 @@
#ifndef __ASM_MACH_MIPS_KERNEL_ENTRY_INIT_H
#define __ASM_MACH_MIPS_KERNEL_ENTRY_INIT_H
+#include <asm/regdef.h>
+#include <asm/mipsregs.h>
+
/*
* Prepare segments for EVA boot:
*
* This is in case the processor boots in legacy configuration
* (SI_EVAReset is de-asserted and CONFIG5.K == 0)
*
- * On entry, t1 is loaded with CP0_CONFIG
- *
* ========================= Mappings =============================
* Virtual memory Physical memory Mapping
* 0x00000000 - 0x7fffffff 0x80000000 - 0xfffffffff MUSUK (kuseg)
@@ -30,12 +31,20 @@
*
*
* Lowmem is expanded to 2GB
+ *
+ * The following code uses the t0, t1, t2 and ra registers without
+ * previously preserving them.
+ *
*/
- .macro eva_entry
+ .macro platform_eva_init
+
+ .set push
+ .set reorder
/*
* Get Config.K0 value and use it to program
* the segmentation registers
*/
+ mfc0 t1, CP0_CONFIG
andi t1, 0x7 /* CCA */
move t2, t1
ins t2, t1, 16, 3
@@ -77,6 +86,8 @@
mtc0 t0, $16, 5
sync
jal mips_ihb
+
+ .set pop
.endm
.macro kernel_entry_setup
@@ -95,7 +106,7 @@
sll t0, t0, 6 /* SC bit */
bgez t0, 9f
- eva_entry
+ platform_eva_init
b 0f
9:
/* Assume we came from YAMON... */
@@ -127,8 +138,7 @@ nonsc_processor:
#ifdef CONFIG_EVA
sync
ehb
- mfc0 t1, CP0_CONFIG
- eva_entry
+ platform_eva_init
#endif
.endm
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 076/158] MIPS: CPS: Initialize EVA before bringing up VPEs from secondary cores
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 075/158] MIPS: Malta: EVA: Rename eva_entry to platform_eva_init Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 077/158] ASoC: wm8994: Prevent double lock of accdet_lock mutex on wm1811 Greg Kroah-Hartman
` (82 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Burton, Markos Chandras, James Hogan
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markos Chandras <markos.chandras@imgtec.com>
commit 6521d9a436a62e83ce57d6be6e5484e1098c1380 upstream.
The CPS code is doing several memory loads when configuring the VPEs
from secondary cores, so the segmentation control registers must be
initialized in time otherwise the kernel will crash with strange
TLB exceptions.
Reviewed-by: Paul Burton <paul.burton@imgtec.com>
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Patchwork: http://patchwork.linux-mips.org/patch/7424/
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/cps-vec.S | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -13,6 +13,7 @@
#include <asm/asm-offsets.h>
#include <asm/asmmacro.h>
#include <asm/cacheops.h>
+#include <asm/eva.h>
#include <asm/mipsregs.h>
#include <asm/mipsmtregs.h>
#include <asm/pm.h>
@@ -166,6 +167,9 @@ dcache_done:
1: jal mips_cps_core_init
nop
+ /* Do any EVA initialization if necessary */
+ eva_init
+
/*
* Boot any other VPEs within this core that should be online, and
* deactivate this VPE if it should be offline.
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 077/158] ASoC: wm8994: Prevent double lock of accdet_lock mutex on wm1811
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 076/158] MIPS: CPS: Initialize EVA before bringing up VPEs from secondary cores Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 078/158] ASoC: pcm: fix dpcm_path_put in dpcm runtime update Greg Kroah-Hartman
` (81 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Charles Keepax, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
commit b38314179c9ccb789e6fe967cff171fa817e8978 upstream.
wm1811_micd_stop takes the accdet_lock mutex, and is called from two
places, one of which is already holding the accdet_lock. This obviously
causes a lock up.
This patch fixes this issue by removing the lock from wm1811_micd_stop
and ensuring that it is always locked externally.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wm8994.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -3505,6 +3505,7 @@ static irqreturn_t wm8994_mic_irq(int ir
return IRQ_HANDLED;
}
+/* Should be called with accdet_lock held */
static void wm1811_micd_stop(struct snd_soc_codec *codec)
{
struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
@@ -3512,14 +3513,10 @@ static void wm1811_micd_stop(struct snd_
if (!wm8994->jackdet)
return;
- mutex_lock(&wm8994->accdet_lock);
-
snd_soc_update_bits(codec, WM8958_MIC_DETECT_1, WM8958_MICD_ENA, 0);
wm1811_jackdet_set_mode(codec, WM1811_JACKDET_MODE_JACK);
- mutex_unlock(&wm8994->accdet_lock);
-
if (wm8994->wm8994->pdata.jd_ext_cap)
snd_soc_dapm_disable_pin(&codec->dapm,
"MICBIAS2");
@@ -3560,10 +3557,10 @@ static void wm8958_open_circuit_work(str
open_circuit_work.work);
struct device *dev = wm8994->wm8994->dev;
- wm1811_micd_stop(wm8994->hubs.codec);
-
mutex_lock(&wm8994->accdet_lock);
+ wm1811_micd_stop(wm8994->hubs.codec);
+
dev_dbg(dev, "Reporting open circuit\n");
wm8994->jack_mic = false;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 078/158] ASoC: pcm: fix dpcm_path_put in dpcm runtime update
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 077/158] ASoC: wm8994: Prevent double lock of accdet_lock mutex on wm1811 Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 079/158] ASoC: wm_adsp: Add missing MODULE_LICENSE Greg Kroah-Hartman
` (80 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Qiao Zhou, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiao Zhou <zhouqiao@marvell.com>
commit 7ed9de76ff342cbd717a9cf897044b99272cb8f8 upstream.
we need to release dapm widget list after dpcm_path_get in
soc_dpcm_runtime_update. otherwise, there will be potential memory
leak. add dpcm_path_put to fix it.
Signed-off-by: Qiao Zhou <zhouqiao@marvell.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/soc-pcm.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -2069,6 +2069,7 @@ int soc_dpcm_runtime_update(struct snd_s
dpcm_be_disconnect(fe, SNDRV_PCM_STREAM_PLAYBACK);
}
+ dpcm_path_put(&list);
capture:
/* skip if FE doesn't have capture capability */
if (!fe->cpu_dai->driver->capture.channels_min)
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 079/158] ASoC: wm_adsp: Add missing MODULE_LICENSE
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 078/158] ASoC: pcm: fix dpcm_path_put in dpcm runtime update Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 080/158] ASoC: blackfin: use samples to set silence Greg Kroah-Hartman
` (79 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Praveen Diwakar, Vinod Koul,
Charles Keepax, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Praveen Diwakar <praveen.diwakar@intel.com>
commit 0a37c6efec4a2fdc2563c5a8faa472b814deee80 upstream.
Since MODULE_LICENSE is missing the module load fails,
so add this for module.
Signed-off-by: Praveen Diwakar <praveen.diwakar@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Reviewed-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wm_adsp.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1758,3 +1758,5 @@ int wm_adsp2_init(struct wm_adsp *adsp,
return 0;
}
EXPORT_SYMBOL_GPL(wm_adsp2_init);
+
+MODULE_LICENSE("GPL v2");
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 080/158] ASoC: blackfin: use samples to set silence
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 079/158] ASoC: wm_adsp: Add missing MODULE_LICENSE Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 081/158] ASoC: samsung: Correct I2S DAI suspend/resume ops Greg Kroah-Hartman
` (78 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Scott Jiang, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Jiang <scott.jiang.linux@gmail.com>
commit 30443408fd7201fd1911b09daccf92fae3cc700d upstream.
The third parameter for snd_pcm_format_set_silence needs the number
of samples instead of sample bytes.
Signed-off-by: Scott Jiang <scott.jiang.linux@gmail.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/blackfin/bf5xx-i2s-pcm.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/sound/soc/blackfin/bf5xx-i2s-pcm.c
+++ b/sound/soc/blackfin/bf5xx-i2s-pcm.c
@@ -290,19 +290,19 @@ static int bf5xx_pcm_silence(struct snd_
unsigned int sample_size = runtime->sample_bits / 8;
void *buf = runtime->dma_area;
struct bf5xx_i2s_pcm_data *dma_data;
- unsigned int offset, size;
+ unsigned int offset, samples;
dma_data = snd_soc_dai_get_dma_data(rtd->cpu_dai, substream);
if (dma_data->tdm_mode) {
offset = pos * 8 * sample_size;
- size = count * 8 * sample_size;
+ samples = count * 8;
} else {
offset = frames_to_bytes(runtime, pos);
- size = frames_to_bytes(runtime, count);
+ samples = count * runtime->channels;
}
- snd_pcm_format_set_silence(runtime->format, buf + offset, size);
+ snd_pcm_format_set_silence(runtime->format, buf + offset, samples);
return 0;
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 081/158] ASoC: samsung: Correct I2S DAI suspend/resume ops
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 080/158] ASoC: blackfin: use samples to set silence Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 082/158] ASoC: adau1701: fix adau1701_reg_read() Greg Kroah-Hartman
` (77 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sylwester Nawrocki, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sylwester Nawrocki <s.nawrocki@samsung.com>
commit d3d4e5247b013008a39e4d5f69ce4c60ed57f997 upstream.
We should save/restore relevant I2S registers regardless of
the dai->active flag, otherwise some settings are being lost
after system suspend/resume cycle. E.g. I2S slave mode set only
during dai initialization is not preserved and the device ends
up in master mode after system resume.
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/samsung/i2s.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
--- a/sound/soc/samsung/i2s.c
+++ b/sound/soc/samsung/i2s.c
@@ -920,11 +920,9 @@ static int i2s_suspend(struct snd_soc_da
{
struct i2s_dai *i2s = to_info(dai);
- if (dai->active) {
- i2s->suspend_i2smod = readl(i2s->addr + I2SMOD);
- i2s->suspend_i2scon = readl(i2s->addr + I2SCON);
- i2s->suspend_i2spsr = readl(i2s->addr + I2SPSR);
- }
+ i2s->suspend_i2smod = readl(i2s->addr + I2SMOD);
+ i2s->suspend_i2scon = readl(i2s->addr + I2SCON);
+ i2s->suspend_i2spsr = readl(i2s->addr + I2SPSR);
return 0;
}
@@ -933,11 +931,9 @@ static int i2s_resume(struct snd_soc_dai
{
struct i2s_dai *i2s = to_info(dai);
- if (dai->active) {
- writel(i2s->suspend_i2scon, i2s->addr + I2SCON);
- writel(i2s->suspend_i2smod, i2s->addr + I2SMOD);
- writel(i2s->suspend_i2spsr, i2s->addr + I2SPSR);
- }
+ writel(i2s->suspend_i2scon, i2s->addr + I2SCON);
+ writel(i2s->suspend_i2smod, i2s->addr + I2SMOD);
+ writel(i2s->suspend_i2spsr, i2s->addr + I2SPSR);
return 0;
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 082/158] ASoC: adau1701: fix adau1701_reg_read()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 081/158] ASoC: samsung: Correct I2S DAI suspend/resume ops Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 083/158] ASoC: max98090: Fix missing free_irq Greg Kroah-Hartman
` (76 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Mack, Lars-Peter Clausen, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <zonque@gmail.com>
commit 3ad80b828b2533f37c221e2df155774efd6ed814 upstream.
Fix a long standing bug in the read register routing of adau1701.
The bytes arrive in the buffer in big-endian, so the result has to be
shifted before and-ing the bytes in the loop.
Signed-off-by: Daniel Mack <zonque@gmail.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/adau1701.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/sound/soc/codecs/adau1701.c
+++ b/sound/soc/codecs/adau1701.c
@@ -230,8 +230,10 @@ static int adau1701_reg_read(void *conte
*value = 0;
- for (i = 0; i < size; i++)
- *value |= recv_buf[i] << (i * 8);
+ for (i = 0; i < size; i++) {
+ *value <<= 8;
+ *value |= recv_buf[i];
+ }
return 0;
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 083/158] ASoC: max98090: Fix missing free_irq
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 082/158] ASoC: adau1701: fix adau1701_reg_read() Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 084/158] ASoC: tlv320aic31xx: Do not ignore errors in aic31xx_device_init() Greg Kroah-Hartman
` (75 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jarkko Nikula, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
commit 4adeb0ccf86a5af1825bbfe290dee9e60a5ab870 upstream.
max98090.c doesn't free the threaded interrupt it requests. This causes
an oops when doing "cat /proc/interrupts" after snd-soc-max98090.ko is
unloaded.
Fix this by requesting the interrupt by using devm_request_threaded_irq().
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/max98090.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/codecs/max98090.c
+++ b/sound/soc/codecs/max98090.c
@@ -2284,7 +2284,7 @@ static int max98090_probe(struct snd_soc
/* Register for interrupts */
dev_dbg(codec->dev, "irq = %d\n", max98090->irq);
- ret = request_threaded_irq(max98090->irq, NULL,
+ ret = devm_request_threaded_irq(codec->dev, max98090->irq, NULL,
max98090_interrupt, IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
"max98090_interrupt", codec);
if (ret < 0) {
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 084/158] ASoC: tlv320aic31xx: Do not ignore errors in aic31xx_device_init()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 083/158] ASoC: max98090: Fix missing free_irq Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 085/158] ASoC: Intel: Cleanup HSW pcm format support Greg Kroah-Hartman
` (74 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
commit a72d2abbe5752f3a773c4d8b7b41ae41f617f772 upstream.
We need to return the error codes from aic31xx_device_init() and return
from the i2c_probe with the error code.
We will have kernel panic (NULL pointer dereference) in
regulator_register_notifier() in case the devm_regulator_bulk_get() fails
(with -EPROBE_DEFER for example).
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/tlv320aic31xx.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/sound/soc/codecs/tlv320aic31xx.c
+++ b/sound/soc/codecs/tlv320aic31xx.c
@@ -1178,7 +1178,7 @@ static void aic31xx_pdata_from_of(struct
}
#endif /* CONFIG_OF */
-static void aic31xx_device_init(struct aic31xx_priv *aic31xx)
+static int aic31xx_device_init(struct aic31xx_priv *aic31xx)
{
int ret, i;
@@ -1197,7 +1197,7 @@ static void aic31xx_device_init(struct a
"aic31xx-reset-pin");
if (ret < 0) {
dev_err(aic31xx->dev, "not able to acquire gpio\n");
- return;
+ return ret;
}
}
@@ -1210,6 +1210,7 @@ static void aic31xx_device_init(struct a
if (ret != 0)
dev_err(aic31xx->dev, "Failed to request supplies: %d\n", ret);
+ return ret;
}
static int aic31xx_i2c_probe(struct i2c_client *i2c,
@@ -1239,7 +1240,9 @@ static int aic31xx_i2c_probe(struct i2c_
aic31xx->pdata.codec_type = id->driver_data;
- aic31xx_device_init(aic31xx);
+ ret = aic31xx_device_init(aic31xx);
+ if (ret)
+ return ret;
return snd_soc_register_codec(&i2c->dev, &soc_codec_driver_aic31xx,
aic31xx_dai_driver,
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 085/158] ASoC: Intel: Cleanup HSW pcm format support
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 084/158] ASoC: tlv320aic31xx: Do not ignore errors in aic31xx_device_init() Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 086/158] ASoC: pxa: pxa-ssp: small leak in probe() Greg Kroah-Hartman
` (73 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jie Yang, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Yang <yang.jie@intel.com>
commit 8e89761876611f06ef4be865b4780b4361caf4af upstream.
This change removes unsupported formats from System,
Capture and Loopback FE DAIs.
Also it fixes S24_LE support on all DAIs.
While at this fix 24 bit flag for BYT as well.
Signed-off-by: Jie Yang <yang.jie@intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/intel/sst-baytrail-pcm.c | 2 +-
sound/soc/intel/sst-haswell-pcm.c | 27 ++++++++++++++++++---------
2 files changed, 19 insertions(+), 10 deletions(-)
--- a/sound/soc/intel/sst-baytrail-pcm.c
+++ b/sound/soc/intel/sst-baytrail-pcm.c
@@ -32,7 +32,7 @@ static const struct snd_pcm_hardware sst
SNDRV_PCM_INFO_PAUSE |
SNDRV_PCM_INFO_RESUME,
.formats = SNDRV_PCM_FMTBIT_S16_LE |
- SNDRV_PCM_FORMAT_S24_LE,
+ SNDRV_PCM_FMTBIT_S24_LE,
.period_bytes_min = 384,
.period_bytes_max = 48000,
.periods_min = 2,
--- a/sound/soc/intel/sst-haswell-pcm.c
+++ b/sound/soc/intel/sst-haswell-pcm.c
@@ -80,7 +80,7 @@ static const struct snd_pcm_hardware hsw
SNDRV_PCM_INFO_PAUSE |
SNDRV_PCM_INFO_RESUME |
SNDRV_PCM_INFO_NO_PERIOD_WAKEUP,
- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FORMAT_S24_LE |
+ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE |
SNDRV_PCM_FMTBIT_S32_LE,
.period_bytes_min = PAGE_SIZE,
.period_bytes_max = (HSW_PCM_PERIODS_MAX / HSW_PCM_PERIODS_MIN) * PAGE_SIZE,
@@ -400,7 +400,15 @@ static int hsw_pcm_hw_params(struct snd_
sst_hsw_stream_set_valid(hsw, pcm_data->stream, 16);
break;
case SNDRV_PCM_FORMAT_S24_LE:
- bits = SST_HSW_DEPTH_24BIT;
+ bits = SST_HSW_DEPTH_32BIT;
+ sst_hsw_stream_set_valid(hsw, pcm_data->stream, 24);
+ break;
+ case SNDRV_PCM_FORMAT_S8:
+ bits = SST_HSW_DEPTH_8BIT;
+ sst_hsw_stream_set_valid(hsw, pcm_data->stream, 8);
+ break;
+ case SNDRV_PCM_FORMAT_S32_LE:
+ bits = SST_HSW_DEPTH_32BIT;
sst_hsw_stream_set_valid(hsw, pcm_data->stream, 32);
break;
default:
@@ -685,8 +693,9 @@ static int hsw_pcm_new(struct snd_soc_pc
}
#define HSW_FORMATS \
- (SNDRV_PCM_FMTBIT_S20_3LE | SNDRV_PCM_FMTBIT_S16_LE |\
- SNDRV_PCM_FMTBIT_S32_LE)
+ (SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S24_LE | \
+ SNDRV_PCM_FMTBIT_S20_3LE | SNDRV_PCM_FMTBIT_S16_LE |\
+ SNDRV_PCM_FMTBIT_S8)
static struct snd_soc_dai_driver hsw_dais[] = {
{
@@ -696,7 +705,7 @@ static struct snd_soc_dai_driver hsw_dai
.channels_min = 2,
.channels_max = 2,
.rates = SNDRV_PCM_RATE_48000,
- .formats = SNDRV_PCM_FMTBIT_S16_LE,
+ .formats = SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE,
},
},
{
@@ -727,8 +736,8 @@ static struct snd_soc_dai_driver hsw_dai
.stream_name = "Loopback Capture",
.channels_min = 2,
.channels_max = 2,
- .rates = SNDRV_PCM_RATE_8000_192000,
- .formats = HSW_FORMATS,
+ .rates = SNDRV_PCM_RATE_48000,
+ .formats = SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE,
},
},
{
@@ -737,8 +746,8 @@ static struct snd_soc_dai_driver hsw_dai
.stream_name = "Analog Capture",
.channels_min = 2,
.channels_max = 2,
- .rates = SNDRV_PCM_RATE_8000_192000,
- .formats = HSW_FORMATS,
+ .rates = SNDRV_PCM_RATE_48000,
+ .formats = SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE,
},
},
};
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 086/158] ASoC: pxa: pxa-ssp: small leak in probe()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 085/158] ASoC: Intel: Cleanup HSW pcm format support Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 087/158] ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE Greg Kroah-Hartman
` (72 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 4548728981de259d7d37d0ae968a777b09794168 upstream.
There is a small memory leak if probe() fails.
Fixes: 2023c90c3a2c ('ASoC: pxa: pxa-ssp: add DT bindings')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/pxa/pxa-ssp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/sound/soc/pxa/pxa-ssp.c
+++ b/sound/soc/pxa/pxa-ssp.c
@@ -723,7 +723,8 @@ static int pxa_ssp_probe(struct snd_soc_
ssp_handle = of_parse_phandle(dev->of_node, "port", 0);
if (!ssp_handle) {
dev_err(dev, "unable to get 'port' phandle\n");
- return -ENODEV;
+ ret = -ENODEV;
+ goto err_priv;
}
priv->ssp = pxa_ssp_request_of(ssp_handle, "SoC audio");
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 087/158] ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 086/158] ASoC: pxa: pxa-ssp: small leak in probe() Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 089/158] ASoC: rt5640: Do not allow regmap to use bulk read-write operations Greg Kroah-Hartman
` (71 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Mack, Johannes Stezenbach, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <zonque@gmail.com>
commit 9301503af016eb537ccce76adec0c1bb5c84871e upstream.
This mode is unsupported, as the DMA controller can't do zero-padding
of samples.
Signed-off-by: Daniel Mack <zonque@gmail.com>
Reported-by: Johannes Stezenbach <js@sig21.net>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/pxa/pxa-ssp.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/sound/soc/pxa/pxa-ssp.c
+++ b/sound/soc/pxa/pxa-ssp.c
@@ -765,9 +765,7 @@ static int pxa_ssp_remove(struct snd_soc
SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_64000 | \
SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000)
-#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE |\
- SNDRV_PCM_FMTBIT_S24_LE | \
- SNDRV_PCM_FMTBIT_S32_LE)
+#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE)
static const struct snd_soc_dai_ops pxa_ssp_dai_ops = {
.startup = pxa_ssp_startup,
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 089/158] ASoC: rt5640: Do not allow regmap to use bulk read-write operations
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 087/158] ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 090/158] ASoC: omap-twl4030: Fix typo in 2nd dai links platform_name Greg Kroah-Hartman
` (70 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jarkko Nikula, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
commit f4821e8e8e957fe4c601a49b9a97b7399d5f7ab1 upstream.
Debugging showed Realtek RT5642 doesn't support autoincrementing writes so
driver should set the use_single_rw flag for regmap.
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/rt5640.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/soc/codecs/rt5640.c
+++ b/sound/soc/codecs/rt5640.c
@@ -2059,6 +2059,7 @@ static struct snd_soc_codec_driver soc_c
static const struct regmap_config rt5640_regmap = {
.reg_bits = 8,
.val_bits = 16,
+ .use_single_rw = true,
.max_register = RT5640_VENDOR_ID2 + 1 + (ARRAY_SIZE(rt5640_ranges) *
RT5640_PR_SPACING),
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 090/158] ASoC: omap-twl4030: Fix typo in 2nd dai links platform_name
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 089/158] ASoC: rt5640: Do not allow regmap to use bulk read-write operations Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 091/158] bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address Greg Kroah-Hartman
` (69 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Peter Ujfalusi, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
commit fdaf42c0105a24de8aefa60f6f7360842c4e673e upstream.
The platform_name should be omap-mcasp3 for the 2nd link which is used for
voice connection.
Reported-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie+linaro@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/omap/omap-twl4030.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/omap/omap-twl4030.c
+++ b/sound/soc/omap/omap-twl4030.c
@@ -260,7 +260,7 @@ static struct snd_soc_dai_link omap_twl4
.stream_name = "TWL4030 Voice",
.cpu_dai_name = "omap-mcbsp.3",
.codec_dai_name = "twl4030-voice",
- .platform_name = "omap-mcbsp.2",
+ .platform_name = "omap-mcbsp.3",
.codec_name = "twl4030-codec",
.dai_fmt = SND_SOC_DAIFMT_DSP_A | SND_SOC_DAIFMT_IB_NF |
SND_SOC_DAIFMT_CBM_CFM,
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 091/158] bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 090/158] ASoC: omap-twl4030: Fix typo in 2nd dai links platform_name Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 092/158] bq2415x_charger: Fix Atomic Sleep Bug Greg Kroah-Hartman
` (68 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Martin K. Petersen,
Anil Gurumurthy, Christoph Hellwig
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 03a6c3ff3282ee9fa893089304d951e0be93a144 upstream.
bfa_swap_words() shifts its argument (assumed to be 64-bit) by 32 bits
each way. In two places the argument type is dma_addr_t, which may be
32-bit, in which case the effect of the bit shift is undefined:
drivers/scsi/bfa/bfa_fcpim.c: In function 'bfa_ioim_send_ioreq':
drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: left shift count >= width of type [enabled by default]
addr = bfa_sgaddr_le(sg_dma_address(sg));
^
drivers/scsi/bfa/bfa_fcpim.c:2497:4: warning: right shift count >= width of type [enabled by default]
drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: left shift count >= width of type [enabled by default]
addr = bfa_sgaddr_le(sg_dma_address(sg));
^
drivers/scsi/bfa/bfa_fcpim.c:2509:4: warning: right shift count >= width of type [enabled by default]
Avoid this by adding casts to u64 in bfa_swap_words().
Compile-tested only.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Anil Gurumurthy <anil.gurumurthy@qlogic.com>
Fixes: f16a17507b09 ('[SCSI] bfa: remove all OS wrappers')
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/bfa/bfa_ioc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/bfa/bfa_ioc.h
+++ b/drivers/scsi/bfa/bfa_ioc.h
@@ -72,7 +72,7 @@ struct bfa_sge_s {
} while (0)
#define bfa_swap_words(_x) ( \
- ((_x) << 32) | ((_x) >> 32))
+ ((u64)(_x) << 32) | ((u64)(_x) >> 32))
#ifdef __BIG_ENDIAN
#define bfa_sge_to_be(_x)
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 092/158] bq2415x_charger: Fix Atomic Sleep Bug
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 091/158] bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 093/158] ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject Greg Kroah-Hartman
` (67 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sebastian Reichel
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Reichel <sre@kernel.org>
commit 3c0185046c0ee49a6e55c714612ef3bcd5385df3 upstream.
Move sysfs_notify and i2c_transfer calls from bq2415x_notifier_call
to bq2415x_timer_work to avoid sleeping in atomic context.
This fixes the following bug:
[ 7.667449] Workqueue: events power_supply_changed_work
[ 7.673034] [<c0015c28>] (unwind_backtrace+0x0/0xe0) from [<c0011e1c>] (show_stack+0x10/0x14)
[ 7.682098] [<c0011e1c>] (show_stack+0x10/0x14) from [<c052cdd0>] (dump_stack+0x78/0xac)
[ 7.690704] [<c052cdd0>] (dump_stack+0x78/0xac) from [<c052a044>] (__schedule_bug+0x48/0x60)
[ 7.699645] [<c052a044>] (__schedule_bug+0x48/0x60) from [<c053071c>] (__schedule+0x74/0x638)
[ 7.708618] [<c053071c>] (__schedule+0x74/0x638) from [<c05301fc>] (schedule_timeout+0x1dc/0x24c)
[ 7.718017] [<c05301fc>] (schedule_timeout+0x1dc/0x24c) from [<c05316ec>] (wait_for_common+0x138/0x17c)
[ 7.727966] [<c05316ec>] (wait_for_common+0x138/0x17c) from [<c0362a70>] (omap_i2c_xfer+0x340/0x4a0)
[ 7.737640] [<c0362a70>] (omap_i2c_xfer+0x340/0x4a0) from [<c035d928>] (__i2c_transfer+0x40/0x74)
[ 7.747039] [<c035d928>] (__i2c_transfer+0x40/0x74) from [<c035e22c>] (i2c_transfer+0x6c/0x90)
[ 7.756195] [<c035e22c>] (i2c_transfer+0x6c/0x90) from [<c037ad24>] (bq2415x_i2c_write+0x48/0x78)
[ 7.765563] [<c037ad24>] (bq2415x_i2c_write+0x48/0x78) from [<c037ae60>] (bq2415x_set_weak_battery_voltage+0x4c/0x50)
[ 7.776824] [<c037ae60>] (bq2415x_set_weak_battery_voltage+0x4c/0x50) from [<c037bce8>] (bq2415x_set_mode+0xdc/0x14c)
[ 7.788085] [<c037bce8>] (bq2415x_set_mode+0xdc/0x14c) from [<c037bfb8>] (bq2415x_notifier_call+0xa8/0xb4)
[ 7.798309] [<c037bfb8>] (bq2415x_notifier_call+0xa8/0xb4) from [<c005f228>] (notifier_call_chain+0x38/0x68)
[ 7.808715] [<c005f228>] (notifier_call_chain+0x38/0x68) from [<c005f284>] (__atomic_notifier_call_chain+0x2c/0x3c)
[ 7.819732] [<c005f284>] (__atomic_notifier_call_chain+0x2c/0x3c) from [<c005f2a8>] (atomic_notifier_call_chain+0x14/0x18)
[ 7.831420] [<c005f2a8>] (atomic_notifier_call_chain+0x14/0x18) from [<c0378078>] (power_supply_changed_work+0x6c/0xb8)
[ 7.842864] [<c0378078>] (power_supply_changed_work+0x6c/0xb8) from [<c00556c0>] (process_one_work+0x248/0x440)
[ 7.853546] [<c00556c0>] (process_one_work+0x248/0x440) from [<c0055d6c>] (worker_thread+0x208/0x350)
[ 7.863372] [<c0055d6c>] (worker_thread+0x208/0x350) from [<c005b0ac>] (kthread+0xc8/0xdc)
[ 7.872131] [<c005b0ac>] (kthread+0xc8/0xdc) from [<c000e138>] (ret_from_fork+0x14/0x3c)
Fixes: 32260308b4ca ("bq2415x_charger: Use power_supply notifier for automode")
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/bq2415x_charger.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/power/bq2415x_charger.c
+++ b/drivers/power/bq2415x_charger.c
@@ -840,8 +840,7 @@ static int bq2415x_notifier_call(struct
if (bq->automode < 1)
return NOTIFY_OK;
- sysfs_notify(&bq->charger.dev->kobj, NULL, "reported_mode");
- bq2415x_set_mode(bq, bq->reported_mode);
+ schedule_delayed_work(&bq->work, 0);
return NOTIFY_OK;
}
@@ -892,6 +891,11 @@ static void bq2415x_timer_work(struct wo
int error;
int boost;
+ if (bq->automode > 0 && (bq->reported_mode != bq->mode)) {
+ sysfs_notify(&bq->charger.dev->kobj, NULL, "reported_mode");
+ bq2415x_set_mode(bq, bq->reported_mode);
+ }
+
if (!bq->autotimer)
return;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 093/158] ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 092/158] bq2415x_charger: Fix Atomic Sleep Bug Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 094/158] ACPICA: Namespace: Properly null terminate objects detached from a namespace node Greg Kroah-Hartman
` (66 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, David E. Box,
Bob Moore, Lv Zheng, Rafael J. Wysocki
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "David E. Box" <david.e.box@linux.intel.com>
commit 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce upstream.
Adds return status check on copy routines to delete the allocated destination
object if either copy fails. Reported by Colin Ian King on bugs.acpica.org,
Bug 1087.
The last applicable commit:
Commit: 3371c19c294a4cb3649aa4e84606be8a1d999e61
Subject: ACPICA: Remove ACPI_GET_OBJECT_TYPE macro
Link: https://bugs.acpica.org/show_bug.cgi?id=1087
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David E. Box <david.e.box@linux.intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpica/utcopy.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/acpi/acpica/utcopy.c
+++ b/drivers/acpi/acpica/utcopy.c
@@ -1001,5 +1001,11 @@ acpi_ut_copy_iobject_to_iobject(union ac
status = acpi_ut_copy_simple_object(source_desc, *dest_desc);
}
+ /* Delete the allocated object if copy failed */
+
+ if (ACPI_FAILURE(status)) {
+ acpi_ut_remove_reference(*dest_desc);
+ }
+
return_ACPI_STATUS(status);
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 094/158] ACPICA: Namespace: Properly null terminate objects detached from a namespace node
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 093/158] ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 095/158] ACPI / hotplug: Check scan handlers in acpi_scan_hot_remove() Greg Kroah-Hartman
` (65 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David E. Box, Bob Moore, Lv Zheng,
Rafael J. Wysocki
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "David E. Box" <david.e.box@linux.intel.com>
commit e23d9b8297546c6ceb7e70771e4915f2a41733cd upstream.
Fixes a bug exposed by an ACPICA unit test around the
acpi_attach_data()/acpi_detach_data() APIs where the failure to null
terminate a detached object led to the creation of a circular linked list
(and infinite looping) when the object is reattached.
Reported in acpica bugzilla #1063
Link: https://bugs.acpica.org/show_bug.cgi?id=1063
Signed-off-by: David E. Box <david.e.box@linux.intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpica/nsobject.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/acpi/acpica/nsobject.c
+++ b/drivers/acpi/acpica/nsobject.c
@@ -239,6 +239,17 @@ void acpi_ns_detach_object(struct acpi_n
}
}
+ /*
+ * Detach the object from any data objects (which are still held by
+ * the namespace node)
+ */
+
+ if (obj_desc->common.next_object &&
+ ((obj_desc->common.next_object)->common.type ==
+ ACPI_TYPE_LOCAL_DATA)) {
+ obj_desc->common.next_object = NULL;
+ }
+
/* Reset the node type to untyped */
node->type = ACPI_TYPE_ANY;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 095/158] ACPI / hotplug: Check scan handlers in acpi_scan_hot_remove()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 094/158] ACPICA: Namespace: Properly null terminate objects detached from a namespace node Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 096/158] spi/pxa2xx: Add ACPI ID for Intel Braswell Greg Kroah-Hartman
` (64 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tang Chen, Rafael J. Wysocki
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tang Chen <tangchen@cn.fujitsu.com>
commit dee1592638ab7ea35a32179b73f9284dead49c03 upstream.
When ACPI_HOTPLUG_MEMORY is not configured, memory_device_handler.attach
is not set. In acpi_scan_attach_handler(), the acpi_device->handler will
not be initialized.
In acpi_scan_hot_remove(), it doesn't check if acpi_device->handler is NULL.
If we do memory hot-remove without ACPI_HOTPLUG_MEMORY configured, the kernel
will panic.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000088
IP: [<ffffffff813e318f>] acpi_device_hotplug+0x1d7/0x4c4
PGD 0
Oops: 0000 [#1] SMP
Modules linked in: sd_mod(E) sr_mod(E) cdrom(E) crc_t10dif(E) crct10dif_common(E) ata_piix(E) libata(E)
CPU: 0 PID: 41 Comm: kworker/u2:1 Tainted: G E 3.16.0-rc7--3.16-rc7-tangchen+ #20
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
Workqueue: kacpi_hotplug acpi_hotplug_work_fn
task: ffff8800182436c0 ti: ffff880018254000 task.ti: ffff880018254000
RIP: 0010:[<ffffffff813e318f>] [<ffffffff813e318f>] acpi_device_hotplug+0x1d7/0x4c4
RSP: 0000:ffff880018257da8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff88001cd8d800 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88001e40e6f8 RDI: 0000000000000246
RBP: ffff880018257df0 R08: 0000000000000096 R09: 00000000000011a0
R10: 63735f6970636120 R11: 725f746f685f6e61 R12: 0000000000000003
R13: ffff88001cc1c400 R14: ffff88001e062028 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff88001e400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000088 CR3: 000000001a9a2000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000
Stack:
00000000523cab58 ffff88001cd8d9f8 ffff88001852d480 00000000523cab58
ffff88001852d480 ffff880018221e40 ffff88001cc1c400 ffff88001cce2d00
0000000000000040 ffff880018257e08 ffffffff813dc31d ffff88001852d480
Call Trace:
[<ffffffff813dc31d>] acpi_hotplug_work_fn+0x1e/0x29
[<ffffffff8108eefb>] process_one_work+0x17b/0x460
[<ffffffff8108f69d>] worker_thread+0x11d/0x5b0
[<ffffffff8108f580>] ? rescuer_thread+0x3a0/0x3a0
[<ffffffff81096811>] kthread+0xe1/0x100
[<ffffffff81096730>] ? kthread_create_on_node+0x1a0/0x1a0
[<ffffffff816cc6bc>] ret_from_fork+0x7c/0xb0
[<ffffffff81096730>] ? kthread_create_on_node+0x1a0/0x1a0
This patch fixes this problem by checking if acpi_device->handler is NULL
in acpi_scan_hot_remove().
