Paul Bolle [Fri, 29 Mar 2013 11:02:14 +0000 (11:02 +0000)]
powerpc: Fix typo "CONFIG_ICSWX_PID"
Untested. As this typo was introduced in v3.3, with commit
9d670280908013004f173b2b86414d9b6918511b ("powerpc: Split ICSWX ACOP and
PID processing"), which actually added PPC_ICSWX_PID, this surely needs
testing.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Paul Bolle [Wed, 20 Mar 2013 23:27:56 +0000 (23:27 +0000)]
memblock: kill "config MAX_ACTIVE_REGIONS"
The Kconfig symbol MAX_ACTIVE_REGIONS is unused. Commit
0ee332c1451869963626bf9cac88f165a90990e1 ("memblock: Kill
early_node_map[]") removed the only place were it was actually used. But
it did not remove its Kconfig entries (for powerpc and sh).
Remove those two entries (and the entry for metag, that popped up in
v3.9-rc1).
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Acked-by: Paul Mundt <lethal@linux-sh.org>
Acked-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Paul Bolle [Wed, 27 Mar 2013 00:47:03 +0000 (00:47 +0000)]
powerpc: remove PReP platform
PPC_PREP is marked as BROKEN since v2.6.15. Remove all PReP specific
code now.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Paul Bolle [Mon, 25 Mar 2013 00:32:11 +0000 (00:32 +0000)]
powerpc: remove dead CONFIG_HVC_SCOM code
Commit
c1fb6816fb1b78dd94b673b0fdaa9a7a16e97bd1 ("powerpc: Add
relocation on exception vector handlers") added two lines of code that
depend on the macro CONFIG_HVC_SCOM. That macro doesn't exist. Perhaps
it was intended to use CONFIG_PPC_SCOM here. But since
"maintence_interrupt" is a typo and there's nothing in arch/powerpc that
looks like maintenance_interrupt it seems best to just delete these
lines.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Acked-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Paul Bolle [Thu, 14 Mar 2013 03:47:50 +0000 (03:47 +0000)]
powerpc/40x: remove unused "config 405GPR"
The last user of Kconfig symbol 405GPR got removed in release v3.2.
Remove this symbol too.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Acked-by: Josh Boyer <jwboyer@gmail.com>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Paul Bolle [Mon, 11 Mar 2013 14:21:50 +0000 (14:21 +0000)]
powerpc: remove outdated default on PCI_PERMEDIA
The Kconfig symbol PCI_PERMEDIA got removed in v2.6.24, through commit
e6b6e3ffb9ee8926f9f2f7dc9147df73e27d5828 ("[POWERPC] Remove APUS support
from arch/ppc"). Remove its last occurrence.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Paul Bolle [Thu, 7 Mar 2013 12:15:59 +0000 (12:15 +0000)]
powerpc/wsp: drop "select PPC_WSP_COPRO"
There is no Kconfig symbol PPC_WSP_COPRO. The select statement for it is
a nop. Drop it.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Geoff Levand [Mon, 18 Mar 2013 15:11:43 +0000 (15:11 +0000)]
powerpc/ps3: Update ps3_defconfig
Refresh and set CONFIG_RD_LZMA=y.
Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Wei Yongjun [Mon, 11 Mar 2013 04:24:18 +0000 (04:24 +0000)]
powerpc: use for_each_compatible_node() macro
Use for_each_compatible_node() macro instead of open coding it.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Valentina Manea [Sun, 10 Mar 2013 03:22:39 +0000 (03:22 +0000)]
powerpc: place EXPORT_SYMBOL macro right after declaration
This fixes the following checkpatch.pl warnings:
WARNING: EXPORT_SYMBOL(foo); should immediately follow its function/variable
+EXPORT_SYMBOL(kmap_prot);
WARNING: EXPORT_SYMBOL(foo); should immediately follow its function/variable
+EXPORT_SYMBOL(kmap_pte);
Signed-off-by: Valentina Manea <valentina.manea.m@gmail.com>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Adrian-Leonard Radu [Sun, 10 Mar 2013 03:07:00 +0000 (03:07 +0000)]
powerpc: Use PTR_RET instead of IS_ERR/PTR_ERR
Signed-off-by: Adrian-Leonard Radu <ady8radu@gmail.com>
Acked-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Gavin Shan [Fri, 8 Mar 2013 01:47:58 +0000 (01:47 +0000)]
powerpc/kernel: Cleanup on rtas_pci.c
It's minor cleanup so that the function names comply with the
coding style.
Signed-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Michael Ellerman [Thu, 21 Feb 2013 17:25:41 +0000 (17:25 +0000)]
powerpc: Remove unused postfix parameter to DEFINE_BITOP()
None of the users of DEFINE_BITOP pass a postfix, and as far as I can
tell none ever did, so drop it.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Vasant Hegde [Fri, 8 Feb 2013 01:18:36 +0000 (01:18 +0000)]
powerpc/rtas_flash: Free kmem upon module exit
Memory allocated to rtas_firmware_flash_list in rtas_flash_write
is not freed during module exit. We hit below call trace if we
unload rtas_flash module after loading new firmware image and
before rebooting the system.
Call trace:
----------
Feb 6 08:42:10 eagle3 kernel: kmem_cache_destroy rtas_flash_cache: Slab cache still has objects
Feb 6 08:42:10 eagle3 kernel: Call Trace:
Feb 6 08:42:10 eagle3 kernel: [
c00000001c303b40] [
c000000000014940] .show_stack+0x70/0x1c0 (unreliable)
Feb 6 08:42:10 eagle3 kernel: [
c00000001c303bf0] [
c000000000199bec] .kmem_cache_destroy+0x15c/0x170
Feb 6 08:42:10 eagle3 kernel: [
c00000001c303c90] [
d000000006fa1208] .rtas_flash_cleanup+0x3c/0x80 [rtas_flash]
Feb 6 08:42:10 eagle3 kernel: [
c00000001c303d20] [
c0000000000f8970] .SyS_delete_module+0x1d0/0x2e0
Feb 6 08:42:10 eagle3 kernel: [
c00000001c303e30] [
c000000000009954] syscall_exit+0x0/0x94
This patch frees rtas_firmware_flash_list during module exit.
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Li Zhong [Thu, 24 Jan 2013 22:12:21 +0000 (22:12 +0000)]
powerpc: Use VPA subfunction macros instead of numbers for vpa calls
Use macros in vpa calls.
Signed-off-by: Li Zhong <zhong@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Linus Torvalds [Mon, 15 Apr 2013 00:45:16 +0000 (17:45 -0700)]
Linux 3.9-rc7
Linus Torvalds [Sun, 14 Apr 2013 18:13:24 +0000 (11:13 -0700)]
Merge branch 'x86-urgent-for-linus' of git://git./linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
"Misc fixes"
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/mm: Flush lazy MMU when DEBUG_PAGEALLOC is set
x86/mm/cpa/selftest: Fix false positive in CPA self test
x86/mm/cpa: Convert noop to functional fix
x86, mm: Patch out arch_flush_lazy_mmu_mode() when running on bare metal
x86, mm, paravirt: Fix vmalloc_fault oops during lazy MMU updates
Linus Torvalds [Sun, 14 Apr 2013 18:12:17 +0000 (11:12 -0700)]
Merge branch 'sched-urgent-for-linus' of git://git./linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
"Misc fixlets"
* 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/cputime: Fix accounting on multi-threaded processes
sched/debug: Fix sd->*_idx limit range avoiding overflow
sched_clock: Prevent 64bit inatomicity on 32bit systems
sched: Convert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s
Linus Torvalds [Sun, 14 Apr 2013 18:10:44 +0000 (11:10 -0700)]
Merge branch 'perf-urgent-for-linus' of git://git./linux/kernel/git/tip/tip
Pull perf fixes from Ingo Molnar:
"Misc fixlets"
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Fix error return code
ftrace: Fix strncpy() use, use strlcpy() instead of strncpy()
perf: Fix strncpy() use, use strlcpy() instead of strncpy()
perf: Fix strncpy() use, always make sure it's NUL terminated
perf: Fix ring_buffer perf_output_space() boundary calculation
perf/x86: Fix uninitialized pt_regs in intel_pmu_drain_bts_buffer()
Linus Torvalds [Sun, 14 Apr 2013 17:55:20 +0000 (10:55 -0700)]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
"One fix for a hotplug locking regressions, and one fix for an oops if
you unplug the monitor at an inopportune moment on the udl device."
