1. 24 May, 2013 40 commits
    • Jiri Kosina's avatar
      random: fix accounting race condition with lockless irq entropy_count update · 10b3a32d
      Jiri Kosina authored
      Commit 902c098a ("random: use lockless techniques in the interrupt
      path") turned IRQ path from being spinlock protected into lockless
      cmpxchg-retry update.
      
      That commit removed r->lock serialization between crediting entropy bits
      from IRQ context and accounting when extracting entropy on userspace
      read path, but didn't turn the r->entropy_count reads/updates in
      account() to use cmpxchg as well.
      
      It has been observed, that under certain circumstances this leads to
      read() on /dev/urandom to return 0 (EOF), as r->entropy_count gets
      corrupted and becomes negative, which in turn results in propagating 0
      all the way from account() to the actual read() call.
      
      Convert the accounting code to be the proper lockless counterpart of
      what has been partially done by 902c098a.
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Cc: Theodore Ts'o <tytso@mit.edu>
      Cc: Greg KH <greg@kroah.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      10b3a32d
    • Jarod Wilson's avatar
      drivers/char/random.c: fix priming of last_data · 1e7e2e05
      Jarod Wilson authored
      Commit ec8f02da ("random: prime last_data value per fips
      requirements") added priming of last_data per fips requirements.
      
      Unfortuantely, it did so in a way that can lead to multiple threads all
      incrementing nbytes, but only one actually doing anything with the extra
      data, which leads to some fun random corruption and panics.
      
      The fix is to simply do everything needed to prime last_data in a single
      shot, so there's no window for multiple cpus to increment nbytes -- in
      fact, we won't even increment or decrement nbytes anymore, we'll just
      extract the needed EXTRACT_SIZE one time per pool and then carry on with
      the normal routine.
      
      All these changes have been tested across multiple hosts and
      architectures where panics were previously encoutered.  The code changes
      are are strictly limited to areas only touched when when booted in fips
      mode.
      
      This change should also go into 3.8-stable, to make the myriads of fips
      users on 3.8.x happy.
      Signed-off-by: default avatarJarod Wilson <jarod@redhat.com>
      Tested-by: default avatarJan Stancek <jstancek@redhat.com>
      Tested-by: default avatarJan Stodola <jstodola@redhat.com>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Matt Mackall <mpm@selenic.com>
      Cc: "Theodore Ts'o" <tytso@mit.edu>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1e7e2e05
    • Randy Dunlap's avatar
      mm/memory_hotplug.c: fix printk format warnings · 348f9f05
      Randy Dunlap authored
      Fix printk format warnings in mm/memory_hotplug.c by using "%pa":
      
        mm/memory_hotplug.c: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 2 has type 'resource_size_t' [-Wformat]
        mm/memory_hotplug.c: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'resource_size_t' [-Wformat]
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Reported-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      348f9f05
    • Ryusuke Konishi's avatar
      nilfs2: fix issue of nilfs_set_page_dirty() for page at EOF boundary · 136e8770
      Ryusuke Konishi authored
      nilfs2: fix issue of nilfs_set_page_dirty for page at EOF boundary
      
      DESCRIPTION:
       There are use-cases when NILFS2 file system (formatted with block size
      lesser than 4 KB) can be remounted in RO mode because of encountering of
      "broken bmap" issue.
      
      The issue was reported by Anthony Doggett <Anthony2486@interfaces.org.uk>:
       "The machine I've been trialling nilfs on is running Debian Testing,
        Linux version 3.2.0-4-686-pae (debian-kernel@lists.debian.org) (gcc
        version 4.6.3 (Debian 4.6.3-14) ) #1 SMP Debian 3.2.35-2), but I've
        also reproduced it (identically) with Debian Unstable amd64 and Debian
        Experimental (using the 3.8-trunk kernel).  The problematic partitions
        were formatted with "mkfs.nilfs2 -b 1024 -B 8192"."
      
      SYMPTOMS:
      (1) System log contains error messages likewise:
      
          [63102.496756] nilfs_direct_assign: invalid pointer: 0
          [63102.496786] NILFS error (device dm-17): nilfs_bmap_assign: broken bmap (inode number=28)
          [63102.496798]
          [63102.524403] Remounting filesystem read-only
      
      (2) The NILFS2 file system is remounted in RO mode.
      