Fixes: d22ddcbc4fb7 (ACPI / hotplug: Add demand_offline hotplug profile flag)
Signed-off-by: Tang Chen <tangchen@cn.fujitsu.com>
[rjw: Subject]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/scan.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -351,7 +351,8 @@ static int acpi_scan_hot_remove(struct a
unsigned long long sta;
acpi_status status;
- if (device->handler->hotplug.demand_offline && !acpi_force_hot_remove) {
+ if (device->handler && device->handler->hotplug.demand_offline
+ && !acpi_force_hot_remove) {
if (!acpi_scan_is_offline(device, true))
return -EBUSY;
} else {
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 096/158] spi/pxa2xx: Add ACPI ID for Intel Braswell
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 095/158] ACPI / hotplug: Check scan handlers in acpi_scan_hot_remove() Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 097/158] ACPI: Run fixed event device notifications in process context Greg Kroah-Hartman
` (63 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alan Cox, Mika Westerberg, Mark Brown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Cox <alan@linux.intel.com>
commit aca26364689e00e3b2052072424682231bdae6ae upstream.
The SPI host controller is the same as used in Baytrail, only the ACPI ID
is different so add this new ID to the list.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-pxa2xx.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1074,6 +1074,7 @@ static struct acpi_device_id pxa2xx_spi_
{ "INT3430", 0 },
{ "INT3431", 0 },
{ "80860F0E", 0 },
+ { "8086228E", 0 },
{ },
};
MODULE_DEVICE_TABLE(acpi, pxa2xx_spi_acpi_match);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 097/158] ACPI: Run fixed event device notifications in process context
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 096/158] spi/pxa2xx: Add ACPI ID for Intel Braswell Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 098/158] ACPI / scan: Allow ACPI drivers to bind to PNP device objects Greg Kroah-Hartman
` (62 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Block, Knut Petersen,
Lan Tianyu, Rafael J. Wysocki
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lan Tianyu <tianyu.lan@intel.com>
commit 236105db632c6279a020f78c83e22eaef746006b upstream.
Currently, notify callbacks for fixed button events are run from
interrupt context. That is not necessary and after commit 0bf6368ee8f2
(ACPI / button: Add ACPI Button event via netlink routine) it causes
netlink routines to be called from interrupt context which is not
correct.
Also, that is different from non-fixed device events (including
non-fixed button events) whose notify callbacks are all executed from
process context.
For the above reasons, make fixed button device notify callbacks run
in process context which will avoid the deadlock when using netlink
to report button events to user space.
Fixes: 0bf6368ee8f2 (ACPI / button: Add ACPI Button event via netlink routine)
Link: https://lkml.org/lkml/2014/8/21/606
Reported-by: Benjamin Block <bebl@mageta.org>
Reported-by: Knut Petersen <Knut_Petersen@t-online.de>
Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
[rjw: Function names, subject and changelog.]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/scan.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -920,12 +920,17 @@ static void acpi_device_notify(acpi_hand
device->driver->ops.notify(device, event);
}
-static acpi_status acpi_device_notify_fixed(void *data)
+static void acpi_device_notify_fixed(void *data)
{
struct acpi_device *device = data;
/* Fixed hardware devices have no handles */
acpi_device_notify(NULL, ACPI_FIXED_HARDWARE_EVENT, device);
+}
+
+static acpi_status acpi_device_fixed_event(void *data)
+{
+ acpi_os_execute(OSL_NOTIFY_HANDLER, acpi_device_notify_fixed, data);
return AE_OK;
}
@@ -936,12 +941,12 @@ static int acpi_device_install_notify_ha
if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON)
status =
acpi_install_fixed_event_handler(ACPI_EVENT_POWER_BUTTON,
- acpi_device_notify_fixed,
+ acpi_device_fixed_event,
device);
else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON)
status =
acpi_install_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON,
- acpi_device_notify_fixed,
+ acpi_device_fixed_event,
device);
else
status = acpi_install_notify_handler(device->handle,
@@ -958,10 +963,10 @@ static void acpi_device_remove_notify_ha
{
if (device->device_type == ACPI_BUS_TYPE_POWER_BUTTON)
acpi_remove_fixed_event_handler(ACPI_EVENT_POWER_BUTTON,
- acpi_device_notify_fixed);
+ acpi_device_fixed_event);
else if (device->device_type == ACPI_BUS_TYPE_SLEEP_BUTTON)
acpi_remove_fixed_event_handler(ACPI_EVENT_SLEEP_BUTTON,
- acpi_device_notify_fixed);
+ acpi_device_fixed_event);
else
acpi_remove_notify_handler(device->handle, ACPI_DEVICE_NOTIFY,
acpi_device_notify);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 098/158] ACPI / scan: Allow ACPI drivers to bind to PNP device objects
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 097/158] ACPI: Run fixed event device notifications in process context Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 099/158] ACPI / EC: Add support to disallow QR_EC to be issued when SCI_EVT isnt set Greg Kroah-Hartman
` (61 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gabriele Mazzotta, Dirk Griesbach,
Rafael J. Wysocki
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
commit fc2e0a8326d1b21d11ef8213298e5302867fed2c upstream.
We generally don't allow ACPI drivers to bind to ACPI device objects
that companion "physical" device objects are created for to avoid
situations in which two different drivers may attempt to handle one
device at the same time. Recent ACPI device enumeration rework
extended that approach to ACPI PNP devices by starting to use a scan
handler for enumerating them. However, we previously allowed ACPI
drivers to bind to ACPI device objects with existing PNP device
companions and changing that led to functional regressions on some
systems.
For this reason, add a special check for PNP devices in
acpi_device_probe() so that ACPI drivers can bind to ACPI device
objects having existing PNP device companions as before.
Fixes: eec15edbb0e1 (ACPI / PNP: use device ID list for PNPACPI device enumeration)
Link: https://bugzilla.kernel.org/show_bug.cgi?id=81511
Link: https://bugzilla.kernel.org/show_bug.cgi?id=81971
Reported-by: Gabriele Mazzotta <gabriele.mzt@gmail.com>
Reported-by: Dirk Griesbach <spamthis@freenet.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/scan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -978,7 +978,7 @@ static int acpi_device_probe(struct devi
struct acpi_driver *acpi_drv = to_acpi_driver(dev->driver);
int ret;
- if (acpi_dev->handler)
+ if (acpi_dev->handler && !acpi_is_pnp_device(acpi_dev))
return -EINVAL;
if (!acpi_drv->ops.add)
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 099/158] ACPI / EC: Add support to disallow QR_EC to be issued when SCI_EVT isnt set
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 098/158] ACPI / scan: Allow ACPI drivers to bind to PNP device objects Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 100/158] ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC Greg Kroah-Hartman
` (60 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lv Zheng, Rafael J. Wysocki
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lv Zheng <lv.zheng@intel.com>
commit 3afcf2ece453e1a8c2c6de19cdf06da3772a1b08 upstream.
There is a platform refusing to respond QR_EC when SCI_EVT isn't set
(Acer Aspire V5-573G).
Currently, we rely on the behaviour that the EC firmware can respond
something (for example, 0x00 to indicate "no outstanding events") to
QR_EC even when SCI_EVT is not set, but the reporter has complained
about AC/battery pluging/unpluging and video brightness change delay
on that platform.
This is because the work item that has issued QR_EC has to wait until
timeout in this case, and the _Qxx method evaluation work item queued
after QR_EC one is delayed.
It sounds reasonable to fix this issue by:
1. Implementing SCI_EVT sanity check before issuing QR_EC in the EC
driver's main state machine.
2. Moving QR_EC issuing out of the work queue used by _Qxx evaluation
to a seperate IRQ handling thread.
This patch fixes this issue using solution 1.
By disallowing QR_EC to be issued when SCI_EVT isn't set, we are able to
handle such platform in the EC driver's main state machine. This patch
enhances the state machine in this way to survive with such malfunctioning
EC firmware.
Note that this patch can also fix CLEAR_ON_RESUME quirk which also relies
on the assumption that the platforms are able to respond even when SCI_EVT
isn't set.
Fixes: c0d653412fc8 ACPI / EC: Fix race condition in ec_transaction_completed()
Link: https://bugzilla.kernel.org/show_bug.cgi?id=82611
Reported-and-tested-by: Alexander Mezin <mezin.alexander@gmail.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/ec.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -197,6 +197,8 @@ static bool advance_transaction(struct a
t->rdata[t->ri++] = acpi_ec_read_data(ec);
if (t->rlen == t->ri) {
t->flags |= ACPI_EC_COMMAND_COMPLETE;
+ if (t->command == ACPI_EC_COMMAND_QUERY)
+ pr_debug("hardware QR_EC completion\n");
wakeup = true;
}
} else
@@ -208,7 +210,20 @@ static bool advance_transaction(struct a
}
return wakeup;
} else {
- if ((status & ACPI_EC_FLAG_IBF) == 0) {
+ /*
+ * There is firmware refusing to respond QR_EC when SCI_EVT
+ * is not set, for which case, we complete the QR_EC
+ * without issuing it to the firmware.
+ * https://bugzilla.kernel.org/show_bug.cgi?id=86211
+ */
+ if (!(status & ACPI_EC_FLAG_SCI) &&
+ (t->command == ACPI_EC_COMMAND_QUERY)) {
+ t->flags |= ACPI_EC_COMMAND_POLL;
+ t->rdata[t->ri++] = 0x00;
+ t->flags |= ACPI_EC_COMMAND_COMPLETE;
+ pr_debug("software QR_EC completion\n");
+ wakeup = true;
+ } else if ((status & ACPI_EC_FLAG_IBF) == 0) {
acpi_ec_write_cmd(ec, t->command);
t->flags |= ACPI_EC_COMMAND_POLL;
} else
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 100/158] ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 099/158] ACPI / EC: Add support to disallow QR_EC to be issued when SCI_EVT isnt set Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 101/158] ACPI / scan: not cache _SUN value in struct acpi_device_pnp Greg Kroah-Hartman
` (59 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lv Zheng, Rafael J. Wysocki
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lv Zheng <lv.zheng@intel.com>
commit 558e4736f2e1b0e6323adf7a5e4df77ed6cfc1a4 upstream.
There is platform refusing to respond QR_EC when SCI_EVT isn't set
which is Acer Aspire V5-573G.
By disallowing QR_EC to be issued before the previous one has been
completed we are able to reduce the possibilities to trigger issues on
such platforms.
Note that this fix can only reduce the occurrence rate of this issue, but
this issue may still occur when such a platform doesn't clear SCI_EVT
before or immediately after completing the previous QR_EC transaction.
This patch cannot fix the CLEAR_ON_RESUME quirk which also relies on
the assumption that the platforms are able to respond even when SCI_EVT
isn't set.
But this patch is still useful as it can help to reduce the number of
scheduled QR_EC work items.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=82611
Reported-and-tested-by: Alexander Mezin <mezin.alexander@gmail.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/ec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -303,11 +303,11 @@ static int acpi_ec_transaction_unlocked(
/* following two actions should be kept atomic */
ec->curr = t;
start_transaction(ec);
- if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
- clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
spin_unlock_irqrestore(&ec->lock, tmp);
ret = ec_poll(ec);
spin_lock_irqsave(&ec->lock, tmp);
+ if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
+ clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
ec->curr = NULL;
spin_unlock_irqrestore(&ec->lock, tmp);
return ret;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 101/158] ACPI / scan: not cache _SUN value in struct acpi_device_pnp
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 100/158] ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 102/158] ACPI / cpuidle: fix deadlock between cpuidle_lock and cpu_hotplug.lock Greg Kroah-Hartman
` (58 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yasuaki Ishimatsu, Rafael J. Wysocki
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
commit a383b68d9fe9864c4d3b86f67ad6488f58136435 upstream.
The _SUN device indentification object is not guaranteed to return
the same value every time it is executed, so we should not cache its
return value, but rather execute it every time as needed. If it is
cached, an incorrect stale value may be used in some situations.
This issue was exposed by commit 202317a573b2 (ACPI / scan: Add
acpi_device objects for all device nodes in the namespace). Fix it
by avoiding to cache the return value of _SUN.
Fixes: 202317a573b2 (ACPI / scan: Add acpi_device objects for all device nodes in the namespace)
Signed-off-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
[ rjw: Changelog ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/scan.c | 15 ++++++++-------
include/acpi/acpi_bus.h | 1 -
2 files changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -665,8 +665,14 @@ static ssize_t
acpi_device_sun_show(struct device *dev, struct device_attribute *attr,
char *buf) {
struct acpi_device *acpi_dev = to_acpi_device(dev);
+ acpi_status status;
+ unsigned long long sun;
+
+ status = acpi_evaluate_integer(acpi_dev->handle, "_SUN", NULL, &sun);
+ if (ACPI_FAILURE(status))
+ return -ENODEV;
- return sprintf(buf, "%lu\n", acpi_dev->pnp.sun);
+ return sprintf(buf, "%llu\n", sun);
}
static DEVICE_ATTR(sun, 0444, acpi_device_sun_show, NULL);
@@ -688,7 +694,6 @@ static int acpi_device_setup_files(struc
{
struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
acpi_status status;
- unsigned long long sun;
int result = 0;
/*
@@ -729,14 +734,10 @@ static int acpi_device_setup_files(struc
if (dev->pnp.unique_id)
result = device_create_file(&dev->dev, &dev_attr_uid);
- status = acpi_evaluate_integer(dev->handle, "_SUN", NULL, &sun);
- if (ACPI_SUCCESS(status)) {
- dev->pnp.sun = (unsigned long)sun;
+ if (acpi_has_method(dev->handle, "_SUN")) {
result = device_create_file(&dev->dev, &dev_attr_sun);
if (result)
goto end;
- } else {
- dev->pnp.sun = (unsigned long)-1;
}
if (acpi_has_method(dev->handle, "_STA")) {
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -246,7 +246,6 @@ struct acpi_device_pnp {
acpi_device_name device_name; /* Driver-determined */
acpi_device_class device_class; /* " */
union acpi_object *str_obj; /* unicode string for _STR method */
- unsigned long sun; /* _SUN */
};
#define acpi_device_bid(d) ((d)->pnp.bus_id)
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 102/158] ACPI / cpuidle: fix deadlock between cpuidle_lock and cpu_hotplug.lock
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 101/158] ACPI / scan: not cache _SUN value in struct acpi_device_pnp Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 103/158] ACPI / video: Fix use_native_backlight selection logic Greg Kroah-Hartman
` (57 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jiri Kosina, Rafael J. Wysocki
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <jkosina@suse.cz>
commit 6726655dfdd2dc60c035c690d9f10cb69d7ea075 upstream.
There is a following AB-BA dependency between cpu_hotplug.lock and
cpuidle_lock:
1) cpu_hotplug.lock -> cpuidle_lock
enable_nonboot_cpus()
_cpu_up()
cpu_hotplug_begin()
LOCK(cpu_hotplug.lock)
cpu_notify()
...
acpi_processor_hotplug()
cpuidle_pause_and_lock()
LOCK(cpuidle_lock)
2) cpuidle_lock -> cpu_hotplug.lock
acpi_os_execute_deferred() workqueue
...
acpi_processor_cst_has_changed()
cpuidle_pause_and_lock()
LOCK(cpuidle_lock)
get_online_cpus()
LOCK(cpu_hotplug.lock)
Fix this by reversing the order acpi_processor_cst_has_changed() does
thigs -- let it first execute the protection against CPU hotplug by
calling get_online_cpus() and obtain the cpuidle lock only after that (and
perform the symmentric change when allowing CPUs hotplug again and
dropping cpuidle lock).
Spotted by lockdep.
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/processor_idle.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1071,9 +1071,9 @@ int acpi_processor_cst_has_changed(struc
if (pr->id == 0 && cpuidle_get_driver() == &acpi_idle_driver) {
- cpuidle_pause_and_lock();
/* Protect against cpu-hotplug */
get_online_cpus();
+ cpuidle_pause_and_lock();
/* Disable all cpuidle devices */
for_each_online_cpu(cpu) {
@@ -1100,8 +1100,8 @@ int acpi_processor_cst_has_changed(struc
cpuidle_enable_device(dev);
}
}
- put_online_cpus();
cpuidle_resume_and_unlock();
+ put_online_cpus();
}
return 0;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 103/158] ACPI / video: Fix use_native_backlight selection logic
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 102/158] ACPI / cpuidle: fix deadlock between cpuidle_lock and cpu_hotplug.lock Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 105/158] ACPI / video: Disable native_backlight on HP ENVY 15 Notebook PC Greg Kroah-Hartman
` (56 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hans de Goede, Rafael J. Wysocki
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit 25294e9f00f03b2b4f4c56e913bc8c573972f33b upstream.
Commit 751109aad583 ("ACPI / video: Change the default for
video.use_native_backlight to 1") has changed the default for
use_native_backlight from 0 to 1, but instead of changing
use_native_backlight_dmi to true, and leaving use_native_backlight_param at -1,
it has changed use_native_backlight_param to 1.
This causes acpi_video_use_native_backlight() to always think that a value was
specified through the param, making it impossible to add a dmi based quirk
to force 0 now that the default is 1.
This fixes this by restoring the use_native_backlight_param default to -1, and
instead setting the use_native_backlight_dmi default to true.
Fixes: 751109aad583 (ACPI / video: Change the default for video.use_native_backlight to 1)
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/video.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -82,9 +82,9 @@ module_param(allow_duplicates, bool, 064
* For Windows 8 systems: used to decide if video module
* should skip registering backlight interface of its own.
*/
-static int use_native_backlight_param = 1;
+static int use_native_backlight_param = -1;
module_param_named(use_native_backlight, use_native_backlight_param, int, 0444);
-static bool use_native_backlight_dmi = false;
+static bool use_native_backlight_dmi = true;
static int register_count;
static struct mutex video_list_lock;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 105/158] ACPI / video: Disable native_backlight on HP ENVY 15 Notebook PC
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 103/158] ACPI / video: Fix use_native_backlight selection logic Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 106/158] xen/events/fifo: reset control block and local HEADs on resume Greg Kroah-Hartman
` (55 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hans de Goede, Rafael J. Wysocki
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit 84c34858a85ecf9dabd72847d860c7d3fb7536e7 upstream.
Link: https://bugs.freedesktop.org/show_bug.cgi?id=81515
Reported-and-tested-by: Hohahiu <rakothedin@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/video.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -675,6 +675,17 @@ static struct dmi_system_id video_dmi_ta
DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T520"),
},
},
+
+ /* The native backlight controls do not work on some older machines */
+ {
+ /* https://bugs.freedesktop.org/show_bug.cgi?id=81515 */
+ .callback = video_disable_native_backlight,
+ .ident = "HP ENVY 15 Notebook",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP ENVY 15 Notebook PC"),
+ },
+ },
{}
};
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 106/158] xen/events/fifo: reset control block and local HEADs on resume
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 105/158] ACPI / video: Disable native_backlight on HP ENVY 15 Notebook PC Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 107/158] ring-buffer: Always reset iterator to reader page Greg Kroah-Hartman
` (54 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Vrabel, Boris Ostrovsky
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Vrabel <david.vrabel@citrix.com>
commit c12784c3d14a2110468ec4d1383f60cfd2665576 upstream.
When using the FIFO-based event channel ABI, if the control block or
the local HEADs are not reset after resuming the guest may see stale
HEAD values and will fail to traverse the FIFO correctly.
This may prevent one or more VCPUs from receiving any events following
a resume.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/events/events_fifo.c | 48 ++++++++++++++++++++++-----------------
1 file changed, 28 insertions(+), 20 deletions(-)
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -99,6 +99,25 @@ static unsigned evtchn_fifo_nr_channels(
return event_array_pages * EVENT_WORDS_PER_PAGE;
}
+static int init_control_block(int cpu,
+ struct evtchn_fifo_control_block *control_block)
+{
+ struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu);
+ struct evtchn_init_control init_control;
+ unsigned int i;
+
+ /* Reset the control block and the local HEADs. */
+ clear_page(control_block);
+ for (i = 0; i < EVTCHN_FIFO_MAX_QUEUES; i++)
+ q->head[i] = 0;
+
+ init_control.control_gfn = virt_to_mfn(control_block);
+ init_control.offset = 0;
+ init_control.vcpu = cpu;
+
+ return HYPERVISOR_event_channel_op(EVTCHNOP_init_control, &init_control);
+}
+
static void free_unused_array_pages(void)
{
unsigned i;
@@ -323,7 +342,6 @@ static void evtchn_fifo_resume(void)
for_each_possible_cpu(cpu) {
void *control_block = per_cpu(cpu_control_block, cpu);
- struct evtchn_init_control init_control;
int ret;
if (!control_block)
@@ -340,12 +358,7 @@ static void evtchn_fifo_resume(void)
continue;
}
- init_control.control_gfn = virt_to_mfn(control_block);
- init_control.offset = 0;
- init_control.vcpu = cpu;
-
- ret = HYPERVISOR_event_channel_op(EVTCHNOP_init_control,
- &init_control);
+ ret = init_control_block(cpu, control_block);
if (ret < 0)
BUG();
}
@@ -373,30 +386,25 @@ static const struct evtchn_ops evtchn_op
.resume = evtchn_fifo_resume,
};
-static int evtchn_fifo_init_control_block(unsigned cpu)
+static int evtchn_fifo_alloc_control_block(unsigned cpu)
{
- struct page *control_block = NULL;
- struct evtchn_init_control init_control;
+ void *control_block = NULL;
int ret = -ENOMEM;
- control_block = alloc_page(GFP_KERNEL|__GFP_ZERO);
+ control_block = (void *)__get_free_page(GFP_KERNEL);
if (control_block == NULL)
goto error;
- init_control.control_gfn = virt_to_mfn(page_address(control_block));
- init_control.offset = 0;
- init_control.vcpu = cpu;
-
- ret = HYPERVISOR_event_channel_op(EVTCHNOP_init_control, &init_control);
+ ret = init_control_block(cpu, control_block);
if (ret < 0)
goto error;
- per_cpu(cpu_control_block, cpu) = page_address(control_block);
+ per_cpu(cpu_control_block, cpu) = control_block;
return 0;
error:
- __free_page(control_block);
+ free_page((unsigned long)control_block);
return ret;
}
@@ -410,7 +418,7 @@ static int evtchn_fifo_cpu_notification(
switch (action) {
case CPU_UP_PREPARE:
if (!per_cpu(cpu_control_block, cpu))
- ret = evtchn_fifo_init_control_block(cpu);
+ ret = evtchn_fifo_alloc_control_block(cpu);
break;
default:
break;
@@ -427,7 +435,7 @@ int __init xen_evtchn_fifo_init(void)
int cpu = get_cpu();
int ret;
- ret = evtchn_fifo_init_control_block(cpu);
+ ret = evtchn_fifo_alloc_control_block(cpu);
if (ret < 0)
goto out;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 107/158] ring-buffer: Always reset iterator to reader page
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (101 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 106/158] xen/events/fifo: reset control block and local HEADs on resume Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 108/158] ring-buffer: Up rb_iter_peek() loop count to 3 Greg Kroah-Hartman
` (53 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Rostedt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 651e22f2701b4113989237c3048d17337dd2185c upstream.
When performing a consuming read, the ring buffer swaps out a
page from the ring buffer with a empty page and this page that
was swapped out becomes the new reader page. The reader page
is owned by the reader and since it was swapped out of the ring
buffer, writers do not have access to it (there's an exception
to that rule, but it's out of scope for this commit).
When reading the "trace" file, it is a non consuming read, which
means that the data in the ring buffer will not be modified.
When the trace file is opened, a ring buffer iterator is allocated
and writes to the ring buffer are disabled, such that the iterator
will not have issues iterating over the data.
Although the ring buffer disabled writes, it does not disable other
reads, or even consuming reads. If a consuming read happens, then
the iterator is reset and starts reading from the beginning again.
My tests would sometimes trigger this bug on my i386 box:
WARNING: CPU: 0 PID: 5175 at kernel/trace/trace.c:1527 __trace_find_cmdline+0x66/0xaa()
Modules linked in:
CPU: 0 PID: 5175 Comm: grep Not tainted 3.16.0-rc3-test+ #8
Hardware name: /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006
00000000 00000000 f09c9e1c c18796b3 c1b5d74c f09c9e4c c103a0e3 c1b5154b
f09c9e78 00001437 c1b5d74c 000005f7 c10bd85a c10bd85a c1cac57c f09c9eb0
ed0e0000 f09c9e64 c103a185 00000009 f09c9e5c c1b5154b f09c9e78 f09c9e80^M
Call Trace:
[<c18796b3>] dump_stack+0x4b/0x75
[<c103a0e3>] warn_slowpath_common+0x7e/0x95
[<c10bd85a>] ? __trace_find_cmdline+0x66/0xaa
[<c10bd85a>] ? __trace_find_cmdline+0x66/0xaa
[<c103a185>] warn_slowpath_fmt+0x33/0x35
[<c10bd85a>] __trace_find_cmdline+0x66/0xaa^M
[<c10bed04>] trace_find_cmdline+0x40/0x64
[<c10c3c16>] trace_print_context+0x27/0xec
[<c10c4360>] ? trace_seq_printf+0x37/0x5b
[<c10c0b15>] print_trace_line+0x319/0x39b
[<c10ba3fb>] ? ring_buffer_read+0x47/0x50
[<c10c13b1>] s_show+0x192/0x1ab
[<c10bfd9a>] ? s_next+0x5a/0x7c
[<c112e76e>] seq_read+0x267/0x34c
[<c1115a25>] vfs_read+0x8c/0xef
[<c112e507>] ? seq_lseek+0x154/0x154
[<c1115ba2>] SyS_read+0x54/0x7f
[<c188488e>] syscall_call+0x7/0xb
---[ end trace 3f507febd6b4cc83 ]---
>>>> ##### CPU 1 buffer started ####
Which was the __trace_find_cmdline() function complaining about the pid
in the event record being negative.
After adding more test cases, this would trigger more often. Strangely
enough, it would never trigger on a single test, but instead would trigger
only when running all the tests. I believe that was the case because it
required one of the tests to be shutting down via delayed instances while
a new test started up.
After spending several days debugging this, I found that it was caused by
the iterator becoming corrupted. Debugging further, I found out why
the iterator became corrupted. It happened with the rb_iter_reset().
As consuming reads may not read the full reader page, and only part
of it, there's a "read" field to know where the last read took place.
The iterator, must also start at the read position. In the rb_iter_reset()
code, if the reader page was disconnected from the ring buffer, the iterator
would start at the head page within the ring buffer (where writes still
happen). But the mistake there was that it still used the "read" field
to start the iterator on the head page, where it should always start
at zero because readers never read from within the ring buffer where
writes occur.
I originally wrote a patch to have it set the iter->head to 0 instead
of iter->head_page->read, but then I questioned why it wasn't always
setting the iter to point to the reader page, as the reader page is
still valid. The list_empty(reader_page->list) just means that it was
successful in swapping out. But the reader_page may still have data.
There was a bug report a long time ago that was not reproducible that
had something about trace_pipe (consuming read) not matching trace
(iterator read). This may explain why that happened.
Anyway, the correct answer to this bug is to always use the reader page
an not reset the iterator to inside the writable ring buffer.
Fixes: d769041f8653 "ring_buffer: implement new locking"
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ring_buffer.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3357,21 +3357,16 @@ static void rb_iter_reset(struct ring_bu
struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer;
/* Iterator usage is expected to have record disabled */
- if (list_empty(&cpu_buffer->reader_page->list)) {
- iter->head_page = rb_set_head_page(cpu_buffer);
- if (unlikely(!iter->head_page))
- return;
- iter->head = iter->head_page->read;
- } else {
- iter->head_page = cpu_buffer->reader_page;
- iter->head = cpu_buffer->reader_page->read;
- }
+ iter->head_page = cpu_buffer->reader_page;
+ iter->head = cpu_buffer->reader_page->read;
+
+ iter->cache_reader_page = iter->head_page;
+ iter->cache_read = iter->head;
+
if (iter->head)
iter->read_stamp = cpu_buffer->read_stamp;
else
iter->read_stamp = iter->head_page->page->time_stamp;
- iter->cache_reader_page = cpu_buffer->reader_page;
- iter->cache_read = cpu_buffer->read;
}
/**
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 108/158] ring-buffer: Up rb_iter_peek() loop count to 3
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (102 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 107/158] ring-buffer: Always reset iterator to reader page Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 109/158] mnt: Only change user settable mount flags in remount Greg Kroah-Hartman
` (52 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Rostedt
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 021de3d904b88b1771a3a2cfc5b75023c391e646 upstream.
After writting a test to try to trigger the bug that caused the
ring buffer iterator to become corrupted, I hit another bug:
WARNING: CPU: 1 PID: 5281 at kernel/trace/ring_buffer.c:3766 rb_iter_peek+0x113/0x238()
Modules linked in: ipt_MASQUERADE sunrpc [...]
CPU: 1 PID: 5281 Comm: grep Tainted: G W 3.16.0-rc3-test+ #143
Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS SDBLI944.86P 05/08/2007
0000000000000000 ffffffff81809a80 ffffffff81503fb0 0000000000000000
ffffffff81040ca1 ffff8800796d6010 ffffffff810c138d ffff8800796d6010
ffff880077438c80 ffff8800796d6010 ffff88007abbe600 0000000000000003
Call Trace:
[<ffffffff81503fb0>] ? dump_stack+0x4a/0x75
[<ffffffff81040ca1>] ? warn_slowpath_common+0x7e/0x97
[<ffffffff810c138d>] ? rb_iter_peek+0x113/0x238
[<ffffffff810c138d>] ? rb_iter_peek+0x113/0x238
[<ffffffff810c14df>] ? ring_buffer_iter_peek+0x2d/0x5c
[<ffffffff810c6f73>] ? tracing_iter_reset+0x6e/0x96
[<ffffffff810c74a3>] ? s_start+0xd7/0x17b
[<ffffffff8112b13e>] ? kmem_cache_alloc_trace+0xda/0xea
[<ffffffff8114cf94>] ? seq_read+0x148/0x361
[<ffffffff81132d98>] ? vfs_read+0x93/0xf1
[<ffffffff81132f1b>] ? SyS_read+0x60/0x8e
[<ffffffff8150bf9f>] ? tracesys+0xdd/0xe2
Debugging this bug, which triggers when the rb_iter_peek() loops too
many times (more than 2 times), I discovered there's a case that can
cause that function to legitimately loop 3 times!
rb_iter_peek() is different than rb_buffer_peek() as the rb_buffer_peek()
only deals with the reader page (it's for consuming reads). The
rb_iter_peek() is for traversing the buffer without consuming it, and as
such, it can loop for one more reason. That is, if we hit the end of
the reader page or any page, it will go to the next page and try again.
That is, we have this:
1. iter->head > iter->head_page->page->commit
(rb_inc_iter() which moves the iter to the next page)
try again
2. event = rb_iter_head_event()
event->type_len == RINGBUF_TYPE_TIME_EXTEND
rb_advance_iter()
try again
3. read the event.
But we never get to 3, because the count is greater than 2 and we
cause the WARNING and return NULL.
Up the counter to 3.
Fixes: 69d1b839f7ee "ring-buffer: Bind time extend and data events together"
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ring_buffer.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1984,7 +1984,7 @@ rb_add_time_stamp(struct ring_buffer_eve
/**
* rb_update_event - update event type and data
- * @event: the even to update
+ * @event: the event to update
* @type: the type of event
* @length: the size of the event field in the ring buffer
*
@@ -3759,12 +3759,14 @@ rb_iter_peek(struct ring_buffer_iter *it
return NULL;
/*
- * We repeat when a time extend is encountered.
- * Since the time extend is always attached to a data event,
- * we should never loop more than once.
- * (We never hit the following condition more than twice).
+ * We repeat when a time extend is encountered or we hit
+ * the end of the page. Since the time extend is always attached
+ * to a data event, we should never loop more than three times.
+ * Once for going to next page, once on time extend, and
+ * finally once to get the event.
+ * (We never hit the following condition more than thrice).
*/
- if (RB_WARN_ON(cpu_buffer, ++nr_loops > 2))
+ if (RB_WARN_ON(cpu_buffer, ++nr_loops > 3))
return NULL;
if (rb_per_cpu_empty(cpu_buffer))
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 109/158] mnt: Only change user settable mount flags in remount
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (103 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 108/158] ring-buffer: Up rb_iter_peek() loop count to 3 Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 110/158] mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags into do_remount Greg Kroah-Hartman
` (51 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Serge E. Hallyn, Eric W. Biederman
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit a6138db815df5ee542d848318e5dae681590fccd upstream.
Kenton Varda <kenton@sandstorm.io> discovered that by remounting a
read-only bind mount read-only in a user namespace the
MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user
to the remount a read-only mount read-write.
Correct this by replacing the mask of mount flags to preserve
with a mask of mount flags that may be changed, and preserve
all others. This ensures that any future bugs with this mask and
remount will fail in an easy to detect way where new mount flags
simply won't change.
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 2 +-
include/linux/mount.h | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1937,7 +1937,7 @@ static int do_remount(struct path *path,
err = do_remount_sb(sb, flags, data, 0);
if (!err) {
lock_mount_hash();
- mnt_flags |= mnt->mnt.mnt_flags & MNT_PROPAGATION_MASK;
+ mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK;
mnt->mnt.mnt_flags = mnt_flags;
touch_mnt_namespace(mnt->mnt_ns);
unlock_mount_hash();
--- a/include/linux/mount.h
+++ b/include/linux/mount.h
@@ -42,7 +42,9 @@ struct mnt_namespace;
* flag, consider how it interacts with shared mounts.
*/
#define MNT_SHARED_MASK (MNT_UNBINDABLE)
-#define MNT_PROPAGATION_MASK (MNT_SHARED | MNT_UNBINDABLE)
+#define MNT_USER_SETTABLE_MASK (MNT_NOSUID | MNT_NODEV | MNT_NOEXEC \
+ | MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME \
+ | MNT_READONLY)
#define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \
MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED)
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 110/158] mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags into do_remount
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (104 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 109/158] mnt: Only change user settable mount flags in remount Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 111/158] mnt: Correct permission checks in do_remount Greg Kroah-Hartman
` (50 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Serge E. Hallyn, Eric W. Biederman
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 07b645589dcda8b7a5249e096fece2a67556f0f4 upstream.
There are no races as locked mount flags are guaranteed to never change.
Moving the test into do_remount makes it more visible, and ensures all
filesystem remounts pass the MNT_LOCK_READONLY permission check. This
second case is not an issue today as filesystem remounts are guarded
by capable(CAP_DAC_ADMIN) and thus will always fail in less privileged
mount namespaces, but it could become an issue in the future.