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/fb-helper: Fix locking in drm_fb_helper_hotplug_event
udl: handle EDID failure properly.
Linus Torvalds [Sun, 14 Apr 2013 17:54:40 +0000 (10:54 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/gerg/m68knommu
Pull m68knommu fix from Greg Ungerer:
"This contains only a single compilation fix for ColdFire m68k targets
that use local non-GPIOLIB support."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
m68k: define a local gpio_request_one() function
Linus Torvalds [Sun, 14 Apr 2013 17:53:54 +0000 (10:53 -0700)]
Merge git://www.linux-watchdog.org/linux-watchdog
Pull watchdog fix from Wim Van Sebroeck:
"It will fix compile errors for the at91rm9200_wdt driver"
* git://www.linux-watchdog.org/linux-watchdog:
watchdog: Revert the AT91RM9200_WATCHDOG dependency
Linus Torvalds [Sun, 14 Apr 2013 17:52:54 +0000 (10:52 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/mason/linux-btrfs
Pull one more btrfs fix from Chris Mason:
"This has a recent fix from Josef for our tree log replay code. It
fixes problems where the inode counter for the number of bytes in the
file wasn't getting updated properly during fsync replay.
The commit did get rebased this morning, but it was only to clean up
the subject line. The code hasn't changed."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
Btrfs: make sure nbytes are right after log replay
Linus Torvalds [Sun, 14 Apr 2013 17:50:55 +0000 (10:50 -0700)]
Merge tag 'trace-fixes-v3.9-rc-v3' of git://git./linux/kernel/git/rostedt/linux-trace
Pull ftrace fixes from Steven Rostedt:
"Namhyung Kim found and fixed a bug that can crash the kernel by simply
doing: echo 1234 | tee -a /sys/kernel/debug/tracing/set_ftrace_pid
Luckily, this can only be done by root, but still is a nasty bug."
* tag 'trace-fixes-v3.9-rc-v3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
ftrace: Move ftrace_filter_lseek out of CONFIG_DYNAMIC_FTRACE section
tracing: Fix possible NULL pointer dereferences
Linus Torvalds [Sun, 14 Apr 2013 17:06:31 +0000 (10:06 -0700)]
Add file_ns_capable() helper function for open-time capability checking
Nothing is using it yet, but this will allow us to delay the open-time
checks to use time, without breaking the normal UNIX permission
semantics where permissions are determined by the opener (and the file
descriptor can then be passed to a different process, or the process can
drop capabilities).
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Nicolas Ferre [Wed, 10 Apr 2013 12:36:22 +0000 (14:36 +0200)]
watchdog: Revert the AT91RM9200_WATCHDOG dependency
Compiling the at91rm9200_wdt.c driver without at91rm9200
support was leading to several errors:
drivers/built-in.o: In function `at91_wdt_close':
at91_adc.c:(.text+0xc9fe4): undefined reference to `at91_st_base'
drivers/built-in.o: In function `at91_wdt_write':
at91_adc.c:(.text+0xca004): undefined reference to `at91_st_base'
drivers/built-in.o: In function `at91wdt_shutdown':
at91_adc.c:(.text+0xca01c): undefined reference to `at91_st_base'
drivers/built-in.o: In function `at91wdt_suspend':
at91_adc.c:(.text+0xca038): undefined reference to `at91_st_base'
drivers/built-in.o: In function `at91_wdt_open':
at91_adc.c:(.text+0xca0cc): undefined reference to `at91_st_base'
drivers/built-in.o:at91_adc.c:(.text+0xca2c8): more undefined references to
`at91_st_base' follow
So, reverting the modification of the "depends" Kconfig line
introduced by patch
a6a1bcd37 (watchdog: at91rm9200: add DT support)
seems to be the good solution.
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Suleiman Souhlal [Sat, 13 Apr 2013 23:03:06 +0000 (16:03 -0700)]
vfs: Revert spurious fix to spinning prevention in prune_icache_sb
Revert commit
62a3ddef6181 ("vfs: fix spinning prevention in prune_icache_sb").
This commit doesn't look right: since we are looking at the tail of the
list (sb->s_inode_lru.prev) if we want to skip an inode, we should put
it back at the head of the list instead of the tail, otherwise we will
keep spinning on it.
Discovered when investigating why prune_icache_sb came top in perf
reports of a swapping load.
Signed-off-by: Suleiman Souhlal <suleiman@google.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: stable@vger.kernel.org # v3.2+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sat, 13 Apr 2013 22:15:30 +0000 (15:15 -0700)]
kobject: fix kset_find_obj() race with concurrent last kobject_put()
Anatol Pomozov identified a race condition that hits module unloading
and re-loading. To quote Anatol:
"This is a race codition that exists between kset_find_obj() and
kobject_put(). kset_find_obj() might return kobject that has refcount
equal to 0 if this kobject is freeing by kobject_put() in other
thread.
Here is timeline for the crash in case if kset_find_obj() searches for
an object tht nobody holds and other thread is doing kobject_put() on
the same kobject:
THREAD A (calls kset_find_obj()) THREAD B (calls kobject_put())
splin_lock()
atomic_dec_return(kobj->kref), counter gets zero here
... starts kobject cleanup ....
spin_lock() // WAIT thread A in kobj_kset_leave()
iterate over kset->list
atomic_inc(kobj->kref) (counter becomes 1)
spin_unlock()
spin_lock() // taken
// it does not know that thread A increased counter so it
remove obj from list
spin_unlock()
vfree(module) // frees module object with containing kobj
// kobj points to freed memory area!!
kobject_put(kobj) // OOPS!!!!
The race above happens because module.c tries to use kset_find_obj()
when somebody unloads module. The module.c code was introduced in
commit
6494a93d55fa"
Anatol supplied a patch specific for module.c that worked around the
problem by simply not using kset_find_obj() at all, but rather than make
a local band-aid, this just fixes kset_find_obj() to be thread-safe
using the proper model of refusing the get a new reference if the
refcount has already dropped to zero.
See examples of this proper refcount handling not only in the kref
documentation, but in various other equivalent uses of this pattern by
grepping for atomic_inc_not_zero().
[ Side note: the module race does indicate that module loading and
unloading is not properly serialized wrt sysfs information using the
module mutex. That may require further thought, but this is the
correct fix at the kobject layer regardless. ]
Reported-analyzed-and-tested-by: Anatol Pomozov <anatol.pomozov@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Josef Bacik [Fri, 5 Apr 2013 20:50:09 +0000 (20:50 +0000)]
Btrfs: make sure nbytes are right after log replay
While trying to track down a tree log replay bug I noticed that fsck was always
complaining about nbytes not being right for our fsynced file. That is because
the new fsync stuff doesn't wait for ordered extents to complete, so the inodes
nbytes are not necessarily updated properly when we log it. So to fix this we
need to set nbytes to whatever it is on the inode that is on disk, so when we
replay the extents we can just add the bytes that are being added as we replay
the extent. This makes it work for the case that we have the wrong nbytes or
the case that we logged everything and nbytes is actually correct. With this
I'm no longer getting nbytes errors out of btrfsck.
Cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <jbacik@fusionio.com>
Signed-off-by: Chris Mason <chris.mason@fusionio.com>
Dave Hansen [Fri, 12 Apr 2013 23:23:54 +0000 (16:23 -0700)]
x86-32: Fix possible incomplete TLB invalidate with PAE pagetables
This patch attempts to fix:
https://bugzilla.kernel.org/show_bug.cgi?id=56461
The symptom is a crash and messages like this:
chrome: Corrupted page table at address
34a03000
*pdpt =
0000000000000000 *pde =
0000000000000000
Bad pagetable: 000f [#1] PREEMPT SMP
Ingo guesses this got introduced by commit
611ae8e3f520 ("x86/tlb:
enable tlb flush range support for x86") since that code started to free
unused pagetables.
On x86-32 PAE kernels, that new code has the potential to free an entire
PMD page and will clear one of the four page-directory-pointer-table
(aka pgd_t entries).
The hardware aggressively "caches" these top-level entries and invlpg
does not actually affect the CPU's copy. If we clear one we *HAVE* to
do a full TLB flush, otherwise we might continue using a freed pmd page.
(note, we do this properly on the population side in pud_populate()).
This patch tracks whenever we clear one of these entries in the 'struct
mmu_gather', and ensures that we follow up with a full tlb flush.
