1. 29 May, 2013 1 commit
  2. 26 May, 2013 9 commits
    • Linus Torvalds's avatar
      Linux 3.10-rc3 · e4aa937e
      Linus Torvalds authored
      e4aa937e
    • Manfred Spraul's avatar
      ipc/sem.c: Fix missing wakeups in do_smart_update_queue() · ab465df9
      Manfred Spraul authored
      do_smart_update_queue() is called when an operation (semop,
      semctl(SETVAL), semctl(SETALL), ...) modified the array.  It must check
      which of the sleeping tasks can proceed.
      
      do_smart_update_queue() missed a few wakeups:
       - if a sleeping complex op was completed, then all per-semaphore queues
         must be scanned - not only those that were modified by *sops
       - if a sleeping simple op proceeded, then the global queue must be
         scanned again
      
      And:
       - the test for "|sops == NULL) before scanning the global queue is not
         required: If the global queue is empty, then it doesn't need to be
         scanned - regardless of the reason for calling do_smart_update_queue()
      
      The patch is not optimized, i.e.  even completing a wait-for-zero
      operation causes a rescan.  This is done to keep the patch as simple as
      possible.
      Signed-off-by: default avatarManfred Spraul <manfred@colorfullife.com>
      Acked-by: default avatarDavidlohr Bueso <davidlohr.bueso@hp.com>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ab465df9
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-3.10-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · 89ff7783
      Linus Torvalds authored
      Pull NFS client bugfixes from Trond Myklebust:
      
       - Stable fix to prevent an rpc_task wakeup race
       - Fix a NFSv4.1 session drain deadlock
       - Fix a NFSv4/v4.1 mount regression when not running rpc.gssd
       - Ensure auth_gss pipe detection works in namespaces
       - Fix SETCLIENTID fallback if rpcsec_gss is not available
      
      * tag 'nfs-for-3.10-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        NFS: Fix SETCLIENTID fallback if GSS is not available
        SUNRPC: Prevent an rpc_task wakeup race
        NFSv4.1 Fix a pNFS session draining deadlock
        SUNRPC: Convert auth_gss pipe detection to work in namespaces
        SUNRPC: Faster detection if gssd is actually running
        SUNRPC: Fix a bug in gss_create_upcall
      89ff7783
    • Linus Torvalds's avatar
      Merge tag 'edac_fixes_for_3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp · 932ff06b
      Linus Torvalds authored
      Pull amd64 edac fix from Borislav Petkov:
       "A sysfs file permissions correction"
      
      * tag 'edac_fixes_for_3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
        amd64_edac: Fix bogus sysfs file permissions
      932ff06b
    • Linus Torvalds's avatar
      Merge branch 'parisc-for-3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · 95f4838e
      Linus Torvalds authored
      Pull parisc fixes from Helge Deller:
       "This time we made the kernel- and interruption stack allocation
        reentrant which fixed some strange kernel crashes (specifically
        protection ID traps).
      
        Furthemore this patchset fixes the interrupt stack in UP and SMP
        configurations by using native locking instructions.  And finally
        usage of floating point calculations on parisc were disabled in the
        MPILIB."
      
      * 'parisc-for-3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: fix irq stack on UP and SMP
        parisc/superio: Use module_pci_driver to register driver
        parisc: make interrupt and interruption stack allocation reentrant
        parisc: show number of FPE and unaligned access handler calls in /proc/interrupts
        parisc: add additional parisc git tree to MAINTAINERS file
        parisc: use PAGE_SHIFT instead of hardcoded value 12 in pacache.S
        parisc: add rp5470 entry to machine database
        MPILIB: disable usage of floating point registers on parisc
      95f4838e
    • Linus Torvalds's avatar
      Merge tag 'for-linus-v3.10-rc3' of git://oss.sgi.com/xfs/xfs · 088d812f
      Linus Torvalds authored
      Pull xfs fixes from Ben Myers:
       "Here are fixes for corruption on 512 byte filesystems, a rounding
        error, a use-after-free, some flags to fix lockdep reports, and
        several fixes related to CRCs.  We have a somewhat larger post -rc1
        queue than usual due to fixes related to the CRC feature we merged for
        3.10:
      
         - Fix for corruption with FSX on 512 byte blocksize filesystems
         - Fix rounding error in xfs_free_file_space
         - Fix use-after-free with extent free intents
         - Add several missing KM_NOFS flags to fix lockdep reports
         - Several fixes for CRC related code"
      
      * tag 'for-linus-v3.10-rc3' of git://oss.sgi.com/xfs/xfs:
        xfs: remote attribute lookups require the value length
        xfs: xfs_attr_shortform_allfit() does not handle attr3 format.
        xfs: xfs_da3_node_read_verify() doesn't handle XFS_ATTR3_LEAF_MAGIC
        xfs: fix missing KM_NOFS tags to keep lockdep happy
        xfs: Don't reference the EFI after it is freed
        xfs: fix rounding in xfs_free_file_space
        xfs: fix sub-page blocksize data integrity writes
      088d812f
    • Linus Torvalds's avatar
      Merge tag 'for-v3.10-fixes' of git://git.infradead.org/battery-2.6 · 72de4c63
      Linus Torvalds authored
      Pull bettery fixes from Anton Vorontsov:
       "Last minute one-liners: wrong kfree usage fix, module alias fixup and
        kconfig adjustments"
      