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1896,9 +1896,6 @@ static int change_mount_flags(struct vfs
if (readonly_request == __mnt_is_readonly(mnt))
return 0;
- if (mnt->mnt_flags & MNT_LOCK_READONLY)
- return -EPERM;
-
if (readonly_request)
error = mnt_make_readonly(real_mount(mnt));
else
@@ -1924,6 +1921,16 @@ static int do_remount(struct path *path,
if (path->dentry != path->mnt->mnt_root)
return -EINVAL;
+ /* Don't allow changing of locked mnt flags.
+ *
+ * No locks need to be held here while testing the various
+ * MNT_LOCK flags because those flags can never be cleared
+ * once they are set.
+ */
+ if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) &&
+ !(mnt_flags & MNT_READONLY)) {
+ return -EPERM;
+ }
err = security_sb_remount(sb, data);
if (err)
return err;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 111/158] mnt: Correct permission checks in do_remount
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (105 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 110/158] mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags into do_remount Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 112/158] mnt: Change the default remount atime from relatime to the existing value Greg Kroah-Hartman
` (49 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Serge E. Hallyn, Eric W. Biederman
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 9566d6742852c527bf5af38af5cbb878dad75705 upstream.
While invesgiating the issue where in "mount --bind -oremount,ro ..."
would result in later "mount --bind -oremount,rw" succeeding even if
the mount started off locked I realized that there are several
additional mount flags that should be locked and are not.
In particular MNT_NOSUID, MNT_NODEV, MNT_NOEXEC, and the atime
flags in addition to MNT_READONLY should all be locked. These
flags are all per superblock, can all be changed with MS_BIND,
and should not be changable if set by a more privileged user.
The following additions to the current logic are added in this patch.
- nosuid may not be clearable by a less privileged user.
- nodev may not be clearable by a less privielged user.
- noexec may not be clearable by a less privileged user.
- atime flags may not be changeable by a less privileged user.
The logic with atime is that always setting atime on access is a
global policy and backup software and auditing software could break if
atime bits are not updated (when they are configured to be updated),
and serious performance degradation could result (DOS attack) if atime
updates happen when they have been explicitly disabled. Therefore an
unprivileged user should not be able to mess with the atime bits set
by a more privileged user.
The additional restrictions are implemented with the addition of
MNT_LOCK_NOSUID, MNT_LOCK_NODEV, MNT_LOCK_NOEXEC, and MNT_LOCK_ATIME
mnt flags.
Taken together these changes and the fixes for MNT_LOCK_READONLY
should make it safe for an unprivileged user to create a user
namespace and to call "mount --bind -o remount,... ..." without
the danger of mount flags being changed maliciously.
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 36 +++++++++++++++++++++++++++++++++---
include/linux/mount.h | 5 +++++
2 files changed, 38 insertions(+), 3 deletions(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -890,8 +890,21 @@ static struct mount *clone_mnt(struct mo
mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED);
/* Don't allow unprivileged users to change mount flags */
- if ((flag & CL_UNPRIVILEGED) && (mnt->mnt.mnt_flags & MNT_READONLY))
- mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;
+ if (flag & CL_UNPRIVILEGED) {
+ mnt->mnt.mnt_flags |= MNT_LOCK_ATIME;
+
+ if (mnt->mnt.mnt_flags & MNT_READONLY)
+ mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;
+
+ if (mnt->mnt.mnt_flags & MNT_NODEV)
+ mnt->mnt.mnt_flags |= MNT_LOCK_NODEV;
+
+ if (mnt->mnt.mnt_flags & MNT_NOSUID)
+ mnt->mnt.mnt_flags |= MNT_LOCK_NOSUID;
+
+ if (mnt->mnt.mnt_flags & MNT_NOEXEC)
+ mnt->mnt.mnt_flags |= MNT_LOCK_NOEXEC;
+ }
/* Don't allow unprivileged users to reveal what is under a mount */
if ((flag & CL_UNPRIVILEGED) && list_empty(&old->mnt_expire))
@@ -1931,6 +1944,23 @@ static int do_remount(struct path *path,
!(mnt_flags & MNT_READONLY)) {
return -EPERM;
}
+ if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) &&
+ !(mnt_flags & MNT_NODEV)) {
+ return -EPERM;
+ }
+ if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) &&
+ !(mnt_flags & MNT_NOSUID)) {
+ return -EPERM;
+ }
+ if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) &&
+ !(mnt_flags & MNT_NOEXEC)) {
+ return -EPERM;
+ }
+ if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) &&
+ ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK))) {
+ return -EPERM;
+ }
+
err = security_sb_remount(sb, data);
if (err)
return err;
@@ -2129,7 +2159,7 @@ static int do_new_mount(struct path *pat
*/
if (!(type->fs_flags & FS_USERNS_DEV_MOUNT)) {
flags |= MS_NODEV;
- mnt_flags |= MNT_NODEV;
+ mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV;
}
}
--- a/include/linux/mount.h
+++ b/include/linux/mount.h
@@ -45,12 +45,17 @@ struct mnt_namespace;
#define MNT_USER_SETTABLE_MASK (MNT_NOSUID | MNT_NODEV | MNT_NOEXEC \
| MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME \
| MNT_READONLY)
+#define MNT_ATIME_MASK (MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME )
#define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \
MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED)
#define MNT_INTERNAL 0x4000
+#define MNT_LOCK_ATIME 0x040000
+#define MNT_LOCK_NOEXEC 0x080000
+#define MNT_LOCK_NOSUID 0x100000
+#define MNT_LOCK_NODEV 0x200000
#define MNT_LOCK_READONLY 0x400000
#define MNT_LOCKED 0x800000
#define MNT_DOOMED 0x1000000
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 112/158] mnt: Change the default remount atime from relatime to the existing value
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (106 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 111/158] mnt: Correct permission checks in do_remount Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 113/158] mnt: Add tests for unprivileged remount cases that have found to be faulty Greg Kroah-Hartman
` (48 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Serge E. Hallyn, Eric W. Biederman
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit ffbc6f0ead47fa5a1dc9642b0331cb75c20a640e upstream.
Since March 2009 the kernel has treated the state that if no
MS_..ATIME flags are passed then the kernel defaults to relatime.
Defaulting to relatime instead of the existing atime state during a
remount is silly, and causes problems in practice for people who don't
specify any MS_...ATIME flags and to get the default filesystem atime
setting. Those users may encounter a permission error because the
default atime setting does not work.
A default that does not work and causes permission problems is
ridiculous, so preserve the existing value to have a default
atime setting that is always guaranteed to work.
Using the default atime setting in this way is particularly
interesting for applications built to run in restricted userspace
environments without /proc mounted, as the existing atime mount
options of a filesystem can not be read from /proc/mounts.
In practice this fixes user space that uses the default atime
setting on remount that are broken by the permission checks
keeping less privileged users from changing more privileged users
atime settings.
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2473,6 +2473,14 @@ long do_mount(const char *dev_name, cons
if (flags & MS_RDONLY)
mnt_flags |= MNT_READONLY;
+ /* The default atime for remount is preservation */
+ if ((flags & MS_REMOUNT) &&
+ ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME |
+ MS_STRICTATIME)) == 0)) {
+ mnt_flags &= ~MNT_ATIME_MASK;
+ mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK;
+ }
+
flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN |
MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
MS_STRICTATIME);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 113/158] mnt: Add tests for unprivileged remount cases that have found to be faulty
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (107 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 112/158] mnt: Change the default remount atime from relatime to the existing value Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 114/158] get rid of propagate_umount() mistakenly treating slaves as busy Greg Kroah-Hartman
` (47 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Serge E. Hallyn, Eric W. Biederman
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit db181ce011e3c033328608299cd6fac06ea50130 upstream.
Kenton Varda <kenton@sandstorm.io> discovered that by remounting a
read-only bind mount read-only in a user namespace the
MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user
to the remount a read-only mount read-write.
Upon review of the code in remount it was discovered that the code allowed
nosuid, noexec, and nodev to be cleared. It was also discovered that
the code was allowing the per mount atime flags to be changed.
The first naive patch to fix these issues contained the flaw that using
default atime settings when remounting a filesystem could be disallowed.
To avoid this problems in the future add tests to ensure unprivileged
remounts are succeeding and failing at the appropriate times.
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/Makefile | 1
tools/testing/selftests/mount/Makefile | 17
tools/testing/selftests/mount/unprivileged-remount-test.c | 242 ++++++++++++++
3 files changed, 260 insertions(+)
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -4,6 +4,7 @@ TARGETS += efivarfs
TARGETS += kcmp
TARGETS += memory-hotplug
TARGETS += mqueue
+TARGETS += mount
TARGETS += net
TARGETS += ptrace
TARGETS += timers
--- /dev/null
+++ b/tools/testing/selftests/mount/Makefile
@@ -0,0 +1,17 @@
+# Makefile for mount selftests.
+
+all: unprivileged-remount-test
+
+unprivileged-remount-test: unprivileged-remount-test.c
+ gcc -Wall -O2 unprivileged-remount-test.c -o unprivileged-remount-test
+
+# Allow specific tests to be selected.
+test_unprivileged_remount: unprivileged-remount-test
+ @if [ -f /proc/self/uid_map ] ; then ./unprivileged-remount-test ; fi
+
+run_tests: all test_unprivileged_remount
+
+clean:
+ rm -f unprivileged-remount-test
+
+.PHONY: all test_unprivileged_remount
--- /dev/null
+++ b/tools/testing/selftests/mount/unprivileged-remount-test.c
@@ -0,0 +1,242 @@
+#define _GNU_SOURCE
+#include <sched.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/mount.h>
+#include <sys/wait.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <grp.h>
+#include <stdbool.h>
+#include <stdarg.h>
+
+#ifndef CLONE_NEWNS
+# define CLONE_NEWNS 0x00020000
+#endif
+#ifndef CLONE_NEWUTS
+# define CLONE_NEWUTS 0x04000000
+#endif
+#ifndef CLONE_NEWIPC
+# define CLONE_NEWIPC 0x08000000
+#endif
+#ifndef CLONE_NEWNET
+# define CLONE_NEWNET 0x40000000
+#endif
+#ifndef CLONE_NEWUSER
+# define CLONE_NEWUSER 0x10000000
+#endif
+#ifndef CLONE_NEWPID
+# define CLONE_NEWPID 0x20000000
+#endif
+
+#ifndef MS_RELATIME
+#define MS_RELATIME (1 << 21)
+#endif
+#ifndef MS_STRICTATIME
+#define MS_STRICTATIME (1 << 24)
+#endif
+
+static void die(char *fmt, ...)
+{
+ va_list ap;
+ va_start(ap, fmt);
+ vfprintf(stderr, fmt, ap);
+ va_end(ap);
+ exit(EXIT_FAILURE);
+}
+
+static void write_file(char *filename, char *fmt, ...)
+{
+ char buf[4096];
+ int fd;
+ ssize_t written;
+ int buf_len;
+ va_list ap;
+
+ va_start(ap, fmt);
+ buf_len = vsnprintf(buf, sizeof(buf), fmt, ap);
+ va_end(ap);
+ if (buf_len < 0) {
+ die("vsnprintf failed: %s\n",
+ strerror(errno));
+ }
+ if (buf_len >= sizeof(buf)) {
+ die("vsnprintf output truncated\n");
+ }
+
+ fd = open(filename, O_WRONLY);
+ if (fd < 0) {
+ die("open of %s failed: %s\n",
+ filename, strerror(errno));
+ }
+ written = write(fd, buf, buf_len);
+ if (written != buf_len) {
+ if (written >= 0) {
+ die("short write to %s\n", filename);
+ } else {
+ die("write to %s failed: %s\n",
+ filename, strerror(errno));
+ }
+ }
+ if (close(fd) != 0) {
+ die("close of %s failed: %s\n",
+ filename, strerror(errno));
+ }
+}
+
+static void create_and_enter_userns(void)
+{
+ uid_t uid;
+ gid_t gid;
+
+ uid = getuid();
+ gid = getgid();
+
+ if (unshare(CLONE_NEWUSER) !=0) {
+ die("unshare(CLONE_NEWUSER) failed: %s\n",
+ strerror(errno));
+ }
+
+ write_file("/proc/self/uid_map", "0 %d 1", uid);
+ write_file("/proc/self/gid_map", "0 %d 1", gid);
+
+ if (setgroups(0, NULL) != 0) {
+ die("setgroups failed: %s\n",
+ strerror(errno));
+ }
+ if (setgid(0) != 0) {
+ die ("setgid(0) failed %s\n",
+ strerror(errno));
+ }
+ if (setuid(0) != 0) {
+ die("setuid(0) failed %s\n",
+ strerror(errno));
+ }
+}
+
+static
+bool test_unpriv_remount(int mount_flags, int remount_flags, int invalid_flags)
+{
+ pid_t child;
+
+ child = fork();
+ if (child == -1) {
+ die("fork failed: %s\n",
+ strerror(errno));
+ }
+ if (child != 0) { /* parent */
+ pid_t pid;
+ int status;
+ pid = waitpid(child, &status, 0);
+ if (pid == -1) {
+ die("waitpid failed: %s\n",
+ strerror(errno));
+ }
+ if (pid != child) {
+ die("waited for %d got %d\n",
+ child, pid);
+ }
+ if (!WIFEXITED(status)) {
+ die("child did not terminate cleanly\n");
+ }
+ return WEXITSTATUS(status) == EXIT_SUCCESS ? true : false;
+ }
+
+ create_and_enter_userns();
+ if (unshare(CLONE_NEWNS) != 0) {
+ die("unshare(CLONE_NEWNS) failed: %s\n",
+ strerror(errno));
+ }
+
+ if (mount("testing", "/tmp", "ramfs", mount_flags, NULL) != 0) {
+ die("mount of /tmp failed: %s\n",
+ strerror(errno));
+ }
+
+ create_and_enter_userns();
+
+ if (unshare(CLONE_NEWNS) != 0) {
+ die("unshare(CLONE_NEWNS) failed: %s\n",
+ strerror(errno));
+ }
+
+ if (mount("/tmp", "/tmp", "none",
+ MS_REMOUNT | MS_BIND | remount_flags, NULL) != 0) {
+ /* system("cat /proc/self/mounts"); */
+ die("remount of /tmp failed: %s\n",
+ strerror(errno));
+ }
+
+ if (mount("/tmp", "/tmp", "none",
+ MS_REMOUNT | MS_BIND | invalid_flags, NULL) == 0) {
+ /* system("cat /proc/self/mounts"); */
+ die("remount of /tmp with invalid flags "
+ "succeeded unexpectedly\n");
+ }
+ exit(EXIT_SUCCESS);
+}
+
+static bool test_unpriv_remount_simple(int mount_flags)
+{
+ return test_unpriv_remount(mount_flags, mount_flags, 0);
+}
+
+static bool test_unpriv_remount_atime(int mount_flags, int invalid_flags)
+{
+ return test_unpriv_remount(mount_flags, mount_flags, invalid_flags);
+}
+
+int main(int argc, char **argv)
+{
+ if (!test_unpriv_remount_simple(MS_RDONLY|MS_NODEV)) {
+ die("MS_RDONLY malfunctions\n");
+ }
+ if (!test_unpriv_remount_simple(MS_NODEV)) {
+ die("MS_NODEV malfunctions\n");
+ }
+ if (!test_unpriv_remount_simple(MS_NOSUID|MS_NODEV)) {
+ die("MS_NOSUID malfunctions\n");
+ }
+ if (!test_unpriv_remount_simple(MS_NOEXEC|MS_NODEV)) {
+ die("MS_NOEXEC malfunctions\n");
+ }
+ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODEV,
+ MS_NOATIME|MS_NODEV))
+ {
+ die("MS_RELATIME malfunctions\n");
+ }
+ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODEV,
+ MS_NOATIME|MS_NODEV))
+ {
+ die("MS_STRICTATIME malfunctions\n");
+ }
+ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODEV,
+ MS_STRICTATIME|MS_NODEV))
+ {
+ die("MS_RELATIME malfunctions\n");
+ }
+ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME|MS_NODEV,
+ MS_NOATIME|MS_NODEV))
+ {
+ die("MS_RELATIME malfunctions\n");
+ }
+ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME|MS_NODEV,
+ MS_NOATIME|MS_NODEV))
+ {
+ die("MS_RELATIME malfunctions\n");
+ }
+ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME|MS_NODEV,
+ MS_STRICTATIME|MS_NODEV))
+ {
+ die("MS_RELATIME malfunctions\n");
+ }
+ if (!test_unpriv_remount(MS_STRICTATIME|MS_NODEV, MS_NODEV,
+ MS_NOATIME|MS_NODEV))
+ {
+ die("Default atime malfunctions\n");
+ }
+ return EXIT_SUCCESS;
+}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 114/158] get rid of propagate_umount() mistakenly treating slaves as busy.
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (108 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 113/158] mnt: Add tests for unprivileged remount cases that have found to be faulty Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 115/158] fix EBUSY on umount() from MNT_SHRINKABLE Greg Kroah-Hartman
` (46 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 88b368f27a094277143d8ecd5a056116f6a41520 upstream.
The check in __propagate_umount() ("has somebody explicitly mounted
something on that slave?") is done *before* taking the already doomed
victims out of the child lists.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 4 +++-
fs/pnode.c | 1 +
2 files changed, 4 insertions(+), 1 deletion(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1262,6 +1262,9 @@ void umount_tree(struct mount *mnt, int
hlist_add_head(&p->mnt_hash, &tmp_list);
}
+ hlist_for_each_entry(p, &tmp_list, mnt_hash)
+ list_del_init(&p->mnt_child);
+
if (how)
propagate_umount(&tmp_list);
@@ -1272,7 +1275,6 @@ void umount_tree(struct mount *mnt, int
p->mnt_ns = NULL;
if (how < 2)
p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
- list_del_init(&p->mnt_child);
if (mnt_has_parent(p)) {
put_mountpoint(p->mnt_mp);
/* move the reference to mountpoint into ->mnt_ex_mountpoint */
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -381,6 +381,7 @@ static void __propagate_umount(struct mo
* other children
*/
if (child && list_empty(&child->mnt_mounts)) {
+ list_del_init(&child->mnt_child);
hlist_del_init_rcu(&child->mnt_hash);
hlist_add_before_rcu(&child->mnt_hash, &mnt->mnt_hash);
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 115/158] fix EBUSY on umount() from MNT_SHRINKABLE
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (109 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 114/158] get rid of propagate_umount() mistakenly treating slaves as busy Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 116/158] Bluetooth: btmrvl: wait for HOST_SLEEP_ENABLE event in suspend Greg Kroah-Hartman
` (45 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 81b6b06197606b4bef4e427a197aeb808e8d89e1 upstream.
We need the parents of victims alive until namespace_unlock() gets to
dput() of the (ex-)mountpoints. However, that screws up the "is it
busy" checks in case when we have shrinkable mounts that need to be
killed. Solution: go ahead and decrement refcounts of parents right
in umount_tree(), increment them again just before dropping rwsem in
namespace_unlock() (and let the loop in the end of namespace_unlock()
finally drop those references for good, as we do now). Parents can't
get freed until we drop rwsem - at least one reference is kept until
then, both in case when parent is among the victims and when it is
not. So they'll still be around when we get to namespace_unlock().
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1226,6 +1226,11 @@ static void namespace_unlock(void)
head.first->pprev = &head.first;
INIT_HLIST_HEAD(&unmounted);
+ /* undo decrements we'd done in umount_tree() */
+ hlist_for_each_entry(mnt, &head, mnt_hash)
+ if (mnt->mnt_ex_mountpoint.mnt)
+ mntget(mnt->mnt_ex_mountpoint.mnt);
+
up_write(&namespace_sem);
synchronize_rcu();
@@ -1277,6 +1282,7 @@ void umount_tree(struct mount *mnt, int
p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
if (mnt_has_parent(p)) {
put_mountpoint(p->mnt_mp);
+ mnt_add_count(p->mnt_parent, -1);
/* move the reference to mountpoint into ->mnt_ex_mountpoint */
p->mnt_ex_mountpoint.dentry = p->mnt_mountpoint;
p->mnt_ex_mountpoint.mnt = &p->mnt_parent->mnt;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 116/158] Bluetooth: btmrvl: wait for HOST_SLEEP_ENABLE event in suspend
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (110 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 115/158] fix EBUSY on umount() from MNT_SHRINKABLE Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 117/158] Bluetooth: Fix merge of advertising data and scan response data Greg Kroah-Hartman
` (44 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chin-Ran Lo, Jeff CF Chen,
Amitkumar Karwar, Bing Zhao, Marcel Holtmann
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chin-Ran Lo <crlo@marvell.com>
commit 396e04f4bb9afefb0744715dc76d9abe18ee5fb0 upstream.
After BT_CMD_HOST_SLEEP_ENABLE command finishes, driver should
wait until getting BT_EVENT_HOST_SLEEP_ENABLE event to complete
suspend procedure.
Without this patch the suspend handler would return success
earlier. By the time when the BT_EVENT_HOST_SLEEP_ENABLE event
comes in the controller driver could have already turned off the
bus clock. This causes kernel crash or system reboot eventually.
Signed-off-by: Chin-Ran Lo <crlo@marvell.com>
Signed-off-by: Jeff CF Chen <jeffc@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btmrvl_drv.h | 1 +
drivers/bluetooth/btmrvl_main.c | 25 ++++++++++++++++++++++++-
2 files changed, 25 insertions(+), 1 deletion(-)
--- a/drivers/bluetooth/btmrvl_drv.h
+++ b/drivers/bluetooth/btmrvl_drv.h
@@ -68,6 +68,7 @@ struct btmrvl_adapter {
u8 hs_state;
u8 wakeup_tries;
wait_queue_head_t cmd_wait_q;
+ wait_queue_head_t event_hs_wait_q;
u8 cmd_complete;
bool is_suspended;
};
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -114,6 +114,7 @@ int btmrvl_process_event(struct btmrvl_p
adapter->hs_state = HS_ACTIVATED;
if (adapter->psmode)
adapter->ps_state = PS_SLEEP;
+ wake_up_interruptible(&adapter->event_hs_wait_q);
BT_DBG("HS ACTIVATED!");
} else {
BT_DBG("HS Enable failed");
@@ -253,11 +254,31 @@ EXPORT_SYMBOL_GPL(btmrvl_enable_ps);
int btmrvl_enable_hs(struct btmrvl_private *priv)
{
+ struct btmrvl_adapter *adapter = priv->adapter;
int ret;
ret = btmrvl_send_sync_cmd(priv, BT_CMD_HOST_SLEEP_ENABLE, NULL, 0);
- if (ret)
+ if (ret) {
BT_ERR("Host sleep enable command failed\n");
+ return ret;
+ }
+
+ ret = wait_event_interruptible_timeout(adapter->event_hs_wait_q,
+ adapter->hs_state,
+ msecs_to_jiffies(WAIT_UNTIL_HS_STATE_CHANGED));
+ if (ret < 0) {
+ BT_ERR("event_hs_wait_q terminated (%d): %d,%d,%d",
+ ret, adapter->hs_state, adapter->ps_state,
+ adapter->wakeup_tries);
+ } else if (!ret) {
+ BT_ERR("hs_enable timeout: %d,%d,%d", adapter->hs_state,
+ adapter->ps_state, adapter->wakeup_tries);
+ ret = -ETIMEDOUT;
+ } else {
+ BT_DBG("host sleep enabled: %d,%d,%d", adapter->hs_state,
+ adapter->ps_state, adapter->wakeup_tries);
+ ret = 0;
+ }
return ret;
}
@@ -358,6 +379,7 @@ static void btmrvl_init_adapter(struct b
}
init_waitqueue_head(&priv->adapter->cmd_wait_q);
+ init_waitqueue_head(&priv->adapter->event_hs_wait_q);
}
static void btmrvl_free_adapter(struct btmrvl_private *priv)
@@ -666,6 +688,7 @@ int btmrvl_remove_card(struct btmrvl_pri
hdev = priv->btmrvl_dev.hcidev;
wake_up_interruptible(&priv->adapter->cmd_wait_q);
+ wake_up_interruptible(&priv->adapter->event_hs_wait_q);
kthread_stop(priv->main_thread.task);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 117/158] Bluetooth: Fix merge of advertising data and scan response data
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (111 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 116/158] Bluetooth: btmrvl: wait for HOST_SLEEP_ENABLE event in suspend Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 118/158] Bluetooth: Fix tracking local SSP authentication requirement Greg Kroah-Hartman
` (43 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marcel Holtmann, Johan Hedberg
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcel Holtmann <marcel@holtmann.org>
commit 42bd6a56ed1ab4b2cb50f4d4e674874da9b47f46 upstream.
The advertising data and scan response data are merged in the wrong
order. It should be advertsing data first and then scan response data
and not the other way around.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4177,8 +4177,8 @@ static void process_adv_report(struct hc
* sending a merged device found event.
*/
mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
- d->last_adv_addr_type, NULL, rssi, 0, 1, data, len,
- d->last_adv_data, d->last_adv_data_len);
+ d->last_adv_addr_type, NULL, rssi, 0, 1,
+ d->last_adv_data, d->last_adv_data_len, data, len);
clear_pending_adv_report(hdev);
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 118/158] Bluetooth: Fix tracking local SSP authentication requirement
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (112 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 117/158] Bluetooth: Fix merge of advertising data and scan response data Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 119/158] Bluetooth: never linger on process exit Greg Kroah-Hartman
` (42 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hedberg, Szymon Janc, Marcel Holtmann
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hedberg <johan.hedberg@intel.com>
commit 6c53823ae0e10e723131055e1e65dd6a328a228e upstream.
When we need to make the decision whether to perform just-works or real
user confirmation we need to know the exact local authentication
requirement that was passed to the controller. So far conn->auth_type
(the local requirement) wasn't in one case updated appropriately in fear
of the user confirmation being rejected later.
The real problem however was not really that conn->auth_type couldn't
represent the true value but that we were checking the local MITM
requirement in an incorrect way. It's perfectly fine to let auth_type
follow what we tell the controller since we're still tracking the target
security level with conn->pending_sec_level.
This patch updates the check for local MITM requirement in the
hci_user_confirm_request_evt function to use the locally requested
security level and ensures that auth_type always represents what we tell
the controller. All other code in hci_user_confirm_request_evt still
uses the auth_type instead of pending_sec_level for determining whether
to do just-works or not, since that's the only value that's in sync with
what the remote device knows.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Tested-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3538,18 +3538,14 @@ static void hci_io_capa_request_evt(stru
/* If we are initiators, there is no remote information yet */
if (conn->remote_auth == 0xff) {
- cp.authentication = conn->auth_type;
-
/* Request MITM protection if our IO caps allow it
* except for the no-bonding case.
- * conn->auth_type is not updated here since
- * that might cause the user confirmation to be
- * rejected in case the remote doesn't have the
- * IO capabilities for MITM.
*/
if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
cp.authentication != HCI_AT_NO_BONDING)
- cp.authentication |= 0x01;
+ conn->auth_type |= 0x01;
+
+ cp.authentication = conn->auth_type;
} else {
conn->auth_type = hci_get_auth_req(conn);
cp.authentication = conn->auth_type;
@@ -3621,9 +3617,12 @@ static void hci_user_confirm_request_evt
rem_mitm = (conn->remote_auth & 0x01);
/* If we require MITM but the remote device can't provide that
- * (it has NoInputNoOutput) then reject the confirmation request
+ * (it has NoInputNoOutput) then reject the confirmation
+ * request. We check the security level here since it doesn't
+ * necessarily match conn->auth_type.
*/
- if (loc_mitm && conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
+ if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
+ conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
BT_DBG("Rejecting request: remote device can't provide MITM");
hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
sizeof(ev->bdaddr), &ev->bdaddr);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 119/158] Bluetooth: never linger on process exit
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (113 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 118/158] Bluetooth: Fix tracking local SSP authentication requirement Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:25 ` [PATCH 3.16 120/158] Bluetooth: Fix using uninitialized variable when pairing Greg Kroah-Hartman
` (41 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Davydov, Marcel Holtmann
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Davydov <vdavydov@parallels.com>
commit 093facf3634da1b0c2cc7ed106f1983da901bbab upstream.
If the current process is exiting, lingering on socket close will make
it unkillable, so we should avoid it.
Reproducer:
#include <sys/types.h>
#include <sys/socket.h>
#define BTPROTO_L2CAP 0
#define BTPROTO_SCO 2
#define BTPROTO_RFCOMM 3
int main()
{
int fd;
struct linger ling;
fd = socket(PF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM);
//or: fd = socket(PF_BLUETOOTH, SOCK_DGRAM, BTPROTO_L2CAP);
//or: fd = socket(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO);
ling.l_onoff = 1;
ling.l_linger = 1000000000;
setsockopt(fd, SOL_SOCKET, SO_LINGER, &ling, sizeof(ling));
return 0;
}
Signed-off-by: Vladimir Davydov <vdavydov@parallels.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/l2cap_sock.c | 3 ++-
net/bluetooth/rfcomm/sock.c | 3 ++-
net/bluetooth/sco.c | 6 ++++--
3 files changed, 8 insertions(+), 4 deletions(-)
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1111,7 +1111,8 @@ static int l2cap_sock_shutdown(struct so
l2cap_chan_close(chan, 0);
lock_sock(sk);
- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
+ if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
+ !(current->flags & PF_EXITING))
err = bt_sock_wait_state(sk, BT_CLOSED,
sk->sk_lingertime);
}
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -918,7 +918,8 @@ static int rfcomm_sock_shutdown(struct s
sk->sk_shutdown = SHUTDOWN_MASK;
__rfcomm_sock_close(sk);
- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
+ if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
+ !(current->flags & PF_EXITING))
err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
}
release_sock(sk);
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -909,7 +909,8 @@ static int sco_sock_shutdown(struct sock
sco_sock_clear_timer(sk);
__sco_sock_close(sk);
- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
+ if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
+ !(current->flags & PF_EXITING))
err = bt_sock_wait_state(sk, BT_CLOSED,
sk->sk_lingertime);
}
@@ -929,7 +930,8 @@ static int sco_sock_release(struct socke
sco_sock_close(sk);
- if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) {
+ if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
+ !(current->flags & PF_EXITING)) {
lock_sock(sk);
err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
release_sock(sk);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 120/158] Bluetooth: Fix using uninitialized variable when pairing
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (114 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 119/158] Bluetooth: never linger on process exit Greg Kroah-Hartman
@ 2014-09-15 19:25 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 121/158] Bluetooth: Avoid use of session socket after the session gets freed Greg Kroah-Hartman
` (40 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:25 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hedberg, Marcel Holtmann
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hedberg <johan.hedberg@intel.com>
commit 9f743d7499bc2c4dc8c35af33bdb2a29bea663b9 upstream.
Commit 6c53823ae0e10e723131055e1e65dd6a328a228e reshuffled the way the
authentication requirement gets set in the hci_io_capa_request_evt()
function, but at the same time it failed to update an if-statement where
cp.authentication is used before it has been initialized. The correct
value the code should be looking for in this if-statement is
conn->auth_type.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3542,7 +3542,7 @@ static void hci_io_capa_request_evt(stru
* except for the no-bonding case.
*/
if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
- cp.authentication != HCI_AT_NO_BONDING)
+ conn->auth_type != HCI_AT_NO_BONDING)
conn->auth_type |= 0x01;
cp.authentication = conn->auth_type;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 121/158] Bluetooth: Avoid use of session socket after the session gets freed
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (115 preceding siblings ...)
2014-09-15 19:25 ` [PATCH 3.16 120/158] Bluetooth: Fix using uninitialized variable when pairing Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 122/158] __generic_file_write_iter(): fix handling of sync error after DIO Greg Kroah-Hartman
` (39 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vignesh Raman, Vitaly Kuzmichev,
Dean Jenkins, Marcel Holtmann
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vignesh Raman <Vignesh_Raman@mentor.com>
commit 32333edb82fb2009980eefc5518100068147ab82 upstream.
The commits 08c30aca9e698faddebd34f81e1196295f9dc063 "Bluetooth: Remove
RFCOMM session refcnt" and 8ff52f7d04d9cc31f1e81dcf9a2ba6335ed34905
"Bluetooth: Return RFCOMM session ptrs to avoid freed session"
allow rfcomm_recv_ua and rfcomm_session_close to delete the session
(and free the corresponding socket) and propagate NULL session pointer
to the upper callers.
Additional fix is required to terminate the loop in rfcomm_process_rx
function to avoid use of freed 'sk' memory.
The issue is only reproducible with kernel option CONFIG_PAGE_POISONING
enabled making freed memory being changed and filled up with fixed char
value used to unmask use-after-free issues.
Signed-off-by: Vignesh Raman <Vignesh_Raman@mentor.com>
Signed-off-by: Vitaly Kuzmichev <Vitaly_Kuzmichev@mentor.com>
Acked-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/rfcomm/core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1909,10 +1909,13 @@ static struct rfcomm_session *rfcomm_pro
/* Get data directly from socket receive queue without copying it. */
while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
skb_orphan(skb);
- if (!skb_linearize(skb))
+ if (!skb_linearize(skb)) {
s = rfcomm_recv_frame(s, skb);
- else
+ if (!s)
+ break;
+ } else {
kfree_skb(skb);
+ }
}
if (s && (sk->sk_state == BT_CLOSED))
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 122/158] __generic_file_write_iter(): fix handling of sync error after DIO
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (116 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 121/158] Bluetooth: Avoid use of session socket after the session gets freed Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 123/158] rbd: rework rbd_request_fn() Greg Kroah-Hartman
` (38 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Anton Altaparmakov, Al Viro
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 60bb45297f7551833346c5cebc6d483ea17ea5f2 upstream.
If DIO results in short write and sync write fails, we want to bugger off
whether the DIO part has written anything or not; the logics on the return
will take care of the right return value.
Reported-by: Anton Altaparmakov <aia21@cam.ac.uk>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/filemap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2584,7 +2584,7 @@ ssize_t __generic_file_write_iter(struct
* that this differs from normal direct-io semantics, which
* will return -EFOO even if some bytes were written.
*/
- if (unlikely(status < 0) && !written) {
+ if (unlikely(status < 0)) {
err = status;
goto out;
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 123/158] rbd: rework rbd_request_fn()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (117 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 122/158] __generic_file_write_iter(): fix handling of sync error after DIO Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 124/158] fix copy_tree() regression Greg Kroah-Hartman
` (37 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ilya Dryomov, Eric Eastman,
Greg Wilson, Alex Elder
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <ilya.dryomov@inktank.com>
commit bc1ecc65a259fa9333dc8bd6a4ba0cf03b7d4bf8 upstream.
While it was never a good idea to sleep in request_fn(), commit
34c6bc2c919a ("locking/mutexes: Add extra reschedule point") made it
a *bad* idea. mutex_lock() since 3.15 may reschedule *before* putting
task on the mutex wait queue, which for tasks in !TASK_RUNNING state
means block forever. request_fn() may be called with !TASK_RUNNING on
the way to schedule() in io_schedule().
Offload request handling to a workqueue, one per rbd device, to avoid
calling blocking primitives from rbd_request_fn().
