1. 29 Aug, 2013 31 commits
  2. 20 Aug, 2013 9 commits
    • Greg Kroah-Hartman's avatar
      Linux 3.10.9 · 0a4b6d4f
      Greg Kroah-Hartman authored
      0a4b6d4f
    • Greg Kroah-Hartman's avatar
      Revert "genetlink: fix family dump race" · 8e743085
      Greg Kroah-Hartman authored
      This reverts commit aab4f8d4, commit
      58ad436f upstream, as it causes
      problems.
      
      Cc: Johannes Berg <johannes.berg@intel.com>
      Cc: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
      Cc: David S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      8e743085
    • Greg Kroah-Hartman's avatar
      Linux 3.10.8 · 6f540594
      Greg Kroah-Hartman authored
      6f540594
    • Li Zefan's avatar
      cpuset: fix the return value of cpuset_write_u64() · 9fa60186
      Li Zefan authored
      commit a903f086 upstream.
      
      Writing to this file always returns -ENODEV:
      
        # echo 1 > cpuset.memory_pressure_enabled
        -bash: echo: write error: No such device
      Signed-off-by: default avatarLi Zefan <lizefan@huawei.com>
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9fa60186
    • Jan Kara's avatar
      jbd2: Fix use after free after error in jbd2_journal_dirty_metadata() · 94aa327e
      Jan Kara authored
      commit 91aa11fa upstream.
      
      When jbd2_journal_dirty_metadata() returns error,
      __ext4_handle_dirty_metadata() stops the handle. However callers of this
      function do not count with that fact and still happily used now freed
      handle. This use after free can result in various issues but very likely
      we oops soon.
      
      The motivation of adding __ext4_journal_stop() into
      __ext4_handle_dirty_metadata() in commit 9ea7a0df seems to be only to
      improve error reporting. So replace __ext4_journal_stop() with
      ext4_journal_abort_handle() which was there before that commit and add
      WARN_ON_ONCE() to dump stack to provide useful information.
      Reported-by: default avatarSage Weil <sage@inktank.com>
      Signed-off-by: default avatarJan Kara <jack@suse.cz>
      Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      94aa327e
    • Guenter Roeck's avatar
      s390: Fix broken build · 9234930d
      Guenter Roeck authored
      commit 215b28a5 upstream.
      
      Fix this build error:
      
        In file included from fs/exec.c:61:0:
        arch/s390/include/asm/tlb.h:35:23: error: expected identifier or '(' before 'unsigned'
        arch/s390/include/asm/tlb.h:36:1: warning: no semicolon at end of struct or union [enabled by default]
        arch/s390/include/asm/tlb.h: In function 'tlb_gather_mmu':
        arch/s390/include/asm/tlb.h:57:5: error: 'struct mmu_gather' has no member named 'end'
      
      Broken due to commit 2b047252 ("Fix TLB gather virtual address range
      invalidation corner cases").
      
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      [ Oh well. We had build testing for ppc amd um, but no s390  - Linus ]
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9234930d
    • Geert Uytterhoeven's avatar
      m68k/atari: ARAnyM - Fix NatFeat module support · 571b78a1
      Geert Uytterhoeven authored
      commit e8184e10 upstream.
      
      As pointed out by Andreas Schwab, pointers passed to ARAnyM NatFeat calls
      should be physical addresses, not virtual addresses.
      
      Fortunately on Atari, physical and virtual kernel addresses are the same,
      as long as normal kernel memory is concerned, so this usually worked fine
      without conversion.
      
      But for modules, pointers to literal strings are located in vmalloc()ed
      memory. Depending on the version of ARAnyM, this causes the nf_get_id()
      call to just fail, or worse, crash ARAnyM itself with e.g.
      
          Gotcha! Illegal memory access. Atari PC = $968c
      
      This is a big issue for distro kernels, who want to have all drivers as
      loadable modules in an initrd.
      
      Add a wrapper for nf_get_id() that copies the literal to the stack to
      work around this issue.
      Reported-by: default avatarThorsten Glaser <tg@debian.org>
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      571b78a1
    • Andreas Schwab's avatar
      m68k: Truncate base in do_div() · e5a16a44
      Andreas Schwab authored
      commit ea077b1b upstream.
      