      * tag 'for-v3.10-fixes' of git://git.infradead.org/battery-2.6:
        pm2301_charger: Fix module alias prefix
        wm831x_backup: Fix wrong kfree call for devdata->backup.name
        bq27x00: Fix I2C dependency in KConfig
        lp8788-charger: Fix kconfig dependency
      72de4c63
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-3.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 1aad08dc
      Linus Torvalds authored
      Pull power management and ACPI fixes from Rafael Wysocki:
      
       - Additional CPU ID for the intel_pstate driver from Dirk Brandewie.
      
       - More cpufreq fixes related to ARM big.LITTLE support and locking from
         Viresh Kumar.
      
       - VIA C7 cpufreq build fix from Rafał Bilski.
      
       - ACPI power management fix making it possible to use device power
         states regardless of the CONFIG_PM setting from Rafael J Wysocki.
      
       - New ACPI video blacklist item from Bastian Triller.
      
      * tag 'pm+acpi-3.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI / video: Add "Asus UL30A" to ACPI video detect blacklist
        cpufreq: arm_big_little_dt: Instantiate as platform_driver
        cpufreq: arm_big_little_dt: Register driver only if DT has valid data
        cpufreq / e_powersaver: Fix linker error when ACPI processor is a module
        cpufreq / intel_pstate: Add additional supported CPU ID
        cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT
        ACPI / PM: Allow device power states to be used for CONFIG_PM unset
      1aad08dc
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma · 27a24cfa
      Linus Torvalds authored
      Pull slave-dma fixes from Vinod Koul:
       "We have two patches from Andy & Rafael fixing the Lynxpoint dma"
      
      * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
        ACPI / LPSS: register clock device for Lynxpoint DMA properly
        dma: acpi-dma: parse CSRT to extract additional resources
      27a24cfa
  3. 25 May, 2013 5 commits
    • Kyle McMartin's avatar
      score: remove redundant kcore_list entries · 6b3f7b5c
      Kyle McMartin authored
      kcore_vmalloc is in fs/proc/kcore.c and kcore_mem is unused across
      the tree. Noticed while grepping the tree for some other kcore stuff.
      
      (score looks pretty unmaintained to me.)
      Signed-off-by: default avatarKyle McMartin <kyle@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6b3f7b5c
    • Linus Torvalds's avatar
      Merge tag 'arc-v3.10-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc · 462a2b58
      Linus Torvalds authored
      Pull ARC fixes from Vineet Gupta:
      
       - Fallouts/wreckage of Cache Flush optimizations / aliasing dcache
         support
      
       - Fix for an interesting bug where piped input to grep was getting
         mysteriously clobbered
      
      * tag 'arc-v3.10-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
        ARC: lazy dcache flush broke gdb in non-aliasing configs
        ARC: Use enough bits for determining page's cache color
        ARC: Brown paper bag bug in macro for checking cache color
        ARC: copy_(to|from)_user() to honor usermode-access permissions
        ARC: [mm] Prevent stray dcache lines after__sync_icache_dcach()
        ARC: [TB10x] Remove redundant abilis,simple-pinctrl mechanism
      462a2b58
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.linaro.org/people/rmk/linux-arm · 4dd9aa89
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "Just three this time, all really quite small"
      
      * 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
        ARM: 7729/1: vfp: ensure VFP_arch is non-zero when VFP is not supported
        ARM: 7727/1: remove the .vm_mm value from gate_vma
        ARM: 7723/1: crypto: sha1-armv4-large.S: fix SP handling
      4dd9aa89
    • Vineet Gupta's avatar
      ARC: lazy dcache flush broke gdb in non-aliasing configs · 7bb66f6e
      Vineet Gupta authored
      gdbserver inserting a breakpoint ends up calling copy_user_page() for a
      code page. The generic version of which (non-aliasing config) didn't set
      the PG_arch_1 bit hence update_mmu_cache() didn't sync dcache/icache for
      corresponding dynamic loader code page - causing garbade to be executed.
      