      REPRODUSING PATH:
      (1) Create volume group with name "unencrypted" by means of vgcreate utility.
      (2) Run script (prepared by Anthony Doggett <Anthony2486@interfaces.org.uk>):
      
      ----------------[BEGIN SCRIPT]--------------------
      
      VG=unencrypted
      lvcreate --size 2G --name ntest $VG
      mkfs.nilfs2 -b 1024 -B 8192 /dev/mapper/$VG-ntest
      mkdir /var/tmp/n
      mkdir /var/tmp/n/ntest
      mount /dev/mapper/$VG-ntest /var/tmp/n/ntest
      mkdir /var/tmp/n/ntest/thedir
      cd /var/tmp/n/ntest/thedir
      sleep 2
      date
      darcs init
      sleep 2
      dmesg|tail -n 5
      date
      darcs whatsnew || true
      date
      sleep 2
      dmesg|tail -n 5
      ----------------[END SCRIPT]--------------------
      
      REPRODUCIBILITY: 100%
      
      INVESTIGATION:
      As it was discovered, the issue takes place during segment
      construction after executing such sequence of user-space operations:
      
        open("_darcs/index", O_RDWR|O_CREAT|O_NOCTTY, 0666) = 7
        fstat(7, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
        ftruncate(7, 60)
      
      The error message "NILFS error (device dm-17): nilfs_bmap_assign: broken
      bmap (inode number=28)" takes place because of trying to get block
      number for third block of the file with logical offset #3072 bytes.  As
      it is possible to see from above output, the file has 60 bytes of the
      whole size.  So, it is enough one block (1 KB in size) allocation for
      the whole file.  Trying to operate with several blocks instead of one
      takes place because of discovering several dirty buffers for this file
      in nilfs_segctor_scan_file() method.
      
      The root cause of this issue is in nilfs_set_page_dirty function which
      is called just before writing to an mmapped page.
      
      When nilfs_page_mkwrite function handles a page at EOF boundary, it
      fills hole blocks only inside EOF through __block_page_mkwrite().
      
      The __block_page_mkwrite() function calls set_page_dirty() after filling
      hole blocks, thus nilfs_set_page_dirty function (=
      a_ops->set_page_dirty) is called.  However, the current implementation
      of nilfs_set_page_dirty() wrongly marks all buffers dirty even for page
      at EOF boundary.
      
      As a result, buffers outside EOF are inconsistently marked dirty and
      queued for write even though they are not mapped with nilfs_get_block
      function.
      
      FIX:
      This modifies nilfs_set_page_dirty() not to mark hole blocks dirty.
      
      Thanks to Vyacheslav Dubeyko for his effort on analysis and proposals
      for this issue.
      Signed-off-by: default avatarRyusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
      Reported-by: default avatarAnthony Doggett <Anthony2486@interfaces.org.uk>
      Reported-by: default avatarVyacheslav Dubeyko <slava@dubeyko.com>
      Cc: Vyacheslav Dubeyko <slava@dubeyko.com>
      Tested-by: default avatarRyusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      136e8770
    • Brian Behlendorf's avatar
      drivers/block/brd.c: fix brd_lookup_page() race · dfd20b2b
      Brian Behlendorf authored
      The index on the page must be set before it is inserted in the radix
      tree.  Otherwise there is a small race which can occur during lookup
      where the page can be found with the incorrect index.  This will trigger
      the BUG_ON() in brd_lookup_page().
      Signed-off-by: default avatarBrian Behlendorf <behlendorf1@llnl.gov>
      Reported-by: default avatarChris Wedgwood <cw@f00f.org>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      dfd20b2b
    • Geert Uytterhoeven's avatar
      fbdev: FB_GOLDFISH should depend on HAS_DMA · e5ee7305
      Geert Uytterhoeven authored
      If NO_DMA=y:
      
        drivers/built-in.o: In function `goldfish_fb_remove':
        drivers/video/goldfishfb.c:301: undefined reference to `dma_free_coherent'
        drivers/built-in.o: In function `goldfish_fb_probe':
        drivers/video/goldfishfb.c:247: undefined reference to `dma_alloc_coherent'
        drivers/video/goldfishfb.c:280: undefined reference to `dma_free_coherent'
      Signed-off-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e5ee7305
    • Lars-Peter Clausen's avatar
      drivers/rtc/rtc-pl031.c: pass correct pointer to free_irq() · cac29af6
      Lars-Peter Clausen authored
      free_irq() expects the same pointer that was passed to request_irq(),
      otherwise the IRQ is not freed.
      
      The issue was found using the following coccinelle script:
      
        <smpl>
        @r1@
        type T;
        T devid;
        @@
        request_irq(..., devid)
      
        @r2@
        type r1.T;
        T devid;
        position p;
        @@
        free_irq@p(..., devid)
      
        @@
        position p != r2.p;
        @@
        *free_irq@p(...)
        </smpl>
      Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
      Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
      Cc: Linus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      cac29af6
    • Randy Dunlap's avatar
      auditfilter.c: fix kernel-doc warnings · 387b8b3e
      Randy Dunlap authored
      Fix kernel-doc warnings in kernel/auditfilter.c:
      