Fixes: http://tracker.ceph.com/issues/8818
Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com>
Tested-by: Eric Eastman <eric0e@aol.com>
Tested-by: Greg Wilson <greg.wilson@keepertech.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/rbd.c | 194 +++++++++++++++++++++++++++++++---------------------
1 file changed, 118 insertions(+), 76 deletions(-)
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -42,6 +42,7 @@
#include <linux/blkdev.h>
#include <linux/slab.h>
#include <linux/idr.h>
+#include <linux/workqueue.h>
#include "rbd_types.h"
@@ -332,7 +333,10 @@ struct rbd_device {
char name[DEV_NAME_LEN]; /* blkdev name, e.g. rbd3 */
+ struct list_head rq_queue; /* incoming rq queue */
spinlock_t lock; /* queue, flags, open_count */
+ struct workqueue_struct *rq_wq;
+ struct work_struct rq_work;
struct rbd_image_header header;
unsigned long flags; /* possibly lock protected */
@@ -3183,102 +3187,129 @@ out:
return ret;
}
-static void rbd_request_fn(struct request_queue *q)
- __releases(q->queue_lock) __acquires(q->queue_lock)
+static void rbd_handle_request(struct rbd_device *rbd_dev, struct request *rq)
{
- struct rbd_device *rbd_dev = q->queuedata;
- struct request *rq;
+ struct rbd_img_request *img_request;
+ u64 offset = (u64)blk_rq_pos(rq) << SECTOR_SHIFT;
+ u64 length = blk_rq_bytes(rq);
+ bool wr = rq_data_dir(rq) == WRITE;
int result;
- while ((rq = blk_fetch_request(q))) {
- bool write_request = rq_data_dir(rq) == WRITE;
- struct rbd_img_request *img_request;
- u64 offset;
- u64 length;
+ /* Ignore/skip any zero-length requests */
- /* Ignore any non-FS requests that filter through. */
+ if (!length) {
+ dout("%s: zero-length request\n", __func__);
+ result = 0;
+ goto err_rq;
+ }
- if (rq->cmd_type != REQ_TYPE_FS) {
- dout("%s: non-fs request type %d\n", __func__,
- (int) rq->cmd_type);
- __blk_end_request_all(rq, 0);
- continue;
+ /* Disallow writes to a read-only device */
+
+ if (wr) {
+ if (rbd_dev->mapping.read_only) {
+ result = -EROFS;
+ goto err_rq;
}
+ rbd_assert(rbd_dev->spec->snap_id == CEPH_NOSNAP);
+ }
- /* Ignore/skip any zero-length requests */
+ /*
+ * Quit early if the mapped snapshot no longer exists. It's
+ * still possible the snapshot will have disappeared by the
+ * time our request arrives at the osd, but there's no sense in
+ * sending it if we already know.
+ */
+ if (!test_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags)) {
+ dout("request for non-existent snapshot");
+ rbd_assert(rbd_dev->spec->snap_id != CEPH_NOSNAP);
+ result = -ENXIO;
+ goto err_rq;
+ }
- offset = (u64) blk_rq_pos(rq) << SECTOR_SHIFT;
- length = (u64) blk_rq_bytes(rq);
+ if (offset && length > U64_MAX - offset + 1) {
+ rbd_warn(rbd_dev, "bad request range (%llu~%llu)", offset,
+ length);
+ result = -EINVAL;
+ goto err_rq; /* Shouldn't happen */
+ }
- if (!length) {
- dout("%s: zero-length request\n", __func__);
- __blk_end_request_all(rq, 0);
- continue;
- }
+ if (offset + length > rbd_dev->mapping.size) {
+ rbd_warn(rbd_dev, "beyond EOD (%llu~%llu > %llu)", offset,
+ length, rbd_dev->mapping.size);
+ result = -EIO;
+ goto err_rq;
+ }
- spin_unlock_irq(q->queue_lock);
+ img_request = rbd_img_request_create(rbd_dev, offset, length, wr);
+ if (!img_request) {
+ result = -ENOMEM;
+ goto err_rq;
+ }
+ img_request->rq = rq;
- /* Disallow writes to a read-only device */
+ result = rbd_img_request_fill(img_request, OBJ_REQUEST_BIO, rq->bio);
+ if (result)
+ goto err_img_request;
- if (write_request) {
- result = -EROFS;
- if (rbd_dev->mapping.read_only)
- goto end_request;
- rbd_assert(rbd_dev->spec->snap_id == CEPH_NOSNAP);
- }
+ result = rbd_img_request_submit(img_request);
+ if (result)
+ goto err_img_request;
- /*
- * Quit early if the mapped snapshot no longer
- * exists. It's still possible the snapshot will
- * have disappeared by the time our request arrives
- * at the osd, but there's no sense in sending it if
- * we already know.
- */
- if (!test_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags)) {
- dout("request for non-existent snapshot");
- rbd_assert(rbd_dev->spec->snap_id != CEPH_NOSNAP);
- result = -ENXIO;
- goto end_request;
- }
+ return;
- result = -EINVAL;
- if (offset && length > U64_MAX - offset + 1) {
- rbd_warn(rbd_dev, "bad request range (%llu~%llu)\n",
- offset, length);
- goto end_request; /* Shouldn't happen */
- }
+err_img_request:
+ rbd_img_request_put(img_request);
+err_rq:
+ if (result)
+ rbd_warn(rbd_dev, "%s %llx at %llx result %d",
+ wr ? "write" : "read", length, offset, result);
+ blk_end_request_all(rq, result);
+}
- result = -EIO;
- if (offset + length > rbd_dev->mapping.size) {
- rbd_warn(rbd_dev, "beyond EOD (%llu~%llu > %llu)\n",
- offset, length, rbd_dev->mapping.size);
- goto end_request;
- }
+static void rbd_request_workfn(struct work_struct *work)
+{
+ struct rbd_device *rbd_dev =
+ container_of(work, struct rbd_device, rq_work);
+ struct request *rq, *next;
+ LIST_HEAD(requests);
- result = -ENOMEM;
- img_request = rbd_img_request_create(rbd_dev, offset, length,
- write_request);
- if (!img_request)
- goto end_request;
+ spin_lock_irq(&rbd_dev->lock); /* rq->q->queue_lock */
+ list_splice_init(&rbd_dev->rq_queue, &requests);
+ spin_unlock_irq(&rbd_dev->lock);
- img_request->rq = rq;
+ list_for_each_entry_safe(rq, next, &requests, queuelist) {
+ list_del_init(&rq->queuelist);
+ rbd_handle_request(rbd_dev, rq);
+ }
+}
- result = rbd_img_request_fill(img_request, OBJ_REQUEST_BIO,
- rq->bio);
- if (!result)
- result = rbd_img_request_submit(img_request);
- if (result)
- rbd_img_request_put(img_request);
-end_request:
- spin_lock_irq(q->queue_lock);
- if (result < 0) {
- rbd_warn(rbd_dev, "%s %llx at %llx result %d\n",
- write_request ? "write" : "read",
- length, offset, result);
+/*
+ * Called with q->queue_lock held and interrupts disabled, possibly on
+ * the way to schedule(). Do not sleep here!
+ */
+static void rbd_request_fn(struct request_queue *q)
+{
+ struct rbd_device *rbd_dev = q->queuedata;
+ struct request *rq;
+ int queued = 0;
+
+ rbd_assert(rbd_dev);
- __blk_end_request_all(rq, result);
+ while ((rq = blk_fetch_request(q))) {
+ /* Ignore any non-FS requests that filter through. */
+ if (rq->cmd_type != REQ_TYPE_FS) {
+ dout("%s: non-fs request type %d\n", __func__,
+ (int) rq->cmd_type);
+ __blk_end_request_all(rq, 0);
+ continue;
}
+
+ list_add_tail(&rq->queuelist, &rbd_dev->rq_queue);
+ queued++;
}
+
+ if (queued)
+ queue_work(rbd_dev->rq_wq, &rbd_dev->rq_work);
}
/*
@@ -3848,6 +3879,8 @@ static struct rbd_device *rbd_dev_create
return NULL;
spin_lock_init(&rbd_dev->lock);
+ INIT_LIST_HEAD(&rbd_dev->rq_queue);
+ INIT_WORK(&rbd_dev->rq_work, rbd_request_workfn);
rbd_dev->flags = 0;
atomic_set(&rbd_dev->parent_ref, 0);
INIT_LIST_HEAD(&rbd_dev->node);
@@ -5066,12 +5099,17 @@ static int rbd_dev_device_setup(struct r
ret = rbd_dev_mapping_set(rbd_dev);
if (ret)
goto err_out_disk;
+
set_capacity(rbd_dev->disk, rbd_dev->mapping.size / SECTOR_SIZE);
set_disk_ro(rbd_dev->disk, rbd_dev->mapping.read_only);
+ rbd_dev->rq_wq = alloc_workqueue(rbd_dev->disk->disk_name, 0, 0);
+ if (!rbd_dev->rq_wq)
+ goto err_out_mapping;
+
ret = rbd_bus_add_dev(rbd_dev);
if (ret)
- goto err_out_mapping;
+ goto err_out_workqueue;
/* Everything's ready. Announce the disk to the world. */
@@ -5083,6 +5121,9 @@ static int rbd_dev_device_setup(struct r
return ret;
+err_out_workqueue:
+ destroy_workqueue(rbd_dev->rq_wq);
+ rbd_dev->rq_wq = NULL;
err_out_mapping:
rbd_dev_mapping_clear(rbd_dev);
err_out_disk:
@@ -5314,6 +5355,7 @@ static void rbd_dev_device_release(struc
{
struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
+ destroy_workqueue(rbd_dev->rq_wq);
rbd_free_disk(rbd_dev);
clear_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
rbd_dev_mapping_clear(rbd_dev);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 124/158] fix copy_tree() regression
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (118 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 123/158] rbd: rework rbd_request_fn() Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 125/158] md/raid1,raid10: always abort recover on write error Greg Kroah-Hartman
` (36 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 12a5b5294cb1896e9a3c9fca8ff5a7e3def4e8c6 upstream.
Since 3.14 we had copy_tree() get the shadowing wrong - if we had one
vfsmount shadowing another (i.e. if A is a slave of B, C is mounted
on A/foo, then D got mounted on B/foo creating D' on A/foo shadowed
by C), copy_tree() of A would make a copy of D' shadow the the copy of
C, not the other way around.
It's easy to fix, fortunately - just make sure that mount follows
the one that shadows it in mnt_child as well as in mnt_hash, and when
copy_tree() decides to attach a new mount, check if the last child
it has added to the same parent should be shadowing the new one.
And if it should, just use the same logics commit_tree() has - put the
new mount into the hash and children lists right after the one that
should shadow it.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 31 ++++++++++++++++++++++++-------
1 file changed, 24 insertions(+), 7 deletions(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -779,6 +779,20 @@ static void attach_mnt(struct mount *mnt
list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
}
+static void attach_shadowed(struct mount *mnt,
+ struct mount *parent,
+ struct mount *shadows)
+{
+ if (shadows) {
+ hlist_add_after_rcu(&shadows->mnt_hash, &mnt->mnt_hash);
+ list_add(&mnt->mnt_child, &shadows->mnt_child);
+ } else {
+ hlist_add_head_rcu(&mnt->mnt_hash,
+ m_hash(&parent->mnt, mnt->mnt_mountpoint));
+ list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
+ }
+}
+
/*
* vfsmount lock must be held for write
*/
@@ -797,12 +811,7 @@ static void commit_tree(struct mount *mn
list_splice(&head, n->list.prev);
- if (shadows)
- hlist_add_after_rcu(&shadows->mnt_hash, &mnt->mnt_hash);
- else
- hlist_add_head_rcu(&mnt->mnt_hash,
- m_hash(&parent->mnt, mnt->mnt_mountpoint));
- list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
+ attach_shadowed(mnt, parent, shadows);
touch_mnt_namespace(n);
}
@@ -1513,6 +1522,7 @@ struct mount *copy_tree(struct mount *mn
continue;
for (s = r; s; s = next_mnt(s, r)) {
+ struct mount *t = NULL;
if (!(flag & CL_COPY_UNBINDABLE) &&
IS_MNT_UNBINDABLE(s)) {
s = skip_mnt_tree(s);
@@ -1534,7 +1544,14 @@ struct mount *copy_tree(struct mount *mn
goto out;
lock_mount_hash();
list_add_tail(&q->mnt_list, &res->mnt_list);
- attach_mnt(q, parent, p->mnt_mp);
+ mnt_set_mountpoint(parent, p->mnt_mp, q);
+ if (!list_empty(&parent->mnt_mounts)) {
+ t = list_last_entry(&parent->mnt_mounts,
+ struct mount, mnt_child);
+ if (t->mnt_mp != p->mnt_mp)
+ t = NULL;
+ }
+ attach_shadowed(q, parent, t);
unlock_mount_hash();
}
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 125/158] md/raid1,raid10: always abort recover on write error.
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (119 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 124/158] fix copy_tree() regression Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 126/158] md/raid5: avoid livelock caused by non-aligned writes Greg Kroah-Hartman
` (35 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, NeilBrown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit 2446dba03f9dabe0b477a126cbeb377854785b47 upstream.
Currently we don't abort recovery on a write error if the write error
to the recovering device was triggerd by normal IO (as opposed to
recovery IO).
This means that for one bitmap region, the recovery might write to the
recovering device for a few sectors, then not bother for subsequent
sectors (as it never writes to failed devices). In this case
the bitmap bit will be cleared, but it really shouldn't.
The result is that if the recovering device fails and is then re-added
(after fixing whatever hardware problem triggerred the failure),
the second recovery won't redo the region it was in the middle of,
so some of the device will not be recovered properly.
If we abort the recovery, the region being processes will be cancelled
(bit not cleared) and the whole region will be retried.
As the bug can result in data corruption the patch is suitable for
-stable. For kernels prior to 3.11 there is a conflict in raid10.c
which will require care.
Original-from: jiao hui <jiaohui@bwstor.com.cn>
Reported-and-tested-by: jiao hui <jiaohui@bwstor.com.cn>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid1.c | 8 ++++----
drivers/md/raid10.c | 11 +++++------
2 files changed, 9 insertions(+), 10 deletions(-)
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1501,12 +1501,12 @@ static void error(struct mddev *mddev, s
mddev->degraded++;
set_bit(Faulty, &rdev->flags);
spin_unlock_irqrestore(&conf->device_lock, flags);
- /*
- * if recovery is running, make sure it aborts.
- */
- set_bit(MD_RECOVERY_INTR, &mddev->recovery);
} else
set_bit(Faulty, &rdev->flags);
+ /*
+ * if recovery is running, make sure it aborts.
+ */
+ set_bit(MD_RECOVERY_INTR, &mddev->recovery);
set_bit(MD_CHANGE_DEVS, &mddev->flags);
printk(KERN_ALERT
"md/raid1:%s: Disk failure on %s, disabling device.\n"
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1684,13 +1684,12 @@ static void error(struct mddev *mddev, s
spin_unlock_irqrestore(&conf->device_lock, flags);
return;
}
- if (test_and_clear_bit(In_sync, &rdev->flags)) {
+ if (test_and_clear_bit(In_sync, &rdev->flags))
mddev->degraded++;
- /*
- * if recovery is running, make sure it aborts.
- */
- set_bit(MD_RECOVERY_INTR, &mddev->recovery);
- }
+ /*
+ * If recovery is running, make sure it aborts.
+ */
+ set_bit(MD_RECOVERY_INTR, &mddev->recovery);
set_bit(Blocked, &rdev->flags);
set_bit(Faulty, &rdev->flags);
set_bit(MD_CHANGE_DEVS, &mddev->flags);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 126/158] md/raid5: avoid livelock caused by non-aligned writes.
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (120 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 125/158] md/raid1,raid10: always abort recover on write error Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 127/158] md/raid6: avoid data corruption during recovery of double-degraded RAID6 Greg Kroah-Hartman
` (34 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, NeilBrown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit a40687ff73a5b14909d6aa522f7d778b158911c5 upstream.
If a stripe in a raid6 array received a write to each data block while
the array is degraded, and if any of these writes to a missing device
are not page-aligned, then a live-lock happens.
In this case the P and Q blocks need to be read so that the part of
the missing block which is *not* being updated by the write can be
constructed. Due to a logic error, these blocks are not loaded, so
the update cannot proceed and the stripe is 'handled' repeatedly in an
infinite loop.
This bug is unlikely as most writes are page aligned. However as it
can lead to a livelock it is suitable for -stable. It was introduced
in 3.16.
Fixed: 67f455486d2ea20b2d94d6adf5b9b783d079e321
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid5.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2922,7 +2922,7 @@ static int fetch_block(struct stripe_hea
(!test_bit(R5_Insync, &dev->flags) || test_bit(STRIPE_PREREAD_ACTIVE, &sh->state)) &&
!test_bit(R5_OVERWRITE, &fdev[0]->flags)) ||
(sh->raid_conf->level == 6 && s->failed && s->to_write &&
- s->to_write < sh->raid_conf->raid_disks - 2 &&
+ s->to_write - s->non_overwrite < sh->raid_conf->raid_disks - 2 &&
(!test_bit(R5_Insync, &dev->flags) || test_bit(STRIPE_PREREAD_ACTIVE, &sh->state))))) {
/* we would like to get this block, possibly by computing it,
* otherwise read it if the backing disk is insync
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 127/158] md/raid6: avoid data corruption during recovery of double-degraded RAID6
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (121 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 126/158] md/raid5: avoid livelock caused by non-aligned writes Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 128/158] md/raid10: fix memory leak when reshaping a RAID10 Greg Kroah-Hartman
` (33 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yuri Tikhonov, Dan Williams,
Manibalan P, NeilBrown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit 9c4bdf697c39805078392d5ddbbba5ae5680e0dd upstream.
During recovery of a double-degraded RAID6 it is possible for
some blocks not to be recovered properly, leading to corruption.
If a write happens to one block in a stripe that would be written to a
missing device, and at the same time that stripe is recovering data
to the other missing device, then that recovered data may not be written.
This patch skips, in the double-degraded case, an optimisation that is
only safe for single-degraded arrays.
Bug was introduced in 2.6.32 and fix is suitable for any kernel since
then. In an older kernel with separate handle_stripe5() and
handle_stripe6() functions the patch must change handle_stripe6().
Fixes: 6c0069c0ae9659e3a91b68eaed06a5c6c37f45c8
Cc: Yuri Tikhonov <yur@emcraft.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Reported-by: "Manibalan P" <pmanibalan@amiindia.co.in>
Tested-by: "Manibalan P" <pmanibalan@amiindia.co.in>
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1090423
Signed-off-by: NeilBrown <neilb@suse.de>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid5.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3817,6 +3817,8 @@ static void handle_stripe(struct stripe_
set_bit(R5_Wantwrite, &dev->flags);
if (prexor)
continue;
+ if (s.failed > 1)
+ continue;
if (!test_bit(R5_Insync, &dev->flags) ||
((i == sh->pd_idx || i == sh->qd_idx) &&
s.failed == 0))
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 128/158] md/raid10: fix memory leak when reshaping a RAID10.
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (122 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 127/158] md/raid6: avoid data corruption during recovery of double-degraded RAID6 Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 129/158] md/raid10: Fix memory leak when raid10 reshape completes Greg Kroah-Hartman
` (32 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Koch, NeilBrown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit ce0b0a46955d1bb389684a2605dbcaa990ba0154 upstream.
raid10 reshape clears unwanted bits from a bio->bi_flags using
a method which, while clumsy, worked until 3.10 when BIO_OWNS_VEC
was added.
Since then it clears that bit but shouldn't. This results in a
memory leak.
So change to used the approved method of clearing unwanted bits.
As this causes a memory leak which can consume all of memory
the fix is suitable for -stable.
Fixes: a38352e0ac02dbbd4fa464dc22d1352b5fbd06fd
Reported-by: mdraid.pkoch@dfgh.net (Peter Koch)
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid10.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -4410,7 +4410,7 @@ read_more:
read_bio->bi_private = r10_bio;
read_bio->bi_end_io = end_sync_read;
read_bio->bi_rw = READ;
- read_bio->bi_flags &= ~(BIO_POOL_MASK - 1);
+ read_bio->bi_flags &= (~0UL << BIO_RESET_BITS);
read_bio->bi_flags |= 1 << BIO_UPTODATE;
read_bio->bi_vcnt = 0;
read_bio->bi_iter.bi_size = 0;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 129/158] md/raid10: Fix memory leak when raid10 reshape completes.
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (123 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 128/158] md/raid10: fix memory leak when reshaping a RAID10 Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 130/158] RDMA/iwcm: Use a default listen backlog if needed Greg Kroah-Hartman
` (31 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, NeilBrown
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit b39685526f46976bcd13aa08c82480092befa46c upstream.
When a raid10 commences a resync/recovery/reshape it allocates
some buffer space.
When a resync/recovery completes the buffer space is freed. But not
when the reshape completes.
This can result in a small memory leak.
There is a subtle side-effect of this bug. When a RAID10 is reshaped
to a larger array (more devices), the reshape is immediately followed
by a "resync" of the new space. This "resync" will use the buffer
space which was allocated for "reshape". This can cause problems
including a "BUG" in the SCSI layer. So this is suitable for -stable.
Fixes: 3ea7daa5d7fde47cd41f4d56c2deb949114da9d6
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid10.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2953,6 +2953,7 @@ static sector_t sync_request(struct mdde
*/
if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery)) {
end_reshape(conf);
+ close_sync(conf);
return 0;
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 130/158] RDMA/iwcm: Use a default listen backlog if needed
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (124 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 129/158] md/raid10: Fix memory leak when raid10 reshape completes Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 131/158] RDMA/uapi: Include socket.h in rdma_user_cm.h Greg Kroah-Hartman
` (30 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steve Wise, Roland Dreier
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve Wise <swise@opengridcomputing.com>
commit 2f0304d21867476394cd51a54e97f7273d112261 upstream.
If the user creates a listening cm_id with backlog of 0 the IWCM ends
up not allowing any connection requests at all. The correct behavior
is for the IWCM to pick a default value if the user backlog parameter
is zero.
Lustre from version 1.8.8 onward uses a backlog of 0, which breaks
iwarp support without this fix.
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/iwcm.c | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -46,6 +46,7 @@
#include <linux/completion.h>
#include <linux/slab.h>
#include <linux/module.h>
+#include <linux/sysctl.h>
#include <rdma/iw_cm.h>
#include <rdma/ib_addr.h>
@@ -65,6 +66,20 @@ struct iwcm_work {
struct list_head free_list;
};
+static unsigned int default_backlog = 256;
+
+static struct ctl_table_header *iwcm_ctl_table_hdr;
+static struct ctl_table iwcm_ctl_table[] = {
+ {
+ .procname = "default_backlog",
+ .data = &default_backlog,
+ .maxlen = sizeof(default_backlog),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ },
+ { }
+};
+
/*
* The following services provide a mechanism for pre-allocating iwcm_work
* elements. The design pre-allocates them based on the cm_id type:
@@ -425,6 +440,9 @@ int iw_cm_listen(struct iw_cm_id *cm_id,
cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
+ if (!backlog)
+ backlog = default_backlog;
+
ret = alloc_work_entries(cm_id_priv, backlog);
if (ret)
return ret;
@@ -1030,11 +1048,20 @@ static int __init iw_cm_init(void)
if (!iwcm_wq)
return -ENOMEM;
+ iwcm_ctl_table_hdr = register_net_sysctl(&init_net, "net/iw_cm",
+ iwcm_ctl_table);
+ if (!iwcm_ctl_table_hdr) {
+ pr_err("iw_cm: couldn't register sysctl paths\n");
+ destroy_workqueue(iwcm_wq);
+ return -ENOMEM;
+ }
+
return 0;
}
static void __exit iw_cm_cleanup(void)
{
+ unregister_net_sysctl_table(iwcm_ctl_table_hdr);
destroy_workqueue(iwcm_wq);
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 131/158] RDMA/uapi: Include socket.h in rdma_user_cm.h
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (125 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 130/158] RDMA/iwcm: Use a default listen backlog if needed Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 132/158] xfs: ensure verifiers are attached to recovered buffers Greg Kroah-Hartman
` (29 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Doug Ledford, Roland Dreier
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doug Ledford <dledford@redhat.com>
commit db1044d458a287c18c4d413adc4ad12e92e253b5 upstream.
added struct sockaddr_storage to rdma_user_cm.h without also adding an
include for linux/socket.h to make sure it is defined. Systemtap
needs the header files to build standalone and cannot rely on other
files to pre-include other headers, so add linux/socket.h to the list
of includes in this file.
Fixes: ee7aed4528f ("RDMA/ucma: Support querying for AF_IB addresses")
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/uapi/rdma/rdma_user_cm.h | 1 +
1 file changed, 1 insertion(+)
--- a/include/uapi/rdma/rdma_user_cm.h
+++ b/include/uapi/rdma/rdma_user_cm.h
@@ -34,6 +34,7 @@
#define RDMA_USER_CM_H
#include <linux/types.h>
+#include <linux/socket.h>
#include <linux/in6.h>
#include <rdma/ib_user_verbs.h>
#include <rdma/ib_user_sa.h>
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 132/158] xfs: ensure verifiers are attached to recovered buffers
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (126 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 131/158] RDMA/uapi: Include socket.h in rdma_user_cm.h Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 133/158] xfs: quotacheck leaves dquot buffers without verifiers Greg Kroah-Hartman
` (28 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Kara, Fanael Linithien, Grozdan,
Dave Chinner, Brian Foster, Christoph Hellwig, Dave Chinner
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Chinner <dchinner@redhat.com>
commit 67dc288c21064b31a98a53dc64f6b9714b819fd6 upstream.
Crash testing of CRC enabled filesystems has resulted in a number of
reports of bad CRCs being detected after the filesystem was mounted.
Errors such as the following were being seen:
XFS (sdb3): Mounting V5 Filesystem
XFS (sdb3): Starting recovery (logdev: internal)
XFS (sdb3): Metadata CRC error detected at xfs_agf_read_verify+0x5a/0x100 [xfs], block 0x1
XFS (sdb3): Unmount and run xfs_repair
XFS (sdb3): First 64 bytes of corrupted metadata buffer:
ffff880136ffd600: 58 41 47 46 00 00 00 01 00 00 00 00 00 0f aa 40 XAGF...........@
ffff880136ffd610: 00 02 6d 53 00 02 77 f8 00 00 00 00 00 00 00 01 ..mS..w.........
ffff880136ffd620: 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 03 ................
ffff880136ffd630: 00 00 00 04 00 08 81 d0 00 08 81 a7 00 00 00 00 ................
XFS (sdb3): metadata I/O error: block 0x1 ("xfs_trans_read_buf_map") error 74 numblks 1
The errors were typically being seen in AGF, AGI and their related
btree block buffers some time after log recovery had run. Often it
wasn't until later subsequent mounts that the problem was
discovered. The common symptom was a buffer with the correct
contents, but a CRC and an LSN that matched an older version of the
contents.
Some debug added to _xfs_buf_ioapply() indicated that buffers were
being written without verifiers attached to them from log recovery,
and Jan Kara isolated the cause to log recovery readahead an dit's
interactions with buffers that had a more recent LSN on disk than
the transaction being recovered. In this case, the buffer did not
get a verifier attached, and os when the second phase of log
recovery ran and recovered EFIs and unlinked inodes, the buffers
were modified and written without the verifier running. Hence they
had up to date contents, but stale LSNs and CRCs.
Fix it by attaching verifiers to buffers we skip due to future LSN
values so they don't escape into the buffer cache without the
correct verifier attached.
This patch is based on analysis and a patch from Jan Kara.
Reported-by: Jan Kara <jack@suse.cz>
Reported-by: Fanael Linithien <fanael4@gmail.com>
Reported-by: Grozdan <neutrino8@gmail.com>
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_log_recover.c | 51 ++++++++++++++++++++++++++++-------------------
1 file changed, 31 insertions(+), 20 deletions(-)
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -2125,6 +2125,17 @@ xlog_recover_validate_buf_type(
__uint16_t magic16;
__uint16_t magicda;
+ /*
+ * We can only do post recovery validation on items on CRC enabled
+ * fielsystems as we need to know when the buffer was written to be able
+ * to determine if we should have replayed the item. If we replay old
+ * metadata over a newer buffer, then it will enter a temporarily
+ * inconsistent state resulting in verification failures. Hence for now
+ * just avoid the verification stage for non-crc filesystems
+ */
+ if (!xfs_sb_version_hascrc(&mp->m_sb))
+ return;
+
magic32 = be32_to_cpu(*(__be32 *)bp->b_addr);
magic16 = be16_to_cpu(*(__be16*)bp->b_addr);
magicda = be16_to_cpu(info->magic);
@@ -2162,8 +2173,6 @@ xlog_recover_validate_buf_type(
bp->b_ops = &xfs_agf_buf_ops;
break;
case XFS_BLFT_AGFL_BUF:
- if (!xfs_sb_version_hascrc(&mp->m_sb))
- break;
if (magic32 != XFS_AGFL_MAGIC) {
xfs_warn(mp, "Bad AGFL block magic!");
ASSERT(0);
@@ -2196,10 +2205,6 @@ xlog_recover_validate_buf_type(
#endif
break;
case XFS_BLFT_DINO_BUF:
- /*
- * we get here with inode allocation buffers, not buffers that
- * track unlinked list changes.
- */
if (magic16 != XFS_DINODE_MAGIC) {
xfs_warn(mp, "Bad INODE block magic!");
ASSERT(0);
@@ -2279,8 +2284,6 @@ xlog_recover_validate_buf_type(
bp->b_ops = &xfs_attr3_leaf_buf_ops;
break;
case XFS_BLFT_ATTR_RMT_BUF:
- if (!xfs_sb_version_hascrc(&mp->m_sb))
- break;
if (magic32 != XFS_ATTR3_RMT_MAGIC) {
xfs_warn(mp, "Bad attr remote magic!");
ASSERT(0);
@@ -2387,16 +2390,7 @@ xlog_recover_do_reg_buffer(
/* Shouldn't be any more regions */
ASSERT(i == item->ri_total);
- /*
- * We can only do post recovery validation on items on CRC enabled
- * fielsystems as we need to know when the buffer was written to be able
- * to determine if we should have replayed the item. If we replay old
- * metadata over a newer buffer, then it will enter a temporarily
- * inconsistent state resulting in verification failures. Hence for now
- * just avoid the verification stage for non-crc filesystems
- */
- if (xfs_sb_version_hascrc(&mp->m_sb))
- xlog_recover_validate_buf_type(mp, bp, buf_f);
+ xlog_recover_validate_buf_type(mp, bp, buf_f);
}
/*
@@ -2504,12 +2498,29 @@ xlog_recover_buffer_pass2(
}
/*
- * recover the buffer only if we get an LSN from it and it's less than
+ * Recover the buffer only if we get an LSN from it and it's less than
* the lsn of the transaction we are replaying.
+ *
+ * Note that we have to be extremely careful of readahead here.
+ * Readahead does not attach verfiers to the buffers so if we don't
+ * actually do any replay after readahead because of the LSN we found
+ * in the buffer if more recent than that current transaction then we
+ * need to attach the verifier directly. Failure to do so can lead to
+ * future recovery actions (e.g. EFI and unlinked list recovery) can
+ * operate on the buffers and they won't get the verifier attached. This
+ * can lead to blocks on disk having the correct content but a stale
+ * CRC.
+ *
+ * It is safe to assume these clean buffers are currently up to date.
+ * If the buffer is dirtied by a later transaction being replayed, then
+ * the verifier will be reset to match whatever recover turns that
+ * buffer into.
*/
lsn = xlog_recover_get_buf_lsn(mp, bp);
- if (lsn && lsn != -1 && XFS_LSN_CMP(lsn, current_lsn) >= 0)
+ if (lsn && lsn != -1 && XFS_LSN_CMP(lsn, current_lsn) >= 0) {
+ xlog_recover_validate_buf_type(mp, bp, buf_f);
goto out_release;
+ }
if (buf_f->blf_flags & XFS_BLF_INODE_BUF) {
error = xlog_recover_do_inode_buffer(mp, item, bp, buf_f);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 133/158] xfs: quotacheck leaves dquot buffers without verifiers
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (127 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 132/158] xfs: ensure verifiers are attached to recovered buffers Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 134/158] xfs: dont dirty buffers beyond EOF Greg Kroah-Hartman
` (27 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Chinner, Brian Foster,
Christoph Hellwig, Dave Chinner
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Chinner <dchinner@redhat.com>
commit 5fd364fee81a7888af806e42ed8a91c845894f2d upstream.
When running xfs/305, I noticed that quotacheck was flushing dquot
buffers that did not have the xfs_dquot_buf_ops verifiers attached:
XFS (vdb): _xfs_buf_ioapply: no ops on block 0x1dc8/0x1dc8
ffff880052489000: 44 51 01 04 00 00 65 b8 00 00 00 00 00 00 00 00 DQ....e.........
ffff880052489010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
ffff880052489020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
ffff880052489030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
CPU: 1 PID: 2376 Comm: mount Not tainted 3.16.0-rc2-dgc+ #306
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
ffff88006fe38000 ffff88004a0ffae8 ffffffff81cf1cca 0000000000000001
ffff88004a0ffb88 ffffffff814d50ca 000010004a0ffc70 0000000000000000
ffff88006be56dc4 0000000000000021 0000000000001dc8 ffff88007c773d80
Call Trace:
[<ffffffff81cf1cca>] dump_stack+0x45/0x56
[<ffffffff814d50ca>] _xfs_buf_ioapply+0x3ca/0x3d0
[<ffffffff810db520>] ? wake_up_state+0x20/0x20
[<ffffffff814d51f5>] ? xfs_bdstrat_cb+0x55/0xb0
[<ffffffff814d513b>] xfs_buf_iorequest+0x6b/0xd0
[<ffffffff814d51f5>] xfs_bdstrat_cb+0x55/0xb0
[<ffffffff814d53ab>] __xfs_buf_delwri_submit+0x15b/0x220
[<ffffffff814d6040>] ? xfs_buf_delwri_submit+0x30/0x90
[<ffffffff814d6040>] xfs_buf_delwri_submit+0x30/0x90
[<ffffffff8150f89d>] xfs_qm_quotacheck+0x17d/0x3c0
[<ffffffff81510591>] xfs_qm_mount_quotas+0x151/0x1e0
[<ffffffff814ed01c>] xfs_mountfs+0x56c/0x7d0
[<ffffffff814f0f12>] xfs_fs_fill_super+0x2c2/0x340
[<ffffffff811c9fe4>] mount_bdev+0x194/0x1d0
[<ffffffff814f0c50>] ? xfs_finish_flags+0x170/0x170
[<ffffffff814ef0f5>] xfs_fs_mount+0x15/0x20
[<ffffffff811ca8c9>] mount_fs+0x39/0x1b0
[<ffffffff811e4d67>] vfs_kern_mount+0x67/0x120
[<ffffffff811e757e>] do_mount+0x23e/0xad0
[<ffffffff8117abde>] ? __get_free_pages+0xe/0x50
[<ffffffff811e71e6>] ? copy_mount_options+0x36/0x150
[<ffffffff811e8103>] SyS_mount+0x83/0xc0
[<ffffffff81cfd40b>] tracesys+0xdd/0xe2
This was caused by dquot buffer readahead not attaching a verifier
structure to the buffer when readahead was issued, resulting in the
followup read of the buffer finding a valid buffer and so not
attaching new verifiers to the buffer as part of the read.
Also, when a verifier failure occurs, we then read the buffer
without verifiers. Attach the verifiers manually after this read so
that if the buffer is then written it will be verified that the
corruption has been repaired.
Further, when flushing a dquot we don't ask for a verifier when
reading in the dquot buffer the dquot belongs to. Most of the time
this isn't an issue because the buffer is still cached, but when it
is not cached it will result in writing the dquot buffer without
having the verfier attached.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_dquot.c | 3 ++-
fs/xfs/xfs_qm.c | 8 +++++++-
2 files changed, 9 insertions(+), 2 deletions(-)
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -974,7 +974,8 @@ xfs_qm_dqflush(
* Get the buffer containing the on-disk dquot
*/
error = xfs_trans_read_buf(mp, NULL, mp->m_ddev_targp, dqp->q_blkno,
- mp->m_quotainfo->qi_dqchunklen, 0, &bp, NULL);
+ mp->m_quotainfo->qi_dqchunklen, 0, &bp,
+ &xfs_dquot_buf_ops);
if (error)
goto out_unlock;
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -1005,6 +1005,12 @@ xfs_qm_dqiter_bufs(
if (error)
break;
+ /*
+ * A corrupt buffer might not have a verifier attached, so
+ * make sure we have the correct one attached before writeback
+ * occurs.