      So now aliasing versions of copy_user_highpage()/clear_page() are made
      default. There is no significant overhead since all of special alias
      handling code is compiled out for non-aliasing build
      Signed-off-by: default avatarVineet Gupta <vgupta@synopsys.com>
      7bb66f6e
    • Linus Torvalds's avatar
      Merge branch 'akpm' (incoming from Andrew Morton) · 9cf18482
      Linus Torvalds authored
      Merge fixes from Andrew Morton:
       "A bunch of fixes and one simple fbdev driver which missed the merge
        window because people will still talking about it (to no great
        effect)."
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (30 commits)
        aio: fix kioctx not being freed after cancellation at exit time
        mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areas
        drivers/rtc/rtc-max8998.c: check for pdata presence before dereferencing
        ocfs2: goto out_unlock if ocfs2_get_clusters_nocache() failed in ocfs2_fiemap()
        random: fix accounting race condition with lockless irq entropy_count update
        drivers/char/random.c: fix priming of last_data
        mm/memory_hotplug.c: fix printk format warnings
        nilfs2: fix issue of nilfs_set_page_dirty() for page at EOF boundary
        drivers/block/brd.c: fix brd_lookup_page() race
        fbdev: FB_GOLDFISH should depend on HAS_DMA
        drivers/rtc/rtc-pl031.c: pass correct pointer to free_irq()
        auditfilter.c: fix kernel-doc warnings
        aio: fix io_getevents documentation
        revert "selftest: add simple test for soft-dirty bit"
        drivers/leds/leds-ot200.c: fix error caused by shifted mask
        mm/THP: use pmd_populate() to update the pmd with pgtable_t pointer
        linux/kernel.h: fix kernel-doc warning
        mm compaction: fix of improper cache flush in migration code
        rapidio/tsi721: fix bug in MSI interrupt handling
        hfs: avoid crash in hfs_bnode_create
        ...
      9cf18482
  4. 24 May, 2013 25 commits
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 00cec111
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "We didn't have any fixes sent up for -rc2, so this is a slightly
        larger batch.  A bit all over the place platform-wise; OMAP, at91,
        marvell, renesas, sunxi, ux500, etc.
      
        I tried to summarize highlights but there isn't a whole lot to point
        out.  Lots of little things fixed all over.  A couple of defconfig
        updates due to new/changing options."
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (44 commits)
        ARM: at91/sama5: fix incorrect PMC pcr div definition
        ARM: at91/dt: fix macb pinctrl_macb_rmii_mii_alt definition
        ARM: at91: at91sam9n12: move external irq declatation to DT
        ARM: shmobile: marzen: Use error values in usb_power_*
        ARM: tegra: defconfig fixes
        ARM: nomadik: fix IRQ assignment for SMC ethernet
        ARM: vt8500: Add missing NULL terminator in dt_compat
        clk: tegra: add ac97 controller clock
        clk: tegra: remove USB from clk init table
        ARM: dts: mvebu: Fix wrong the address reg value for the L2-cache node
        ARM: plat-orion: Fix num_resources and id for ge10 and ge11
        ARM: OMAP2+: hwmod: Remove sysc slave idle and auto idle apis
        SERIAL: OMAP: Remove the slave idle handling from the driver
        ARM: OMAP2+: serial: Remove the un-used slave idle hooks
        ARM: OMAP2+: hwmod-data: UART IP needs software control to manage sidle modes
        ARM: OMAP2+: hwmod: Add a new flag to handle SIDLE in SWSUP only in active
        ARM: OMAP2+: hwmod: Fix sidle programming in _enable_sysc()/_idle_sysc()
        arm: mvebu: fix the 'ranges' property to handle PCIe
        ARM: mvebu: select ARCH_REQUIRE_GPIOLIB for mvebu platform
        ARM: AM33XX: Add missing .clkdm_name to clkdiv32k_ick clock
        ...
      00cec111
    • Benjamin LaHaise's avatar
      aio: fix kioctx not being freed after cancellation at exit time · 03e04f04
      Benjamin LaHaise authored
      The recent changes overhauling fs/aio.c introduced a bug that results in
      the kioctx not being freed when outstanding kiocbs are cancelled at
      exit_aio() time.  Specifically, a kiocb that is cancelled has its
      completion events discarded by batch_complete_aio(), which then fails to
      wake up the process stuck in free_ioctx().  Fix this by modifying the
      wait_event() condition in free_ioctx() appropriately.
      
      This patch was tested with the cancel operation in the thread based code
      posted yesterday.
      
      [akpm@linux-foundation.org: fix build]
      Signed-off-by: default avatarBenjamin LaHaise <bcrl@kvack.org>
      Signed-off-by: default avatarKent Overstreet <koverstreet@google.com>
      Cc: Kent Overstreet <koverstreet@google.com>
      Cc: Josh Boyer <jwboyer@redhat.com>
      Cc: Zach Brown <zab@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      03e04f04
    • Cliff Wickman's avatar
      mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areas · a9ff785e
      Cliff Wickman authored
      A panic can be caused by simply cat'ing /proc/<pid>/smaps while an
      application has a VM_PFNMAP range.  It happened in-house when a
      benchmarker was trying to decipher the memory layout of his program.
      
      /proc/<pid>/smaps and similar walks through a user page table should not
      be looking at VM_PFNMAP areas.
      