BTW, I disassembled and checked that:
if (tlb->fullmm == 0)
and
if (!tlb->fullmm && !tlb->need_flush_all)
generate essentially the same code, so there should be zero impact there
to the !PAE case.
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Peter Anvin <hpa@zytor.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Artem S Tashkinov <t.artem@mailcity.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Fri, 12 Apr 2013 22:26:42 +0000 (15:26 -0700)]
Merge git://git./linux/kernel/git/nab/target-pending
Pull SCSI target fixes from Nicholas Bellinger:
"Here are remaining target-pending items for v3.9-rc7 code.
The tcm_vhost patches are more than I'd usually include in a -rc7
pull, but are changes required for v3.9 to work correctly with the
pending vhost-scsi-pci QEMU upstream series merge. (Paolo CC'ed)
Plus Asias's conversion to use vhost_virtqueue->private_data + RCU for
managing vhost-scsi endpoints has gotten alot of review + testing over
the past weeks, and MST has ACKed the full series.
Also, there is a target patch to fix a long-standing bug within
control CDB handling with Standby/Offline/Transition ALUA port access
states, that had been incorrectly rejecting the control CDBs required
for LUN scan to work during these port group states. CC'ing to
stable."
* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
target: Fix incorrect fallthrough of ALUA Standby/Offline/Transition CDBs
tcm_vhost: Send bad target to guest when cmd fails
tcm_vhost: Add vhost_scsi_send_bad_target() helper
tcm_vhost: Fix tv_cmd leak in vhost_scsi_handle_vq
tcm_vhost: Remove double check of response
tcm_vhost: Initialize vq->last_used_idx when set endpoint
tcm_vhost: Use vq->private_data to indicate if the endpoint is setup
tcm_vhost: Use ACCESS_ONCE for vs->vs_tpg[target] access
Linus Torvalds [Fri, 12 Apr 2013 22:18:56 +0000 (15:18 -0700)]
Merge tag 'scsi-fixes' of git://git./linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"This is a set of ten bug fixes (and two consisting of copyright year
update and version number change) pretty much all of which involve
either a crash or a hang except the removal of the random sleep from
the qla2xxx driver (which is a coding error so bad, we want it gone
before anyone has a chance to copy it)."
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
[SCSI] lpfc: fix potential NULL pointer dereference in lpfc_sli4_rq_put()
[SCSI] libsas: fix handling vacant phy in sas_set_ex_phy()
[SCSI] ibmvscsi: Fix slave_configure deadlock
[SCSI] qla2xxx: Update the driver version to 8.04.00.13-k.
[SCSI] qla2xxx: Remove debug code that msleeps for random duration.
[SCSI] qla2xxx: Update copyright dates information in LICENSE.qla2xxx file.
[SCSI] qla2xxx: Fix crash during firmware dump procedure.
[SCSI] Revert "qla2xxx: Add setting of driver version string for vendor application."
[SCSI] ipr: dlpar failed when adding an adapter back
[SCSI] ipr: fix addition of abort command to HRRQ free queue
[SCSI] st: Take additional queue ref in st_probe
[SCSI] libsas: use right function to alloc smp response
[SCSI] ipr: ipr_test_msi() fails when running with msi-x enabled adapter
Linus Torvalds [Fri, 12 Apr 2013 22:18:20 +0000 (15:18 -0700)]
Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6
Pull CIFS fix from Steve French:
"Fixes a regression in cifs in which a password which begins with a
comma is parsed incorrectly as a blank password"
* 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
cifs: Allow passwords which begin with a delimitor
Steven Rostedt (Red Hat) [Fri, 12 Apr 2013 20:40:13 +0000 (16:40 -0400)]
ftrace: Move ftrace_filter_lseek out of CONFIG_DYNAMIC_FTRACE section
As ftrace_filter_lseek is now used with ftrace_pid_fops, it needs to
be moved out of the #ifdef CONFIG_DYNAMIC_FTRACE section as the
ftrace_pid_fops is defined when DYNAMIC_FTRACE is not.
Cc: stable@vger.kernel.org
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Namhyung Kim [Thu, 11 Apr 2013 06:55:01 +0000 (15:55 +0900)]
tracing: Fix possible NULL pointer dereferences
Currently set_ftrace_pid and set_graph_function files use seq_lseek
for their fops. However seq_open() is called only for FMODE_READ in
the fops->open() so that if an user tries to seek one of those file
when she open it for writing, it sees NULL seq_file and then panic.
It can be easily reproduced with following command:
$ cd /sys/kernel/debug/tracing
$ echo 1234 | sudo tee -a set_ftrace_pid
In this example, GNU coreutils' tee opens the file with fopen(, "a")
and then the fopen() internally calls lseek().
Link: http://lkml.kernel.org/r/1365663302-2170-1-git-send-email-namhyung@kernel.org
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Namhyung Kim <namhyung.kim@lge.com>
Cc: stable@vger.kernel.org
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Linus Torvalds [Fri, 12 Apr 2013 14:45:17 +0000 (07:45 -0700)]
Merge tag 'sound-3.9' of git://git./linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"This contains a few small ASoC fixes (wm8903, wm5102, samsung-i2s,
tegra, and soc-compress) and an endian fix for NI USB-audio devices,
update for Mark's e-mail address.
No scary changes, AFAIS."
* tag 'sound-3.9' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
MAINTAINERS: Update e-mail address
ASoC: wm5102: Correct lookup of arizona struct in SYSCLK event
ASoC: wm8903: Fix the bypass to HP/LINEOUT when no DAC or ADC is running
ALSA: usb-audio: fix endianness bug in snd_nativeinstruments_*
ASoC: tegra: Don't claim to support PCM pause and resume
ASoC: Samsung: set drvdata before adding secondary device
ASoC: Samsung: return error if drvdata is not set
ASoC: compress: Cancel delayed power down if needed
ASoC: core: Fix to check return value of snd_soc_update_bits_locked()
Takashi Iwai [Fri, 12 Apr 2013 11:53:35 +0000 (13:53 +0200)]
Merge tag 'asoc-maintainers-v3.9-rc6' of git://git./linux/kernel/git/broonie/sound into for-linus
MAINTAINERS: Update e-mail address
Update the e-mail address I use for subsystems.
Mark Brown [Fri, 12 Apr 2013 10:39:57 +0000 (11:39 +0100)]
MAINTAINERS: Update e-mail address
Update the e-mail address I use for subsystems.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Takashi Iwai [Fri, 12 Apr 2013 08:27:39 +0000 (10:27 +0200)]
Merge tag 'asoc-v3.9-rc6' of git://git./linux/kernel/git/broonie/sound into for-linus
ASoC: Updates for v3.9
A few updates, more than I'd like, fixing some relatively small issues
but mostly driver specific ones. Nothing wildly exciting so if it
doesn't make v3.9 it won't be the end of the world but it'd be nice.
Boris Ostrovsky [Thu, 11 Apr 2013 17:59:52 +0000 (13:59 -0400)]
x86/mm: Flush lazy MMU when DEBUG_PAGEALLOC is set
When CONFIG_DEBUG_PAGEALLOC is set page table updates made by
kernel_map_pages() are not made visible (via TLB flush)
immediately if lazy MMU is on. In environments that support lazy
MMU (e.g. Xen) this may lead to fatal page faults, for example,
when zap_pte_range() needs to allocate pages in
__tlb_remove_page() -> tlb_next_batch().
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: konrad.wilk@oracle.com
Link: http://lkml.kernel.org/r/1365703192-2089-1-git-send-email-boris.ostrovsky@oracle.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Andrea Arcangeli [Thu, 11 Apr 2013 13:36:09 +0000 (15:36 +0200)]
x86/mm/cpa/selftest: Fix false positive in CPA self test
If the pmd is not present, _PAGE_PSE will not be set anymore.
Fix the false positive.