+ */
+ bp->b_ops = &xfs_dquot_buf_ops;
xfs_qm_reset_dqcounts(mp, bp, firstid, type);
xfs_buf_delwri_queue(bp, buffer_list);
xfs_buf_relse(bp);
@@ -1090,7 +1096,7 @@ xfs_qm_dqiterate(
xfs_buf_readahead(mp->m_ddev_targp,
XFS_FSB_TO_DADDR(mp, rablkno),
mp->m_quotainfo->qi_dqchunklen,
- NULL);
+ &xfs_dquot_buf_ops);
rablkno++;
}
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 134/158] xfs: dont dirty buffers beyond EOF
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (128 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 133/158] xfs: quotacheck leaves dquot buffers without verifiers Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 135/158] xfs: dont zero partial page cache pages during O_DIRECT writes Greg Kroah-Hartman
` (26 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Chinner, Brian Foster, Dave Chinner
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Chinner <dchinner@redhat.com>
commit 22e757a49cf010703fcb9c9b4ef793248c39b0c2 upstream.
generic/263 is failing fsx at this point with a page spanning
EOF that cannot be invalidated. The operations are:
1190 mapwrite 0x52c00 thru 0x5e569 (0xb96a bytes)
1191 mapread 0x5c000 thru 0x5d636 (0x1637 bytes)
1192 write 0x5b600 thru 0x771ff (0x1bc00 bytes)
where 1190 extents EOF from 0x54000 to 0x5e569. When the direct IO
write attempts to invalidate the cached page over this range, it
fails with -EBUSY and so any attempt to do page invalidation fails.
The real question is this: Why can't that page be invalidated after
it has been written to disk and cleaned?
Well, there's data on the first two buffers in the page (1k block
size, 4k page), but the third buffer on the page (i.e. beyond EOF)
is failing drop_buffers because it's bh->b_state == 0x3, which is
BH_Uptodate | BH_Dirty. IOWs, there's dirty buffers beyond EOF. Say
what?
OK, set_buffer_dirty() is called on all buffers from
__set_page_buffers_dirty(), regardless of whether the buffer is
beyond EOF or not, which means that when we get to ->writepage,
we have buffers marked dirty beyond EOF that we need to clean.
So, we need to implement our own .set_page_dirty method that
doesn't dirty buffers beyond EOF.
This is messy because the buffer code is not meant to be shared
and it has interesting locking issues on the buffer dirty bits.
So just copy and paste it and then modify it to suit what we need.
Note: the solutions the other filesystems and generic block code use
of marking the buffers clean in ->writepage does not work for XFS.
It still leaves dirty buffers beyond EOF and invalidations still
fail. Hence rather than play whack-a-mole, this patch simply
prevents those buffers from being dirtied in the first place.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_aops.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 61 insertions(+)
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -1753,11 +1753,72 @@ xfs_vm_readpages(
return mpage_readpages(mapping, pages, nr_pages, xfs_get_blocks);
}
+/*
+ * This is basically a copy of __set_page_dirty_buffers() with one
+ * small tweak: buffers beyond EOF do not get marked dirty. If we mark them
+ * dirty, we'll never be able to clean them because we don't write buffers
+ * beyond EOF, and that means we can't invalidate pages that span EOF
+ * that have been marked dirty. Further, the dirty state can leak into
+ * the file interior if the file is extended, resulting in all sorts of
+ * bad things happening as the state does not match the underlying data.
+ *
+ * XXX: this really indicates that bufferheads in XFS need to die. Warts like
+ * this only exist because of bufferheads and how the generic code manages them.
+ */
+STATIC int
+xfs_vm_set_page_dirty(
+ struct page *page)
+{
+ struct address_space *mapping = page->mapping;
+ struct inode *inode = mapping->host;
+ loff_t end_offset;
+ loff_t offset;
+ int newly_dirty;
+
+ if (unlikely(!mapping))
+ return !TestSetPageDirty(page);
+
+ end_offset = i_size_read(inode);
+ offset = page_offset(page);
+
+ spin_lock(&mapping->private_lock);
+ if (page_has_buffers(page)) {
+ struct buffer_head *head = page_buffers(page);
+ struct buffer_head *bh = head;
+
+ do {
+ if (offset < end_offset)
+ set_buffer_dirty(bh);
+ bh = bh->b_this_page;
+ offset += 1 << inode->i_blkbits;
+ } while (bh != head);
+ }
+ newly_dirty = !TestSetPageDirty(page);
+ spin_unlock(&mapping->private_lock);
+
+ if (newly_dirty) {
+ /* sigh - __set_page_dirty() is static, so copy it here, too */
+ unsigned long flags;
+
+ spin_lock_irqsave(&mapping->tree_lock, flags);
+ if (page->mapping) { /* Race with truncate? */
+ WARN_ON_ONCE(!PageUptodate(page));
+ account_page_dirtied(page, mapping);
+ radix_tree_tag_set(&mapping->page_tree,
+ page_index(page), PAGECACHE_TAG_DIRTY);
+ }
+ spin_unlock_irqrestore(&mapping->tree_lock, flags);
+ __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
+ }
+ return newly_dirty;
+}
+
const struct address_space_operations xfs_address_space_operations = {
.readpage = xfs_vm_readpage,
.readpages = xfs_vm_readpages,
.writepage = xfs_vm_writepage,
.writepages = xfs_vm_writepages,
+ .set_page_dirty = xfs_vm_set_page_dirty,
.releasepage = xfs_vm_releasepage,
.invalidatepage = xfs_vm_invalidatepage,
.write_begin = xfs_vm_write_begin,
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 135/158] xfs: dont zero partial page cache pages during O_DIRECT writes
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (129 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 134/158] xfs: dont dirty buffers beyond EOF Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 136/158] xfs: dont zero partial page cache pages during O_DIRECT write Greg Kroah-Hartman
` (25 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Chinner, Brian Foster,
Christoph Hellwig, Dave Chinner
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Chinner <dchinner@redhat.com>
commit 834ffca6f7e345a79f6f2e2d131b0dfba8a4b67a upstream.
Similar to direct IO reads, direct IO writes are using
truncate_pagecache_range to invalidate the page cache. This is
incorrect due to the sub-block zeroing in the page cache that
truncate_pagecache_range() triggers.
This patch fixes things by using invalidate_inode_pages2_range
instead. It preserves the page cache invalidation, but won't zero
any pages.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_file.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -634,7 +634,15 @@ xfs_file_dio_aio_write(
pos, -1);
if (ret)
goto out;
- truncate_pagecache_range(VFS_I(ip), pos, -1);
+ /*
+ * Invalidate whole pages. This can return an error if
+ * we fail to invalidate a page, but this should never
+ * happen on XFS. Warn if it does fail.
+ */
+ ret = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
+ pos >> PAGE_CACHE_SHIFT, -1);
+ WARN_ON_ONCE(ret);
+ ret = 0;
}
/*
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 136/158] xfs: dont zero partial page cache pages during O_DIRECT write
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (130 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 135/158] xfs: dont zero partial page cache pages during O_DIRECT writes Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 137/158] libceph: set last_piece in ceph_msg_data_pages_cursor_init() correctly Greg Kroah-Hartman
` (24 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Mason, Dave Chinner,
Brian Foster, Christoph Hellwig, Dave Chinner
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@fb.com>
commit 85e584da3212140ee80fd047f9058bbee0bc00d5 upstream.
xfs is using truncate_pagecache_range to invalidate the page cache
during DIO reads. This is different from the other filesystems who
only invalidate pages during DIO writes.
truncate_pagecache_range is meant to be used when we are freeing the
underlying data structs from disk, so it will zero any partial
ranges in the page. This means a DIO read can zero out part of the
page cache page, and it is possible the page will stay in cache.
buffered reads will find an up to date page with zeros instead of
the data actually on disk.
This patch fixes things by using invalidate_inode_pages2_range
instead. It preserves the page cache invalidation, but won't zero
any pages.
[dchinner: catch error and warn if it fails. Comment.]
Signed-off-by: Chris Mason <clm@fb.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_file.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -295,7 +295,16 @@ xfs_file_read_iter(
xfs_rw_iunlock(ip, XFS_IOLOCK_EXCL);
return ret;
}
- truncate_pagecache_range(VFS_I(ip), pos, -1);
+
+ /*
+ * Invalidate whole pages. This can return an error if
+ * we fail to invalidate a page, but this should never
+ * happen on XFS. Warn if it does fail.
+ */
+ ret = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
+ pos >> PAGE_CACHE_SHIFT, -1);
+ WARN_ON_ONCE(ret);
+ ret = 0;
}
xfs_rw_ilock_demote(ip, XFS_IOLOCK_EXCL);
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 137/158] libceph: set last_piece in ceph_msg_data_pages_cursor_init() correctly
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (131 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 136/158] xfs: dont zero partial page cache pages during O_DIRECT write Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 138/158] libceph: gracefully handle large reply messages from the mon Greg Kroah-Hartman
` (23 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ilya Dryomov, Sage Weil, Alex Elder
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <ilya.dryomov@inktank.com>
commit 5f740d7e1531099b888410e6bab13f68da9b1a4d upstream.
Determining ->last_piece based on the value of ->page_offset + length
is incorrect because length here is the length of the entire message.
->last_piece set to false even if page array data item length is <=
PAGE_SIZE, which results in invalid length passed to
ceph_tcp_{send,recv}page() and causes various asserts to fire.
# cat pages-cursor-init.sh
#!/bin/bash
rbd create --size 10 --image-format 2 foo
FOO_DEV=$(rbd map foo)
dd if=/dev/urandom of=$FOO_DEV bs=1M &>/dev/null
rbd snap create foo@snap
rbd snap protect foo@snap
rbd clone foo@snap bar
# rbd_resize calls librbd rbd_resize(), size is in bytes
./rbd_resize bar $(((4 << 20) + 512))
rbd resize --size 10 bar
BAR_DEV=$(rbd map bar)
# trigger a 512-byte copyup -- 512-byte page array data item
dd if=/dev/urandom of=$BAR_DEV bs=1M count=1 seek=5
The problem exists only in ceph_msg_data_pages_cursor_init(),
ceph_msg_data_pages_advance() does the right thing. The size_t cast is
unnecessary.
Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/messenger.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -900,7 +900,7 @@ static void ceph_msg_data_pages_cursor_i
BUG_ON(page_count > (int)USHRT_MAX);
cursor->page_count = (unsigned short)page_count;
BUG_ON(length > SIZE_MAX - cursor->page_offset);
- cursor->last_piece = (size_t)cursor->page_offset + length <= PAGE_SIZE;
+ cursor->last_piece = cursor->page_offset + cursor->resid <= PAGE_SIZE;
}
static struct page *
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 138/158] libceph: gracefully handle large reply messages from the mon
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (132 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 137/158] libceph: set last_piece in ceph_msg_data_pages_cursor_init() correctly Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 139/158] libceph: add process_one_ticket() helper Greg Kroah-Hartman
` (22 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sage Weil, Ilya Dryomov
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sage Weil <sage@redhat.com>
commit 73c3d4812b4c755efeca0140f606f83772a39ce4 upstream.
We preallocate a few of the message types we get back from the mon. If we
get a larger message than we are expecting, fall back to trying to allocate
a new one instead of blindly using the one we have.
Signed-off-by: Sage Weil <sage@redhat.com>
Reviewed-by: Ilya Dryomov <ilya.dryomov@inktank.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/mon_client.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -1181,7 +1181,15 @@ static struct ceph_msg *mon_alloc_msg(st
if (!m) {
pr_info("alloc_msg unknown type %d\n", type);
*skip = 1;
+ } else if (front_len > m->front_alloc_len) {
+ pr_warning("mon_alloc_msg front %d > prealloc %d (%u#%llu)\n",
+ front_len, m->front_alloc_len,
+ (unsigned int)con->peer_name.type,
+ le64_to_cpu(con->peer_name.num));
+ ceph_msg_put(m);
+ m = ceph_msg_new(type, front_len, GFP_NOFS, false);
}
+
return m;
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 139/158] libceph: add process_one_ticket() helper
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (133 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 138/158] libceph: gracefully handle large reply messages from the mon Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 140/158] libceph: do not hard code max auth ticket len Greg Kroah-Hartman
` (21 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ilya Dryomov, Sage Weil
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <ilya.dryomov@inktank.com>
commit 597cda357716a3cf8d994cb11927af917c8d71fa upstream.
Add a helper for processing individual cephx auth tickets. Needed for
the next commit, which deals with allocating ticket buffers. (Most of
the diff here is whitespace - view with git diff -b).
Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/auth_x.c | 228 +++++++++++++++++++++++++++++-------------------------
1 file changed, 124 insertions(+), 104 deletions(-)
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -129,17 +129,131 @@ static void remove_ticket_handler(struct
kfree(th);
}
+static int process_one_ticket(struct ceph_auth_client *ac,
+ struct ceph_crypto_key *secret,
+ void **p, void *end,
+ void *dbuf, void *ticket_buf)
+{
+ struct ceph_x_info *xi = ac->private;
+ int type;
+ u8 tkt_struct_v, blob_struct_v;
+ struct ceph_x_ticket_handler *th;
+ void *dp, *dend;
+ int dlen;
+ char is_enc;
+ struct timespec validity;
+ struct ceph_crypto_key old_key;
+ void *tp, *tpend;
+ struct ceph_timespec new_validity;
+ struct ceph_crypto_key new_session_key;
+ struct ceph_buffer *new_ticket_blob;
+ unsigned long new_expires, new_renew_after;
+ u64 new_secret_id;
+ int ret;
+
+ ceph_decode_need(p, end, sizeof(u32) + 1, bad);
+
+ type = ceph_decode_32(p);
+ dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
+
+ tkt_struct_v = ceph_decode_8(p);
+ if (tkt_struct_v != 1)
+ goto bad;
+
+ th = get_ticket_handler(ac, type);
+ if (IS_ERR(th)) {
+ ret = PTR_ERR(th);
+ goto out;
+ }
+
+ /* blob for me */
+ dlen = ceph_x_decrypt(secret, p, end, dbuf,
+ TEMP_TICKET_BUF_LEN);
+ if (dlen <= 0) {
+ ret = dlen;
+ goto out;
+ }
+ dout(" decrypted %d bytes\n", dlen);
+ dp = dbuf;
+ dend = dp + dlen;
+
+ tkt_struct_v = ceph_decode_8(&dp);
+ if (tkt_struct_v != 1)
+ goto bad;
+
+ memcpy(&old_key, &th->session_key, sizeof(old_key));
+ ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
+ if (ret)
+ goto out;
+
+ ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
+ ceph_decode_timespec(&validity, &new_validity);
+ new_expires = get_seconds() + validity.tv_sec;
+ new_renew_after = new_expires - (validity.tv_sec / 4);
+ dout(" expires=%lu renew_after=%lu\n", new_expires,
+ new_renew_after);
+
+ /* ticket blob for service */
+ ceph_decode_8_safe(p, end, is_enc, bad);
+ tp = ticket_buf;
+ if (is_enc) {
+ /* encrypted */
+ dout(" encrypted ticket\n");
+ dlen = ceph_x_decrypt(&old_key, p, end, ticket_buf,
+ TEMP_TICKET_BUF_LEN);
+ if (dlen < 0) {
+ ret = dlen;
+ goto out;
+ }
+ dlen = ceph_decode_32(&tp);
+ } else {
+ /* unencrypted */
+ ceph_decode_32_safe(p, end, dlen, bad);
+ ceph_decode_need(p, end, dlen, bad);
+ ceph_decode_copy(p, ticket_buf, dlen);
+ }
+ tpend = tp + dlen;
+ dout(" ticket blob is %d bytes\n", dlen);
+ ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
+ blob_struct_v = ceph_decode_8(&tp);
+ new_secret_id = ceph_decode_64(&tp);
+ ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
+ if (ret)
+ goto out;
+
+ /* all is well, update our ticket */
+ ceph_crypto_key_destroy(&th->session_key);
+ if (th->ticket_blob)
+ ceph_buffer_put(th->ticket_blob);
+ th->session_key = new_session_key;
+ th->ticket_blob = new_ticket_blob;
+ th->validity = new_validity;
+ th->secret_id = new_secret_id;
+ th->expires = new_expires;
+ th->renew_after = new_renew_after;
+ dout(" got ticket service %d (%s) secret_id %lld len %d\n",
+ type, ceph_entity_type_name(type), th->secret_id,
+ (int)th->ticket_blob->vec.iov_len);
+ xi->have_keys |= th->service;
+
+out:
+ return ret;
+
+bad:
+ ret = -EINVAL;
+ goto out;
+}
+
static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
struct ceph_crypto_key *secret,
void *buf, void *end)
{
- struct ceph_x_info *xi = ac->private;
- int num;
void *p = buf;
- int ret;
char *dbuf;
char *ticket_buf;
u8 reply_struct_v;
+ u32 num;
+ int ret;
dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
if (!dbuf)
@@ -150,112 +264,18 @@ static int ceph_x_proc_ticket_reply(stru
if (!ticket_buf)
goto out_dbuf;
- ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
- reply_struct_v = ceph_decode_8(&p);
+ ceph_decode_8_safe(&p, end, reply_struct_v, bad);
if (reply_struct_v != 1)
- goto bad;
- num = ceph_decode_32(&p);
- dout("%d tickets\n", num);
- while (num--) {
- int type;
- u8 tkt_struct_v, blob_struct_v;
- struct ceph_x_ticket_handler *th;
- void *dp, *dend;
- int dlen;
- char is_enc;
- struct timespec validity;
- struct ceph_crypto_key old_key;
- void *tp, *tpend;
- struct ceph_timespec new_validity;
- struct ceph_crypto_key new_session_key;
- struct ceph_buffer *new_ticket_blob;
- unsigned long new_expires, new_renew_after;
- u64 new_secret_id;
-
- ceph_decode_need(&p, end, sizeof(u32) + 1, bad);
-
- type = ceph_decode_32(&p);
- dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
-
- tkt_struct_v = ceph_decode_8(&p);
- if (tkt_struct_v != 1)
- goto bad;
-
- th = get_ticket_handler(ac, type);
- if (IS_ERR(th)) {
- ret = PTR_ERR(th);
- goto out;
- }
-
- /* blob for me */
- dlen = ceph_x_decrypt(secret, &p, end, dbuf,
- TEMP_TICKET_BUF_LEN);
- if (dlen <= 0) {
- ret = dlen;
- goto out;
- }
- dout(" decrypted %d bytes\n", dlen);
- dend = dbuf + dlen;
- dp = dbuf;
-
- tkt_struct_v = ceph_decode_8(&dp);
- if (tkt_struct_v != 1)
- goto bad;
+ return -EINVAL;
- memcpy(&old_key, &th->session_key, sizeof(old_key));
- ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
- if (ret)
- goto out;
+ ceph_decode_32_safe(&p, end, num, bad);
+ dout("%d tickets\n", num);
- ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
- ceph_decode_timespec(&validity, &new_validity);
- new_expires = get_seconds() + validity.tv_sec;
- new_renew_after = new_expires - (validity.tv_sec / 4);
- dout(" expires=%lu renew_after=%lu\n", new_expires,
- new_renew_after);
-
- /* ticket blob for service */
- ceph_decode_8_safe(&p, end, is_enc, bad);
- tp = ticket_buf;
- if (is_enc) {
- /* encrypted */
- dout(" encrypted ticket\n");
- dlen = ceph_x_decrypt(&old_key, &p, end, ticket_buf,
- TEMP_TICKET_BUF_LEN);
- if (dlen < 0) {
- ret = dlen;
- goto out;
- }
- dlen = ceph_decode_32(&tp);
- } else {
- /* unencrypted */
- ceph_decode_32_safe(&p, end, dlen, bad);
- ceph_decode_need(&p, end, dlen, bad);
- ceph_decode_copy(&p, ticket_buf, dlen);
- }
- tpend = tp + dlen;
- dout(" ticket blob is %d bytes\n", dlen);
- ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
- blob_struct_v = ceph_decode_8(&tp);
- new_secret_id = ceph_decode_64(&tp);
- ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
+ while (num--) {
+ ret = process_one_ticket(ac, secret, &p, end,
+ dbuf, ticket_buf);
if (ret)
goto out;
-
- /* all is well, update our ticket */
- ceph_crypto_key_destroy(&th->session_key);
- if (th->ticket_blob)
- ceph_buffer_put(th->ticket_blob);
- th->session_key = new_session_key;
- th->ticket_blob = new_ticket_blob;
- th->validity = new_validity;
- th->secret_id = new_secret_id;
- th->expires = new_expires;
- th->renew_after = new_renew_after;
- dout(" got ticket service %d (%s) secret_id %lld len %d\n",
- type, ceph_entity_type_name(type), th->secret_id,
- (int)th->ticket_blob->vec.iov_len);
- xi->have_keys |= th->service;
}
ret = 0;
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 140/158] libceph: do not hard code max auth ticket len
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (134 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 139/158] libceph: add process_one_ticket() helper Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 141/158] CIFS: Fix STATUS_CANNOT_DELETE error mapping for SMB2 Greg Kroah-Hartman
` (20 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ilya Dryomov, Sage Weil
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <ilya.dryomov@inktank.com>
commit c27a3e4d667fdcad3db7b104f75659478e0c68d8 upstream.
We hard code cephx auth ticket buffer size to 256 bytes. This isn't
enough for any moderate setups and, in case tickets themselves are not
encrypted, leads to buffer overflows (ceph_x_decrypt() errors out, but
ceph_decode_copy() doesn't - it's just a memcpy() wrapper). Since the
buffer is allocated dynamically anyway, allocated it a bit later, at
the point where we know how much is going to be needed.
Fixes: http://tracker.ceph.com/issues/8979
Signed-off-by: Ilya Dryomov <ilya.dryomov@inktank.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/auth_x.c | 64 ++++++++++++++++++++++++------------------------------
1 file changed, 29 insertions(+), 35 deletions(-)
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -13,8 +13,6 @@
#include "auth_x.h"
#include "auth_x_protocol.h"
-#define TEMP_TICKET_BUF_LEN 256
-
static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed);
static int ceph_x_is_authenticated(struct ceph_auth_client *ac)
@@ -64,7 +62,7 @@ static int ceph_x_encrypt(struct ceph_cr
}
static int ceph_x_decrypt(struct ceph_crypto_key *secret,
- void **p, void *end, void *obuf, size_t olen)
+ void **p, void *end, void **obuf, size_t olen)
{
struct ceph_x_encrypt_header head;
size_t head_len = sizeof(head);
@@ -75,8 +73,14 @@ static int ceph_x_decrypt(struct ceph_cr
return -EINVAL;
dout("ceph_x_decrypt len %d\n", len);
- ret = ceph_decrypt2(secret, &head, &head_len, obuf, &olen,
- *p, len);
+ if (*obuf == NULL) {
+ *obuf = kmalloc(len, GFP_NOFS);
+ if (!*obuf)
+ return -ENOMEM;
+ olen = len;
+ }
+
+ ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len);
if (ret)
return ret;
if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC)
@@ -131,18 +135,19 @@ static void remove_ticket_handler(struct
static int process_one_ticket(struct ceph_auth_client *ac,
struct ceph_crypto_key *secret,
- void **p, void *end,
- void *dbuf, void *ticket_buf)
+ void **p, void *end)
{
struct ceph_x_info *xi = ac->private;
int type;
u8 tkt_struct_v, blob_struct_v;
struct ceph_x_ticket_handler *th;
+ void *dbuf = NULL;
void *dp, *dend;
int dlen;
char is_enc;
struct timespec validity;
struct ceph_crypto_key old_key;
+ void *ticket_buf = NULL;
void *tp, *tpend;
struct ceph_timespec new_validity;
struct ceph_crypto_key new_session_key;
@@ -167,8 +172,7 @@ static int process_one_ticket(struct cep
}
/* blob for me */
- dlen = ceph_x_decrypt(secret, p, end, dbuf,
- TEMP_TICKET_BUF_LEN);
+ dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0);
if (dlen <= 0) {
ret = dlen;
goto out;
@@ -195,20 +199,25 @@ static int process_one_ticket(struct cep
/* ticket blob for service */
ceph_decode_8_safe(p, end, is_enc, bad);
- tp = ticket_buf;
if (is_enc) {
/* encrypted */
dout(" encrypted ticket\n");
- dlen = ceph_x_decrypt(&old_key, p, end, ticket_buf,
- TEMP_TICKET_BUF_LEN);
+ dlen = ceph_x_decrypt(&old_key, p, end, &ticket_buf, 0);
if (dlen < 0) {
ret = dlen;
goto out;
}
+ tp = ticket_buf;
dlen = ceph_decode_32(&tp);
} else {
/* unencrypted */
ceph_decode_32_safe(p, end, dlen, bad);
+ ticket_buf = kmalloc(dlen, GFP_NOFS);
+ if (!ticket_buf) {
+ ret = -ENOMEM;
+ goto out;
+ }
+ tp = ticket_buf;
ceph_decode_need(p, end, dlen, bad);
ceph_decode_copy(p, ticket_buf, dlen);
}
@@ -237,6 +246,8 @@ static int process_one_ticket(struct cep
xi->have_keys |= th->service;
out:
+ kfree(ticket_buf);
+ kfree(dbuf);
return ret;
bad:
@@ -249,21 +260,10 @@ static int ceph_x_proc_ticket_reply(stru
void *buf, void *end)
{
void *p = buf;
- char *dbuf;
- char *ticket_buf;
u8 reply_struct_v;
u32 num;
int ret;
- dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
- if (!dbuf)
- return -ENOMEM;
-
- ret = -ENOMEM;
- ticket_buf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
- if (!ticket_buf)
- goto out_dbuf;
-
ceph_decode_8_safe(&p, end, reply_struct_v, bad);
if (reply_struct_v != 1)
return -EINVAL;
@@ -272,22 +272,15 @@ static int ceph_x_proc_ticket_reply(stru
dout("%d tickets\n", num);
while (num--) {
- ret = process_one_ticket(ac, secret, &p, end,
- dbuf, ticket_buf);
+ ret = process_one_ticket(ac, secret, &p, end);
if (ret)
- goto out;
+ return ret;
}
- ret = 0;
-out:
- kfree(ticket_buf);
-out_dbuf:
- kfree(dbuf);
- return ret;
+ return 0;
bad:
- ret = -EINVAL;
- goto out;
+ return -EINVAL;
}
static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
@@ -603,13 +596,14 @@ static int ceph_x_verify_authorizer_repl
struct ceph_x_ticket_handler *th;
int ret = 0;
struct ceph_x_authorize_reply reply;
+ void *preply = &reply;
void *p = au->reply_buf;
void *end = p + sizeof(au->reply_buf);
th = get_ticket_handler(ac, au->service);
if (IS_ERR(th))
return PTR_ERR(th);
- ret = ceph_x_decrypt(&th->session_key, &p, end, &reply, sizeof(reply));
+ ret = ceph_x_decrypt(&th->session_key, &p, end, &preply, sizeof(reply));
if (ret < 0)
return ret;
if (ret != sizeof(reply))
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 141/158] CIFS: Fix STATUS_CANNOT_DELETE error mapping for SMB2
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (135 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 140/158] libceph: do not hard code max auth ticket len Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 142/158] CIFS: Fix async reading on reconnects Greg Kroah-Hartman
` (19 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Shilovsky, Steve French
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <pshilovsky@samba.org>
commit 21496687a79424572f46a84c690d331055f4866f upstream.
The existing mapping causes unlink() call to return error after delete
operation. Changing the mapping to -EACCES makes the client process
the call like CIFS protocol does - reset dos attributes with ATTR_READONLY
flag masked off and retry the operation.
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2maperror.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/cifs/smb2maperror.c
+++ b/fs/cifs/smb2maperror.c
@@ -605,7 +605,7 @@ static const struct status_to_posix_erro
{STATUS_MAPPED_FILE_SIZE_ZERO, -EIO, "STATUS_MAPPED_FILE_SIZE_ZERO"},
{STATUS_TOO_MANY_OPENED_FILES, -EMFILE, "STATUS_TOO_MANY_OPENED_FILES"},
{STATUS_CANCELLED, -EIO, "STATUS_CANCELLED"},
- {STATUS_CANNOT_DELETE, -EIO, "STATUS_CANNOT_DELETE"},
+ {STATUS_CANNOT_DELETE, -EACCES, "STATUS_CANNOT_DELETE"},
{STATUS_INVALID_COMPUTER_NAME, -EIO, "STATUS_INVALID_COMPUTER_NAME"},
{STATUS_FILE_DELETED, -EIO, "STATUS_FILE_DELETED"},
{STATUS_SPECIAL_ACCOUNT, -EIO, "STATUS_SPECIAL_ACCOUNT"},
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 142/158] CIFS: Fix async reading on reconnects
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (136 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 141/158] CIFS: Fix STATUS_CANNOT_DELETE error mapping for SMB2 Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 143/158] CIFS: Possible null ptr deref in SMB2_tcon Greg Kroah-Hartman
` (18 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jeff Layton, Pavel Shilovsky, Steve French
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <pshilovsky@samba.org>
commit 038bc961c31b070269ecd07349a7ee2e839d4fec upstream.
If we get into read_into_pages() from cifs_readv_receive() and then
loose a network, we issue cifs_reconnect that moves all mids to
a private list and issue their callbacks. The callback of the async
read request sets a mid to retry, frees it and wakes up a process
that waits on the rdata completion.
After the connection is established we return from read_into_pages()
with a short read, use the mid that was freed before and try to read
the remaining data from the a newly created socket. Both actions are
not what we want to do. In reconnect cases (-EAGAIN) we should not
mask off the error with a short read but should return the error
code instead.
Acked-by: Jeff Layton <jlayton@samba.org>
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/file.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2823,7 +2823,7 @@ cifs_uncached_read_into_pages(struct TCP
total_read += result;
}
- return total_read > 0 ? total_read : result;
+ return total_read > 0 && result != -EAGAIN ? total_read : result;
}
ssize_t cifs_user_readv(struct kiocb *iocb, struct iov_iter *to)
@@ -3231,7 +3231,7 @@ cifs_readpages_read_into_pages(struct TC
total_read += result;
}
- return total_read > 0 ? total_read : result;
+ return total_read > 0 && result != -EAGAIN ? total_read : result;
}
static int cifs_readpages(struct file *file, struct address_space *mapping,
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 143/158] CIFS: Possible null ptr deref in SMB2_tcon
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (137 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 142/158] CIFS: Fix async reading on reconnects Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 144/158] CIFS: Fix wrong directory attributes after rename Greg Kroah-Hartman
` (17 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steve French, Raphael Geissert
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <smfrench@gmail.com>
commit 18f39e7be0121317550d03e267e3ebd4dbfbb3ce upstream.
As Raphael Geissert pointed out, tcon_error_exit can dereference tcon
and there is one path in which tcon can be null.
Signed-off-by: Steve French <smfrench@gmail.com>
Reported-by: Raphael Geissert <geissert@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2pdu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -922,7 +922,8 @@ tcon_exit:
tcon_error_exit:
if (rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) {
cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
- tcon->bad_network_name = true;
+ if (tcon)
+ tcon->bad_network_name = true;
}
goto tcon_exit;
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 144/158] CIFS: Fix wrong directory attributes after rename
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (138 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 143/158] CIFS: Possible null ptr deref in SMB2_tcon Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 145/158] CIFS: Fix directory rename error Greg Kroah-Hartman
` (16 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Shilovsky, Steve French
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <pshilovsky@samba.org>
commit b46799a8f28c43c5264ac8d8ffa28b311b557e03 upstream.
When we requests rename we also need to update attributes
of both source and target parent directories. Not doing it
causes generic/309 xfstest to fail on SMB2 mounts. Fix this
by marking these directories for force revalidating.
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1717,6 +1717,12 @@ unlink_target:
target_dentry, to_name);
}
+ /* force revalidate to go get info when needed */
+ CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
+
+ source_dir->i_ctime = source_dir->i_mtime = target_dir->i_ctime =
+ target_dir->i_mtime = current_fs_time(source_dir->i_sb);
+
cifs_rename_exit:
kfree(info_buf_source);
kfree(from_name);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 145/158] CIFS: Fix directory rename error
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (139 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 144/158] CIFS: Fix wrong directory attributes after rename Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 146/158] CIFS: Fix wrong filename length for SMB2 Greg Kroah-Hartman
` (15 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Shilovsky, Steve French
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <pshilovsky@samba.org>
commit a07d322059db66b84c9eb4f98959df468e88b34b upstream.
CIFS servers process nlink counts differently for files and directories.
In cifs_rename() if we the request fails on the existing target, we
try to remove it through cifs_unlink() but this is not what we want
to do for directories. As the result the following sequence of commands
mkdir {1,2}; mv -T 1 2; rmdir {1,2}; mkdir {1,2}; echo foo > 2/bar
and XFS test generic/023 fail with -ENOENT error. That's why the second
mkdir reuses the existing inode (target inode of the mv -T command) with
S_DEAD flag.
Fix this by checking whether the target is directory or not and
calling cifs_rmdir() rather than cifs_unlink() for directories.
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/inode.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1710,7 +1710,10 @@ cifs_rename(struct inode *source_dir, st
unlink_target:
/* Try unlinking the target dentry if it's not negative */
if (target_dentry->d_inode && (rc == -EACCES || rc == -EEXIST)) {
- tmprc = cifs_unlink(target_dir, target_dentry);
+ if (d_is_dir(target_dentry))
+ tmprc = cifs_rmdir(target_dir, target_dentry);
+ else
+ tmprc = cifs_unlink(target_dir, target_dentry);
if (tmprc)
goto cifs_rename_exit;
rc = cifs_do_rename(xid, source_dentry, from_name,
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 146/158] CIFS: Fix wrong filename length for SMB2
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (140 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 145/158] CIFS: Fix directory rename error Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 147/158] CIFS: Fix wrong restart readdir for SMB1 Greg Kroah-Hartman
` (14 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Shilovsky, Steve French
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <pshilovsky@samba.org>
commit 1bbe4997b13de903c421c1cc78440e544b5f9064 upstream.
The existing code uses the old MAX_NAME constant. This causes
XFS test generic/013 to fail. Fix it by replacing MAX_NAME with
PATH_MAX that SMB1 uses. Also remove an unused MAX_NAME constant
definition.