        Warning(kernel/auditfilter.c:1029): Excess function parameter 'loginuid' description in 'audit_receive_filter'
        Warning(kernel/auditfilter.c:1029): Excess function parameter 'sessionid' description in 'audit_receive_filter'
        Warning(kernel/auditfilter.c:1029): Excess function parameter 'sid' description in 'audit_receive_filter'
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: Eric Paris <eparis@redhat.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      387b8b3e
    • Jeff Moyer's avatar
      aio: fix io_getevents documentation · 6900807c
      Jeff Moyer authored
      In reviewing man pages, I noticed that io_getevents is documented to
      update the timeout that gets passed into the library call.  This doesn't
      happen in kernel space or in the library (even though it's documented to
      do so in both places).  Unless there is objection, I'd like to fix the
      comments/docs to match the code (I will also update the man page upon
      consensus).
      Signed-off-by: default avatarJeff Moyer <jmoyer@redhat.com>
      Signed-off-by: default avatarBenjamin LaHaise <bcrl@kvack.org>
      Acked-by: default avatarCyril Hrubis <chrubis@suse.cz>
      Acked-by: default avatarMichael Kerrisk <mtk.manpages@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6900807c
    • Andrew Morton's avatar
      revert "selftest: add simple test for soft-dirty bit" · 97c9266b
      Andrew Morton authored
      Revert commit 58c7be84 ("selftest: add simple test for soft-dirty
      bit").  This is the self test for Pavel's pagemap2 patches which didn't
      actually get merged.
      Reported-by: default avatarPavel Emelyanov <xemul@parallels.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      97c9266b
    • Christian Gmeiner's avatar
      drivers/leds/leds-ot200.c: fix error caused by shifted mask · 4b949b8a
      Christian Gmeiner authored
      During the development of this driver an in-house register documentation
      was used.  The last week some integration tests were done and this
      problem was found.  It turned out that the released register
      documentation is wrong.
      
      The fix is very simple: shift all masks by one.
      Signed-off-by: default avatarChristian Gmeiner <christian.gmeiner@gmail.com>
      Cc: Bryan Wu <cooloney@gmail.com>
      Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      4b949b8a
    • Aneesh Kumar K.V's avatar
      mm/THP: use pmd_populate() to update the pmd with pgtable_t pointer · 7c342512
      Aneesh Kumar K.V authored
      We should not use set_pmd_at to update pmd_t with pgtable_t pointer.
      set_pmd_at is used to set pmd with huge pte entries and architectures
      like ppc64, clear few flags from the pte when saving a new entry.
      Without this change we observe bad pte errors like below on ppc64 with
      THP enabled.
      
        BUG: Bad page map in process ld mm=0xc000001ee39f4780 pte:7fc3f37848000001 pmd:c000001ec0000000
      Signed-off-by: default avatarAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Reviewed-by: default avatarAndrea Arcangeli <aarcange@redhat.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7c342512
    • Randy Dunlap's avatar
      linux/kernel.h: fix kernel-doc warning · 7450231f
      Randy Dunlap authored
      Fix kernel-doc warning in <linux/kernel.h>:
      
        Warning(include/linux/kernel.h:590): No description found for parameter 'ip'
      
      scripts/kernel-doc cannot handle macros, functions, or function
      prototypes between the function or macro that is being documented and
      its definition, so move these prototypes above the function that is
      being documented.
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7450231f
    • Leonid Yegoshin's avatar
      mm compaction: fix of improper cache flush in migration code · c2cc499c
      Leonid Yegoshin authored
      Page 'new' during MIGRATION can't be flushed with flush_cache_page().
      Using flush_cache_page(vma, addr, pfn) is justified only if the page is
      already placed in process page table, and that is done right after
      flush_cache_page().  But without it the arch function has no knowledge
      of process PTE and does nothing.
      
      Besides that, flush_cache_page() flushes an application cache page, but
      the kernel has a different page virtual address and dirtied it.
      
      Replace it with flush_dcache_page(new) which is the proper usage.
      
      The old page is flushed in try_to_unmap_one() before migration.
      
      This bug takes place in Sead3 board with M14Kc MIPS CPU without cache
      aliasing (but Harvard arch - separate I and D cache) in tight memory
      environment (128MB) each 1-3days on SOAK test.  It fails in cc1 during
      kernel build (SIGILL, SIGBUS, SIGSEG) if CONFIG_COMPACTION is switched
      ON.
      Signed-off-by: default avatarLeonid Yegoshin <Leonid.Yegoshin@imgtec.com>
      Cc: Leonid Yegoshin <yegoshin@mips.com>
      Acked-by: default avatarRik van Riel <riel@redhat.com>
      Cc: Michal Hocko <mhocko@suse.cz>
      Acked-by: default avatarMel Gorman <mgorman@suse.de>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Russell King <rmk@arm.linux.org.uk>
      Cc: David Miller <davem@davemloft.net>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c2cc499c
    • Alexandre Bounine's avatar
      rapidio/tsi721: fix bug in MSI interrupt handling · 1ccc819d
      Alexandre Bounine authored
      Fix bug in MSI interrupt handling which causes loss of event
      notifications.
      
      Typical indication of lost MSI interrupts are stalled message and
      doorbell transfers between RapidIO endpoints.  To avoid loss of MSI
      interrupts all interrupts from the device must be disabled on entering
      the interrupt handler routine and re-enabled when exiting it.
      Re-enabling device interrupts will trigger new MSI message(s) if Tsi721
      registered new events since entering interrupt handler routine.
      