Reported-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: Stefan Bader <stefan.bader@canonical.com>
Cc: Andy Whitcroft <apw@canonical.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Borislav Petkov <bp@alien8.de>
Link: http://lkml.kernel.org/r/1365687369-30802-1-git-send-email-aarcange@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Wei Yongjun [Fri, 12 Apr 2013 03:05:54 +0000 (11:05 +0800)]
perf: Fix error return code
Fix to return -ENOMEM in the allocation error case instead of 0
(if pmu_bus_running == 1), as done elsewhere in this function.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Cc: a.p.zijlstra@chello.nl
Cc: paulus@samba.org
Cc: acme@ghostprotocols.net
Link: http://lkml.kernel.org/r/CAPgLHd8j_fWcgqe%3DKLWjpBj%2B%3Do0Pw6Z-SEq%3DNTPU08c2w1tngQ@mail.gmail.com
[ Tweaked the error code setting placement and the changelog. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Daniel Vetter [Thu, 11 Apr 2013 14:26:55 +0000 (14:26 +0000)]
drm/fb-helper: Fix locking in drm_fb_helper_hotplug_event
Driver's and ->fill_modes functions are allowed to grab crtc mutexes
(for e.g. load detect). Hence we need to first only grab the general
kms mutex, and only in a second step grab all locks to do the
modesets.
This prevents a deadlock on my gm45 in the tv load detect code called
by drm_helper_probe_single_connector_modes.
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Dave Airlie [Fri, 12 Apr 2013 03:25:20 +0000 (13:25 +1000)]
udl: handle EDID failure properly.
Don't oops seems proper.
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Linus Torvalds [Fri, 12 Apr 2013 03:35:11 +0000 (20:35 -0700)]
Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma
Pull slave-dmaengine fixes from Vinod Koul:
"The first one fixes issue in pl330 to check for DT compatible and
the second one fixes omap-dma to start without delay"
* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
dmaengine: omap-dma: Start DMA without delay for cyclic channels
DMA: PL330: Add check if device tree compatible
Linus Torvalds [Fri, 12 Apr 2013 03:33:38 +0000 (20:33 -0700)]
Merge tag 'pm-3.9-rc7' of git://git./linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
- System reboot/halt fix related to CPU offline ordering from Huacai
Chen.
- intel_pstate driver fix for a delay time computation error
occasionally crashing systems using it from Dirk Brandewie.
* tag 'pm-3.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
PM / reboot: call syscore_shutdown() after disable_nonboot_cpus()
cpufreq / intel_pstate: Set timer timeout correctly
Linus Torvalds [Fri, 12 Apr 2013 01:22:20 +0000 (18:22 -0700)]
Merge tag 'regmap-v3.9-rc6' of git://git./linux/kernel/git/broonie/regmap
Pull regmap revert from Mark Brown:
"regmap: Back out work buffer fix
This reverts commit bc8ce4 (regmap: don't corrupt work buffer in
_regmap_raw_write()) since it turns out that it can cause issues when
taken in isolation from the other changes in -next that lead to its
discovery. On the basis that nobody noticed the problems for quite
some time without that subsequent work let's drop it from v3.9."
* tag 'regmap-v3.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: Back out work buffer fix
Linus Torvalds [Fri, 12 Apr 2013 01:21:45 +0000 (18:21 -0700)]
Merge tag 'gpio-fixes-v3.9-rc6' of git://git./linux/kernel/git/linusw/linux-gpio
Pull GPIO fix from Linus Walleij:
"Oneliner fix for the PCA 953x driver."
* tag 'gpio-fixes-v3.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
gpio: pca953x: fix irq_domain_add_simple usage
Linus Torvalds [Fri, 12 Apr 2013 01:20:31 +0000 (18:20 -0700)]
Merge tag 'arm-soc-fixes' of git://git./linux/kernel/git/arm/arm-soc
Pull ARM SoC bug fixes from Arnd Bergmann:
"A little later during the week than the last few pull requests, since
there was very little that came in before 3.9-rc6. At least things
have calmed down again here.
Some important bug fixes that came in over the last 10 days, mostly
mvebu and imx:
- Multiple regressions on i.mx following the conversion of the clock
code, hopefully the last we are seeing of those.
- a regression in the mvebu irq handling code
- An incorrect register offset in the rewritten s3c24xx irq code.
- Two bugs in setting up the iomega_ix2_200 machine
- Turning on an extra bus clock on imx
- A MAINTAINERS file entry for Roland Stigge"
* tag 'arm-soc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
arm: mvebu: Fix the irq map function in SMP mode
Fix GE0/GE1 init on ix2-200 as GE0 has no PHY
ARM: S3C24XX: Fix interrupt pending register offset of the EINT controller
ARM: S3C24XX: Correct NR_IRQS definition for s3c2440
ARM i.MX6: Fix ldb_di clock selection
ARM: imx: provide twd clock lookup from device tree
ARM: imx35 Bugfix admux clock
ARM: clk-imx35: Bugfix iomux clock
ARM: mxs: Slow down the I2C clock speed
MAINTAINERS: Add maintainer for LPC32xx
ARM: Kirkwood: Fix typo in the definition of ix2-200 rebuild LED
Wei Yongjun [Sun, 2 Dec 2012 13:33:24 +0000 (08:33 -0500)]
[SCSI] lpfc: fix potential NULL pointer dereference in lpfc_sli4_rq_put()
The dereference to 'put_index' should be moved below the NULL test.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Acked-by: James Smart <james.smart@emulex.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Alexandre Belloni [Wed, 3 Apr 2013 17:40:14 +0000 (19:40 +0200)]
gpio: pca953x: fix irq_domain_add_simple usage
We actually have to pass chip as the host_data parameter of
irq_domain_add_simple() as later on, it is used to initialize chip_data
in pca953x_gpio_irq_map(). Failing to do so is leading to a NULL pointer
dereference after calling irq_data_get_irq_chip_data() in
pca953x_irq_mask(), pca953x_irq_unmask(), pca953x_irq_bus_lock(),
pca953x_irq_bus_sync_unlock() and pca953x_irq_set_type().
Fixes regression introduced by commit
0e8f2fdacf1d44651aa7e57063c76142d1f4988b (gpio: pca953x: use simple
irqdomain)
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Mark Brown [Thu, 11 Apr 2013 17:00:31 +0000 (18:00 +0100)]
Merge remote-tracking branch 'asoc/fix/wm8903' into tmp
Mark Brown [Thu, 11 Apr 2013 17:00:30 +0000 (18:00 +0100)]
Merge remote-tracking branch 'asoc/fix/tegra' into tmp
Mark Brown [Thu, 11 Apr 2013 17:00:29 +0000 (18:00 +0100)]
Merge remote-tracking branch 'asoc/fix/samsung' into tmp
Mark Brown [Thu, 11 Apr 2013 17:00:28 +0000 (18:00 +0100)]
Merge remote-tracking branch 'asoc/fix/core' into tmp
Mark Brown [Thu, 11 Apr 2013 17:00:27 +0000 (18:00 +0100)]
Merge remote-tracking branch 'asoc/fix/compress' into tmp
Arnd Bergmann [Thu, 11 Apr 2013 14:55:29 +0000 (16:55 +0200)]
Merge tag 'mvebu_fixes_for_v3.9_round3' of git://git.infradead.org/users/jcooper/linux into fixes
From Jason Cooper <jason@lakedaemon.net>:
mvebu fixes for v3.9 round 3
- Kirkwood
- a couple of small fixes for the Iomega ix2-200 board (ether and led)
- mvebu
- allow GPIO button to work on Mirabox when running SMP
* tag 'mvebu_fixes_for_v3.9_round3' of git://git.infradead.org/users/jcooper/linux:
arm: mvebu: Fix the irq map function in SMP mode
Fix GE0/GE1 init on ix2-200 as GE0 has no PHY
ARM: Kirkwood: Fix typo in the definition of ix2-200 rebuild LED
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Nicholas Bellinger [Wed, 10 Apr 2013 22:00:27 +0000 (15:00 -0700)]
target: Fix incorrect fallthrough of ALUA Standby/Offline/Transition CDBs
This patch fixes a bug where a handful of informational / control CDBs
that should be allowed during ALUA access state Standby/Offline/Transition
where incorrectly returning CHECK_CONDITION + ASCQ_04H_ALUA_TG_PT_*.
This includes INQUIRY + REPORT_LUNS, which would end up preventing LUN
registration when LUN scanning occured during these ALUA access states.
Cc: Hannes Reinecke <hare@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Asias He [Wed, 10 Apr 2013 07:06:16 +0000 (15:06 +0800)]
tcm_vhost: Send bad target to guest when cmd fails
Send bad target to guest in case:
1) we can not allocate the cmd
2) fail to submit the cmd
Signed-off-by: Asias He <asias@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Asias He [Wed, 10 Apr 2013 07:06:15 +0000 (15:06 +0800)]
tcm_vhost: Add vhost_scsi_send_bad_target() helper
Share the send bad target code with other use cases.