      Explicitly truncate the second operand of do_div() to 32 bits to guard
      against bogus code calling it with a 64-bit divisor.
      
      [Thorsten]
      
      After upgrading from 3.2 to 3.10, mounting a btrfs volume fails with:
      
      btrfs: setting nodatacow, compression disabled
      btrfs: enabling auto recovery
      btrfs: disk space caching is enabled
        *** ZERO DIVIDE ***   FORMAT=2
      Current process id is 722
      BAD KERNEL TRAP: 00000000
      Modules linked in: evdev mac_hid ext4 crc16 jbd2 mbcache btrfs xor lzo_compress zlib_deflate raid6_pq crc32c libcrc32c
      PC: [<319535b2>] __btrfs_map_block+0x11c/0x119a [btrfs]
      SR: 2000  SP: 30c1fab4  a2: 30f0faf0
      d0: 00000000    d1: 00001000    d2: 00000000    d3: 00000000
      d4: 00010000    d5: 00000000    a0: 3085c72c    a1: 3085c72c
      Process mount (pid: 722, task=30f0faf0)
      Frame format=2 instr addr=319535ae
      Stack from 30c1faec:
              00000000 00000020 00000000 00001000 00000000 01401000 30253928 300ffc00
              00a843ac 3026f640 00000000 00010000 0009e250 00d106c0 00011220 00000000
              00001000 301c6830 0009e32a 000000ff 00000009 3085c72c 00000000 00000000
              30c1fd14 00000000 00000020 00000000 30c1fd14 0009e26c 00000020 00000003
              00000000 0009dd8a 300b0b6c 30253928 00a843ac 00001000 00000000 00000000
              0000a008 3194e76a 30253928 00a843ac 00001000 00000000 00000000 00000002
      Call Trace: [<00001000>] kernel_pg_dir+0x0/0x1000
      
          [...]
      
      Code: 222e ff74 2a2e ff5c 2c2e ff60 4c45 1402 <2d40> ff64 2d41 ff68 2205 4c2e 1800 ff68 4c04 0800 2041 d1c0 2206 4c2e 1400 ff68
      
      [Geert]
      
      As diagnosed by Andreas, fs/btrfs/volumes.c:__btrfs_map_block()
      calls
      
          do_div(stripe_nr, stripe_len);
      
      with stripe_len u64, while do_div() assumes the divisor is a 32-bit number.
      
      Due to the lack of truncation in the m68k-specific implementation of
      do_div(), the division is performed using the upper 32-bit word of
      stripe_len, which is zero.
      
      This was introduced by commit 53b381b3
      ("Btrfs: RAID5 and RAID6"), which changed the divisor from
      map->stripe_len (struct map_lookup.stripe_len is int) to a 64-bit temporary.
      Reported-by: default avatarThorsten Glaser <tg@debian.org>
      Signed-off-by: default avatarAndreas Schwab <schwab@linux-m68k.org>
      Tested-by: default avatarThorsten Glaser <tg@debian.org>
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e5a16a44
    • Will Deacon's avatar
      ARM: 7809/1: perf: fix event validation for software group leaders · 85932546
      Will Deacon authored
      commit c95eb318 upstream.
      
      It is possible to construct an event group with a software event as a
      group leader and then subsequently add a hardware event to the group.
      This results in the event group being validated by adding all members
      of the group to a fake PMU and attempting to allocate each event on
      their respective PMU.
      
      Unfortunately, for software events wthout a corresponding arm_pmu, this
      results in a kernel crash attempting to dereference the ->get_event_idx
      function pointer.
      
      This patch fixes the problem by checking explicitly for software events
      and ignoring those in event validation (since they can always be
      scheduled). We will probably want to revisit this for 3.12, since the
      validation checks don't appear to work correctly when dealing with
      multiple hardware PMUs anyway.
      Reported-by: default avatarVince Weaver <vincent.weaver@maine.edu>
      Tested-by: default avatarVince Weaver <vincent.weaver@maine.edu>
      Tested-by: default avatarMark Rutland <mark.rutland@arm.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      85932546