      This patch is applicable to kernel versions starting from v3.2.
      Signed-off-by: default avatarAlexandre Bounine <alexandre.bounine@idt.com>
      Cc: Matt Porter <mporter@kernel.crashing.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1ccc819d
    • Jeff Mahoney's avatar
      hfs: avoid crash in hfs_bnode_create · fb09c373
      Jeff Mahoney authored
      Commit 634725a9 ("hfs: cleanup HFS+ prints") removed the BUG_ON in
      hfs_bnode_create in hfsplus.  This patch removes it from the hfs version
      and avoids an fsfuzzer crash.
      Signed-off-by: default avatarJeff Mahoney <jeffm@suse.com>
      Acked-by: default avatarJeff Mahoney <jeffm@suse.com>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      Cc: Vyacheslav Dubeyko <slava@dubeyko.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fb09c373
    • Johannes Weiner's avatar
      mm: memcg: remove incorrect VM_BUG_ON for swap cache pages in uncharge · 28ccddf7
      Johannes Weiner authored
      Commit 0c59b89c ("mm: memcg: push down PageSwapCache check into
      uncharge entry functions") added a VM_BUG_ON() on PageSwapCache in the
      uncharge path after checking that page flag once, assuming that the
      state is stable in all paths, but this is not the case and the condition
      triggers in user environments.  An uncharge after the last page table
      reference to the page goes away can race with reclaim adding the page to
      swap cache.
      
      Swap cache pages are usually uncharged when they are freed after
      swapout, from a path that also handles swap usage accounting and memcg
      lifetime management.  However, since the last page table reference is
      gone and thus no references to the swap slot left, the swap slot will be
      freed shortly when reclaim attempts to write the page to disk.  The
      whole swap accounting is not even necessary.
      
      So while the race condition for which this VM_BUG_ON was added is real
      and actually existed all along, there are no negative effects.  Remove
      the VM_BUG_ON again.
      Reported-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
      Reported-by: default avatarLingzhu Xiang <lxiang@redhat.com>
      Signed-off-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Acked-by: default avatarHugh Dickins <hughd@google.com>
      Acked-by: default avatarMichal Hocko <mhocko@suse.cz>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      28ccddf7
    • Stephen Warren's avatar
      drivers/video: implement a simple framebuffer driver · 26549c8d
      Stephen Warren authored
      A simple frame-buffer describes a raw memory region that may be rendered
      to, with the assumption that the display hardware has already been set
      up to scan out from that buffer.
      
      This is useful in cases where a bootloader exists and has set up the
      display hardware, but a Linux driver doesn't yet exist for the display
      hardware.
      
      Examples use-cases include:
      
      * The built-in LCD panels on the Samsung ARM chromebook, and Tegra
        devices, and likely many other ARM or embedded systems.  These cannot
        yet be supported using a full graphics driver, since the panel control
        should be provided by the CDF (Common Display Framework), which has been
        stuck in design/review for quite some time.  One could support these
        panels using custom SoC-specific code, but there is a desire to use
        common infra-structure rather than having each SoC vendor invent their
        own code, hence the desire to wait for CDF.
      
      * Hardware for which a full graphics driver is not yet available, and
        the path to obtain one upstream isn't yet clear.  For example, the
        Raspberry Pi.
      
      * Any hardware in early stages of upstreaming, before a full graphics
        driver has been tackled.  This driver can provide a graphical boot
        console (even full X support) much earlier in the upstreaming process,
        thus making new SoC or board support more generally useful earlier.
      
      [akpm@linux-foundation.org: make simplefb_formats[] static]
      Signed-off-by: default avatarStephen Warren <swarren@wwwdotorg.org>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Acked-by: default avatarOlof Johansson <olof@lixom.net>
      Cc: Rob Clark <robclark@gmail.com>
      Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
      Cc: Tomasz Figa <tomasz.figa@gmail.com>
      Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      26549c8d
    • Joseph Qi's avatar
      ocfs2: unlock rw lock if inode lock failed · afe1bb73
      Joseph Qi authored
      In ocfs2_file_aio_write(), it does ocfs2_rw_lock() first and then
      ocfs2_inode_lock().
      
      But if ocfs2_inode_lock() failed, it goes to out_sems without unlocking
      rw lock.  This will cause a bug in ocfs2_lock_res_free() when testing
      res->l_ex_holders, which is increased in __ocfs2_cluster_lock() and
      decreased in __ocfs2_cluster_unlock().
      Signed-off-by: default avatarJoseph Qi <joseph.qi@huawei.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Mark Fasheh <mfasheh@suse.com>
      Cc: Li Zefan <lizefan@huawei.com>
      Cc: "Duyongfeng (B)" <du.duyongfeng@huawei.com>
      Acked-by: default avatarSunil Mushran <sunil.mushran@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      afe1bb73
    • Xiao Guangrong's avatar
      mm: mmu_notifier: re-fix freed page still mapped in secondary MMU · d34883d4
      Xiao Guangrong authored
      Commit 751efd86 ("mmu_notifier_unregister NULL Pointer deref and
      multiple ->release()") breaks the fix 3ad3d901 ("mm: mmu_notifier:
      fix freed page still mapped in secondary MMU").
      