Signed-off-by: Asias He <asias@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Asias He [Wed, 10 Apr 2013 07:06:14 +0000 (15:06 +0800)]
tcm_vhost: Fix tv_cmd leak in vhost_scsi_handle_vq
If we fail to submit the allocated tv_vmd to tcm_vhost_submission_work,
we will leak the tv_vmd. Free tv_vmd on fail path.
Signed-off-by: Asias He <asias@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Asias He [Wed, 10 Apr 2013 07:06:13 +0000 (15:06 +0800)]
tcm_vhost: Remove double check of response
We did the length of response check twice.
Signed-off-by: Asias He <asias@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Andrea Arcangeli [Wed, 10 Apr 2013 13:28:25 +0000 (15:28 +0200)]
x86/mm/cpa: Convert noop to functional fix
Commit:
a8aed3e0752b ("x86/mm/pageattr: Prevent PSE and GLOABL leftovers to confuse pmd/pte_present and pmd_huge")
introduced a valid fix but one location that didn't trigger the bug that
lead to finding those (small) problems, wasn't updated using the
right variable.
The wrong variable was also initialized for no good reason, that
may have been the source of the confusion. Remove the noop
initialization accordingly.
Commit
a8aed3e0752b also erroneously removed one canon_pgprot pass meant
to clear pmd bitflags not supported in hardware by older CPUs, that
automatically gets corrected by this patch too by applying it to the right
variable in the new location.
Reported-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Andy Whitcroft <apw@canonical.com>
Cc: Mel Gorman <mgorman@suse.de>
Link: http://lkml.kernel.org/r/1365600505-19314-1-git-send-email-aarcange@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Linus Torvalds [Wed, 10 Apr 2013 23:00:53 +0000 (16:00 -0700)]
Merge tag 'char-misc-3.9-rc6' of git://git./linux/kernel/git/gregkh/char-misc
Pull char/misc fix from Greg Kroah-Hartman:
"Here is a single Kconfig dependancy build fix for 3.9.
It's been in linux-next for a while, and fixes a problem that has been
reported multiple times."
* tag 'char-misc-3.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
misc/vmw_vmci: Add dependency on CONFIG_NET
Linus Torvalds [Wed, 10 Apr 2013 22:59:12 +0000 (15:59 -0700)]
Merge tag 'tty-3.9-rc6' of git://git./linux/kernel/git/gregkh/tty
Pull tty/serial fixes from Greg Kroah-Hartman:
"Here are 4 small tty/serial fixes for 3.9.
One fixes a bug where we broke the documentation build, and the others
fix reported problems in some serial drivers.
All have been in linux-next for a while"
* tag 'tty-3.9-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
tty: mxser: fix cycle termination condition in mxser_probe() and mxser_module_init()
Revert "tty/8250_pnp: serial port detection regression since v3.7"
OMAP/serial: Revert bad fix of Rx FIFO threshold granularity
tty: Documentation: fix a path in a DocBook template
Linus Torvalds [Wed, 10 Apr 2013 22:57:33 +0000 (15:57 -0700)]
Merge tag 'stable/for-linus-3.9-rc6-tag' of git://git./linux/kernel/git/konrad/xen
Pull Xen fixes from Konrad Rzeszutek Wilk:
"Two bug-fixes:
- Early bootup issue found on DL380 machines
- Fix for the timer interrupt not being processed right awaym leading
to quite delayed time skew on certain workloads"
* tag 'stable/for-linus-3.9-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
xen/mmu: On early bootup, flush the TLB when changing RO->RW bits Xen provided pagetables.
xen/events: Handle VIRQ_TIMER before any other hardirq in event loop.
Linus Torvalds [Wed, 10 Apr 2013 22:56:57 +0000 (15:56 -0700)]
Merge tag 'trace-fixes-3.9-rc-v2' of git://git./linux/kernel/git/rostedt/linux-trace
Pull tracing fix from Steven Rostedt:
"Namhyung Kim fixed a long standing bug that can cause a kernel panic.
If the function profiler fails to allocate memory for everything, it
will do a double free on the same pointer which can cause a panic"
* tag 'trace-fixes-3.9-rc-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
tracing: Fix double free when function profile init failed
Linus Torvalds [Wed, 10 Apr 2013 21:15:27 +0000 (14:15 -0700)]
Merge git://git./linux/kernel/git/davem/net
Pull networking fixes from David Miller:
1) cfg80211_conn_scan() must be called with the sched_scan_mutex, fix
from Artem Savkov.
2) Fix regression in TCP ICMPv6 processing, we do not want to treat
redirects as socket errors, from Christoph Paasch.
3) Fix several recvmsg() msg_name kernel memory leaks into userspace,
in ATM, AX25, Bluetooth, CAIF, IRDA, s390 IUCV, L2TP, LLC, Netrom,
NFC, Rose, TIPC, and VSOCK. From Mathias Krause and Wei Yongjun.
4) Fix AF_IUCV handling of segmented SKBs in recvmsg(), from Ursula
Braun and Eric Dumazet.
5) CAN gw.c code does kfree() on SLAB cache memory, use
kmem_cache_free() instead. Fix from Wei Yongjun.
6) Fix LSM regression on TCP SYN/ACKs, some LSMs such as SELINUX want
an skb->sk socket context available for these packets, but nothing
else requires it. From Eric Dumazet and Paul Moore.
7) Fix ipv4 address lifetime processing so that we don't perform
sleepable acts inside of rcu_read_lock() sections, do them in an
rtnl_lock() section instead. From Jiri Pirko.
8) mvneta driver accidently sets HW features after device registry, it
should do so beforehand. Fix from Willy Tarreau.
9) Fix bonding unload races more correctly, from Nikolay Aleksandrov
and Veaceslav Falico.
10) rtnl_dump_ifinfo() and rtnl_calcit() invoke nlmsg_parse() with wrong
header size argument. Fix from Michael Riesch.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (44 commits)
lsm: add the missing documentation for the security_skb_owned_by() hook
bnx2x: Prevent null pointer dereference in AFEX mode
e100: Add dma mapping error check
selinux: add a skb_owned_by() hook
can: gw: use kmem_cache_free() instead of kfree()
netrom: fix invalid use of sizeof in nr_recvmsg()
qeth: fix qeth_wait_for_threads() deadlock for OSN devices
af_iucv: fix recvmsg by replacing skb_pull() function
rtnetlink: Call nlmsg_parse() with correct header length
bonding: fix bonding_masters race condition in bond unloading
Revert "bonding: remove sysfs before removing devices"
net: mvneta: enable features before registering the driver
hyperv: Fix RNDIS send_completion code path
hyperv: Fix a kernel warning from netvsc_linkstatus_callback()
net: ipv4: fix schedule while atomic bug in check_lifetime()
net: ipv4: reset check_lifetime_work after changing lifetime
bnx2x: Fix KR2 rapid link flap
sctp: remove 'sridhar' from maintainers list
VSOCK: Fix missing msg_namelen update in vsock_stream_recvmsg()
VSOCK: vmci - fix possible info leak in vmci_transport_dgram_dequeue()
...
Linus Torvalds [Wed, 10 Apr 2013 21:14:27 +0000 (14:14 -0700)]
Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming
Pull C6X fix from Mark Salter.
Final (?) fix from the barrier discussion.
* tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
add memory barrier to arch_local_irq_restore
Sachin Prabhu [Tue, 9 Apr 2013 17:17:41 +0000 (18:17 +0100)]
cifs: Allow passwords which begin with a delimitor
Fixes a regression in cifs_parse_mount_options where a password
which begins with a delimitor is parsed incorrectly as being a blank
password.
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Paul Moore [Wed, 10 Apr 2013 19:34:14 +0000 (15:34 -0400)]
lsm: add the missing documentation for the security_skb_owned_by() hook
Unfortunately we didn't catch the missing comments earlier when the
patch was merged.
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Yuval Mintz [Wed, 10 Apr 2013 10:34:39 +0000 (13:34 +0300)]
bnx2x: Prevent null pointer dereference in AFEX mode
The cnic module is responsible for initializing various bnx2x structs
via callbacks provided by the bnx2x module.
One such struct is the queue object for the FCoE queue.
If a device is working in AFEX mode and its configuration allows FCoE yet
the cnic module is not loaded, it's very likely a null pointer dereference
will occur, as the bnx2x will erroneously access the FCoE's queue object.