      Certain tests in walk_page_range() (specifically split_huge_page_pmd())
      assume that all the mapped PFN's are backed with page structures.  And
      this is not usually true for VM_PFNMAP areas.  This can result in panics
      on kernel page faults when attempting to address those page structures.
      
      There are a half dozen callers of walk_page_range() that walk through a
      task's entire page table (as N.  Horiguchi pointed out).  So rather than
      change all of them, this patch changes just walk_page_range() to ignore
      VM_PFNMAP areas.
      
      The logic of hugetlb_vma() is moved back into walk_page_range(), as we
      want to test any vma in the range.
      
      VM_PFNMAP areas are used by:
      - graphics memory manager   gpu/drm/drm_gem.c
      - global reference unit     sgi-gru/grufile.c
      - sgi special memory        char/mspec.c
      - and probably several out-of-tree modules
      
      [akpm@linux-foundation.org: remove now-unused hugetlb_vma() stub]
      Signed-off-by: default avatarCliff Wickman <cpw@sgi.com>
      Reviewed-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Cc: Mel Gorman <mel@csn.ul.ie>
      Cc: Andrea Arcangeli <aarcange@redhat.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: David Sterba <dsterba@suse.cz>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: KOSAKI Motohiro <kosaki.motohiro@gmail.com>
      Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a9ff785e
    • Tomasz Figa's avatar
      drivers/rtc/rtc-max8998.c: check for pdata presence before dereferencing · 43c523bf
      Tomasz Figa authored
      Currently the driver can crash with a NULL pointer dereference if no
      pdata is provided, despite of successful registration of the MFD part.
      This patch fixes the problem by adding a NULL check before dereferencing
      the pdata pointer.
      Signed-off-by: default avatarTomasz Figa <t.figa@samsung.com>
      Signed-off-by: default avatarKyungmin Park <kyungmin.park@samsung.com>
      Cc: Sachin Kamat <sachin.kamat@linaro.org>
      Reviewed-by: default avatarJingoo Han <jg1.han@samsung.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      43c523bf
    • Joseph Qi's avatar
      ocfs2: goto out_unlock if ocfs2_get_clusters_nocache() failed in ocfs2_fiemap() · b4ca2b4b
      Joseph Qi authored
      Last time we found there is lock/unlock bug in ocfs2_file_aio_write, and
      then we did a thorough search for all lock resources in
      ocfs2_inode_info, including rw, inode and open lockres and found this
      bug.  My kernel version is 3.0.13, and it is also in the lastest version
      3.9.  In ocfs2_fiemap, once ocfs2_get_clusters_nocache failed, it should
      goto out_unlock instead of out, because we need release buffer head, up
      read alloc sem and unlock inode.
      Signed-off-by: default avatarJoseph Qi <joseph.qi@huawei.com>
      Reviewed-by: default avatarJie Liu <jeff.liu@oracle.com>
      Cc: Mark Fasheh <mfasheh@suse.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Acked-by: default avatarSunil Mushran <sunil.mushran@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b4ca2b4b
    • Jiri Kosina's avatar
      random: fix accounting race condition with lockless irq entropy_count update · 10b3a32d
      Jiri Kosina authored
      Commit 902c098a ("random: use lockless techniques in the interrupt
      path") turned IRQ path from being spinlock protected into lockless
      cmpxchg-retry update.
      
      That commit removed r->lock serialization between crediting entropy bits
      from IRQ context and accounting when extracting entropy on userspace
      read path, but didn't turn the r->entropy_count reads/updates in
      account() to use cmpxchg as well.
      
      It has been observed, that under certain circumstances this leads to
      read() on /dev/urandom to return 0 (EOF), as r->entropy_count gets
      corrupted and becomes negative, which in turn results in propagating 0
      all the way from account() to the actual read() call.
      
      Convert the accounting code to be the proper lockless counterpart of
      what has been partially done by 902c098a.
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Cc: Theodore Ts'o <tytso@mit.edu>
      Cc: Greg KH <greg@kroah.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      10b3a32d
    • Jarod Wilson's avatar
      drivers/char/random.c: fix priming of last_data · 1e7e2e05
      Jarod Wilson authored
      Commit ec8f02da ("random: prime last_data value per fips
      requirements") added priming of last_data per fips requirements.
      
      Unfortuantely, it did so in a way that can lead to multiple threads all
      incrementing nbytes, but only one actually doing anything with the extra
      data, which leads to some fun random corruption and panics.
      
      The fix is to simply do everything needed to prime last_data in a single
      shot, so there's no window for multiple cpus to increment nbytes -- in
      fact, we won't even increment or decrement nbytes anymore, we'll just
      extract the needed EXTRACT_SIZE one time per pool and then carry on with
      the normal routine.
      
      All these changes have been tested across multiple hosts and
      architectures where panics were previously encoutered.  The code changes
      are are strictly limited to areas only touched when when booted in fips
      mode.
      