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifsglob.h | 5 -----
fs/cifs/smb2file.c | 2 +-
fs/cifs/smb2inode.c | 2 +-
fs/cifs/smb2ops.c | 2 +-
fs/cifs/smb2pdu.c | 2 +-
5 files changed, 4 insertions(+), 9 deletions(-)
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -70,11 +70,6 @@
#define SERVER_NAME_LENGTH 40
#define SERVER_NAME_LEN_WITH_NULL (SERVER_NAME_LENGTH + 1)
-/* used to define string lengths for reversing unicode strings */
-/* (256+1)*2 = 514 */
-/* (max path length + 1 for null) * 2 for unicode */
-#define MAX_NAME 514
-
/* SMB echo "timeout" -- FIXME: tunable? */
#define SMB_ECHO_INTERVAL (60 * HZ)
--- a/fs/cifs/smb2file.c
+++ b/fs/cifs/smb2file.c
@@ -50,7 +50,7 @@ smb2_open_file(const unsigned int xid, s
goto out;
}
- smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
+ smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
GFP_KERNEL);
if (smb2_data == NULL) {
rc = -ENOMEM;
--- a/fs/cifs/smb2inode.c
+++ b/fs/cifs/smb2inode.c
@@ -131,7 +131,7 @@ smb2_query_path_info(const unsigned int
*adjust_tz = false;
*symlink = false;
- smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
+ smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
GFP_KERNEL);
if (smb2_data == NULL)
return -ENOMEM;
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -339,7 +339,7 @@ smb2_query_file_info(const unsigned int
int rc;
struct smb2_file_all_info *smb2_data;
- smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
+ smb2_data = kzalloc(sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
GFP_KERNEL);
if (smb2_data == NULL)
return -ENOMEM;
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1546,7 +1546,7 @@ SMB2_query_info(const unsigned int xid,
{
return query_info(xid, tcon, persistent_fid, volatile_fid,
FILE_ALL_INFORMATION,
- sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
+ sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
sizeof(struct smb2_file_all_info), data);
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 147/158] CIFS: Fix wrong restart readdir for SMB1
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (141 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 146/158] CIFS: Fix wrong filename length for SMB2 Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 148/158] mtd/ftl: fix the double free of the buffers allocated in build_maps() Greg Kroah-Hartman
` (13 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Pavel Shilovsky, Steve French
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <pshilovsky@samba.org>
commit f736906a7669a77cf8cabdcbcf1dc8cb694e12ef upstream.
The existing code calls server->ops->close() that is not
right. This causes XFS test generic/310 to fail. Fix this
by using server->ops->closedir() function.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/readdir.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -596,8 +596,8 @@ find_cifs_entry(const unsigned int xid,
if (!cfile->srch_inf.endOfSearch && !cfile->invalidHandle) {
cfile->invalidHandle = true;
spin_unlock(&cifs_file_list_lock);
- if (server->ops->close)
- server->ops->close(xid, tcon, &cfile->fid);
+ if (server->ops->close_dir)
+ server->ops->close_dir(xid, tcon, &cfile->fid);
} else
spin_unlock(&cifs_file_list_lock);
if (cfile->srch_inf.ntwrk_buf_start) {
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 148/158] mtd/ftl: fix the double free of the buffers allocated in build_maps()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (142 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 147/158] CIFS: Fix wrong restart readdir for SMB1 Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 149/158] mtd: nand: omap: Fix 1-bit Hamming code scheme, omap_calculate_ecc() Greg Kroah-Hartman
` (12 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kevin Hao, Brian Norris
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Hao <haokexin@gmail.com>
commit a152056c912db82860a8b4c23d0bd3a5aa89e363 upstream.
I got the following panic on my fsl p5020ds board.
Unable to handle kernel paging request for data at address 0x7375627379737465
Faulting instruction address: 0xc000000000100778
Oops: Kernel access of bad area, sig: 11 [#1]
SMP NR_CPUS=24 CoreNet Generic
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.15.0-next-20140613 #145
task: c0000000fe080000 ti: c0000000fe088000 task.ti: c0000000fe088000
NIP: c000000000100778 LR: c00000000010073c CTR: 0000000000000000
REGS: c0000000fe08aa00 TRAP: 0300 Not tainted (3.15.0-next-20140613)
MSR: 0000000080029000 <CE,EE,ME> CR: 24ad2e24 XER: 00000000
DEAR: 7375627379737465 ESR: 0000000000000000 SOFTE: 1
GPR00: c0000000000c99b0 c0000000fe08ac80 c0000000009598e0 c0000000fe001d80
GPR04: 00000000000000d0 0000000000000913 c000000007902b20 0000000000000000
GPR08: c0000000feaae888 0000000000000000 0000000007091000 0000000000200200
GPR12: 0000000028ad2e28 c00000000fff4000 c0000000007abe08 0000000000000000
GPR16: c0000000007ab160 c0000000007aaf98 c00000000060ba68 c0000000007abda8
GPR20: c0000000007abde8 c0000000feaea6f8 c0000000feaea708 c0000000007abd10
GPR24: c000000000989370 c0000000008c6228 00000000000041ed c0000000fe00a400
GPR28: c00000000017c1cc 00000000000000d0 7375627379737465 c0000000fe001d80
NIP [c000000000100778] .__kmalloc_track_caller+0x70/0x168
LR [c00000000010073c] .__kmalloc_track_caller+0x34/0x168
Call Trace:
[c0000000fe08ac80] [c00000000087e6b8] uevent_sock_list+0x0/0x10 (unreliable)
[c0000000fe08ad20] [c0000000000c99b0] .kstrdup+0x44/0x90
[c0000000fe08adc0] [c00000000017c1cc] .__kernfs_new_node+0x4c/0x130
[c0000000fe08ae70] [c00000000017d7e4] .kernfs_new_node+0x2c/0x64
[c0000000fe08aef0] [c00000000017db00] .kernfs_create_dir_ns+0x34/0xc8
[c0000000fe08af80] [c00000000018067c] .sysfs_create_dir_ns+0x58/0xcc
[c0000000fe08b010] [c0000000002c711c] .kobject_add_internal+0xc8/0x384
[c0000000fe08b0b0] [c0000000002c7644] .kobject_add+0x64/0xc8
[c0000000fe08b140] [c000000000355ebc] .device_add+0x11c/0x654
[c0000000fe08b200] [c0000000002b5988] .add_disk+0x20c/0x4b4
[c0000000fe08b2c0] [c0000000003a21d4] .add_mtd_blktrans_dev+0x340/0x514
[c0000000fe08b350] [c0000000003a3410] .mtdblock_add_mtd+0x74/0xb4
[c0000000fe08b3e0] [c0000000003a32cc] .blktrans_notify_add+0x64/0x94
[c0000000fe08b470] [c00000000039b5b4] .add_mtd_device+0x1d4/0x368
[c0000000fe08b520] [c00000000039b830] .mtd_device_parse_register+0xe8/0x104
[c0000000fe08b5c0] [c0000000003b8408] .of_flash_probe+0x72c/0x734
[c0000000fe08b750] [c00000000035ba40] .platform_drv_probe+0x38/0x84
[c0000000fe08b7d0] [c0000000003599a4] .really_probe+0xa4/0x29c
[c0000000fe08b870] [c000000000359d3c] .__driver_attach+0x100/0x104
[c0000000fe08b900] [c00000000035746c] .bus_for_each_dev+0x84/0xe4
[c0000000fe08b9a0] [c0000000003593c0] .driver_attach+0x24/0x38
[c0000000fe08ba10] [c000000000358f24] .bus_add_driver+0x1c8/0x2ac
[c0000000fe08bab0] [c00000000035a3a4] .driver_register+0x8c/0x158
[c0000000fe08bb30] [c00000000035b9f4] .__platform_driver_register+0x6c/0x80
[c0000000fe08bba0] [c00000000084e080] .of_flash_driver_init+0x1c/0x30
[c0000000fe08bc10] [c000000000001864] .do_one_initcall+0xbc/0x238
[c0000000fe08bd00] [c00000000082cdc0] .kernel_init_freeable+0x188/0x268
[c0000000fe08bdb0] [c0000000000020a0] .kernel_init+0x1c/0xf7c
[c0000000fe08be30] [c000000000000884] .ret_from_kernel_thread+0x58/0xd4
Instruction dump:
41bd0010 480000c8 4bf04eb5 60000000 e94d0028 e93f0000 7cc95214 e8a60008
7fc9502a 2fbe0000 419e00c8 e93f0022 <7f7e482a> 39200000 88ed06b2 992d06b2
---[ end trace b4c9a94804a42d40 ]---
It seems that the corrupted partition header on my mtd device triggers
a bug in the ftl. In function build_maps() it will allocate the buffers
needed by the mtd partition, but if something goes wrong such as kmalloc
failure, mtd read error or invalid partition header parameter, it will
free all allocated buffers and then return non-zero. In my case, it
seems that partition header parameter 'NumTransferUnits' is invalid.
And the ftl_freepart() is a function which free all the partition
buffers allocated by build_maps(). Given the build_maps() is a self
cleaning function, so there is no need to invoke this function even
if build_maps() return with error. Otherwise it will causes the
buffers to be freed twice and then weird things would happen.
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/ftl.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/mtd/ftl.c
+++ b/drivers/mtd/ftl.c
@@ -1075,7 +1075,6 @@ static void ftl_add_mtd(struct mtd_blktr
return;
}
- ftl_freepart(partition);
kfree(partition);
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 149/158] mtd: nand: omap: Fix 1-bit Hamming code scheme, omap_calculate_ecc()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (143 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 148/158] mtd/ftl: fix the double free of the buffers allocated in build_maps() Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 150/158] blkcg: dont call into policy draining if root_blkg is already gone Greg Kroah-Hartman
` (11 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Roger Quadros, Tony Lindgren
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <rogerq@ti.com>
commit 40ddbf5069bd4e11447c0088fc75318e0aac53f0 upstream.
commit 65b97cf6b8de introduced in v3.7 caused a regression
by using a reversed CS_MASK thus causing omap_calculate_ecc to
always fail. As the NAND base driver never checks for .calculate()'s
return value, the zeroed ECC values are used as is without showing
any error to the user. However, this won't work and the NAND device
won't be guarded by any error code.
Fix the issue by using the correct mask.
Code was tested on omap3beagle using the following procedure
- flash the primary bootloader (MLO) from the kernel to the first
NAND partition using nandwrite.
- boot the board from NAND. This utilizes OMAP ROM loader that
relies on 1-bit Hamming code ECC.
Fixes: 65b97cf6b8de (mtd: nand: omap2: handle nand on gpmc)
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/omap2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -931,7 +931,7 @@ static int omap_calculate_ecc(struct mtd
u32 val;
val = readl(info->reg.gpmc_ecc_config);
- if (((val >> ECC_CONFIG_CS_SHIFT) & ~CS_MASK) != info->gpmc_cs)
+ if (((val >> ECC_CONFIG_CS_SHIFT) & CS_MASK) != info->gpmc_cs)
return -EINVAL;
/* read ecc result */
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 150/158] blkcg: dont call into policy draining if root_blkg is already gone
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (144 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 149/158] mtd: nand: omap: Fix 1-bit Hamming code scheme, omap_calculate_ecc() Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 151/158] dm table: propagate QUEUE_FLAG_NO_SG_MERGE Greg Kroah-Hartman
` (10 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tejun Heo, Shirish Pargaonkar,
Sasha Levin, Jet Chen, Jens Axboe
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 2a1b4cf2331d92bc009bf94fa02a24604cdaf24c upstream.
While a queue is being destroyed, all the blkgs are destroyed and its
->root_blkg pointer is set to NULL. If someone else starts to drain
while the queue is in this state, the following oops happens.
NULL pointer dereference at 0000000000000028
IP: [<ffffffff8144e944>] blk_throtl_drain+0x84/0x230
PGD e4a1067 PUD b773067 PMD 0
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Modules linked in: cfq_iosched(-) [last unloaded: cfq_iosched]
CPU: 1 PID: 537 Comm: bash Not tainted 3.16.0-rc3-work+ #2
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
task: ffff88000e222250 ti: ffff88000efd4000 task.ti: ffff88000efd4000
RIP: 0010:[<ffffffff8144e944>] [<ffffffff8144e944>] blk_throtl_drain+0x84/0x230
RSP: 0018:ffff88000efd7bf0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff880015091450 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88000efd7c10 R08: 0000000000000000 R09: 0000000000000001
R10: ffff88000e222250 R11: 0000000000000000 R12: ffff880015091450
R13: ffff880015092e00 R14: ffff880015091d70 R15: ffff88001508fc28
FS: 00007f1332650740(0000) GS:ffff88001fa80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000028 CR3: 0000000009446000 CR4: 00000000000006e0
Stack:
ffffffff8144e8f6 ffff880015091450 0000000000000000 ffff880015091d80
ffff88000efd7c28 ffffffff8144ae2f ffff880015091450 ffff88000efd7c58
ffffffff81427641 ffff880015091450 ffffffff82401f00 ffff880015091450
Call Trace:
[<ffffffff8144ae2f>] blkcg_drain_queue+0x1f/0x60
[<ffffffff81427641>] __blk_drain_queue+0x71/0x180
[<ffffffff81429b3e>] blk_queue_bypass_start+0x6e/0xb0
[<ffffffff814498b8>] blkcg_deactivate_policy+0x38/0x120
[<ffffffff8144ec44>] blk_throtl_exit+0x34/0x50
[<ffffffff8144aea5>] blkcg_exit_queue+0x35/0x40
[<ffffffff8142d476>] blk_release_queue+0x26/0xd0
[<ffffffff81454968>] kobject_cleanup+0x38/0x70
[<ffffffff81454848>] kobject_put+0x28/0x60
[<ffffffff81427505>] blk_put_queue+0x15/0x20
[<ffffffff817d07bb>] scsi_device_dev_release_usercontext+0x16b/0x1c0
[<ffffffff810bc339>] execute_in_process_context+0x89/0xa0
[<ffffffff817d064c>] scsi_device_dev_release+0x1c/0x20
[<ffffffff817930e2>] device_release+0x32/0xa0
[<ffffffff81454968>] kobject_cleanup+0x38/0x70
[<ffffffff81454848>] kobject_put+0x28/0x60
[<ffffffff817934d7>] put_device+0x17/0x20
[<ffffffff817d11b9>] __scsi_remove_device+0xa9/0xe0
[<ffffffff817d121b>] scsi_remove_device+0x2b/0x40
[<ffffffff817d1257>] sdev_store_delete+0x27/0x30
[<ffffffff81792ca8>] dev_attr_store+0x18/0x30
[<ffffffff8126f75e>] sysfs_kf_write+0x3e/0x50
[<ffffffff8126ea87>] kernfs_fop_write+0xe7/0x170
[<ffffffff811f5e9f>] vfs_write+0xaf/0x1d0
[<ffffffff811f69bd>] SyS_write+0x4d/0xc0
[<ffffffff81d24692>] system_call_fastpath+0x16/0x1b
776687bce42b ("block, blk-mq: draining can't be skipped even if
bypass_depth was non-zero") made it easier to trigger this bug by
making blk_queue_bypass_start() drain even when it loses the first
bypass test to blk_cleanup_queue(); however, the bug has always been
there even before the commit as blk_queue_bypass_start() could race
against queue destruction, win the initial bypass test but perform the
actual draining after blk_cleanup_queue() already destroyed all blkgs.
Fix it by skippping calling into policy draining if all the blkgs are
already gone.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Shirish Pargaonkar <spargaonkar@suse.com>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Reported-by: Jet Chen <jet.chen@intel.com>
Tested-by: Shirish Pargaonkar <spargaonkar@suse.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-cgroup.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -879,6 +879,13 @@ void blkcg_drain_queue(struct request_qu
if (!q->root_blkg)
return;
+ /*
+ * @q could be exiting and already have destroyed all blkgs as
+ * indicated by NULL root_blkg. If so, don't confuse policies.
+ */
+ if (!q->root_blkg)
+ return;
+
blk_throtl_drain(q);
}
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 151/158] dm table: propagate QUEUE_FLAG_NO_SG_MERGE
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (145 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 150/158] blkcg: dont call into policy draining if root_blkg is already gone Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 152/158] IB/srp: Fix deadlock between host removal and multipathd Greg Kroah-Hartman
` (9 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeff Moyer, Mike Snitzer
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Moyer <jmoyer@redhat.com>
commit 200612ec33e555a356eebc717630b866ae2b694f upstream.
Commit 05f1dd5 ("block: add queue flag for disabling SG merging")
introduced a new queue flag: QUEUE_FLAG_NO_SG_MERGE. This gets set by
default in blk_mq_init_queue for mq-enabled devices. The effect of
the flag is to bypass the SG segment merging. Instead, the
bio->bi_vcnt is used as the number of hardware segments.
With a device mapper target on top of a device with
QUEUE_FLAG_NO_SG_MERGE set, we can end up sending down more segments
than a driver is prepared to handle. I ran into this when backporting
the virtio_blk mq support. It triggerred this BUG_ON, in
virtio_queue_rq:
BUG_ON(req->nr_phys_segments + 2 > vblk->sg_elems);
The queue's max is set here:
blk_queue_max_segments(q, vblk->sg_elems-2);
Basically, what happens is that a bio is built up for the dm device
(which does not have the QUEUE_FLAG_NO_SG_MERGE flag set) using
bio_add_page. That path will call into __blk_recalc_rq_segments, so
what you end up with is bi_phys_segments being much smaller than bi_vcnt
(and bi_vcnt grows beyond the maximum sg elements). Then, when the bio
is submitted, it gets cloned. When the cloned bio is submitted, it will
end up in blk_recount_segments, here:
if (test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags))
bio->bi_phys_segments = bio->bi_vcnt;
and now we've set bio->bi_phys_segments to a number that is beyond what
was registered as queue_max_segments by the driver.
The right way to fix this is to propagate the queue flag up the stack.
The rules for propagating the flag are simple:
- if the flag is set for any underlying device, it must be set for the
upper device
- consequently, if the flag is not set for any underlying device, it
should not be set for the upper device.
Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-table.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1386,6 +1386,14 @@ static int device_is_not_random(struct d
return q && !blk_queue_add_random(q);
}
+static int queue_supports_sg_merge(struct dm_target *ti, struct dm_dev *dev,
+ sector_t start, sector_t len, void *data)
+{
+ struct request_queue *q = bdev_get_queue(dev->bdev);
+
+ return q && !test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags);
+}
+
static bool dm_table_all_devices_attribute(struct dm_table *t,
iterate_devices_callout_fn func)
{
@@ -1464,6 +1472,11 @@ void dm_table_set_restrictions(struct dm
if (!dm_table_supports_write_same(t))
q->limits.max_write_same_sectors = 0;
+ if (dm_table_all_devices_attribute(t, queue_supports_sg_merge))
+ queue_flag_clear_unlocked(QUEUE_FLAG_NO_SG_MERGE, q);
+ else
+ queue_flag_set_unlocked(QUEUE_FLAG_NO_SG_MERGE, q);
+
dm_table_set_integrity(t);
/*
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 152/158] IB/srp: Fix deadlock between host removal and multipathd
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (146 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 151/158] dm table: propagate QUEUE_FLAG_NO_SG_MERGE Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 153/158] drm/nouveau: Dis/Enable vblank irqs during suspend/resume Greg Kroah-Hartman
` (8 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Sagi Grimberg,
David Dillow, Sebastian Parschauer, Roland Dreier
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
commit bcc05910359183b431da92713e98eed478edf83a upstream.
If scsi_remove_host() is invoked after a SCSI device has been blocked,
if the fast_io_fail_tmo or dev_loss_tmo work gets scheduled on the
workqueue executing srp_remove_work() and if an I/O request is
scheduled after the SCSI device had been blocked by e.g. multipathd
then the following deadlock can occur:
kworker/6:1 D ffff880831f3c460 0 195 2 0x00000000
Call Trace:
[<ffffffff814aafd9>] schedule+0x29/0x70
[<ffffffff814aa0ef>] schedule_timeout+0x10f/0x2a0
[<ffffffff8105af6f>] msleep+0x2f/0x40
[<ffffffff8123b0ae>] __blk_drain_queue+0x4e/0x180
[<ffffffff8123d2d5>] blk_cleanup_queue+0x225/0x230
[<ffffffffa0010732>] __scsi_remove_device+0x62/0xe0 [scsi_mod]
[<ffffffffa000ed2f>] scsi_forget_host+0x6f/0x80 [scsi_mod]
[<ffffffffa0002eba>] scsi_remove_host+0x7a/0x130 [scsi_mod]
[<ffffffffa07cf5c5>] srp_remove_work+0x95/0x180 [ib_srp]
[<ffffffff8106d7aa>] process_one_work+0x1ea/0x6c0
[<ffffffff8106dd9b>] worker_thread+0x11b/0x3a0
[<ffffffff810758bd>] kthread+0xed/0x110
[<ffffffff814b972c>] ret_from_fork+0x7c/0xb0
multipathd D ffff880096acc460 0 5340 1 0x00000000
Call Trace:
[<ffffffff814aafd9>] schedule+0x29/0x70
[<ffffffff814aa0ef>] schedule_timeout+0x10f/0x2a0
[<ffffffff814ab79b>] io_schedule_timeout+0x9b/0xf0
[<ffffffff814abe1c>] wait_for_completion_io_timeout+0xdc/0x110
[<ffffffff81244b9b>] blk_execute_rq+0x9b/0x100
[<ffffffff8124f665>] sg_io+0x1a5/0x450
[<ffffffff8124fd21>] scsi_cmd_ioctl+0x2a1/0x430
[<ffffffff8124fef2>] scsi_cmd_blk_ioctl+0x42/0x50
[<ffffffffa00ec97e>] sd_ioctl+0xbe/0x140 [sd_mod]
[<ffffffff8124bd04>] blkdev_ioctl+0x234/0x840
[<ffffffff811cb491>] block_ioctl+0x41/0x50
[<ffffffff811a0df0>] do_vfs_ioctl+0x300/0x520
[<ffffffff811a1051>] SyS_ioctl+0x41/0x80
[<ffffffff814b9962>] tracesys+0xd0/0xd5
Fix this by scheduling removal work on another workqueue than the
transport layer timers.
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
Reviewed-by: David Dillow <dave@thedillows.org>
Cc: Sebastian Parschauer <sebastian.riemer@profitbricks.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/srp/ib_srp.c | 38 ++++++++++++++++++++++++++----------
1 file changed, 28 insertions(+), 10 deletions(-)
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -130,6 +130,7 @@ static void srp_send_completion(struct i
static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event);
static struct scsi_transport_template *ib_srp_transport_template;
+static struct workqueue_struct *srp_remove_wq;
static struct ib_client srp_client = {
.name = "srp",
@@ -731,7 +732,7 @@ static bool srp_queue_remove_work(struct
spin_unlock_irq(&target->lock);
if (changed)
- queue_work(system_long_wq, &target->remove_work);
+ queue_work(srp_remove_wq, &target->remove_work);
return changed;
}
@@ -3261,9 +3262,10 @@ static void srp_remove_one(struct ib_dev
spin_unlock(&host->target_lock);
/*
- * Wait for target port removal tasks.
+ * Wait for tl_err and target port removal tasks.
*/
flush_workqueue(system_long_wq);
+ flush_workqueue(srp_remove_wq);
kfree(host);
}
@@ -3313,16 +3315,22 @@ static int __init srp_init_module(void)
indirect_sg_entries = cmd_sg_entries;
}
+ srp_remove_wq = create_workqueue("srp_remove");
+ if (IS_ERR(srp_remove_wq)) {
+ ret = PTR_ERR(srp_remove_wq);
+ goto out;
+ }
+
+ ret = -ENOMEM;
ib_srp_transport_template =
srp_attach_transport(&ib_srp_transport_functions);
if (!ib_srp_transport_template)
- return -ENOMEM;
+ goto destroy_wq;
ret = class_register(&srp_class);
if (ret) {
pr_err("couldn't register class infiniband_srp\n");
- srp_release_transport(ib_srp_transport_template);
- return ret;
+ goto release_tr;
}
ib_sa_register_client(&srp_sa_client);
@@ -3330,13 +3338,22 @@ static int __init srp_init_module(void)
ret = ib_register_client(&srp_client);
if (ret) {
pr_err("couldn't register IB client\n");
- srp_release_transport(ib_srp_transport_template);
- ib_sa_unregister_client(&srp_sa_client);
- class_unregister(&srp_class);
- return ret;
+ goto unreg_sa;
}
- return 0;
+out:
+ return ret;
+
+unreg_sa:
+ ib_sa_unregister_client(&srp_sa_client);
+ class_unregister(&srp_class);
+
+release_tr:
+ srp_release_transport(ib_srp_transport_template);
+
+destroy_wq:
+ destroy_workqueue(srp_remove_wq);
+ goto out;
}
static void __exit srp_cleanup_module(void)
@@ -3345,6 +3362,7 @@ static void __exit srp_cleanup_module(vo
ib_sa_unregister_client(&srp_sa_client);
class_unregister(&srp_class);
srp_release_transport(ib_srp_transport_template);
+ destroy_workqueue(srp_remove_wq);
}
module_init(srp_init_module);
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 153/158] drm/nouveau: Dis/Enable vblank irqs during suspend/resume.
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (147 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 152/158] IB/srp: Fix deadlock between host removal and multipathd Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 154/158] drm/nouveau: Bump version from 1.1.1 to 1.1.2 Greg Kroah-Hartman
` (7 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mario Kleiner, Ben Skeggs
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <mario.kleiner.de@gmail.com>
commit 9cba5efab5a8145ae6c52ea273553f069c294482 upstream.
Vblank irqs don't get disabled during suspend or driver
unload, which causes irq delivery after "suspend" or
driver unload, at least until the gpu is powered off.
This could race with drm_vblank_cleanup() in the case
of nouveau and cause a use-after-free bug if the driver
is unloaded.
More annoyingly during everyday use, at least on nv50
display engine (likely also others), vblank irqs are
off after a resume from suspend, but the drm doesn't
know this, so all vblank related functionality is dead
after a resume. E.g., all windowed OpenGL clients will
hang at swapbuffers time, as well as many fullscreen
clients in many cases. This makes suspend/resume useless
if one wants to use any OpenGL apps after the resume.
In Linux 3.16, drm_vblank_on() was added, complementing
the older drm_vblank_off() to solve these problems
elegantly, so use those calls in nouveaus suspend/resume
code.
For kernels 3.8 - 3.15, we need to cherry-pick the
drm_vblank_on() patch to support this patch.
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_display.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -404,6 +404,11 @@ nouveau_display_fini(struct drm_device *
{
struct nouveau_display *disp = nouveau_display(dev);
struct drm_connector *connector;
+ int head;
+
+ /* Make sure that drm and hw vblank irqs get properly disabled. */
+ for (head = 0; head < dev->mode_config.num_crtc; head++)
+ drm_vblank_off(dev, head);
/* disable hotplug interrupts */
list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
@@ -620,6 +625,8 @@ void
nouveau_display_resume(struct drm_device *dev)
{
struct drm_crtc *crtc;
+ int head;
+
nouveau_display_init(dev);
/* Force CLUT to get re-loaded during modeset */
@@ -629,6 +636,10 @@ nouveau_display_resume(struct drm_device
nv_crtc->lut.depth = 0;
}
+ /* Make sure that drm and hw vblank irqs get resumed if needed. */
+ for (head = 0; head < dev->mode_config.num_crtc; head++)
+ drm_vblank_on(dev, head);
+
drm_helper_resume_force_mode(dev);
list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 154/158] drm/nouveau: Bump version from 1.1.1 to 1.1.2
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (148 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 153/158] drm/nouveau: Dis/Enable vblank irqs during suspend/resume Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 155/158] vfs: fix bad hashing of dentries Greg Kroah-Hartman
` (6 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mario Kleiner, Ben Skeggs
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <mario.kleiner.de@gmail.com>
commit 7820e5eef0faa4a5e10834296680827f7ce78a89 upstream.
Linux 3.16 fixed multiple bugs in kms pageflip completion events
and timestamping, which were originally introduced in Linux 3.13.
These fixes have been backported to all stable kernels since 3.13.
However, the userspace nouveau-ddx needs to be aware if it is
running on a kernel on which these bugs are fixed, or not.
Bump the patchlevel of the drm driver version to signal this,
so backporting this patch to stable 3.13+ kernels will give the
ddx the required info.
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_drm.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/nouveau_drm.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.h
@@ -10,7 +10,7 @@
#define DRIVER_MAJOR 1
#define DRIVER_MINOR 1
-#define DRIVER_PATCHLEVEL 1
+#define DRIVER_PATCHLEVEL 2
/*
* 1.1.1:
@@ -21,6 +21,8 @@
* to control registers on the MPs to enable performance counters,
* and to control the warp error enable mask (OpenGL requires out of
* bounds access to local memory to be silently ignored / return 0).
+ * 1.1.2:
+ * - fixes multiple bugs in flip completion events and timestamping
*/
#include <core/client.h>
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 155/158] vfs: fix bad hashing of dentries
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (149 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 154/158] drm/nouveau: Bump version from 1.1.1 to 1.1.2 Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 156/158] CIFS: Fix SMB2 readdir error handling Greg Kroah-Hartman
` (5 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josef Bacik, Al Viro,
Christoph Hellwig, Chris Mason, linux-fsdevel, Linus Torvalds
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit 99d263d4c5b2f541dfacb5391e22e8c91ea982a6 upstream.
Josef Bacik found a performance regression between 3.2 and 3.10 and
narrowed it down to commit bfcfaa77bdf0 ("vfs: use 'unsigned long'
accesses for dcache name comparison and hashing"). He reports:
"The test case is essentially
for (i = 0; i < 1000000; i++)
mkdir("a$i");
On xfs on a fio card this goes at about 20k dir/sec with 3.2, and 12k
dir/sec with 3.10. This is because we spend waaaaay more time in
__d_lookup on 3.10 than in 3.2.
The new hashing function for strings is suboptimal for <
sizeof(unsigned long) string names (and hell even > sizeof(unsigned
long) string names that I've tested). I broke out the old hashing
function and the new one into a userspace helper to get real numbers
and this is what I'm getting:
Old hash table had 1000000 entries, 0 dupes, 0 max dupes
New hash table had 12628 entries, 987372 dupes, 900 max dupes
We had 11400 buckets with a p50 of 30 dupes, p90 of 240 dupes, p99 of 567 dupes for the new hash
My test does the hash, and then does the d_hash into a integer pointer
array the same size as the dentry hash table on my system, and then
just increments the value at the address we got to see how many
entries we overlap with.
As you can see the old hash function ended up with all 1 million
entries in their own bucket, whereas the new one they are only
distributed among ~12.5k buckets, which is why we're using so much
more CPU in __d_lookup".
The reason for this hash regression is two-fold:
- On 64-bit architectures the down-mixing of the original 64-bit
word-at-a-time hash into the final 32-bit hash value is very
simplistic and suboptimal, and just adds the two 32-bit parts
together.
In particular, because there is no bit shuffling and the mixing
boundary is also a byte boundary, similar character patterns in the
low and high word easily end up just canceling each other out.
- the old byte-at-a-time hash mixed each byte into the final hash as it
hashed the path component name, resulting in the low bits of the hash
generally being a good source of hash data. That is not true for the
word-at-a-time case, and the hash data is distributed among all the
bits.
The fix is the same in both cases: do a better job of mixing the bits up
and using as much of the hash data as possible. We already have the
"hash_32|64()" functions to do that.
Reported-by: Josef Bacik <jbacik@fb.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Chris Mason <clm@fb.com>
Cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/dcache.c | 3 +--
fs/namei.c | 4 ++--
2 files changed, 3 insertions(+), 4 deletions(-)
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -106,8 +106,7 @@ static inline struct hlist_bl_head *d_ha
unsigned int hash)
{
hash += (unsigned long) parent / L1_CACHE_BYTES;
- hash = hash + (hash >> d_hash_shift);
- return dentry_hashtable + (hash & d_hash_mask);
+ return dentry_hashtable + hash_32(hash, d_hash_shift);
}
/* Statistics gathering. */
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -34,6 +34,7 @@
#include <linux/device_cgroup.h>
#include <linux/fs_struct.h>
#include <linux/posix_acl.h>
+#include <linux/hash.h>
#include <asm/uaccess.h>
#include "internal.h"
@@ -1629,8 +1630,7 @@ static inline int nested_symlink(struct
static inline unsigned int fold_hash(unsigned long hash)
{
- hash += hash >> (8*sizeof(int));
- return hash;
+ return hash_64(hash, 32);
}
#else /* 32-bit case */
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 156/158] CIFS: Fix SMB2 readdir error handling
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (150 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 155/158] vfs: fix bad hashing of dentries Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 157/158] KEYS: Fix use-after-free in assoc_array_gc() Greg Kroah-Hartman
` (4 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Shilovsky, Steve French
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <pshilovsky@samba.org>
commit 52755808d4525f4d5b86d112d36ffc7a46f3fb48 upstream.
SMB2 servers indicates the end of a directory search with
STATUS_NO_MORE_FILE error code that is not processed now.
This causes generic/257 xfstest to fail. Fix this by triggering
the end of search by this error code in SMB2_query_directory.
Also when negotiating CIFS protocol we tell the server to close
the search automatically at the end and there is no need to do
it itself. In the case of SMB2 protocol, we need to close it
explicitly - separate close directory checks for different
protocols.