      Since hlist_for_each_entry_rcu() is changed now, we can not revert that
      patch directly, so this patch reverts the commit and simply fix the bug
      spotted by that patch
      
      This bug spotted by commit 751efd86 is:
      
          There is a race condition between mmu_notifier_unregister() and
          __mmu_notifier_release().
      
          Assume two tasks, one calling mmu_notifier_unregister() as a result
          of a filp_close() ->flush() callout (task A), and the other calling
          mmu_notifier_release() from an mmput() (task B).
      
                              A                               B
          t1                                            srcu_read_lock()
          t2            if (!hlist_unhashed())
          t3                                            srcu_read_unlock()
          t4            srcu_read_lock()
          t5                                            hlist_del_init_rcu()
          t6                                            synchronize_srcu()
          t7            srcu_read_unlock()
          t8            hlist_del_rcu()  <--- NULL pointer deref.
      
      This can be fixed by using hlist_del_init_rcu instead of hlist_del_rcu.
      
      The another issue spotted in the commit is "multiple ->release()
      callouts", we needn't care it too much because it is really rare (e.g,
      can not happen on kvm since mmu-notify is unregistered after
      exit_mmap()) and the later call of multiple ->release should be fast
      since all the pages have already been released by the first call.
      Anyway, this issue should be fixed in a separate patch.
      
      -stable suggestions: Any version that has commit 751efd86 need to be
      backported.  I find the oldest version has this commit is 3.0-stable.
      
      [akpm@linux-foundation.org: tweak comments]
      Signed-off-by: default avatarXiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
      Tested-by: default avatarRobin Holt <holt@sgi.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d34883d4
    • Imre Deak's avatar
      wait: fix false timeouts when using wait_event_timeout() · 4c663cfc
      Imre Deak authored
      Many callers of the wait_event_timeout() and
      wait_event_interruptible_timeout() expect that the return value will be
      positive if the specified condition becomes true before the timeout
      elapses.  However, at the moment this isn't guaranteed.  If the wake-up
      handler is delayed enough, the time remaining until timeout will be
      calculated as 0 - and passed back as a return value - even if the
      condition became true before the timeout has passed.
      
      Fix this by returning at least 1 if the condition becomes true.  This
      semantic is in line with what wait_for_condition_timeout() does; see
      commit bb10ed09 ("sched: fix wait_for_completion_timeout() spurious
      failure under heavy load").
      
      Daniel said "We have 3 instances of this bug in drm/i915.  One case even
      where we switch between the interruptible and not interruptible
      wait_event_timeout variants, foolishly presuming they have the same
      semantics.  I very much like this."
      
      One such bug is reported at
        https://bugs.freedesktop.org/show_bug.cgi?id=64133Signed-off-by: default avatarImre Deak <imre.deak@intel.com>
      Acked-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Acked-by: default avatarDavid Howells <dhowells@redhat.com>
      Acked-by: default avatarJens Axboe <axboe@kernel.dk>
      Cc: "Paul E.  McKenney" <paulmck@linux.vnet.ibm.com>
      Cc: Dave Jones <davej@redhat.com>
      Cc: Lukas Czerner <lczerner@redhat.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      4c663cfc
    • OGAWA Hirofumi's avatar
      fat: fix possible overflow for fat_clusters · 7b92d03c
      OGAWA Hirofumi authored
      Intermediate value of fat_clusters can be overflowed on 32bits arch.
      Reported-by: default avatarKrzysztof Strasburger <strasbur@chkw386.ch.pwr.wroc.pl>
      Signed-off-by: default avatarOGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7b92d03c
    • Alexandre Bounine's avatar
      rapidio: documentation update for enumeration changes · 5eeb9293
      Alexandre Bounine authored
      Update RapidIO documentation to reflect changes made to
      enumeration/discovery build configuration and user space triggering
      mechanism.
      Signed-off-by: default avatarAlexandre Bounine <alexandre.bounine@idt.com>
      Cc: Matt Porter <mporter@kernel.crashing.org>
      Cc: Li Yang <leoli@freescale.com>
      Cc: Kumar Gala <galak@kernel.crashing.org>
      Cc: Andre van Herk <andre.van.herk@Prodrive.nl>
      Cc: Micha Nelissen <micha.nelissen@Prodrive.nl>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5eeb9293
    • Alexandre Bounine's avatar
      rapidio: add enumeration/discovery start from user space · bc8fcfea
      Alexandre Bounine authored
      Add RapidIO enumeration/discovery start from user space.  User space
      start allows to defer RapidIO fabric scan until the moment when all
      participating endpoints are initialized avoiding mandatory synchronized
      start of all endpoints (which may be challenging in systems with large
      number of RapidIO endpoints).
      Signed-off-by: default avatarAlexandre Bounine <alexandre.bounine@idt.com>
      Cc: Matt Porter <mporter@kernel.crashing.org>
      Cc: Li Yang <leoli@freescale.com>
      Cc: Kumar Gala <galak@kernel.crashing.org>
      Cc: Andre van Herk <andre.van.herk@Prodrive.nl>
      Cc: Micha Nelissen <micha.nelissen@Prodrive.nl>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      bc8fcfea
    • Alexandre Bounine's avatar
      rapidio: make enumeration/discovery configurable · a11650e1
      Alexandre Bounine authored
      Systems that use RapidIO fabric may need to implement their own
      enumeration and discovery methods which are better suitable for needs of
      a target application.
      