      This change should also go into 3.8-stable, to make the myriads of fips
      users on 3.8.x happy.
      Signed-off-by: default avatarJarod Wilson <jarod@redhat.com>
      Tested-by: default avatarJan Stancek <jstancek@redhat.com>
      Tested-by: default avatarJan Stodola <jstodola@redhat.com>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Matt Mackall <mpm@selenic.com>
      Cc: "Theodore Ts'o" <tytso@mit.edu>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1e7e2e05
    • Randy Dunlap's avatar
      mm/memory_hotplug.c: fix printk format warnings · 348f9f05
      Randy Dunlap authored
      Fix printk format warnings in mm/memory_hotplug.c by using "%pa":
      
        mm/memory_hotplug.c: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 2 has type 'resource_size_t' [-Wformat]
        mm/memory_hotplug.c: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'resource_size_t' [-Wformat]
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Reported-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      348f9f05
    • Ryusuke Konishi's avatar
      nilfs2: fix issue of nilfs_set_page_dirty() for page at EOF boundary · 136e8770
      Ryusuke Konishi authored
      nilfs2: fix issue of nilfs_set_page_dirty for page at EOF boundary
      
      DESCRIPTION:
       There are use-cases when NILFS2 file system (formatted with block size
      lesser than 4 KB) can be remounted in RO mode because of encountering of
      "broken bmap" issue.
      
      The issue was reported by Anthony Doggett <Anthony2486@interfaces.org.uk>:
       "The machine I've been trialling nilfs on is running Debian Testing,
        Linux version 3.2.0-4-686-pae (debian-kernel@lists.debian.org) (gcc
        version 4.6.3 (Debian 4.6.3-14) ) #1 SMP Debian 3.2.35-2), but I've
        also reproduced it (identically) with Debian Unstable amd64 and Debian
        Experimental (using the 3.8-trunk kernel).  The problematic partitions
        were formatted with "mkfs.nilfs2 -b 1024 -B 8192"."
      
      SYMPTOMS:
      (1) System log contains error messages likewise:
      
          [63102.496756] nilfs_direct_assign: invalid pointer: 0
          [63102.496786] NILFS error (device dm-17): nilfs_bmap_assign: broken bmap (inode number=28)
          [63102.496798]
          [63102.524403] Remounting filesystem read-only
      
      (2) The NILFS2 file system is remounted in RO mode.
      
      REPRODUSING PATH:
      (1) Create volume group with name "unencrypted" by means of vgcreate utility.
      (2) Run script (prepared by Anthony Doggett <Anthony2486@interfaces.org.uk>):
      
      ----------------[BEGIN SCRIPT]--------------------
      
      VG=unencrypted
      lvcreate --size 2G --name ntest $VG
      mkfs.nilfs2 -b 1024 -B 8192 /dev/mapper/$VG-ntest
      mkdir /var/tmp/n
      mkdir /var/tmp/n/ntest
      mount /dev/mapper/$VG-ntest /var/tmp/n/ntest
      mkdir /var/tmp/n/ntest/thedir
      cd /var/tmp/n/ntest/thedir
      sleep 2
      date
      darcs init
      sleep 2
      dmesg|tail -n 5
      date
      darcs whatsnew || true
      date
      sleep 2
      dmesg|tail -n 5
      ----------------[END SCRIPT]--------------------
      
      REPRODUCIBILITY: 100%
      
      INVESTIGATION:
      As it was discovered, the issue takes place during segment
      construction after executing such sequence of user-space operations:
      
        open("_darcs/index", O_RDWR|O_CREAT|O_NOCTTY, 0666) = 7
        fstat(7, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
        ftruncate(7, 60)
      
      The error message "NILFS error (device dm-17): nilfs_bmap_assign: broken
      bmap (inode number=28)" takes place because of trying to get block
      number for third block of the file with logical offset #3072 bytes.  As
      it is possible to see from above output, the file has 60 bytes of the
      whole size.  So, it is enough one block (1 KB in size) allocation for
      the whole file.  Trying to operate with several blocks instead of one
      takes place because of discovering several dirty buffers for this file
      in nilfs_segctor_scan_file() method.
      
      The root cause of this issue is in nilfs_set_page_dirty function which
      is called just before writing to an mmapped page.
      
      When nilfs_page_mkwrite function handles a page at EOF boundary, it
      fills hole blocks only inside EOF through __block_page_mkwrite().
      
      The __block_page_mkwrite() function calls set_page_dirty() after filling
      hole blocks, thus nilfs_set_page_dirty function (=
      a_ops->set_page_dirty) is called.  However, the current implementation
      of nilfs_set_page_dirty() wrongly marks all buffers dirty even for page
      at EOF boundary.
      
      As a result, buffers outside EOF are inconsistently marked dirty and
      queued for write even though they are not mapped with nilfs_get_block
      function.
      
      FIX:
      This modifies nilfs_set_page_dirty() not to mark hole blocks dirty.
      