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifsglob.h | 2 ++
fs/cifs/file.c | 2 +-
fs/cifs/readdir.c | 2 +-
fs/cifs/smb1ops.c | 7 +++++++
fs/cifs/smb2maperror.c | 2 +-
fs/cifs/smb2ops.c | 9 +++++++++
fs/cifs/smb2pdu.c | 9 ++++-----
7 files changed, 25 insertions(+), 8 deletions(-)
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -399,6 +399,8 @@ struct smb_version_operations {
const struct cifs_fid *, u32 *);
int (*set_acl)(struct cifs_ntsd *, __u32, struct inode *, const char *,
int);
+ /* check if we need to issue closedir */
+ bool (*dir_needs_close)(struct cifsFileInfo *);
};
struct smb_version_values {
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -762,7 +762,7 @@ int cifs_closedir(struct inode *inode, s
cifs_dbg(FYI, "Freeing private data in close dir\n");
spin_lock(&cifs_file_list_lock);
- if (!cfile->srch_inf.endOfSearch && !cfile->invalidHandle) {
+ if (server->ops->dir_needs_close(cfile)) {
cfile->invalidHandle = true;
spin_unlock(&cifs_file_list_lock);
if (server->ops->close_dir)
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -593,7 +593,7 @@ find_cifs_entry(const unsigned int xid,
/* close and restart search */
cifs_dbg(FYI, "search backing up - close and restart search\n");
spin_lock(&cifs_file_list_lock);
- if (!cfile->srch_inf.endOfSearch && !cfile->invalidHandle) {
+ if (server->ops->dir_needs_close(cfile)) {
cfile->invalidHandle = true;
spin_unlock(&cifs_file_list_lock);
if (server->ops->close_dir)
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -1009,6 +1009,12 @@ cifs_is_read_op(__u32 oplock)
return oplock == OPLOCK_READ;
}
+static bool
+cifs_dir_needs_close(struct cifsFileInfo *cfile)
+{
+ return !cfile->srch_inf.endOfSearch && !cfile->invalidHandle;
+}
+
struct smb_version_operations smb1_operations = {
.send_cancel = send_nt_cancel,
.compare_fids = cifs_compare_fids,
@@ -1078,6 +1084,7 @@ struct smb_version_operations smb1_opera
.query_mf_symlink = cifs_query_mf_symlink,
.create_mf_symlink = cifs_create_mf_symlink,
.is_read_op = cifs_is_read_op,
+ .dir_needs_close = cifs_dir_needs_close,
#ifdef CONFIG_CIFS_XATTR
.query_all_EAs = CIFSSMBQAllEAs,
.set_EA = CIFSSMBSetEA,
--- a/fs/cifs/smb2maperror.c
+++ b/fs/cifs/smb2maperror.c
@@ -214,7 +214,7 @@ static const struct status_to_posix_erro
{STATUS_BREAKPOINT, -EIO, "STATUS_BREAKPOINT"},
{STATUS_SINGLE_STEP, -EIO, "STATUS_SINGLE_STEP"},
{STATUS_BUFFER_OVERFLOW, -EIO, "STATUS_BUFFER_OVERFLOW"},
- {STATUS_NO_MORE_FILES, -EIO, "STATUS_NO_MORE_FILES"},
+ {STATUS_NO_MORE_FILES, -ENODATA, "STATUS_NO_MORE_FILES"},
{STATUS_WAKE_SYSTEM_DEBUGGER, -EIO, "STATUS_WAKE_SYSTEM_DEBUGGER"},
{STATUS_HANDLES_CLOSED, -EIO, "STATUS_HANDLES_CLOSED"},
{STATUS_NO_INHERITANCE, -EIO, "STATUS_NO_INHERITANCE"},
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -1104,6 +1104,12 @@ smb3_parse_lease_buf(void *buf, unsigned
return le32_to_cpu(lc->lcontext.LeaseState);
}
+static bool
+smb2_dir_needs_close(struct cifsFileInfo *cfile)
+{
+ return !cfile->invalidHandle;
+}
+
struct smb_version_operations smb20_operations = {
.compare_fids = smb2_compare_fids,
.setup_request = smb2_setup_request,
@@ -1177,6 +1183,7 @@ struct smb_version_operations smb20_oper
.create_lease_buf = smb2_create_lease_buf,
.parse_lease_buf = smb2_parse_lease_buf,
.clone_range = smb2_clone_range,
+ .dir_needs_close = smb2_dir_needs_close,
};
struct smb_version_operations smb21_operations = {
@@ -1252,6 +1259,7 @@ struct smb_version_operations smb21_oper
.create_lease_buf = smb2_create_lease_buf,
.parse_lease_buf = smb2_parse_lease_buf,
.clone_range = smb2_clone_range,
+ .dir_needs_close = smb2_dir_needs_close,
};
struct smb_version_operations smb30_operations = {
@@ -1330,6 +1338,7 @@ struct smb_version_operations smb30_oper
.parse_lease_buf = smb3_parse_lease_buf,
.clone_range = smb2_clone_range,
.validate_negotiate = smb3_validate_negotiate,
+ .dir_needs_close = smb2_dir_needs_close,
};
struct smb_version_values smb20_values = {
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2142,6 +2142,10 @@ SMB2_query_directory(const unsigned int
rsp = (struct smb2_query_directory_rsp *)iov[0].iov_base;
if (rc) {
+ if (rc == -ENODATA && rsp->hdr.Status == STATUS_NO_MORE_FILES) {
+ srch_inf->endOfSearch = true;
+ rc = 0;
+ }
cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
goto qdir_exit;
}
@@ -2179,11 +2183,6 @@ SMB2_query_directory(const unsigned int
else
cifs_dbg(VFS, "illegal search buffer type\n");
- if (rsp->hdr.Status == STATUS_NO_MORE_FILES)
- srch_inf->endOfSearch = 1;
- else
- srch_inf->endOfSearch = 0;
-
return rc;
qdir_exit:
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 157/158] KEYS: Fix use-after-free in assoc_array_gc()
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (151 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 156/158] CIFS: Fix SMB2 readdir error handling Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-15 19:26 ` [PATCH 3.16 158/158] KEYS: Fix termination condition in assoc array garbage collection Greg Kroah-Hartman
` (3 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreea-Cristina Bernat,
David Howells, shemming, paulmck, James Morris
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 27419604f51a97d497853f14142c1059d46eb597 upstream.
An edit script should be considered inaccessible by a function once it has
called assoc_array_apply_edit() or assoc_array_cancel_edit().
However, assoc_array_gc() is accessing the edit script just after the
gc_complete: label.
Reported-by: Andreea-Cristina Bernat <bernat.ada@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Andreea-Cristina Bernat <bernat.ada@gmail.com>
cc: shemming@brocade.com
cc: paulmck@linux.vnet.ibm.com
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/assoc_array.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -1735,7 +1735,7 @@ ascend_old_tree:
gc_complete:
edit->set[0].to = new_root;
assoc_array_apply_edit(edit);
- edit->array->nr_leaves_on_tree = nr_leaves_on_tree;
+ array->nr_leaves_on_tree = nr_leaves_on_tree;
return 0;
enomem:
^ permalink raw reply [flat|nested] 161+ messages in thread* [PATCH 3.16 158/158] KEYS: Fix termination condition in assoc array garbage collection
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (152 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 157/158] KEYS: Fix use-after-free in assoc_array_gc() Greg Kroah-Hartman
@ 2014-09-15 19:26 ` Greg Kroah-Hartman
2014-09-16 1:56 ` [PATCH 3.16 000/158] 3.16.3-stable review Guenter Roeck
` (2 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-15 19:26 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Howells, Don Zickus, James Morris
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 95389b08d93d5c06ec63ab49bd732b0069b7c35e upstream.
This fixes CVE-2014-3631.
It is possible for an associative array to end up with a shortcut node at the
root of the tree if there are more than fan-out leaves in the tree, but they
all crowd into the same slot in the lowest level (ie. they all have the same
first nibble of their index keys).
When assoc_array_gc() returns back up the tree after scanning some leaves, it
can fall off of the root and crash because it assumes that the back pointer
from a shortcut (after label ascend_old_tree) must point to a normal node -
which isn't true of a shortcut node at the root.
Should we find we're ascending rootwards over a shortcut, we should check to
see if the backpointer is zero - and if it is, we have completed the scan.
This particular bug cannot occur if the root node is not a shortcut - ie. if
you have fewer than 17 keys in a keyring or if you have at least two keys that
sit into separate slots (eg. a keyring and a non keyring).
This can be reproduced by:
ring=`keyctl newring bar @s`
for ((i=1; i<=18; i++)); do last_key=`keyctl newring foo$i $ring`; done
keyctl timeout $last_key 2
Doing this:
echo 3 >/proc/sys/kernel/keys/gc_delay
first will speed things up.
If we do fall off of the top of the tree, we get the following oops:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
IP: [<ffffffff8136cea7>] assoc_array_gc+0x2f7/0x540
PGD dae15067 PUD cfc24067 PMD 0
Oops: 0000 [#1] SMP
Modules linked in: xt_nat xt_mark nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_rpfilter ip6t_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_ni
CPU: 0 PID: 26011 Comm: kworker/0:1 Not tainted 3.14.9-200.fc20.x86_64 #1
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Workqueue: events key_garbage_collector
task: ffff8800918bd580 ti: ffff8800aac14000 task.ti: ffff8800aac14000
RIP: 0010:[<ffffffff8136cea7>] [<ffffffff8136cea7>] assoc_array_gc+0x2f7/0x540
RSP: 0018:ffff8800aac15d40 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8800aaecacc0
RDX: ffff8800daecf440 RSI: 0000000000000001 RDI: ffff8800aadc2bc0
RBP: ffff8800aac15da8 R08: 0000000000000001 R09: 0000000000000003
R10: ffffffff8136ccc7 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000070 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff88011fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000018 CR3: 00000000db10d000 CR4: 00000000000006f0
Stack:
ffff8800aac15d50 0000000000000011 ffff8800aac15db8 ffffffff812e2a70
ffff880091a00600 0000000000000000 ffff8800aadc2bc3 00000000cd42c987
ffff88003702df20 ffff88003702dfa0 0000000053b65c09 ffff8800aac15fd8
Call Trace:
[<ffffffff812e2a70>] ? keyring_detect_cycle_iterator+0x30/0x30
[<ffffffff812e3e75>] keyring_gc+0x75/0x80
[<ffffffff812e1424>] key_garbage_collector+0x154/0x3c0
[<ffffffff810a67b6>] process_one_work+0x176/0x430
[<ffffffff810a744b>] worker_thread+0x11b/0x3a0
[<ffffffff810a7330>] ? rescuer_thread+0x3b0/0x3b0
[<ffffffff810ae1a8>] kthread+0xd8/0xf0
[<ffffffff810ae0d0>] ? insert_kthread_work+0x40/0x40
[<ffffffff816ffb7c>] ret_from_fork+0x7c/0xb0
[<ffffffff810ae0d0>] ? insert_kthread_work+0x40/0x40
Code: 08 4c 8b 22 0f 84 bf 00 00 00 41 83 c7 01 49 83 e4 fc 41 83 ff 0f 4c 89 65 c0 0f 8f 5a fe ff ff 48 8b 45 c0 4d 63 cf 49 83 c1 02 <4e> 8b 34 c8 4d 85 f6 0f 84 be 00 00 00 41 f6 c6 01 0f 84 92
RIP [<ffffffff8136cea7>] assoc_array_gc+0x2f7/0x540
RSP <ffff8800aac15d40>
CR2: 0000000000000018
---[ end trace 1129028a088c0cbd ]---
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Don Zickus <dzickus@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/assoc_array.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -1723,11 +1723,13 @@ ascend_old_tree:
shortcut = assoc_array_ptr_to_shortcut(ptr);
slot = shortcut->parent_slot;
cursor = shortcut->back_pointer;
+ if (!cursor)
+ goto gc_complete;
} else {
slot = node->parent_slot;
cursor = ptr;
}
- BUG_ON(!ptr);
+ BUG_ON(!cursor);
node = assoc_array_ptr_to_node(cursor);
slot++;
goto continue_node;
^ permalink raw reply [flat|nested] 161+ messages in thread* Re: [PATCH 3.16 000/158] 3.16.3-stable review
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (153 preceding siblings ...)
2014-09-15 19:26 ` [PATCH 3.16 158/158] KEYS: Fix termination condition in assoc array garbage collection Greg Kroah-Hartman
@ 2014-09-16 1:56 ` Guenter Roeck
2014-09-16 18:41 ` Shuah Khan
2014-09-16 22:58 ` Satoru Takeuchi
156 siblings, 0 replies; 161+ messages in thread
From: Guenter Roeck @ 2014-09-16 1:56 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, satoru.takeuchi, shuah.kh, stable
On 09/15/2014 12:23 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.16.3 release.
> There are 158 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Sep 17 19:25:26 UTC 2014.
> Anything received after that time might be too late.
>
Build results:
total: 136 pass: 136 fail: 0
Qemu test results:
total: 24 pass: 24 fail: 0
Details are available at http://server.roeck-us.net:8010/builders.
Guenter
^ permalink raw reply [flat|nested] 161+ messages in thread* Re: [PATCH 3.16 000/158] 3.16.3-stable review
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
` (154 preceding siblings ...)
2014-09-16 1:56 ` [PATCH 3.16 000/158] 3.16.3-stable review Guenter Roeck
@ 2014-09-16 18:41 ` Shuah Khan
2014-09-16 18:58 ` Greg Kroah-Hartman
2014-09-16 22:58 ` Satoru Takeuchi
156 siblings, 1 reply; 161+ messages in thread
From: Shuah Khan @ 2014-09-16 18:41 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, satoru.takeuchi, shuah.kh, stable
On 09/15/2014 01:23 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.16.3 release.
> There are 158 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Sep 17 19:25:26 UTC 2014.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.16.3-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978
^ permalink raw reply [flat|nested] 161+ messages in thread* Re: [PATCH 3.16 000/158] 3.16.3-stable review
2014-09-16 18:41 ` Shuah Khan
@ 2014-09-16 18:58 ` Greg Kroah-Hartman
0 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-16 18:58 UTC (permalink / raw)
To: Shuah Khan
Cc: linux-kernel, torvalds, akpm, linux, satoru.takeuchi, shuah.kh, stable
On Tue, Sep 16, 2014 at 12:41:14PM -0600, Shuah Khan wrote:
> On 09/15/2014 01:23 PM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.16.3 release.
> > There are 158 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed Sep 17 19:25:26 UTC 2014.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.16.3-rc1.gz
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
>
> Compiled and booted on my test system. No dmesg regressions.
Thanks for testing all 3 of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 161+ messages in thread
* Re: [PATCH 3.16 000/158] 3.16.3-stable review
2014-09-15 19:23 [PATCH 3.16 000/158] 3.16.3-stable review Greg Kroah-Hartman
@ 2014-09-16 22:58 ` Satoru Takeuchi
2014-09-15 19:24 ` [PATCH 3.16 002/158] reiserfs: Fix use after free in journal teardown Greg Kroah-Hartman
` (155 subsequent siblings)
156 siblings, 0 replies; 161+ messages in thread
From: Satoru Takeuchi @ 2014-09-16 22:58 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, satoru.takeuchi, shuah.kh, stable
At Mon, 15 Sep 2014 12:23:59 -0700,
Greg Kroah-Hartman wrote:
>
> This is the start of the stable review cycle for the 3.16.3 release.
> There are 158 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Sep 17 19:25:26 UTC 2014.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.16.3-rc1.gz
> and the diffstat can be found below.
All 3.10.55-rc1, 3.14.19-rc1, and 3.6.3-rc1 passed my test.
- Test Cases:
- Build this kernel.
- Boot this kernel.
- Build the latest mainline kernel with this kernel.
- Test Tool:
https://github.com/satoru-takeuchi/test-linux-stable
- Test Result (kernel .config, ktest config and test log):
http://satoru-takeuchi.org/test-linux-stable/results/<version>-<test datetime>.tar.xz
- Build Environment:
- OS: Debian Jessy x86_64
- CPU: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz x 4
- memory: 8GB
- Test Target Environment:
- Debian Jessy x86_64 (KVM guest on the Build Environment)
- # of vCPU: 2
- memory: 2GB
Thanks,
Satoru
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 3.16.3-rc1
>
> David Howells <dhowells@redhat.com>
> KEYS: Fix termination condition in assoc array garbage collection
>
> David Howells <dhowells@redhat.com>
> KEYS: Fix use-after-free in assoc_array_gc()
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix SMB2 readdir error handling
>
> Linus Torvalds <torvalds@linux-foundation.org>
> vfs: fix bad hashing of dentries
>
> Mario Kleiner <mario.kleiner.de@gmail.com>
> drm/nouveau: Bump version from 1.1.1 to 1.1.2
>
> Mario Kleiner <mario.kleiner.de@gmail.com>
> drm/nouveau: Dis/Enable vblank irqs during suspend/resume.
>
> Bart Van Assche <bvanassche@acm.org>
> IB/srp: Fix deadlock between host removal and multipathd
>
> Jeff Moyer <jmoyer@redhat.com>
> dm table: propagate QUEUE_FLAG_NO_SG_MERGE
>
> Tejun Heo <tj@kernel.org>
> blkcg: don't call into policy draining if root_blkg is already gone
>
> Roger Quadros <rogerq@ti.com>
> mtd: nand: omap: Fix 1-bit Hamming code scheme, omap_calculate_ecc()
>
> Kevin Hao <haokexin@gmail.com>
> mtd/ftl: fix the double free of the buffers allocated in build_maps()
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix wrong restart readdir for SMB1
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix wrong filename length for SMB2
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix directory rename error
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix wrong directory attributes after rename
>
> Steve French <smfrench@gmail.com>
> CIFS: Possible null ptr deref in SMB2_tcon
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix async reading on reconnects
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix STATUS_CANNOT_DELETE error mapping for SMB2
>
> Ilya Dryomov <ilya.dryomov@inktank.com>
> libceph: do not hard code max auth ticket len
>
> Ilya Dryomov <ilya.dryomov@inktank.com>
> libceph: add process_one_ticket() helper
>
> Sage Weil <sage@redhat.com>
> libceph: gracefully handle large reply messages from the mon
>
> Ilya Dryomov <ilya.dryomov@inktank.com>
> libceph: set last_piece in ceph_msg_data_pages_cursor_init() correctly
>
> Chris Mason <clm@fb.com>
> xfs: don't zero partial page cache pages during O_DIRECT write
>
> Dave Chinner <dchinner@redhat.com>
> xfs: don't zero partial page cache pages during O_DIRECT writes
>
> Dave Chinner <dchinner@redhat.com>
> xfs: don't dirty buffers beyond EOF
>
> Dave Chinner <dchinner@redhat.com>
> xfs: quotacheck leaves dquot buffers without verifiers
>
> Dave Chinner <dchinner@redhat.com>
> xfs: ensure verifiers are attached to recovered buffers
>
> Doug Ledford <dledford@redhat.com>
> RDMA/uapi: Include socket.h in rdma_user_cm.h
>
> Steve Wise <swise@opengridcomputing.com>
> RDMA/iwcm: Use a default listen backlog if needed
>
> NeilBrown <neilb@suse.de>
> md/raid10: Fix memory leak when raid10 reshape completes.
>
> NeilBrown <neilb@suse.de>
> md/raid10: fix memory leak when reshaping a RAID10.
>
> NeilBrown <neilb@suse.de>
> md/raid6: avoid data corruption during recovery of double-degraded RAID6
>
> NeilBrown <neilb@suse.de>
> md/raid5: avoid livelock caused by non-aligned writes.
>
> NeilBrown <neilb@suse.de>
> md/raid1,raid10: always abort recover on write error.
>
> Al Viro <viro@zeniv.linux.org.uk>
> fix copy_tree() regression
>
> Ilya Dryomov <ilya.dryomov@inktank.com>
> rbd: rework rbd_request_fn()
>
> Al Viro <viro@zeniv.linux.org.uk>
> __generic_file_write_iter(): fix handling of sync error after DIO
>
> Vignesh Raman <Vignesh_Raman@mentor.com>
> Bluetooth: Avoid use of session socket after the session gets freed
>
> Johan Hedberg <johan.hedberg@intel.com>
> Bluetooth: Fix using uninitialized variable when pairing
>
> Vladimir Davydov <vdavydov@parallels.com>
> Bluetooth: never linger on process exit
>
> Johan Hedberg <johan.hedberg@intel.com>
> Bluetooth: Fix tracking local SSP authentication requirement
>
> Marcel Holtmann <marcel@holtmann.org>
> Bluetooth: Fix merge of advertising data and scan response data
>
> Chin-Ran Lo <crlo@marvell.com>
> Bluetooth: btmrvl: wait for HOST_SLEEP_ENABLE event in suspend
>
> Al Viro <viro@zeniv.linux.org.uk>
> fix EBUSY on umount() from MNT_SHRINKABLE
>
> Al Viro <viro@zeniv.linux.org.uk>
> get rid of propagate_umount() mistakenly treating slaves as busy.
>
> Eric W. Biederman <ebiederm@xmission.com>
> mnt: Add tests for unprivileged remount cases that have found to be faulty
>
> Eric W. Biederman <ebiederm@xmission.com>
> mnt: Change the default remount atime from relatime to the existing value
>
> Eric W. Biederman <ebiederm@xmission.com>
> mnt: Correct permission checks in do_remount
>
> Eric W. Biederman <ebiederm@xmission.com>
> mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags into do_remount
>
> Eric W. Biederman <ebiederm@xmission.com>
> mnt: Only change user settable mount flags in remount
>
> Steven Rostedt (Red Hat) <rostedt@goodmis.org>
> ring-buffer: Up rb_iter_peek() loop count to 3
>
> Steven Rostedt (Red Hat) <rostedt@goodmis.org>
> ring-buffer: Always reset iterator to reader page
>
> David Vrabel <david.vrabel@citrix.com>
> xen/events/fifo: reset control block and local HEADs on resume
>
> Hans de Goede <hdegoede@redhat.com>
> ACPI / video: Disable native_backlight on HP ENVY 15 Notebook PC
>
> Hans de Goede <hdegoede@redhat.com>
> ACPI / video: Add a disable_native_backlight quirk
>
> Hans de Goede <hdegoede@redhat.com>
> ACPI / video: Fix use_native_backlight selection logic
>
> Jiri Kosina <jkosina@suse.cz>
> ACPI / cpuidle: fix deadlock between cpuidle_lock and cpu_hotplug.lock
>
> Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
> ACPI / scan: not cache _SUN value in struct acpi_device_pnp
>
> Lv Zheng <lv.zheng@intel.com>
> ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC
>
> Lv Zheng <lv.zheng@intel.com>
> ACPI / EC: Add support to disallow QR_EC to be issued when SCI_EVT isn't set
>
> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> ACPI / scan: Allow ACPI drivers to bind to PNP device objects
>
> Lan Tianyu <tianyu.lan@intel.com>
> ACPI: Run fixed event device notifications in process context
>
> Alan Cox <alan@linux.intel.com>
> spi/pxa2xx: Add ACPI ID for Intel Braswell
>
> Tang Chen <tangchen@cn.fujitsu.com>
> ACPI / hotplug: Check scan handlers in acpi_scan_hot_remove()
>
> David E. Box <david.e.box@linux.intel.com>
> ACPICA: Namespace: Properly null terminate objects detached from a namespace node
>
> David E. Box <david.e.box@linux.intel.com>
> ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject
>
> Sebastian Reichel <sre@kernel.org>
> bq2415x_charger: Fix Atomic Sleep Bug
>
> Ben Hutchings <ben@decadent.org.uk>
> bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address
>
> Peter Ujfalusi <peter.ujfalusi@ti.com>
> ASoC: omap-twl4030: Fix typo in 2nd dai link's platform_name
>
> Jarkko Nikula <jarkko.nikula@linux.intel.com>
> ASoC: rt5640: Do not allow regmap to use bulk read-write operations
>
> Andreas Färber <afaerber@suse.de>
> ASoC: axi: Fix ADI AXI SPDIF specification
>
> Daniel Mack <zonque@gmail.com>
> ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE
>
> Dan Carpenter <dan.carpenter@oracle.com>
> ASoC: pxa: pxa-ssp: small leak in probe()
>
> Jie Yang <yang.jie@intel.com>
> ASoC: Intel: Cleanup HSW pcm format support
>
> Peter Ujfalusi <peter.ujfalusi@ti.com>
> ASoC: tlv320aic31xx: Do not ignore errors in aic31xx_device_init()
>
> Jarkko Nikula <jarkko.nikula@linux.intel.com>
> ASoC: max98090: Fix missing free_irq
>
> Daniel Mack <zonque@gmail.com>
> ASoC: adau1701: fix adau1701_reg_read()
>
> Sylwester Nawrocki <s.nawrocki@samsung.com>
> ASoC: samsung: Correct I2S DAI suspend/resume ops
>
> Scott Jiang <scott.jiang.linux@gmail.com>
> ASoC: blackfin: use samples to set silence
>
> Praveen Diwakar <praveen.diwakar@intel.com>
> ASoC: wm_adsp: Add missing MODULE_LICENSE
>
> Qiao Zhou <zhouqiao@marvell.com>
> ASoC: pcm: fix dpcm_path_put in dpcm runtime update
>
> Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
> ASoC: wm8994: Prevent double lock of accdet_lock mutex on wm1811
>
> Markos Chandras <markos.chandras@imgtec.com>
> MIPS: CPS: Initialize EVA before bringing up VPEs from secondary cores
>
> Markos Chandras <markos.chandras@imgtec.com>
> MIPS: Malta: EVA: Rename 'eva_entry' to 'platform_eva_init'
>
> Markos Chandras <markos.chandras@imgtec.com>
> MIPS: EVA: Add new EVA header
>
> Aaro Koskinen <aaro.koskinen@nsn.com>
> MIPS: OCTEON: make get_system_type() thread-safe
>
> Markos Chandras <markos.chandras@imgtec.com>
> MIPS: Malta: Improve system memory detection for '{e, }memsize' >= 2G
>
> Markos Chandras <markos.chandras@imgtec.com>
> MIPS: scall64-o32: Fix indirect syscall detection
>
> Markos Chandras <markos.chandras@imgtec.com>
> MIPS: syscall: Fix AUDIT value for O32 processes on MIPS64
>
> Alex Smith <alex@alex-smith.me.uk>
> MIPS: asm/reg.h: Make 32- and 64-bit definitions available at the same time
>
> Huacai Chen <chenhc@lemote.com>
> MIPS: Remove BUG_ON(!is_fpu_owner()) in do_ade()
>
> Huacai Chen <chenhc@lemote.com>
> MIPS: tlbex: Fix a missing statement for HUGETLB
>
> Paul Burton <paul.burton@imgtec.com>
> MIPS: Prevent user from setting FCSR cause bits
>
> James Hogan <james.hogan@imgtec.com>
> MIPS: smp-mt: Fix link error when PROC_FS=n
>
> Alex Smith <alex@alex-smith.me.uk>
> MIPS: ptrace: Avoid smp_processor_id() when retrieving FPU IR
>
> Alex Smith <alex@alex-smith.me.uk>
> MIPS: ptrace: Change GP regset to use correct core dump register layout
>
> Alex Smith <alex@alex-smith.me.uk>
> MIPS: ptrace: Test correct task's flags in task_user_regset_view()
>
> Alex Smith <alex.smith@imgtec.com>
> MIPS: O32/32-bit: Fix bug which can cause incorrect system call restarts
>
> Jeffrey Deans <jeffrey.deans@imgtec.com>
> MIPS: GIC: Prevent array overrun
>
> Tony Battersby <tonyb@cybernetics.com>
> fix regression in SCSI_IOCTL_SEND_COMMAND
>
> Juergen Gross <jgross@suse.com>
> SCSI: save command pool address of Scsi_Host
>
> Bart Van Assche <bvanassche@acm.org>
> scsi_transport_srp: Fix fast_io_fail_tmo=dev_loss_tmo=off behavior
>
> Janusz Dziemidowicz <rraptorr@nails.eu.org>
> scsi: do not issue SCSI RSOC command to Promise Vtrak E610f
>
> Martin K. Petersen <martin.petersen@oracle.com>
> scsi: add a blacklist flag which enables VPD page inquiries
>
> Hannes Reinecke <hare@suse.de>
> scsi_scan: Restrict sequential scan to 256 LUNs
>
> K. Y. Srinivasan <kys@microsoft.com>
> drivers: scsi: storvsc: Correctly handle TEST_UNIT_READY failure
>
> K. Y. Srinivasan <kys@microsoft.com>
> drivers: scsi: storvsc: Set srb_flags in all cases
>
> K. Y. Srinivasan <kys@microsoft.com>
> Drivers: scsi: storvsc: Fix a bug in handling VMBUS protocol version
>
> K. Y. Srinivasan <kys@microsoft.com>
> Drivers: scsi: storvsc: Set cmd_per_lun to reflect value supported by the Host
>
> K. Y. Srinivasan <kys@microsoft.com>
> Drivers: scsi: storvsc: Change the limits to reflect the values on the host
>
> K. Y. Srinivasan <kys@microsoft.com>
> Drivers: scsi: storvsc: Filter commands based on the storage protocol version
>
> K. Y. Srinivasan <kys@microsoft.com>
> Drivers: scsi: storvsc: Implement a eh_timed_out handler
>
> James Bottomley <JBottomley@Parallels.com>
> scsi: use short driver name for per-driver cmd slab caches
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/thp: Use ACCESS_ONCE when loading pmdp
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/thp: Invalidate with vpn in loop
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/thp: Handle combo pages in invalidate
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/thp: Invalidate old 64K based hash page mapping before insert of 4k pte
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/thp: Don't recompute vsid and ssize in loop on invalidate
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/thp: Add write barrier after updating the valid bit
>
> Gavin Shan <gwshan@linux.vnet.ibm.com>
> powerpc/pseries: Avoid deadlock on removing ddw
>
> Gavin Shan <gwshan@linux.vnet.ibm.com>
> powerpc/pseries: Failure on removing device node
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/mm: Use read barrier when creating real_pte
>
> Andrey Utkin <andrey.krieger.utkin@gmail.com>
> powerpc/mm/numa: Fix break placement
>
> Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
> powerpc/cpuidle: Fix parsing of idle state flags from device-tree
>
> Felipe Balbi <balbi@ti.com>
> regulator: tps65218: fix DCDC4 linear voltage range
>
> Nikesh Oswal <nikesh@opensource.wolfsonmicro.com>
> regulator: arizona-ldo1: remove bypass functionality
>
> Tony Lindgren <tony@atomide.com>
> mfd: twl4030-power: Fix PM idle pin configuration to not conflict with regulators
>
> Jeff Mahoney <jeffm@suse.com>
> drivers/mfd/rtsx_usb.c: export device table
>
> Michael Welling <mwelling@emacinc.com>
> mfd: omap-usb-host: Fix improper mask use.
>
> Sasha Levin <sasha.levin@oracle.com>
> kernel/smp.c:on_each_cpu_cond(): fix warning in fallback path
>
> Li Zhong <zhong@linux.vnet.ibm.com>
> mm: fix potential infinite loop in dissolve_free_huge_pages()
>
> Pranith Kumar <bobby.prani@gmail.com>
> sh: fix build error by adding generic ioport_{map/unmap}()
>
> Ben Hutchings <ben@decadent.org.uk>
> ocfs2: do not write error flag to user structure we cannot copy from/to
>
> Jan Kara <jack@suse.cz>
> fanotify: fix double free of pending permission events
>
> Eric Paris <eparis@redhat.com>
> CAPABILITIES: remove undefined caps from all processes
>
> Stefan Berger <stefanb@linux.vnet.ibm.com>
> tpm: Properly clean sysfs entries in error path
>
> Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
> tpm: Provide a generic means to override the chip returned timeouts
>
> Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> tpm: missing tpm_chip_put in tpm_get_random()
>
> Guenter Roeck <linux@roeck-us.net>
> firmware: Do not use WARN_ON(!spin_is_locked())
>
> Alex Deucher <alexander.deucher@amd.com>
> drm/radeon: use packet2 for nop on hawaii with old firmware
>
> Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
> powerpc/cpufreq: Add pr_warn() on OPAL firmware failures
>
> Christian Borntraeger <borntraeger@de.ibm.com>
> s390/locking: Reenable optimistic spinning
>
> Mark A. Greer <mgreer@animalcreek.com>
> spi: omap2-mcspi: Configure hardware when slave driver changes mode
>
> Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
> spi: orion: fix incorrect handling of cell-index DT property
>
> Joerg Roedel <jroedel@suse.de>
> iommu/amd: Fix cleanup_domain for mass device removal
>
> Joerg Roedel <jroedel@suse.de>
> iommu/vt-d: Defer domain removal if device is assigned to a driver
>
> Gavin Shan <gwshan@linux.vnet.ibm.com>
> powerpc/powernv: Fix IOMMU group lost
>
> Alex Williamson <alex.williamson@redhat.com>
> iommu/vt-d: Exclude devices using RMRRs from IOMMU API domains
>
> Paul Bolle <pebolle@tiscali.nl>
> media: sms: Remove CONFIG_ prefix from Kconfig symbols
>
> Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
> media: v4l: vb2: Fix stream start and buffer completion race
>
> Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> media: v4l: vsp1: Remove the unneeded vsp1_video_buffer video field
>
> Philipp Zabel <p.zabel@pengutronix.de>
> media: mt9v032: fix hblank calculation
>
> Salva Peiró <speiro@ai2.upv.es>
> media: media-device: Remove duplicated memset() in media_enum_entities()
>
> Mauro Carvalho Chehab <m.chehab@samsung.com>
> media: au0828: Only alt setting logic when needed
>
> Mauro Carvalho Chehab <m.chehab@samsung.com>
> media: xc4000: Fix get_frequency()
>
> Mauro Carvalho Chehab <m.chehab@samsung.com>
> media: xc5000: Fix get_frequency()
>
> Jan Kara <jack@suse.cz>
> reiserfs: Fix use after free in journal teardown
>
> Jeff Mahoney <jeffm@suse.com>
> reiserfs: fix corruption introduced by balance_leaf refactor
>
>
> -------------
>
> Diffstat:
>
> .../devicetree/bindings/sound/adi,axi-spdif-tx.txt | 2 +-
> Makefile | 4 +-
> arch/arm/boot/dts/omap3-n900.dts | 2 +-
> arch/mips/cavium-octeon/setup.c | 18 +-
> arch/mips/include/asm/eva.h | 43 ++++
> .../include/asm/mach-malta/kernel-entry-init.h | 22 +-
> arch/mips/include/asm/ptrace.h | 2 +-
> arch/mips/include/asm/reg.h | 260 +++++++++++++--------
> arch/mips/include/asm/syscall.h | 8 +-
> arch/mips/kernel/binfmt_elfo32.c | 32 ++-
> arch/mips/kernel/cps-vec.S | 4 +
> arch/mips/kernel/irq-gic.c | 6 +-
> arch/mips/kernel/ptrace.c | 196 +++++++++++++---
> arch/mips/kernel/ptrace32.c | 2 +-
> arch/mips/kernel/scall64-o32.S | 12 +-
> arch/mips/kernel/smp-mt.c | 2 +
> arch/mips/kernel/unaligned.c | 1 -
> arch/mips/mm/tlbex.c | 1 +
> arch/mips/mti-malta/malta-memory.c | 14 +-
> arch/powerpc/include/asm/machdep.h | 6 +-
> arch/powerpc/include/asm/pgtable-ppc64.h | 2 +-
> arch/powerpc/include/asm/pte-hash64-64k.h | 30 ++-
> arch/powerpc/kernel/iommu.c | 38 +--
> arch/powerpc/mm/hash_native_64.c | 40 +---
> arch/powerpc/mm/hugepage-hash64.c | 88 ++++++-
> arch/powerpc/mm/numa.c | 2 +-
> arch/powerpc/mm/pgtable_64.c | 38 +--
> arch/powerpc/mm/tlb_hash64.c | 2 +-
> arch/powerpc/platforms/powernv/pci-ioda.c | 2 +-
> arch/powerpc/platforms/pseries/hotplug-memory.c | 2 +-
> arch/powerpc/platforms/pseries/iommu.c | 20 +-
> arch/powerpc/platforms/pseries/lpar.c | 20 +-
> arch/s390/Kconfig | 1 +
> arch/sh/include/asm/io_noioport.h | 11 +
> block/blk-cgroup.c | 7 +
> block/scsi_ioctl.c | 9 +-
> drivers/acpi/acpica/nsobject.c | 11 +
> drivers/acpi/acpica/utcopy.c | 6 +
> drivers/acpi/ec.c | 21 +-
> drivers/acpi/processor_idle.c | 4 +-
> drivers/acpi/scan.c | 35 +--
> drivers/acpi/video.c | 45 +++-
> drivers/block/rbd.c | 196 ++++++++++------
> drivers/bluetooth/btmrvl_drv.h | 1 +
> drivers/bluetooth/btmrvl_main.c | 25 +-
> drivers/char/tpm/tpm-interface.c | 73 ++++--
> drivers/char/tpm/tpm_tis.c | 31 +++
> drivers/cpufreq/powernv-cpufreq.c | 18 +-
> drivers/cpuidle/cpuidle-powernv.c | 16 +-
> drivers/firmware/efi/vars.c | 8 +-
> drivers/gpu/drm/nouveau/nouveau_display.c | 11 +
> drivers/gpu/drm/nouveau/nouveau_drm.h | 4 +-
> drivers/gpu/drm/radeon/cik.c | 13 +-
> drivers/infiniband/core/iwcm.c | 27 +++
> drivers/infiniband/ulp/srp/ib_srp.c | 38 ++-
> drivers/iommu/amd_iommu.c | 10 +-
> drivers/iommu/intel-iommu.c | 57 ++++-
> drivers/md/dm-table.c | 13 ++
> drivers/md/raid1.c | 8 +-
> drivers/md/raid10.c | 14 +-
> drivers/md/raid5.c | 4 +-
> drivers/media/common/siano/Kconfig | 3 +-
> drivers/media/i2c/mt9v032.c | 4 +-
> drivers/media/media-device.c | 2 -
> drivers/media/platform/vsp1/vsp1_video.c | 2 -
> drivers/media/platform/vsp1/vsp1_video.h | 1 -
> drivers/media/tuners/xc4000.c | 20 +-
> drivers/media/tuners/xc5000.c | 22 +-
> drivers/media/usb/au0828/au0828-video.c | 34 +--
> drivers/media/v4l2-core/videobuf2-core.c | 4 +-
> drivers/mfd/omap-usb-host.c | 2 +-
> drivers/mfd/rtsx_usb.c | 1 +
> drivers/mfd/twl4030-power.c | 20 +-
> drivers/mtd/ftl.c | 1 -
> drivers/mtd/nand/omap2.c | 2 +-
> drivers/power/bq2415x_charger.c | 8 +-
> drivers/regulator/arizona-ldo1.c | 2 -
> drivers/regulator/tps65218-regulator.c | 2 +-
> drivers/scsi/bfa/bfa_ioc.h | 2 +-
> drivers/scsi/scsi.c | 16 +-
> drivers/scsi/scsi_devinfo.c | 1 +
> drivers/scsi/scsi_scan.c | 16 +-
> drivers/scsi/scsi_transport_srp.c | 3 +-
> drivers/scsi/sd.c | 5 +
> drivers/scsi/storvsc_drv.c | 113 ++++++---
> drivers/spi/spi-omap2-mcspi.c | 14 ++
> drivers/spi/spi-orion.c | 10 +-
> drivers/spi/spi-pxa2xx.c | 1 +
> drivers/xen/events/events_fifo.c | 48 ++--
> fs/cifs/cifsglob.h | 7 +-
> fs/cifs/file.c | 6 +-
> fs/cifs/inode.c | 11 +-
> fs/cifs/readdir.c | 6 +-
> fs/cifs/smb1ops.c | 7 +
> fs/cifs/smb2file.c | 2 +-
> fs/cifs/smb2inode.c | 2 +-
> fs/cifs/smb2maperror.c | 4 +-
> fs/cifs/smb2ops.c | 11 +-
> fs/cifs/smb2pdu.c | 14 +-
> fs/dcache.c | 3 +-
> fs/namei.c | 4 +-
> fs/namespace.c | 100 ++++++--
> fs/notify/fanotify/fanotify.c | 9 +-
> fs/notify/fanotify/fanotify_user.c | 12 +
> fs/notify/notification.c | 18 +-
> fs/ocfs2/ioctl.c | 129 ++++------
> fs/pnode.c | 1 +
> fs/proc/array.c | 11 +-
> fs/reiserfs/do_balan.c | 111 +++++----
> fs/reiserfs/journal.c | 22 +-
> fs/reiserfs/lbalance.c | 5 +-
> fs/reiserfs/reiserfs.h | 9 +-
> fs/reiserfs/super.c | 6 +-
> fs/xfs/xfs_aops.c | 61 +++++
> fs/xfs/xfs_dquot.c | 3 +-
> fs/xfs/xfs_file.c | 21 +-
> fs/xfs/xfs_log_recover.c | 51 ++--
> fs/xfs/xfs_qm.c | 8 +-
> include/acpi/acpi_bus.h | 1 -
> include/linux/capability.h | 5 +-
> include/linux/fsnotify_backend.h | 2 +
> include/linux/mount.h | 9 +-
> include/linux/tpm.h | 3 +
> include/scsi/scsi_device.h | 1 +
> include/scsi/scsi_devinfo.h | 5 +
> include/uapi/rdma/rdma_user_cm.h | 1 +
> kernel/audit.c | 2 +-
> kernel/capability.c | 4 +
> kernel/smp.c | 2 +-
> kernel/trace/ring_buffer.c | 31 ++-
> lib/assoc_array.c | 6 +-
> mm/filemap.c | 2 +-
> mm/hugetlb.c | 3 +
> net/bluetooth/hci_event.c | 23 +-
> net/bluetooth/l2cap_sock.c | 3 +-
> net/bluetooth/rfcomm/core.c | 7 +-
> net/bluetooth/rfcomm/sock.c | 3 +-
> net/bluetooth/sco.c | 6 +-
> net/ceph/auth_x.c | 256 ++++++++++----------
> net/ceph/messenger.c | 2 +-
> net/ceph/mon_client.c | 8 +
> security/commoncap.c | 3 +
> sound/soc/blackfin/bf5xx-i2s-pcm.c | 8 +-
> sound/soc/codecs/adau1701.c | 6 +-
> sound/soc/codecs/max98090.c | 2 +-
> sound/soc/codecs/rt5640.c | 1 +
> sound/soc/codecs/tlv320aic31xx.c | 9 +-
> sound/soc/codecs/wm8994.c | 9 +-
> sound/soc/codecs/wm_adsp.c | 2 +
> sound/soc/intel/sst-baytrail-pcm.c | 2 +-
> sound/soc/intel/sst-haswell-pcm.c | 27 ++-
> sound/soc/omap/omap-twl4030.c | 2 +-
> sound/soc/pxa/pxa-ssp.c | 7 +-
> sound/soc/samsung/i2s.c | 16 +-
> sound/soc/soc-pcm.c | 1 +
> tools/testing/selftests/Makefile | 1 +
> tools/testing/selftests/mount/Makefile | 17 ++
> .../selftests/mount/unprivileged-remount-test.c | 242 +++++++++++++++++++
> 158 files changed, 2370 insertions(+), 1021 deletions(-)
>
>
^ permalink raw reply [flat|nested] 161+ messages in thread* Re: [PATCH 3.16 000/158] 3.16.3-stable review
@ 2014-09-16 22:58 ` Satoru Takeuchi
0 siblings, 0 replies; 161+ messages in thread
From: Satoru Takeuchi @ 2014-09-16 22:58 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, satoru.takeuchi, shuah.kh, stable
At Mon, 15 Sep 2014 12:23:59 -0700,
Greg Kroah-Hartman wrote:
>
> This is the start of the stable review cycle for the 3.16.3 release.