      The following set of patches is intended to simplify process of
      introduction of new RapidIO fabric enumeration/discovery methods.
      
      The first patch offers ability to add new RapidIO enumeration/discovery
      methods using kernel configuration options.  This new configuration
      option mechanism allows to select statically linked or modular
      enumeration/discovery method(s) from the list of existing methods or use
      external module(s).
      
      This patch also updates the currently existing enumeration/discovery
      code to be used as a statically linked or modular method.
      
      The corresponding configuration option is named "Basic
      enumeration/discovery" method.  This is the only one configuration
      option available today but new methods are expected to be introduced
      after adoption of provided patches.
      
      The second patch address a long time complaint of RapidIO subsystem
      users regarding fabric enumeration/discovery start sequence.  Existing
      implementation offers only a boot-time enumeration/discovery start which
      requires synchronized boot of all endpoints in RapidIO network.  While
      it works for small closed configurations with limited number of
      endpoints, using this approach in systems with large number of endpoints
      is quite challenging.
      
      To eliminate requirement for synchronized start the second patch
      introduces RapidIO enumeration/discovery start from user space.
      
      For compatibility with the existing RapidIO subsystem implementation,
      automatic boot time enumeration/discovery start can be configured in by
      specifying "rio-scan.scan=1" command line parameter if statically linked
      basic enumeration method is selected.
      
      This patch:
      
      Rework to implement RapidIO enumeration/discovery method selection
      combined with ability to use enumeration/discovery as a kernel module.
      
      This patch adds ability to introduce new RapidIO enumeration/discovery
      methods using kernel configuration options.  Configuration option
      mechanism allows to select statically linked or modular
      enumeration/discovery method from the list of existing methods or use
      external modules.  If a modular enumeration/discovery is selected each
      RapidIO mport device can have its own method attached to it.
      
      The existing enumeration/discovery code was updated to be used as
      statically linked or modular method.  This configuration option is named
      "Basic enumeration/discovery" method.
      
      Several common routines have been moved from rio-scan.c to make them
      available to other enumeration methods and reduce number of exported
      symbols.
      Signed-off-by: default avatarAlexandre Bounine <alexandre.bounine@idt.com>
      Cc: Matt Porter <mporter@kernel.crashing.org>
      Cc: Li Yang <leoli@freescale.com>
      Cc: Kumar Gala <galak@kernel.crashing.org>
      Cc: Andre van Herk <andre.van.herk@Prodrive.nl>
      Cc: Micha Nelissen <micha.nelissen@Prodrive.nl>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a11650e1
    • Gernot Vormayr's avatar
      drivers/block/xsysace.c: fix id with missing port-number · 585dc0c2
      Gernot Vormayr authored
      If the port number is missing from the device-tree the device gets named
      xs` instead of xsa.  This fixes the check for missing ids.
      
      Tested on ml507 board.
      Signed-off-by: default avatarGernot Vormayr <gvormayr@gmail.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Grant Likely <grant.likely@linaro.org>
      Cc: Rob Herring <rob.herring@calxeda.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      585dc0c2
    • Linus Torvalds's avatar
      Merge tag 'trace-fixes-v3.10-rc2' of... · 17fdfd08
      Linus Torvalds authored
      Merge tag 'trace-fixes-v3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
      
      Pull tracing fix from Steven Rostedt:
       "Masami Hiramatsu fixed another bug.  This time returning a proper
        result in event_enable_func().  After checking the return status of
        try_module_get(), it returned the status of try_module_get().
      
        But try_module_get() returns 0 on failure, which is success for
        event_enable_func()"
      
      * tag 'trace-fixes-v3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Return -EBUSY when event_enable_func() fails to get module
      17fdfd08
    • Linus Torvalds's avatar
      Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 · a8432588
      Linus Torvalds authored
      Pull CIFS fix from Steve French:
       "One cifs fix to merge now - fixes possible DFS oops (I expect to
        request a merge of 4 additional cifs fixes next week)"
      
      * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: only set ops for inodes in I_NEW state
      a8432588
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-fixes · 0e255f1c
      Linus Torvalds authored
      Pull gfs2 fixes from Steven Whitehouse:
       "This time there are just four fixes.  There are a couple of minor
        updates to the quota code, a fix for KConfig to ensure that only valid
        combinations including GFS2 can be built, and a fix for a typo
        affecting end i/o processing when writing the journal.
      