Prevent said access until cnic properly registers itself.
Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com>
Signed-off-by: Ariel Elior <ariele@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Neil Horman [Tue, 9 Apr 2013 23:19:00 +0000 (23:19 +0000)]
e100: Add dma mapping error check
e100 uses pci_map_single, but fails to check for a dma mapping error after its
use, resulting in a stack trace:
[ 46.656594] ------------[ cut here ]------------
[ 46.657004] WARNING: at lib/dma-debug.c:933 check_unmap+0x47b/0x950()
[ 46.657004] Hardware name: To Be Filled By O.E.M.
[ 46.657004] e100 0000:00:0e.0: DMA-API: device driver failed to check map
error[device address=0x000000007a4540fa] [size=90 bytes] [mapped as single]
[ 46.657004] Modules linked in:
[ 46.657004] w83627hf hwmon_vid snd_via82xx ppdev snd_ac97_codec ac97_bus
snd_seq snd_pcm snd_mpu401 snd_mpu401_uart ns558 snd_rawmidi gameport parport_pc
e100 snd_seq_device parport snd_page_alloc snd_timer snd soundcore skge shpchp
k8temp mii edac_core i2c_viapro edac_mce_amd nfsd auth_rpcgss nfs_acl lockd
sunrpc binfmt_misc uinput ata_generic pata_acpi radeon i2c_algo_bit
drm_kms_helper ttm firewire_ohci drm firewire_core pata_via sata_via i2c_core
sata_promise crc_itu_t
[ 46.657004] Pid: 792, comm: ip Not tainted 3.8.0-0.rc6.git0.1.fc19.x86_64 #1
[ 46.657004] Call Trace:
[ 46.657004] <IRQ> [<
ffffffff81065ed0>] warn_slowpath_common+0x70/0xa0
[ 46.657004] [<
ffffffff81065f4c>] warn_slowpath_fmt+0x4c/0x50
[ 46.657004] [<
ffffffff81364cfb>] check_unmap+0x47b/0x950
[ 46.657004] [<
ffffffff8136522f>] debug_dma_unmap_page+0x5f/0x70
[ 46.657004] [<
ffffffffa030f0f0>] ? e100_tx_clean+0x30/0x210 [e100]
[ 46.657004] [<
ffffffffa030f1a8>] e100_tx_clean+0xe8/0x210 [e100]
[ 46.657004] [<
ffffffffa030fc6f>] e100_poll+0x56f/0x6c0 [e100]
[ 46.657004] [<
ffffffff8159dce1>] ? net_rx_action+0xa1/0x370
[ 46.657004] [<
ffffffff8159ddb2>] net_rx_action+0x172/0x370
[ 46.657004] [<
ffffffff810703bf>] __do_softirq+0xef/0x3d0
[ 46.657004] [<
ffffffff816e4ebc>] call_softirq+0x1c/0x30
[ 46.657004] [<
ffffffff8101c485>] do_softirq+0x85/0xc0
[ 46.657004] [<
ffffffff81070885>] irq_exit+0xd5/0xe0
[ 46.657004] [<
ffffffff816e5756>] do_IRQ+0x56/0xc0
[ 46.657004] [<
ffffffff816dacb2>] common_interrupt+0x72/0x72
[ 46.657004] <EOI> [<
ffffffff816da1eb>] ?
_raw_spin_unlock_irqrestore+0x3b/0x70
[ 46.657004] [<
ffffffff816d124d>] __slab_free+0x58/0x38b
[ 46.657004] [<
ffffffff81214424>] ? fsnotify_clear_marks_by_inode+0x34/0x120
[ 46.657004] [<
ffffffff811b0417>] ? kmem_cache_free+0x97/0x320
[ 46.657004] [<
ffffffff8157fc14>] ? sock_destroy_inode+0x34/0x40
[ 46.657004] [<
ffffffff8157fc14>] ? sock_destroy_inode+0x34/0x40
[ 46.657004] [<
ffffffff811b0692>] kmem_cache_free+0x312/0x320
[ 46.657004] [<
ffffffff8157fc14>] sock_destroy_inode+0x34/0x40
[ 46.657004] [<
ffffffff811e8c28>] destroy_inode+0x38/0x60
[ 46.657004] [<
ffffffff811e8d5e>] evict+0x10e/0x1a0
[ 46.657004] [<
ffffffff811e9605>] iput+0xf5/0x180
[ 46.657004] [<
ffffffff811e4338>] dput+0x248/0x310
[ 46.657004] [<
ffffffff811ce0e1>] __fput+0x171/0x240
[ 46.657004] [<
ffffffff811ce26e>] ____fput+0xe/0x10
[ 46.657004] [<
ffffffff8108d54c>] task_work_run+0xac/0xe0
[ 46.657004] [<
ffffffff8106c6ed>] do_exit+0x26d/0xc30
[ 46.657004] [<
ffffffff8109eccc>] ? finish_task_switch+0x7c/0x120
[ 46.657004] [<
ffffffff816dad58>] ? retint_swapgs+0x13/0x1b
[ 46.657004] [<
ffffffff8106d139>] do_group_exit+0x49/0xc0
[ 46.657004] [<
ffffffff8106d1c4>] sys_exit_group+0x14/0x20
[ 46.657004] [<
ffffffff816e3b19>] system_call_fastpath+0x16/0x1b
[ 46.657004] ---[ end trace
4468c44e2156e7d1 ]---
[ 46.657004] Mapped at:
[ 46.657004] [<
ffffffff813663d1>] debug_dma_map_page+0x91/0x140
[ 46.657004] [<
ffffffffa030e8eb>] e100_xmit_prepare+0x12b/0x1c0 [e100]
[ 46.657004] [<
ffffffffa030c924>] e100_exec_cb+0x84/0x140 [e100]
[ 46.657004] [<
ffffffffa030e56a>] e100_xmit_frame+0x3a/0x190 [e100]
[ 46.657004] [<
ffffffff8159ee89>] dev_hard_start_xmit+0x259/0x6c0
Easy fix, modify the cb paramter to e100_exec_cb to return an error, and do the
dma_mapping_error check in the obvious place
This was reported previously here:
http://article.gmane.org/gmane.linux.network/257893
But nobody stepped up and fixed it.
CC: Josh Boyer <jwboyer@redhat.com>
CC: e1000-devel@lists.sourceforge.net
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: Michal Jaegermann <michal@harddata.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Boris Ostrovsky [Sat, 23 Mar 2013 13:36:36 +0000 (09:36 -0400)]
x86, mm: Patch out arch_flush_lazy_mmu_mode() when running on bare metal
Invoking arch_flush_lazy_mmu_mode() results in calls to
preempt_enable()/disable() which may have performance impact.
Since lazy MMU is not used on bare metal we can patch away
arch_flush_lazy_mmu_mode() so that it is never called in such
environment.
[ hpa: the previous patch "Fix vmalloc_fault oops during lazy MMU
updates" may cause a minor performance regression on
bare metal. This patch resolves that performance regression. It is
somewhat unclear to me if this is a good -stable candidate. ]
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Link: http://lkml.kernel.org/r/1364045796-10720-2-git-send-email-konrad.wilk@oracle.com
Tested-by: Josh Boyer <jwboyer@redhat.com>
Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: <stable@vger.kernel.org> SEE NOTE ABOVE
Samu Kallio [Sat, 23 Mar 2013 13:36:35 +0000 (09:36 -0400)]
x86, mm, paravirt: Fix vmalloc_fault oops during lazy MMU updates
In paravirtualized x86_64 kernels, vmalloc_fault may cause an oops
when lazy MMU updates are enabled, because set_pgd effects are being
deferred.
One instance of this problem is during process mm cleanup with memory
cgroups enabled. The chain of events is as follows:
- zap_pte_range enables lazy MMU updates
- zap_pte_range eventually calls mem_cgroup_charge_statistics,
which accesses the vmalloc'd mem_cgroup per-cpu stat area
- vmalloc_fault is triggered which tries to sync the corresponding
PGD entry with set_pgd, but the update is deferred
- vmalloc_fault oopses due to a mismatch in the PUD entries
The OOPs usually looks as so:
------------[ cut here ]------------
kernel BUG at arch/x86/mm/fault.c:396!
invalid opcode: 0000 [#1] SMP
.. snip ..