> There are 158 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Sep 17 19:25:26 UTC 2014.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.16.3-rc1.gz
> and the diffstat can be found below.
All 3.10.55-rc1, 3.14.19-rc1, and 3.6.3-rc1 passed my test.
- Test Cases:
- Build this kernel.
- Boot this kernel.
- Build the latest mainline kernel with this kernel.
- Test Tool:
https://github.com/satoru-takeuchi/test-linux-stable
- Test Result (kernel .config, ktest config and test log):
http://satoru-takeuchi.org/test-linux-stable/results/<version>-<test datetime>.tar.xz
- Build Environment:
- OS: Debian Jessy x86_64
- CPU: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz x 4
- memory: 8GB
- Test Target Environment:
- Debian Jessy x86_64 (KVM guest on the Build Environment)
- # of vCPU: 2
- memory: 2GB
Thanks,
Satoru
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 3.16.3-rc1
>
> David Howells <dhowells@redhat.com>
> KEYS: Fix termination condition in assoc array garbage collection
>
> David Howells <dhowells@redhat.com>
> KEYS: Fix use-after-free in assoc_array_gc()
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix SMB2 readdir error handling
>
> Linus Torvalds <torvalds@linux-foundation.org>
> vfs: fix bad hashing of dentries
>
> Mario Kleiner <mario.kleiner.de@gmail.com>
> drm/nouveau: Bump version from 1.1.1 to 1.1.2
>
> Mario Kleiner <mario.kleiner.de@gmail.com>
> drm/nouveau: Dis/Enable vblank irqs during suspend/resume.
>
> Bart Van Assche <bvanassche@acm.org>
> IB/srp: Fix deadlock between host removal and multipathd
>
> Jeff Moyer <jmoyer@redhat.com>
> dm table: propagate QUEUE_FLAG_NO_SG_MERGE
>
> Tejun Heo <tj@kernel.org>
> blkcg: don't call into policy draining if root_blkg is already gone
>
> Roger Quadros <rogerq@ti.com>
> mtd: nand: omap: Fix 1-bit Hamming code scheme, omap_calculate_ecc()
>
> Kevin Hao <haokexin@gmail.com>
> mtd/ftl: fix the double free of the buffers allocated in build_maps()
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix wrong restart readdir for SMB1
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix wrong filename length for SMB2
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix directory rename error
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix wrong directory attributes after rename
>
> Steve French <smfrench@gmail.com>
> CIFS: Possible null ptr deref in SMB2_tcon
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix async reading on reconnects
>
> Pavel Shilovsky <pshilovsky@samba.org>
> CIFS: Fix STATUS_CANNOT_DELETE error mapping for SMB2
>
> Ilya Dryomov <ilya.dryomov@inktank.com>
> libceph: do not hard code max auth ticket len
>
> Ilya Dryomov <ilya.dryomov@inktank.com>
> libceph: add process_one_ticket() helper
>
> Sage Weil <sage@redhat.com>
> libceph: gracefully handle large reply messages from the mon
>
> Ilya Dryomov <ilya.dryomov@inktank.com>
> libceph: set last_piece in ceph_msg_data_pages_cursor_init() correctly
>
> Chris Mason <clm@fb.com>
> xfs: don't zero partial page cache pages during O_DIRECT write
>
> Dave Chinner <dchinner@redhat.com>
> xfs: don't zero partial page cache pages during O_DIRECT writes
>
> Dave Chinner <dchinner@redhat.com>
> xfs: don't dirty buffers beyond EOF
>
> Dave Chinner <dchinner@redhat.com>
> xfs: quotacheck leaves dquot buffers without verifiers
>
> Dave Chinner <dchinner@redhat.com>
> xfs: ensure verifiers are attached to recovered buffers
>
> Doug Ledford <dledford@redhat.com>
> RDMA/uapi: Include socket.h in rdma_user_cm.h
>
> Steve Wise <swise@opengridcomputing.com>
> RDMA/iwcm: Use a default listen backlog if needed
>
> NeilBrown <neilb@suse.de>
> md/raid10: Fix memory leak when raid10 reshape completes.
>
> NeilBrown <neilb@suse.de>
> md/raid10: fix memory leak when reshaping a RAID10.
>
> NeilBrown <neilb@suse.de>
> md/raid6: avoid data corruption during recovery of double-degraded RAID6
>
> NeilBrown <neilb@suse.de>
> md/raid5: avoid livelock caused by non-aligned writes.
>
> NeilBrown <neilb@suse.de>
> md/raid1,raid10: always abort recover on write error.
>
> Al Viro <viro@zeniv.linux.org.uk>
> fix copy_tree() regression
>
> Ilya Dryomov <ilya.dryomov@inktank.com>
> rbd: rework rbd_request_fn()
>
> Al Viro <viro@zeniv.linux.org.uk>
> __generic_file_write_iter(): fix handling of sync error after DIO
>
> Vignesh Raman <Vignesh_Raman@mentor.com>
> Bluetooth: Avoid use of session socket after the session gets freed
>
> Johan Hedberg <johan.hedberg@intel.com>
> Bluetooth: Fix using uninitialized variable when pairing
>
> Vladimir Davydov <vdavydov@parallels.com>
> Bluetooth: never linger on process exit
>
> Johan Hedberg <johan.hedberg@intel.com>
> Bluetooth: Fix tracking local SSP authentication requirement
>
> Marcel Holtmann <marcel@holtmann.org>
> Bluetooth: Fix merge of advertising data and scan response data
>
> Chin-Ran Lo <crlo@marvell.com>
> Bluetooth: btmrvl: wait for HOST_SLEEP_ENABLE event in suspend
>
> Al Viro <viro@zeniv.linux.org.uk>
> fix EBUSY on umount() from MNT_SHRINKABLE
>
> Al Viro <viro@zeniv.linux.org.uk>
> get rid of propagate_umount() mistakenly treating slaves as busy.
>
> Eric W. Biederman <ebiederm@xmission.com>
> mnt: Add tests for unprivileged remount cases that have found to be faulty
>
> Eric W. Biederman <ebiederm@xmission.com>
> mnt: Change the default remount atime from relatime to the existing value
>
> Eric W. Biederman <ebiederm@xmission.com>
> mnt: Correct permission checks in do_remount
>
> Eric W. Biederman <ebiederm@xmission.com>
> mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags into do_remount
>
> Eric W. Biederman <ebiederm@xmission.com>
> mnt: Only change user settable mount flags in remount
>
> Steven Rostedt (Red Hat) <rostedt@goodmis.org>
> ring-buffer: Up rb_iter_peek() loop count to 3
>
> Steven Rostedt (Red Hat) <rostedt@goodmis.org>
> ring-buffer: Always reset iterator to reader page
>
> David Vrabel <david.vrabel@citrix.com>
> xen/events/fifo: reset control block and local HEADs on resume
>
> Hans de Goede <hdegoede@redhat.com>
> ACPI / video: Disable native_backlight on HP ENVY 15 Notebook PC
>
> Hans de Goede <hdegoede@redhat.com>
> ACPI / video: Add a disable_native_backlight quirk
>
> Hans de Goede <hdegoede@redhat.com>
> ACPI / video: Fix use_native_backlight selection logic
>
> Jiri Kosina <jkosina@suse.cz>
> ACPI / cpuidle: fix deadlock between cpuidle_lock and cpu_hotplug.lock
>
> Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
> ACPI / scan: not cache _SUN value in struct acpi_device_pnp
>
> Lv Zheng <lv.zheng@intel.com>
> ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC
>
> Lv Zheng <lv.zheng@intel.com>
> ACPI / EC: Add support to disallow QR_EC to be issued when SCI_EVT isn't set
>
> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> ACPI / scan: Allow ACPI drivers to bind to PNP device objects
>
> Lan Tianyu <tianyu.lan@intel.com>
> ACPI: Run fixed event device notifications in process context
>
> Alan Cox <alan@linux.intel.com>
> spi/pxa2xx: Add ACPI ID for Intel Braswell
>
> Tang Chen <tangchen@cn.fujitsu.com>
> ACPI / hotplug: Check scan handlers in acpi_scan_hot_remove()
>
> David E. Box <david.e.box@linux.intel.com>
> ACPICA: Namespace: Properly null terminate objects detached from a namespace node
>
> David E. Box <david.e.box@linux.intel.com>
> ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject
>
> Sebastian Reichel <sre@kernel.org>
> bq2415x_charger: Fix Atomic Sleep Bug
>
> Ben Hutchings <ben@decadent.org.uk>
> bfa: Fix undefined bit shift on big-endian architectures with 32-bit DMA address
>
> Peter Ujfalusi <peter.ujfalusi@ti.com>
> ASoC: omap-twl4030: Fix typo in 2nd dai link's platform_name
>
> Jarkko Nikula <jarkko.nikula@linux.intel.com>
> ASoC: rt5640: Do not allow regmap to use bulk read-write operations
>
> Andreas F�rber <afaerber@suse.de>
> ASoC: axi: Fix ADI AXI SPDIF specification
>
> Daniel Mack <zonque@gmail.com>
> ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE
>
> Dan Carpenter <dan.carpenter@oracle.com>
> ASoC: pxa: pxa-ssp: small leak in probe()
>
> Jie Yang <yang.jie@intel.com>
> ASoC: Intel: Cleanup HSW pcm format support
>
> Peter Ujfalusi <peter.ujfalusi@ti.com>
> ASoC: tlv320aic31xx: Do not ignore errors in aic31xx_device_init()
>
> Jarkko Nikula <jarkko.nikula@linux.intel.com>
> ASoC: max98090: Fix missing free_irq
>
> Daniel Mack <zonque@gmail.com>
> ASoC: adau1701: fix adau1701_reg_read()
>
> Sylwester Nawrocki <s.nawrocki@samsung.com>
> ASoC: samsung: Correct I2S DAI suspend/resume ops
>
> Scott Jiang <scott.jiang.linux@gmail.com>
> ASoC: blackfin: use samples to set silence
>
> Praveen Diwakar <praveen.diwakar@intel.com>
> ASoC: wm_adsp: Add missing MODULE_LICENSE
>
> Qiao Zhou <zhouqiao@marvell.com>
> ASoC: pcm: fix dpcm_path_put in dpcm runtime update
>
> Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
> ASoC: wm8994: Prevent double lock of accdet_lock mutex on wm1811
>
> Markos Chandras <markos.chandras@imgtec.com>
> MIPS: CPS: Initialize EVA before bringing up VPEs from secondary cores
>
> Markos Chandras <markos.chandras@imgtec.com>
> MIPS: Malta: EVA: Rename 'eva_entry' to 'platform_eva_init'
>
> Markos Chandras <markos.chandras@imgtec.com>
> MIPS: EVA: Add new EVA header
>
> Aaro Koskinen <aaro.koskinen@nsn.com>
> MIPS: OCTEON: make get_system_type() thread-safe
>
> Markos Chandras <markos.chandras@imgtec.com>
> MIPS: Malta: Improve system memory detection for '{e, }memsize' >= 2G
>
> Markos Chandras <markos.chandras@imgtec.com>
> MIPS: scall64-o32: Fix indirect syscall detection
>
> Markos Chandras <markos.chandras@imgtec.com>
> MIPS: syscall: Fix AUDIT value for O32 processes on MIPS64
>
> Alex Smith <alex@alex-smith.me.uk>
> MIPS: asm/reg.h: Make 32- and 64-bit definitions available at the same time
>
> Huacai Chen <chenhc@lemote.com>
> MIPS: Remove BUG_ON(!is_fpu_owner()) in do_ade()
>
> Huacai Chen <chenhc@lemote.com>
> MIPS: tlbex: Fix a missing statement for HUGETLB
>
> Paul Burton <paul.burton@imgtec.com>
> MIPS: Prevent user from setting FCSR cause bits
>
> James Hogan <james.hogan@imgtec.com>
> MIPS: smp-mt: Fix link error when PROC_FS=n
>
> Alex Smith <alex@alex-smith.me.uk>
> MIPS: ptrace: Avoid smp_processor_id() when retrieving FPU IR
>
> Alex Smith <alex@alex-smith.me.uk>
> MIPS: ptrace: Change GP regset to use correct core dump register layout
>
> Alex Smith <alex@alex-smith.me.uk>
> MIPS: ptrace: Test correct task's flags in task_user_regset_view()
>
> Alex Smith <alex.smith@imgtec.com>
> MIPS: O32/32-bit: Fix bug which can cause incorrect system call restarts
>
> Jeffrey Deans <jeffrey.deans@imgtec.com>
> MIPS: GIC: Prevent array overrun
>
> Tony Battersby <tonyb@cybernetics.com>
> fix regression in SCSI_IOCTL_SEND_COMMAND
>
> Juergen Gross <jgross@suse.com>
> SCSI: save command pool address of Scsi_Host
>
> Bart Van Assche <bvanassche@acm.org>
> scsi_transport_srp: Fix fast_io_fail_tmo=dev_loss_tmo=off behavior
>
> Janusz Dziemidowicz <rraptorr@nails.eu.org>
> scsi: do not issue SCSI RSOC command to Promise Vtrak E610f
>
> Martin K. Petersen <martin.petersen@oracle.com>
> scsi: add a blacklist flag which enables VPD page inquiries
>
> Hannes Reinecke <hare@suse.de>
> scsi_scan: Restrict sequential scan to 256 LUNs
>
> K. Y. Srinivasan <kys@microsoft.com>
> drivers: scsi: storvsc: Correctly handle TEST_UNIT_READY failure
>
> K. Y. Srinivasan <kys@microsoft.com>
> drivers: scsi: storvsc: Set srb_flags in all cases
>
> K. Y. Srinivasan <kys@microsoft.com>
> Drivers: scsi: storvsc: Fix a bug in handling VMBUS protocol version
>
> K. Y. Srinivasan <kys@microsoft.com>
> Drivers: scsi: storvsc: Set cmd_per_lun to reflect value supported by the Host
>
> K. Y. Srinivasan <kys@microsoft.com>
> Drivers: scsi: storvsc: Change the limits to reflect the values on the host
>
> K. Y. Srinivasan <kys@microsoft.com>
> Drivers: scsi: storvsc: Filter commands based on the storage protocol version
>
> K. Y. Srinivasan <kys@microsoft.com>
> Drivers: scsi: storvsc: Implement a eh_timed_out handler
>
> James Bottomley <JBottomley@Parallels.com>
> scsi: use short driver name for per-driver cmd slab caches
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/thp: Use ACCESS_ONCE when loading pmdp
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/thp: Invalidate with vpn in loop
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/thp: Handle combo pages in invalidate
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/thp: Invalidate old 64K based hash page mapping before insert of 4k pte
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/thp: Don't recompute vsid and ssize in loop on invalidate
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/thp: Add write barrier after updating the valid bit
>
> Gavin Shan <gwshan@linux.vnet.ibm.com>
> powerpc/pseries: Avoid deadlock on removing ddw
>
> Gavin Shan <gwshan@linux.vnet.ibm.com>
> powerpc/pseries: Failure on removing device node
>
> Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> powerpc/mm: Use read barrier when creating real_pte
>
> Andrey Utkin <andrey.krieger.utkin@gmail.com>
> powerpc/mm/numa: Fix break placement
>
> Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
> powerpc/cpuidle: Fix parsing of idle state flags from device-tree
>
> Felipe Balbi <balbi@ti.com>
> regulator: tps65218: fix DCDC4 linear voltage range
>
> Nikesh Oswal <nikesh@opensource.wolfsonmicro.com>
> regulator: arizona-ldo1: remove bypass functionality
>
> Tony Lindgren <tony@atomide.com>
> mfd: twl4030-power: Fix PM idle pin configuration to not conflict with regulators
>
> Jeff Mahoney <jeffm@suse.com>
> drivers/mfd/rtsx_usb.c: export device table
>
> Michael Welling <mwelling@emacinc.com>
> mfd: omap-usb-host: Fix improper mask use.
>
> Sasha Levin <sasha.levin@oracle.com>
> kernel/smp.c:on_each_cpu_cond(): fix warning in fallback path
>
> Li Zhong <zhong@linux.vnet.ibm.com>
> mm: fix potential infinite loop in dissolve_free_huge_pages()
>
> Pranith Kumar <bobby.prani@gmail.com>
> sh: fix build error by adding generic ioport_{map/unmap}()
>
> Ben Hutchings <ben@decadent.org.uk>
> ocfs2: do not write error flag to user structure we cannot copy from/to
>
> Jan Kara <jack@suse.cz>
> fanotify: fix double free of pending permission events
>
> Eric Paris <eparis@redhat.com>
> CAPABILITIES: remove undefined caps from all processes
>
> Stefan Berger <stefanb@linux.vnet.ibm.com>
> tpm: Properly clean sysfs entries in error path
>
> Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
> tpm: Provide a generic means to override the chip returned timeouts
>
> Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> tpm: missing tpm_chip_put in tpm_get_random()
>
> Guenter Roeck <linux@roeck-us.net>
> firmware: Do not use WARN_ON(!spin_is_locked())
>
> Alex Deucher <alexander.deucher@amd.com>
> drm/radeon: use packet2 for nop on hawaii with old firmware
>
> Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
> powerpc/cpufreq: Add pr_warn() on OPAL firmware failures
>
> Christian Borntraeger <borntraeger@de.ibm.com>
> s390/locking: Reenable optimistic spinning
>
> Mark A. Greer <mgreer@animalcreek.com>
> spi: omap2-mcspi: Configure hardware when slave driver changes mode
>
> Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
> spi: orion: fix incorrect handling of cell-index DT property
>
> Joerg Roedel <jroedel@suse.de>
> iommu/amd: Fix cleanup_domain for mass device removal
>
> Joerg Roedel <jroedel@suse.de>
> iommu/vt-d: Defer domain removal if device is assigned to a driver
>
> Gavin Shan <gwshan@linux.vnet.ibm.com>
> powerpc/powernv: Fix IOMMU group lost
>
> Alex Williamson <alex.williamson@redhat.com>
> iommu/vt-d: Exclude devices using RMRRs from IOMMU API domains
>
> Paul Bolle <pebolle@tiscali.nl>
> media: sms: Remove CONFIG_ prefix from Kconfig symbols
>
> Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
> media: v4l: vb2: Fix stream start and buffer completion race
>
> Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> media: v4l: vsp1: Remove the unneeded vsp1_video_buffer video field
>
> Philipp Zabel <p.zabel@pengutronix.de>
> media: mt9v032: fix hblank calculation
>
> Salva Peir� <speiro@ai2.upv.es>
> media: media-device: Remove duplicated memset() in media_enum_entities()
>
> Mauro Carvalho Chehab <m.chehab@samsung.com>
> media: au0828: Only alt setting logic when needed
>
> Mauro Carvalho Chehab <m.chehab@samsung.com>
> media: xc4000: Fix get_frequency()
>
> Mauro Carvalho Chehab <m.chehab@samsung.com>
> media: xc5000: Fix get_frequency()
>
> Jan Kara <jack@suse.cz>
> reiserfs: Fix use after free in journal teardown
>
> Jeff Mahoney <jeffm@suse.com>
> reiserfs: fix corruption introduced by balance_leaf refactor
>
>
> -------------
>
> Diffstat:
>
> .../devicetree/bindings/sound/adi,axi-spdif-tx.txt | 2 +-
> Makefile | 4 +-
> arch/arm/boot/dts/omap3-n900.dts | 2 +-
> arch/mips/cavium-octeon/setup.c | 18 +-
> arch/mips/include/asm/eva.h | 43 ++++
> .../include/asm/mach-malta/kernel-entry-init.h | 22 +-
> arch/mips/include/asm/ptrace.h | 2 +-
> arch/mips/include/asm/reg.h | 260 +++++++++++++--------
> arch/mips/include/asm/syscall.h | 8 +-
> arch/mips/kernel/binfmt_elfo32.c | 32 ++-
> arch/mips/kernel/cps-vec.S | 4 +
> arch/mips/kernel/irq-gic.c | 6 +-
> arch/mips/kernel/ptrace.c | 196 +++++++++++++---
> arch/mips/kernel/ptrace32.c | 2 +-
> arch/mips/kernel/scall64-o32.S | 12 +-
> arch/mips/kernel/smp-mt.c | 2 +
> arch/mips/kernel/unaligned.c | 1 -
> arch/mips/mm/tlbex.c | 1 +
> arch/mips/mti-malta/malta-memory.c | 14 +-
> arch/powerpc/include/asm/machdep.h | 6 +-
> arch/powerpc/include/asm/pgtable-ppc64.h | 2 +-
> arch/powerpc/include/asm/pte-hash64-64k.h | 30 ++-
> arch/powerpc/kernel/iommu.c | 38 +--
> arch/powerpc/mm/hash_native_64.c | 40 +---
> arch/powerpc/mm/hugepage-hash64.c | 88 ++++++-
> arch/powerpc/mm/numa.c | 2 +-
> arch/powerpc/mm/pgtable_64.c | 38 +--
> arch/powerpc/mm/tlb_hash64.c | 2 +-
> arch/powerpc/platforms/powernv/pci-ioda.c | 2 +-
> arch/powerpc/platforms/pseries/hotplug-memory.c | 2 +-
> arch/powerpc/platforms/pseries/iommu.c | 20 +-
> arch/powerpc/platforms/pseries/lpar.c | 20 +-
> arch/s390/Kconfig | 1 +
> arch/sh/include/asm/io_noioport.h | 11 +
> block/blk-cgroup.c | 7 +
> block/scsi_ioctl.c | 9 +-
> drivers/acpi/acpica/nsobject.c | 11 +
> drivers/acpi/acpica/utcopy.c | 6 +
> drivers/acpi/ec.c | 21 +-
> drivers/acpi/processor_idle.c | 4 +-
> drivers/acpi/scan.c | 35 +--
> drivers/acpi/video.c | 45 +++-
> drivers/block/rbd.c | 196 ++++++++++------
> drivers/bluetooth/btmrvl_drv.h | 1 +
> drivers/bluetooth/btmrvl_main.c | 25 +-
> drivers/char/tpm/tpm-interface.c | 73 ++++--
> drivers/char/tpm/tpm_tis.c | 31 +++
> drivers/cpufreq/powernv-cpufreq.c | 18 +-
> drivers/cpuidle/cpuidle-powernv.c | 16 +-
> drivers/firmware/efi/vars.c | 8 +-
> drivers/gpu/drm/nouveau/nouveau_display.c | 11 +
> drivers/gpu/drm/nouveau/nouveau_drm.h | 4 +-
> drivers/gpu/drm/radeon/cik.c | 13 +-
> drivers/infiniband/core/iwcm.c | 27 +++
> drivers/infiniband/ulp/srp/ib_srp.c | 38 ++-
> drivers/iommu/amd_iommu.c | 10 +-
> drivers/iommu/intel-iommu.c | 57 ++++-
> drivers/md/dm-table.c | 13 ++
> drivers/md/raid1.c | 8 +-
> drivers/md/raid10.c | 14 +-
> drivers/md/raid5.c | 4 +-
> drivers/media/common/siano/Kconfig | 3 +-
> drivers/media/i2c/mt9v032.c | 4 +-
> drivers/media/media-device.c | 2 -
> drivers/media/platform/vsp1/vsp1_video.c | 2 -
> drivers/media/platform/vsp1/vsp1_video.h | 1 -
> drivers/media/tuners/xc4000.c | 20 +-
> drivers/media/tuners/xc5000.c | 22 +-
> drivers/media/usb/au0828/au0828-video.c | 34 +--
> drivers/media/v4l2-core/videobuf2-core.c | 4 +-
> drivers/mfd/omap-usb-host.c | 2 +-
> drivers/mfd/rtsx_usb.c | 1 +
> drivers/mfd/twl4030-power.c | 20 +-
> drivers/mtd/ftl.c | 1 -
> drivers/mtd/nand/omap2.c | 2 +-
> drivers/power/bq2415x_charger.c | 8 +-
> drivers/regulator/arizona-ldo1.c | 2 -
> drivers/regulator/tps65218-regulator.c | 2 +-
> drivers/scsi/bfa/bfa_ioc.h | 2 +-
> drivers/scsi/scsi.c | 16 +-
> drivers/scsi/scsi_devinfo.c | 1 +
> drivers/scsi/scsi_scan.c | 16 +-
> drivers/scsi/scsi_transport_srp.c | 3 +-
> drivers/scsi/sd.c | 5 +
> drivers/scsi/storvsc_drv.c | 113 ++++++---
> drivers/spi/spi-omap2-mcspi.c | 14 ++
> drivers/spi/spi-orion.c | 10 +-
> drivers/spi/spi-pxa2xx.c | 1 +
> drivers/xen/events/events_fifo.c | 48 ++--
> fs/cifs/cifsglob.h | 7 +-
> fs/cifs/file.c | 6 +-
> fs/cifs/inode.c | 11 +-
> fs/cifs/readdir.c | 6 +-
> fs/cifs/smb1ops.c | 7 +
> fs/cifs/smb2file.c | 2 +-
> fs/cifs/smb2inode.c | 2 +-
> fs/cifs/smb2maperror.c | 4 +-
> fs/cifs/smb2ops.c | 11 +-
> fs/cifs/smb2pdu.c | 14 +-
> fs/dcache.c | 3 +-
> fs/namei.c | 4 +-
> fs/namespace.c | 100 ++++++--
> fs/notify/fanotify/fanotify.c | 9 +-
> fs/notify/fanotify/fanotify_user.c | 12 +
> fs/notify/notification.c | 18 +-
> fs/ocfs2/ioctl.c | 129 ++++------
> fs/pnode.c | 1 +
> fs/proc/array.c | 11 +-
> fs/reiserfs/do_balan.c | 111 +++++----
> fs/reiserfs/journal.c | 22 +-
> fs/reiserfs/lbalance.c | 5 +-
> fs/reiserfs/reiserfs.h | 9 +-
> fs/reiserfs/super.c | 6 +-
> fs/xfs/xfs_aops.c | 61 +++++
> fs/xfs/xfs_dquot.c | 3 +-
> fs/xfs/xfs_file.c | 21 +-
> fs/xfs/xfs_log_recover.c | 51 ++--
> fs/xfs/xfs_qm.c | 8 +-
> include/acpi/acpi_bus.h | 1 -
> include/linux/capability.h | 5 +-
> include/linux/fsnotify_backend.h | 2 +
> include/linux/mount.h | 9 +-
> include/linux/tpm.h | 3 +
> include/scsi/scsi_device.h | 1 +
> include/scsi/scsi_devinfo.h | 5 +
> include/uapi/rdma/rdma_user_cm.h | 1 +
> kernel/audit.c | 2 +-
> kernel/capability.c | 4 +
> kernel/smp.c | 2 +-
> kernel/trace/ring_buffer.c | 31 ++-
> lib/assoc_array.c | 6 +-
> mm/filemap.c | 2 +-
> mm/hugetlb.c | 3 +
> net/bluetooth/hci_event.c | 23 +-
> net/bluetooth/l2cap_sock.c | 3 +-
> net/bluetooth/rfcomm/core.c | 7 +-
> net/bluetooth/rfcomm/sock.c | 3 +-
> net/bluetooth/sco.c | 6 +-
> net/ceph/auth_x.c | 256 ++++++++++----------
> net/ceph/messenger.c | 2 +-
> net/ceph/mon_client.c | 8 +
> security/commoncap.c | 3 +
> sound/soc/blackfin/bf5xx-i2s-pcm.c | 8 +-
> sound/soc/codecs/adau1701.c | 6 +-
> sound/soc/codecs/max98090.c | 2 +-
> sound/soc/codecs/rt5640.c | 1 +
> sound/soc/codecs/tlv320aic31xx.c | 9 +-
> sound/soc/codecs/wm8994.c | 9 +-
> sound/soc/codecs/wm_adsp.c | 2 +
> sound/soc/intel/sst-baytrail-pcm.c | 2 +-
> sound/soc/intel/sst-haswell-pcm.c | 27 ++-
> sound/soc/omap/omap-twl4030.c | 2 +-
> sound/soc/pxa/pxa-ssp.c | 7 +-
> sound/soc/samsung/i2s.c | 16 +-
> sound/soc/soc-pcm.c | 1 +
> tools/testing/selftests/Makefile | 1 +
> tools/testing/selftests/mount/Makefile | 17 ++
> .../selftests/mount/unprivileged-remount-test.c | 242 +++++++++++++++++++
> 158 files changed, 2370 insertions(+), 1021 deletions(-)
>
>
^ permalink raw reply [flat|nested] 161+ messages in thread* Re: [PATCH 3.16 000/158] 3.16.3-stable review
2014-09-16 22:58 ` Satoru Takeuchi
(?)
@ 2014-09-16 23:11 ` Greg Kroah-Hartman
-1 siblings, 0 replies; 161+ messages in thread
From: Greg Kroah-Hartman @ 2014-09-16 23:11 UTC (permalink / raw)
To: Satoru Takeuchi; +Cc: linux-kernel, torvalds, akpm, linux, shuah.kh, stable
On Wed, Sep 17, 2014 at 07:58:26AM +0900, Satoru Takeuchi wrote:
> At Mon, 15 Sep 2014 12:23:59 -0700,
> Greg Kroah-Hartman wrote:
> >
> > This is the start of the stable review cycle for the 3.16.3 release.
> > There are 158 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed Sep 17 19:25:26 UTC 2014.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.16.3-rc1.gz
> > and the diffstat can be found below.
>
> All 3.10.55-rc1, 3.14.19-rc1, and 3.6.3-rc1 passed my test.
>
> - Test Cases:
> - Build this kernel.
> - Boot this kernel.
> - Build the latest mainline kernel with this kernel.
>
> - Test Tool:
> https://github.com/satoru-takeuchi/test-linux-stable
>
> - Test Result (kernel .config, ktest config and test log):
> http://satoru-takeuchi.org/test-linux-stable/results/<version>-<test datetime>.tar.xz
>
> - Build Environment:
> - OS: Debian Jessy x86_64
> - CPU: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz x 4
> - memory: 8GB
>
> - Test Target Environment:
> - Debian Jessy x86_64 (KVM guest on the Build Environment)
> - # of vCPU: 2
> - memory: 2GB
Thanks for testing and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 161+ messages in thread