        Also, there is a temporary fix for a performance regression relating
        to block reservations and directories.  A longer fix will be applied
        in due course, but this deals with the most immediate problem for now"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-fixes:
        GFS2: Fix typo in gfs2_log_end_write loop
        GFS2: fix DLM depends to fix build errors
        GFS2: Use single-block reservations for directories
        GFS2: two minor quota fixups
      0e255f1c
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc · d4c2456a
      Linus Torvalds authored
      Pull powerpc fixes from Benjamin Herrenschmidt:
       "Some more P8 related bits, a bunch of fixes for our P7+/P8 HW crypto
        drivers, some added workarounds for those radeons that don't do proper
        64-bit MSIs and a couple of other trivialities by myself."
      
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
        powerpc/pseries: Make 32-bit MSI quirk work on systems lacking firmware support
        powerpc/powernv: Build a zImage.epapr
        powerpc: Make radeon 32-bit MSI quirk work on powernv
        powerpc: Context switch more PMU related SPRs
        powerpc/powernv: Fix condition for when to invalidate the TCE cache
        powerpc/pci: Fix bogus message at boot about empty memory resources
        powerpc: Fix TLB cleanup at boot on POWER8
        drivers/crypto/nx: Fixes for multiple races and issues
      d4c2456a
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · eb3d3390
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "It's been a while since my last pull request so quite a few fixes have
        piled up."
      
      Indeed.
      
       1) Fix nf_{log,queue} compilation with PROC_FS disabled, from Pablo
          Neira Ayuso.
      
       2) Fix data corruption on some tg3 chips with TSO enabled, from Michael
          Chan.
      
       3) Fix double insertion of VLAN tags in be2net driver, from Sarveshwar
          Bandi.
      
       4) Don't have TCP's MD5 support pass > PAGE_SIZE page offsets in
          scatter-gather entries into the crypto layer, the crypto layer can't
          handle that.  From Eric Dumazet.
      
       5) Fix lockdep splat in 802.1Q MRP code, also from Eric Dumazet.
      
       6) Fix OOPS in netfilter log module when called from conntrack, from
          Hans Schillstrom.
      
       7) FEC driver needs to use netif_tx_{lock,unlock}_bh() rather than the
          non-BH disabling variants.  From Fabio Estevam.
      
       8) TCP GSO can generate out-of-order packets, fix from Eric Dumazet.
      
       9) vxlan driver doesn't update 'used' field of fdb entries when it
          should, from Sridhar Samudrala.
      
      10) ipv6 should use kzalloc() to allocate inet6 socket cork options,
          otherwise we can OOPS in ip6_cork_release().  From Eric Dumazet.
      
      11) Fix races in bonding set mode, from Nikolay Aleksandrov.
      
      12) Fix checksum generation regression added by "r8169: fix 8168evl
          frame padding.", from Francois Romieu.
      
      13) ip_gre can look at stale SKB data pointer, fix from Eric Dumazet.
      
      14) Fix checksum handling when GSO is enabled in bnx2x driver with
          certain chips, from Yuval Mintz.
      
      15) Fix double free in batman-adv, from Martin Hundebøll.
      
      16) Fix device startup synchronization with firmware in tg3 driver, from
          Nithin Sujit.
      
      17) perf networking dropmonitor doesn't work at all due to mixed up
          trace parameter ordering, from Ben Hutchings.
      
      18) Fix proportional rate reduction handling in tcp_ack(), from Nandita
          Dukkipati.
      
      19) IPSEC layer doesn't return an error when a valid state is detected,
          causing an OOPS.  Fix from Timo Teräs.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (85 commits)
        be2net: bug fix on returning an invalid nic descriptor
        tcp: xps: fix reordering issues
        net: Revert unused variable changes.
        xfrm: properly handle invalid states as an error
        virtio_net: enable napi for all possible queues during open
        tcp: bug fix in proportional rate reduction.
        net: ethernet: sun: drop unused variable
        net: ethernet: korina: drop unused variable
        net: ethernet: apple: drop unused variable
        qmi_wwan: Added support for Cinterion's PLxx WWAN Interface
        perf: net_dropmonitor: Remove progress indicator
        perf: net_dropmonitor: Use bisection in symbol lookup
        perf: net_dropmonitor: Do not assume ordering of dictionaries
        perf: net_dropmonitor: Fix symbol-relative addresses
        perf: net_dropmonitor: Fix trace parameter order
        net: fec: use a more proper compatible string for MVF type device
        qlcnic: Fix updating netdev->features
        qlcnic: remove netdev->trans_start updates within the driver
        qlcnic: Return proper error codes from probe failure paths
        tg3: Update version to 3.132
        ...
      eb3d3390
    • Steven Whitehouse's avatar
      GFS2: Fix typo in gfs2_log_end_write loop · e97e548b
      Steven Whitehouse authored
      There was a missing _all in this loop iterator
      Signed-off-by: default avatarSteven Whitehouse <swhiteho@redhat.com>
      e97e548b
    • Randy Dunlap's avatar
      GFS2: fix DLM depends to fix build errors · 75f96ce6
      Randy Dunlap authored
      Fix build errors by correcting DLM dependencies in GFS2.
      Build errors happen when CONFIG_GFS2_FS_LOCKING_DLM=y and CONFIG_DLM=m:
      