      Thanks to Vyacheslav Dubeyko for his effort on analysis and proposals
      for this issue.
      Signed-off-by: default avatarRyusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
      Reported-by: default avatarAnthony Doggett <Anthony2486@interfaces.org.uk>
      Reported-by: default avatarVyacheslav Dubeyko <slava@dubeyko.com>
      Cc: Vyacheslav Dubeyko <slava@dubeyko.com>
      Tested-by: default avatarRyusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      136e8770
    • Brian Behlendorf's avatar
      drivers/block/brd.c: fix brd_lookup_page() race · dfd20b2b
      Brian Behlendorf authored
      The index on the page must be set before it is inserted in the radix
      tree.  Otherwise there is a small race which can occur during lookup
      where the page can be found with the incorrect index.  This will trigger
      the BUG_ON() in brd_lookup_page().
      Signed-off-by: default avatarBrian Behlendorf <behlendorf1@llnl.gov>
      Reported-by: default avatarChris Wedgwood <cw@f00f.org>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      dfd20b2b
    • Geert Uytterhoeven's avatar
      fbdev: FB_GOLDFISH should depend on HAS_DMA · e5ee7305
      Geert Uytterhoeven authored
      If NO_DMA=y:
      
        drivers/built-in.o: In function `goldfish_fb_remove':
        drivers/video/goldfishfb.c:301: undefined reference to `dma_free_coherent'
        drivers/built-in.o: In function `goldfish_fb_probe':
        drivers/video/goldfishfb.c:247: undefined reference to `dma_alloc_coherent'
        drivers/video/goldfishfb.c:280: undefined reference to `dma_free_coherent'
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e5ee7305
    • Lars-Peter Clausen's avatar
      drivers/rtc/rtc-pl031.c: pass correct pointer to free_irq() · cac29af6
      Lars-Peter Clausen authored
      free_irq() expects the same pointer that was passed to request_irq(),
      otherwise the IRQ is not freed.
      
      The issue was found using the following coccinelle script:
      
        <smpl>
        @r1@
        type T;
        T devid;
        @@
        request_irq(..., devid)
      
        @r2@
        type r1.T;
        T devid;
        position p;
        @@
        free_irq@p(..., devid)
      
        @@
        position p != r2.p;
        @@
        *free_irq@p(...)
        </smpl>
      Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
      Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
      Cc: Linus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      cac29af6
    • Randy Dunlap's avatar
      auditfilter.c: fix kernel-doc warnings · 387b8b3e
      Randy Dunlap authored
      Fix kernel-doc warnings in kernel/auditfilter.c:
      
        Warning(kernel/auditfilter.c:1029): Excess function parameter 'loginuid' description in 'audit_receive_filter'
        Warning(kernel/auditfilter.c:1029): Excess function parameter 'sessionid' description in 'audit_receive_filter'
        Warning(kernel/auditfilter.c:1029): Excess function parameter 'sid' description in 'audit_receive_filter'
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: Eric Paris <eparis@redhat.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      387b8b3e
    • Jeff Moyer's avatar
      aio: fix io_getevents documentation · 6900807c
      Jeff Moyer authored
      In reviewing man pages, I noticed that io_getevents is documented to
      update the timeout that gets passed into the library call.  This doesn't
      happen in kernel space or in the library (even though it's documented to
      do so in both places).  Unless there is objection, I'd like to fix the
      comments/docs to match the code (I will also update the man page upon
      consensus).
      Signed-off-by: default avatarJeff Moyer <jmoyer@redhat.com>
      Signed-off-by: default avatarBenjamin LaHaise <bcrl@kvack.org>
      Acked-by: default avatarCyril Hrubis <chrubis@suse.cz>
      Acked-by: default avatarMichael Kerrisk <mtk.manpages@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6900807c
    • Andrew Morton's avatar
      revert "selftest: add simple test for soft-dirty bit" · 97c9266b
      Andrew Morton authored
      Revert commit 58c7be84 ("selftest: add simple test for soft-dirty
      bit").  This is the self test for Pavel's pagemap2 patches which didn't
      actually get merged.
      Reported-by: default avatarPavel Emelyanov <xemul@parallels.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      97c9266b
    • Christian Gmeiner's avatar
      drivers/leds/leds-ot200.c: fix error caused by shifted mask · 4b949b8a
      Christian Gmeiner authored
      During the development of this driver an in-house register documentation
      was used.  The last week some integration tests were done and this
      problem was found.  It turned out that the released register
      documentation is wrong.
      
      The fix is very simple: shift all masks by one.
      Signed-off-by: Christian Gmeiner's avatarChristian Gmeiner <christian.gmeiner@gmail.com>
      Cc: Bryan Wu <cooloney@gmail.com>
      Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      4b949b8a
    • Aneesh Kumar K.V's avatar
      mm/THP: use pmd_populate() to update the pmd with pgtable_t pointer · 7c342512
      Aneesh Kumar K.V authored
      We should not use set_pmd_at to update pmd_t with pgtable_t pointer.
      set_pmd_at is used to set pmd with huge pte entries and architectures
      like ppc64, clear few flags from the pte when saving a new entry.
      Without this change we observe bad pte errors like below on ppc64 with
      THP enabled.
      