CPU 1
Pid: 10866, comm: httpd Not tainted 3.6.10-4.fc18.x86_64 #1
RIP: e030:[<
ffffffff816271bf>] [<
ffffffff816271bf>] vmalloc_fault+0x11f/0x208
.. snip ..
Call Trace:
[<
ffffffff81627759>] do_page_fault+0x399/0x4b0
[<
ffffffff81004f4c>] ? xen_mc_extend_args+0xec/0x110
[<
ffffffff81624065>] page_fault+0x25/0x30
[<
ffffffff81184d03>] ? mem_cgroup_charge_statistics.isra.13+0x13/0x50
[<
ffffffff81186f78>] __mem_cgroup_uncharge_common+0xd8/0x350
[<
ffffffff8118aac7>] mem_cgroup_uncharge_page+0x57/0x60
[<
ffffffff8115fbc0>] page_remove_rmap+0xe0/0x150
[<
ffffffff8115311a>] ? vm_normal_page+0x1a/0x80
[<
ffffffff81153e61>] unmap_single_vma+0x531/0x870
[<
ffffffff81154962>] unmap_vmas+0x52/0xa0
[<
ffffffff81007442>] ? pte_mfn_to_pfn+0x72/0x100
[<
ffffffff8115c8f8>] exit_mmap+0x98/0x170
[<
ffffffff810050d9>] ? __raw_callee_save_xen_pmd_val+0x11/0x1e
[<
ffffffff81059ce3>] mmput+0x83/0xf0
[<
ffffffff810624c4>] exit_mm+0x104/0x130
[<
ffffffff8106264a>] do_exit+0x15a/0x8c0
[<
ffffffff810630ff>] do_group_exit+0x3f/0xa0
[<
ffffffff81063177>] sys_exit_group+0x17/0x20
[<
ffffffff8162bae9>] system_call_fastpath+0x16/0x1b
Calling arch_flush_lazy_mmu_mode immediately after set_pgd makes the
changes visible to the consistency checks.
Cc: <stable@vger.kernel.org>
RedHat-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=914737
Tested-by: Josh Boyer <jwboyer@redhat.com>
Reported-and-Tested-by: Krishna Raman <kraman@redhat.com>
Signed-off-by: Samu Kallio <samu.kallio@aberdeencloud.com>
Link: http://lkml.kernel.org/r/1364045796-10720-1-git-send-email-konrad.wilk@oracle.com
Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Linus Torvalds [Wed, 10 Apr 2013 17:26:49 +0000 (10:26 -0700)]
Merge tag 'nfs-for-3.9-5' of git://git.linux-nfs.org/projects/trondmy/linux-nfs
Pull another nfs fixlet from Trond Myklebust:
"I suddenly noticed that a one-line issue that I _thought_ I had fixed
with the nfs41_walk_client_list patch was apparently still there in
the pull request I sent earlier today. I'm very sorry for not
catching that in time.
- Fix a brain fart in nfs41_walk_client_list"
* tag 'nfs-for-3.9-5' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
NFSv4: Doh! Typo in the fix to nfs41_walk_client_list
Gregory CLEMENT [Fri, 5 Apr 2013 12:32:52 +0000 (14:32 +0200)]
arm: mvebu: Fix the irq map function in SMP mode
This patch fix the regression introduced by the commit
3202bf0157ccb
"arm: mvebu: Improve the SMP support of the interrupt controller":
GPIO IRQ were no longer delivered to the CPUs.
To be delivered to a CPU an interrupt must be enabled at CPU level and
at interrupt source level. Before the offending patch, all the
interrupts were enabled at source level during map() function. Mask()
and unmask() was done by handling the per-CPU part. It was fine when
running in UP with only one CPU.
The offending patch added support for SMP, in this case mask() and
unmask() was done by handling the interrupt source level part. The
per-CPU level part was handled by the affinity API to select the CPU
which will receive the interrupt. (Due to some hardware limitation
only one CPU at a time can received a given interrupt).
For "normal" interrupt __setup_irq() was called when an irq was
registered. irq_set_affinity() is called from this function, which
enabled the interrupt on one of the CPUs. Whereas for GPIO IRQ which
were chained interrupts, the irq_set_affinity() was never called and
none of the CPUs was selected to receive the interrupt.
With this patch all the interrupt are enable on the current CPU during
map() function. Enabling the interrupts on a CPU doesn't depend
anymore on irq_set_affinity() and then the chained irq are not anymore
a special case. However the CPU which will receive the irq can still
be modify later using irq_set_affinity().
Tested with Mirabox (A370) and Openblocks AX3 (AXP), rootfs mounted
over NFS, compiled with CONFIG_SMP=y/N.
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Reported-by: Ryan Press <ryan@presslab.us>
Investigated-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Tested-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Tested-by: Ryan Press <ryan@presslab.us>
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
Trond Myklebust [Wed, 10 Apr 2013 16:44:18 +0000 (12:44 -0400)]
NFSv4: Doh! Typo in the fix to nfs41_walk_client_list
Make sure that we set the status to 0 on success. Missed in testing
because it never appears when doing multiple mounts to _different_
servers.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: <stable@vger.kernel.org> # 3.7.x: 7b1f1fd: NFSv4/4.1: Fix bugs in nfs4[01]_walk_client_list
Nigel Roberts [Sun, 31 Mar 2013 04:13:24 +0000 (15:13 +1100)]
Fix GE0/GE1 init on ix2-200 as GE0 has no PHY
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
Linus Torvalds [Wed, 10 Apr 2013 16:00:51 +0000 (09:00 -0700)]
Merge tag 'nfs-for-3.9-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs
Pull NFS client bugfixes from Trond Myklebust:
- fix for memory corruption issues in nfs4[01]_walk_client_list (stable)
- fix for an Oopsable bug in rpc_clone_client (stable)
- another state manager deadlock in the NFSv4 open code
- memory leaks in nfs4_discover_server_trunking and rpc_new_client
* tag 'nfs-for-3.9-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
NFSv4: Fix another potential state manager deadlock
SUNRPC: Fix a potential memory leak in rpc_new_client
NFSv4/4.1: Fix bugs in nfs4[01]_walk_client_list
NFSv4: Fix a memory leak in nfs4_discover_server_trunking
SUNRPC: Remove extra xprt_put()
Peter Ujfalusi [Tue, 9 Apr 2013 14:33:06 +0000 (16:33 +0200)]
dmaengine: omap-dma: Start DMA without delay for cyclic channels
cyclic DMA is only used by audio which needs DMA to be started without a
delay.
If the DMA for audio is started using the tasklet we experience random
channel switch (to be more precise: channel shift).
Reported-by: Peter Meerwald <pmeerw@pmeerw.net>
CC: stable@vger.kernel.org # v3.7+
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Acked-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Linus Torvalds [Wed, 10 Apr 2013 03:19:50 +0000 (20:19 -0700)]
Merge git://git./linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
"This fixes a GCM bug that breaks IPsec and a compile problem in
ux500."
* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: ux500 - add missing comma
crypto: gcm - fix assumption that assoc has one segment
Linus Torvalds [Wed, 10 Apr 2013 00:41:26 +0000 (17:41 -0700)]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
"Just a spare semicolon in nouveau that caused some issues, and an
mgag200 fix"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/mgag200: Index 24 in extended CRTC registers is 24 in hex, not decimal.
drm/nouveau: fix unconditional return waiting on memory
Christopher Harvey [Fri, 5 Apr 2013 14:51:15 +0000 (10:51 -0400)]
drm/mgag200: Index 24 in extended CRTC registers is 24 in hex, not decimal.
This change properly enables the "requester" in G200ER cards that is
responsible for getting pixels out of memory and clocking them out to
the screen.
Signed-off-by: Christopher Harvey <charvey@matrox.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Namhyung Kim [Mon, 1 Apr 2013 12:46:23 +0000 (21:46 +0900)]
tracing: Fix double free when function profile init failed
On the failure path, stat->start and stat->pages will refer same page.
So it'll attempt to free the same page again and get kernel panic.
Link: http://lkml.kernel.org/r/1364820385-32027-1-git-send-email-namhyung@kernel.org
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Namhyung Kim <namhyung.kim@lge.com>
Cc: stable@vger.kernel.org
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Mark Salter [Tue, 9 Apr 2013 19:35:46 +0000 (15:35 -0400)]
add memory barrier to arch_local_irq_restore
arch_local_irq_save() and friends are required to act as compiler
memory barriers. This patch adds a "memory" clobber to the inline
asm code in arch_local_irq_restore() which is used as the building
block for other functions needing to set/clear the interrupt enable
in the CSR register.