      fs/built-in.o: In function `gfs2_lock':
      file.c:(.text+0xc7abd): undefined reference to `dlm_posix_get'
      file.c:(.text+0xc7ad0): undefined reference to `dlm_posix_unlock'
      file.c:(.text+0xc7ad9): undefined reference to `dlm_posix_lock'
      fs/built-in.o: In function `gdlm_unmount':
      lock_dlm.c:(.text+0xd6e5b): undefined reference to `dlm_release_lockspace'
      fs/built-in.o: In function `sync_unlock':
      lock_dlm.c:(.text+0xd6e9e): undefined reference to `dlm_unlock'
      fs/built-in.o: In function `sync_lock':
      lock_dlm.c:(.text+0xd6fb6): undefined reference to `dlm_lock'
      fs/built-in.o: In function `gdlm_put_lock':
      lock_dlm.c:(.text+0xd7238): undefined reference to `dlm_unlock'
      fs/built-in.o: In function `gdlm_mount':
      lock_dlm.c:(.text+0xd753e): undefined reference to `dlm_new_lockspace'
      lock_dlm.c:(.text+0xd79d3): undefined reference to `dlm_release_lockspace'
      fs/built-in.o: In function `gdlm_lock':
      lock_dlm.c:(.text+0xd8179): undefined reference to `dlm_lock'
      fs/built-in.o: In function `gdlm_cancel':
      lock_dlm.c:(.text+0xd6b22): undefined reference to `dlm_unlock'
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: default avatarSteven Whitehouse <swhiteho@redhat.com>
      75f96ce6
    • Bob Peterson's avatar
      GFS2: Use single-block reservations for directories · af21ca8e
      Bob Peterson authored
      This patch changes the multi-block allocation code, such that
      directory inodes only get a single block reserved in the bitmap.
      That way, the bitmaps are more tightly packed together, and there
      are fewer spans of free blocks for in-use block reservations.
      This means it takes less time to find a free span of blocks in the
      bitmap, which speeds things up. This increases the performance of
      some workloads by almost 2X. In Nate's mockup.py script (which does
      (1) create dir, (2) create dir in dir, (3) create file in that dir)
      the test executes in 23 steps rather than 43 steps, a 47%
      performance improvement.
      Signed-off-by: default avatarBob Peterson <rpeterso@redhat.com>
      Signed-off-by: default avatarSteven Whitehouse <swhiteho@redhat.com>
      af21ca8e
    • Bob Peterson's avatar
      GFS2: two minor quota fixups · 37f71577
      Bob Peterson authored
      This patch fixes two regression problems that Abhi found in the
      GFS2 quota code.
      Signed-off-by: default avatarBob Peterson <rpeterso@redhat.com>
      Signed-off-by: default avatarSteven Whitehouse <swhiteho@redhat.com>
      37f71577
    • Brian King's avatar
      powerpc/pseries: Make 32-bit MSI quirk work on systems lacking firmware support · f1dd1531
      Brian King authored
      Recent commit e61133dd added support
      for a new firmware feature to force an adapter to use 32 bit MSIs.
      However, this firmware is not available for all systems. The hack below
      allows devices needing 32 bit MSIs to work on these systems as well.
      It is careful to only enable this on Gen2 slots, which should limit
      this to configurations where this hack is needed and tested to work.
      
      [Small change to factor out the hack into a separate function -- BenH]
      Signed-off-by: default avatarBrian King <brking@linux.vnet.ibm.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      f1dd1531
    • Benjamin Herrenschmidt's avatar
      powerpc/powernv: Build a zImage.epapr · 83920c49
      Benjamin Herrenschmidt authored
      The zImage.epapr wrapper allows to use zImages when booting via a flat
      device-tree which can be used on powernv.
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      83920c49
    • Benjamin Herrenschmidt's avatar
      powerpc: Make radeon 32-bit MSI quirk work on powernv · b72c1f65
      Benjamin Herrenschmidt authored
      This moves the quirk itself to pci_64.c as to get built on all ppc64
      platforms (the only ones with a pci_dn), factors the two implementations
      of get_pdn() into a single pci_get_dn() and use the quirk to do 32-bit
      MSIs on IODA based powernv platforms.
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      b72c1f65
    • Michael Ellerman's avatar
      powerpc: Context switch more PMU related SPRs · 59affcd3
      Michael Ellerman authored
      In commit 9353374b "Context switch the new EBB SPRs" we added support for
      context switching some new EBB SPRs. However despite four of us signing
      off on that patch we missed some. To be fair these are not actually new
      SPRs, but they are now potentially user accessible so need to be context
      switched.
      Signed-off-by: default avatarMichael Ellerman <michael@ellerman.id.au>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      59affcd3
    • Benjamin Herrenschmidt's avatar
      powerpc/powernv: Fix condition for when to invalidate the TCE cache · 605e44d6
      Benjamin Herrenschmidt authored
      We use two flags, one to indicate an invalidation is needed after
      creating a new entry and one to indicate an invalidation is needed
      after removing an entry. However we were testing the wrong flag
      in the remove case.
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      605e44d6