        BUG: Bad page map in process ld mm=0xc000001ee39f4780 pte:7fc3f37848000001 pmd:c000001ec0000000
      Signed-off-by: default avatarAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Reviewed-by: default avatarAndrea Arcangeli <aarcange@redhat.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7c342512
    • Randy Dunlap's avatar
      linux/kernel.h: fix kernel-doc warning · 7450231f
      Randy Dunlap authored
      Fix kernel-doc warning in <linux/kernel.h>:
      
        Warning(include/linux/kernel.h:590): No description found for parameter 'ip'
      
      scripts/kernel-doc cannot handle macros, functions, or function
      prototypes between the function or macro that is being documented and
      its definition, so move these prototypes above the function that is
      being documented.
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7450231f
    • Leonid Yegoshin's avatar
      mm compaction: fix of improper cache flush in migration code · c2cc499c
      Leonid Yegoshin authored
      Page 'new' during MIGRATION can't be flushed with flush_cache_page().
      Using flush_cache_page(vma, addr, pfn) is justified only if the page is
      already placed in process page table, and that is done right after
      flush_cache_page().  But without it the arch function has no knowledge
      of process PTE and does nothing.
      
      Besides that, flush_cache_page() flushes an application cache page, but
      the kernel has a different page virtual address and dirtied it.
      
      Replace it with flush_dcache_page(new) which is the proper usage.
      
      The old page is flushed in try_to_unmap_one() before migration.
      
      This bug takes place in Sead3 board with M14Kc MIPS CPU without cache
      aliasing (but Harvard arch - separate I and D cache) in tight memory
      environment (128MB) each 1-3days on SOAK test.  It fails in cc1 during
      kernel build (SIGILL, SIGBUS, SIGSEG) if CONFIG_COMPACTION is switched
      ON.
      Signed-off-by: default avatarLeonid Yegoshin <Leonid.Yegoshin@imgtec.com>
      Cc: Leonid Yegoshin <yegoshin@mips.com>
      Acked-by: default avatarRik van Riel <riel@redhat.com>
      Cc: Michal Hocko <mhocko@suse.cz>
      Acked-by: default avatarMel Gorman <mgorman@suse.de>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Russell King <rmk@arm.linux.org.uk>
      Cc: David Miller <davem@davemloft.net>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c2cc499c
    • Alexandre Bounine's avatar
      rapidio/tsi721: fix bug in MSI interrupt handling · 1ccc819d
      Alexandre Bounine authored
      Fix bug in MSI interrupt handling which causes loss of event
      notifications.
      
      Typical indication of lost MSI interrupts are stalled message and
      doorbell transfers between RapidIO endpoints.  To avoid loss of MSI
      interrupts all interrupts from the device must be disabled on entering
      the interrupt handler routine and re-enabled when exiting it.
      Re-enabling device interrupts will trigger new MSI message(s) if Tsi721
      registered new events since entering interrupt handler routine.
      
      This patch is applicable to kernel versions starting from v3.2.
      Signed-off-by: default avatarAlexandre Bounine <alexandre.bounine@idt.com>
      Cc: Matt Porter <mporter@kernel.crashing.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1ccc819d
    • Jeff Mahoney's avatar
      hfs: avoid crash in hfs_bnode_create · fb09c373
      Jeff Mahoney authored
      Commit 634725a9 ("hfs: cleanup HFS+ prints") removed the BUG_ON in
      hfs_bnode_create in hfsplus.  This patch removes it from the hfs version
      and avoids an fsfuzzer crash.
      Signed-off-by: default avatarJeff Mahoney <jeffm@suse.com>
      Acked-by: default avatarJeff Mahoney <jeffm@suse.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      Cc: Vyacheslav Dubeyko <slava@dubeyko.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fb09c373
    • Johannes Weiner's avatar
      mm: memcg: remove incorrect VM_BUG_ON for swap cache pages in uncharge · 28ccddf7
      Johannes Weiner authored
      Commit 0c59b89c ("mm: memcg: push down PageSwapCache check into
      uncharge entry functions") added a VM_BUG_ON() on PageSwapCache in the
      uncharge path after checking that page flag once, assuming that the
      state is stable in all paths, but this is not the case and the condition
      triggers in user environments.  An uncharge after the last page table
      reference to the page goes away can race with reclaim adding the page to
      swap cache.
      
      Swap cache pages are usually uncharged when they are freed after
      swapout, from a path that also handles swap usage accounting and memcg
      lifetime management.  However, since the last page table reference is
      gone and thus no references to the swap slot left, the swap slot will be
      freed shortly when reclaim attempts to write the page to disk.  The
      whole swap accounting is not even necessary.
      