Signed-off-by: Mark Salter <msalter@redhat.com>
Linus Torvalds [Tue, 9 Apr 2013 19:22:49 +0000 (12:22 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/viro/vfs
Pull vfs fixes from Al Viro:
"A nasty bug in fs/namespace.c caught by Andrey + a couple of less
serious unpleasantness - ecryptfs misc device playing hopeless games
with try_module_get() and palinfo procfs support being... not quite
correctly done, to be polite."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
mnt: release locks on error path in do_loopback
palinfo fixes
procfs: add proc_remove_subtree()
ecryptfs: close rmmod race
Linus Torvalds [Tue, 9 Apr 2013 19:07:01 +0000 (12:07 -0700)]
Merge tag 'vfio-v3.9-rc7' of git://github.com/awilliam/linux-vfio
Pull vfio overflow fix from Alex Williamson.
* tag 'vfio-v3.9-rc7' of git://github.com/awilliam/linux-vfio:
vfio-pci: Fix possible integer overflow
Linus Torvalds [Tue, 9 Apr 2013 19:05:41 +0000 (12:05 -0700)]
Merge tag 'for-linus-
20130409' of git://git.kernel.dk/linux-block
Pull block fixes from Jens Axboe:
"I've got a few smaller fixes queued up for 3.9 that should go in. The
major one is the loop regression, the others are nice fixes on their
own though. It contains:
- Fix for unitialized var in the block sysfs code, courtesy of Arnd
and gcc-4.8.
- Two fixes for mtip32xx, fixing probe and command timeout. Also a
debug measure that could have waited for 3.10, but it's driver
only, so I let it slip in.
- Revert the loop partition cleanup fix, it could cause a deadlock on
auto-teardown as part of umount. The fix is clear, but at this
point we just want to revert it and get a real fix in for 3.10."
* tag 'for-linus-
20130409' of git://git.kernel.dk/linux-block:
Revert "loop: cleanup partitions when detaching loop device"
mtip32xx: fix two smatch warnings
mtip32xx: Add debugfs entry device_status
mtip32xx: return 0 from pci probe in case of rebuild
mtip32xx: recovery from command timeout
block: avoid using uninitialized value in from queue_var_store
Andrey Vagin [Tue, 9 Apr 2013 13:33:29 +0000 (17:33 +0400)]
mnt: release locks on error path in do_loopback
do_loopback calls lock_mount(path) and forget to unlock_mount
if clone_mnt or copy_mnt fails.
[ 77.661566] ================================================
[ 77.662939] [ BUG: lock held when returning to user space! ]
[ 77.664104] 3.9.0-rc5+ #17 Not tainted
[ 77.664982] ------------------------------------------------
[ 77.666488] mount/514 is leaving the kernel with locks still held!
[ 77.668027] 2 locks held by mount/514:
[ 77.668817] #0: (&sb->s_type->i_mutex_key#7){+.+.+.}, at: [<
ffffffff811cca22>] lock_mount+0x32/0xe0
[ 77.671755] #1: (&namespace_sem){+++++.}, at: [<
ffffffff811cca3a>] lock_mount+0x4a/0xe0
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 1 Apr 2013 02:34:37 +0000 (22:34 -0400)]
palinfo fixes
* check for proc_mkdir() failures
* fix buffer overrun - sizeof(format string) is *not* enough to
hold sprintf() result.
* use proc_remove_subtree(); life's much easier with it
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 31 Mar 2013 00:13:46 +0000 (20:13 -0400)]
procfs: add proc_remove_subtree()
just what it sounds like; do that only to procfs subtrees you've
created - doing that to something shared with another driver is
not only antisocial, but might cause interesting races with
proc_create() and its ilk.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 28 Mar 2013 17:30:23 +0000 (13:30 -0400)]
ecryptfs: close rmmod race
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Linus Torvalds [Tue, 9 Apr 2013 17:48:33 +0000 (10:48 -0700)]
spinlocks and preemption points need to be at least compiler barriers
In UP and non-preempt respectively, the spinlocks and preemption
disable/enable points are stubbed out entirely, because there is no
regular code that can ever hit the kind of concurrency they are meant to
protect against.
However, while there is no regular code that can cause scheduling, we
_do_ end up having some exceptional (literally!) code that can do so,
and that we need to make sure does not ever get moved into the critical
region by the compiler.
In particular, get_user() and put_user() is generally implemented as
inline asm statements (even if the inline asm may then make a call
instruction to call out-of-line), and can obviously cause a page fault
and IO as a result. If that inline asm has been scheduled into the
middle of a preemption-safe (or spinlock-protected) code region, we
obviously lose.
Now, admittedly this is *very* unlikely to actually ever happen, and
we've not seen examples of actual bugs related to this. But partly
exactly because it's so hard to trigger and the resulting bug is so
subtle, we should be extra careful to get this right.
So make sure that even when preemption is disabled, and we don't have to
generate any actual *code* to explicitly tell the system that we are in
a preemption-disabled region, we need to at least tell the compiler not
to move things around the critical region.
This patch grew out of the same discussion that caused commits
79e5f05edcbf ("ARC: Add implicit compiler barrier to raw_local_irq*
functions") and
3e2e0d2c222b ("tile: comment assumption about
__insn_mtspr for <asm/irqflags.h>") to come about.
Note for stable: use discretion when/if applying this. As mentioned,
this bug may never have actually bitten anybody, and gcc may never have
done the required code motion for it to possibly ever trigger in
practice.
Cc: stable@vger.kernel.org
Cc: Steven Rostedt <srostedt@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David S. Miller [Tue, 9 Apr 2013 17:24:35 +0000 (13:24 -0400)]
Merge branch 'fixes-for-3.9' of git://gitorious.org/linux-can/linux-can
Marc Kleine-Budde says:
====================
here's a fix for the v3.9 release cycle, if not too late:
Wei Yongjun contributes a patch for the can-gw protocoll. The patch fixes the
memory allocated with kmem_cache_alloc(), is now freed using kmem_cache_free(),
not kfree().
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Mon, 8 Apr 2013 17:58:11 +0000 (17:58 +0000)]
selinux: add a skb_owned_by() hook
Commit
90ba9b1986b5ac (tcp: tcp_make_synack() can use alloc_skb())
broke certain SELinux/NetLabel configurations by no longer correctly
assigning the sock to the outgoing SYNACK packet.
Cost of atomic operations on the LISTEN socket is quite big,
and we would like it to happen only if really needed.
This patch introduces a new security_ops->skb_owned_by() method,
that is a void operation unless selinux is active.
Reported-by: Miroslav Vadkerti <mvadkert@redhat.com>
Diagnosed-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: linux-security-module@vger.kernel.org
Acked-by: James Morris <james.l.morris@oracle.com>
Tested-by: Paul Moore <pmoore@redhat.com>
Acked-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Trond Myklebust [Tue, 9 Apr 2013 16:56:52 +0000 (12:56 -0400)]
NFSv4: Fix another potential state manager deadlock
Don't hold the NFSv4 sequence id while we check for open permission.
The call to ACCESS may block due to reboot recovery.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Chris Metcalf [Tue, 9 Apr 2013 16:33:07 +0000 (12:33 -0400)]
tile: comment assumption about __insn_mtspr for <asm/irqflags.h>
The arch_local_irq_save(), etc., routines are required to function
as compiler barriers. They do, but it's subtle and requires knowing
that the gcc builtin __insn_mtspr() is marked as a memory clobber.
Provide a comment explaining the assumption.
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
[ This came about from me wondering about the synchronization rules of
__insn_mtspr() - Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Mark Brown [Tue, 9 Apr 2013 17:03:25 +0000 (18:03 +0100)]
regmap: Back out work buffer fix
This reverts commit bc8ce4 (regmap: don't corrupt work buffer in
_regmap_raw_write()) since it turns out that it can cause issues when
taken in isolation from the other changes in -next that lead to its
discovery. On the basis that nobody noticed the problems for quite some
time without that subsequent work let's drop it from v3.9.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Mark Brown [Fri, 5 Apr 2013 12:19:26 +0000 (13:19 +0100)]
ASoC: wm5102: Correct lookup of arizona struct in SYSCLK event
Reported-by: Ryo Tsutsui <Ryo.Tsutsui@wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: stable@vger.kernel.org