      So while the race condition for which this VM_BUG_ON was added is real
      and actually existed all along, there are no negative effects.  Remove
      the VM_BUG_ON again.
      Reported-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
      Reported-by: default avatarLingzhu Xiang <lxiang@redhat.com>
      Signed-off-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Acked-by: default avatarHugh Dickins <hughd@google.com>
      Acked-by: default avatarMichal Hocko <mhocko@suse.cz>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      28ccddf7
    • Stephen Warren's avatar
      drivers/video: implement a simple framebuffer driver · 26549c8d
      Stephen Warren authored
      A simple frame-buffer describes a raw memory region that may be rendered
      to, with the assumption that the display hardware has already been set
      up to scan out from that buffer.
      
      This is useful in cases where a bootloader exists and has set up the
      display hardware, but a Linux driver doesn't yet exist for the display
      hardware.
      
      Examples use-cases include:
      
      * The built-in LCD panels on the Samsung ARM chromebook, and Tegra
        devices, and likely many other ARM or embedded systems.  These cannot
        yet be supported using a full graphics driver, since the panel control
        should be provided by the CDF (Common Display Framework), which has been
        stuck in design/review for quite some time.  One could support these
        panels using custom SoC-specific code, but there is a desire to use
        common infra-structure rather than having each SoC vendor invent their
        own code, hence the desire to wait for CDF.
      
      * Hardware for which a full graphics driver is not yet available, and
        the path to obtain one upstream isn't yet clear.  For example, the
        Raspberry Pi.
      
      * Any hardware in early stages of upstreaming, before a full graphics
        driver has been tackled.  This driver can provide a graphical boot
        console (even full X support) much earlier in the upstreaming process,
        thus making new SoC or board support more generally useful earlier.
      
      [akpm@linux-foundation.org: make simplefb_formats[] static]
      Signed-off-by: default avatarStephen Warren <swarren@wwwdotorg.org>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarOlof Johansson <olof@lixom.net>
      Cc: Rob Clark <robclark@gmail.com>
      Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
      Cc: Tomasz Figa <tomasz.figa@gmail.com>
      Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      26549c8d
    • Joseph Qi's avatar
      ocfs2: unlock rw lock if inode lock failed · afe1bb73
      Joseph Qi authored
      In ocfs2_file_aio_write(), it does ocfs2_rw_lock() first and then
      ocfs2_inode_lock().
      
      But if ocfs2_inode_lock() failed, it goes to out_sems without unlocking
      rw lock.  This will cause a bug in ocfs2_lock_res_free() when testing
      res->l_ex_holders, which is increased in __ocfs2_cluster_lock() and
      decreased in __ocfs2_cluster_unlock().
      Signed-off-by: default avatarJoseph Qi <joseph.qi@huawei.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Mark Fasheh <mfasheh@suse.com>
      Cc: Li Zefan <lizefan@huawei.com>
      Cc: "Duyongfeng (B)" <du.duyongfeng@huawei.com>
      Acked-by: default avatarSunil Mushran <sunil.mushran@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      afe1bb73
    • Xiao Guangrong's avatar
      mm: mmu_notifier: re-fix freed page still mapped in secondary MMU · d34883d4
      Xiao Guangrong authored
      Commit 751efd86 ("mmu_notifier_unregister NULL Pointer deref and
      multiple ->release()") breaks the fix 3ad3d901 ("mm: mmu_notifier:
      fix freed page still mapped in secondary MMU").
      
      Since hlist_for_each_entry_rcu() is changed now, we can not revert that
      patch directly, so this patch reverts the commit and simply fix the bug
      spotted by that patch
      
      This bug spotted by commit 751efd86 is:
      
          There is a race condition between mmu_notifier_unregister() and
          __mmu_notifier_release().
      
          Assume two tasks, one calling mmu_notifier_unregister() as a result
          of a filp_close() ->flush() callout (task A), and the other calling
          mmu_notifier_release() from an mmput() (task B).
      
                              A                               B
          t1                                            srcu_read_lock()
          t2            if (!hlist_unhashed())
          t3                                            srcu_read_unlock()
          t4            srcu_read_lock()
          t5                                            hlist_del_init_rcu()
          t6                                            synchronize_srcu()
          t7            srcu_read_unlock()
          t8            hlist_del_rcu()  <--- NULL pointer deref.
      
      This can be fixed by using hlist_del_init_rcu instead of hlist_del_rcu.
      
      The another issue spotted in the commit is "multiple ->release()
      callouts", we needn't care it too much because it is really rare (e.g,
      can not happen on kvm since mmu-notify is unregistered after
      exit_mmap()) and the later call of multiple ->release should be fast
      since all the pages have already been released by the first call.
      Anyway, this issue should be fixed in a separate patch.
      
      -stable suggestions: Any version that has commit 751efd86 need to be
      backported.  I find the oldest version has this commit is 3.0-stable.
      
      [akpm@linux-foundation.org: tweak comments]
      Signed-off-by: default avatarXiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
      Tested-by: default avatarRobin Holt <holt@sgi.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d34883d4