1. 29 Jan, 2016 3 commits
  2. 22 Jan, 2016 1 commit
    • Vineet Gupta's avatar
      ARCv2: STAR 9000950267: Handle return from intr to Delay Slot #2 · cbfe74a7
      Vineet Gupta authored
      Returning to delay slot, riding an interrupti, had one loose end.
      AUX_USER_SP used for restoring user mode SP upon RTIE was not being
      setup from orig task's saved value, causing task to use wrong SP,
      leading to ProtV errors.
      
      The reason being:
       - INTERRUPT_EPILOGUE returns to a kernel trampoline, thus not expected to restore it
       - EXCEPTION_EPILOGUE is not used at all
      
      Fix that by restoring AUX_USER_SP explicitly in the trampoline.
      
      This was broken in the original workaround, but the error scenarios got
      reduced considerably since v3.14 due to following:
      
       1. The Linuxthreads.old based userspace at the time caused many more
          exceptions in delay slot than the current NPTL based one.
          Infact with current userspace the error doesn't happen at all.
      
       2. Return from interrupt (delay slot or otherwise) doesn't get exercised much
          after commit 4de0e528 ("Really Re-enable interrupts to avoid deadlocks")
          since IRQ_ACTIVE.active being clear means most returns are as if from pure
          kernel (even for active interrupts)
      
      Infact the issue only happened in an experimental branch where I was tinkering with
      reverted 4de0e528
      
      Cc: stable@kernel.org # v4.2+
      Fixes: 4255b07f ("ARCv2: STAR 9000793984: Handle return from intr to Delay Slot")
      Signed-off-by: default avatarVineet Gupta <vgupta@synopsys.com>
      cbfe74a7
  3. 10 Jan, 2016 1 commit
  4. 09 Jan, 2016 4 commits
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · eac6f76a
      Linus Torvalds authored
      Pull SCSI fix from James Bottomley:
       "A single fix for machines with pages > 4k (PPC mostly).
      
        There's a bug in our optimal transfer size code where we don't account
        for pages > 4k and can set the transfer size to be less than the page
        size causing nasty failures"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        sd: Reject optimal transfer length smaller than page size
      eac6f76a
    • Linus Torvalds's avatar
      Merge tag 'pci-v4.4-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · c0cb1393
      Linus Torvalds authored
      Pull PCI fixlet from Bjorn Helgaas:
       "This marks the TI DRA7xx host bridge driver as broken.  Apparently it
        has never worked without some additional out-of-tree code, so I'm
        going to mark it broken now and remove it completely next cycle unless
        it's fixed"
      
      * tag 'pci-v4.4-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        PCI: dra7xx: Mark driver as broken
      c0cb1393
    • Michal Hocko's avatar
      vmstat: allocate vmstat_wq before it is used · 751e5f5c
      Michal Hocko authored
      kernel test robot has reported the following crash:
      
        BUG: unable to handle kernel NULL pointer dereference at 00000100
        IP: [<c1074df6>] __queue_work+0x26/0x390
        *pdpt = 0000000000000000 *pde = f000ff53f000ff53 *pde = f000ff53f000ff53
        Oops: 0000 [#1] PREEMPT PREEMPT SMP SMP
        CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.4.0-rc4-00139-g373ccbe5 #1
        Workqueue: events vmstat_shepherd
        task: cb684600 ti: cb7ba000 task.ti: cb7ba000
        EIP: 0060:[<c1074df6>] EFLAGS: 00010046 CPU: 0
        EIP is at __queue_work+0x26/0x390
        EAX: 00000046 EBX: cbb37800 ECX: cbb37800 EDX: 00000000
        ESI: 00000000 EDI: 00000000 EBP: cb7bbe68 ESP: cb7bbe38
         DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
        CR0: 8005003b CR2: 00000100 CR3: 01fd5000 CR4: 000006b0
        Stack:
        Call Trace:
          __queue_delayed_work+0xa1/0x160
          queue_delayed_work_on+0x36/0x60
          vmstat_shepherd+0xad/0xf0
          process_one_work+0x1aa/0x4c0
          worker_thread+0x41/0x440
          kthread+0xb0/0xd0
          ret_from_kernel_thread+0x21/0x40
      
      The reason is that start_shepherd_timer schedules the shepherd work item
      which uses vmstat_wq (vmstat_shepherd) before setup_vmstat allocates
      that workqueue so if the further initialization takes more than HZ we
      might end up scheduling on a NULL vmstat_wq.  This is really unlikely
      but not impossible.
      
      Fixes: 373ccbe5 ("mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress")
      Reported-by: default avatarkernel test robot <ying.huang@linux.intel.com>
      Signed-off-by: default avatarMichal Hocko <mhocko@suse.com>
      Tested-by: default avatarTetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
      Cc: stable@vger.kernel.org
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      751e5f5c
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 44d8a7d5
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
       "This is the final small set of ARM SoC bug fixes for linux-4.4, almost
        all regressions:
      
        OMAP:
         - data corruption on the Nokia N900 flash
      
        Allwinner:
         - Two defconfig change to get USB working again
      
        ARM Versatile:
         - Interrupt numbers gone bad after an older bug fix
      
        Nomadik:
         - Crashes from incorrect L2 cache settings
      
        VIA vt8500:
         - SD/MMC support on WM8650 never worked"
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        dts: vt8500: Add SDHC node to DTS file for WM8650
        ARM: Fix broken USB support in multi_v7_defconfig for sunxi devices
        ARM: versatile: fix MMC/SD interrupt assignment
        ARM: nomadik: set latencies to 8 cycles
        ARM: OMAP2+: Fix onenand rate detection to avoid filesystem corruption
        ARM: Fix broken USB support in sunxi_defconfig
      44d8a7d5
  5. 08 Jan, 2016 15 commits
  6. 07 Jan, 2016 15 commits
  7. 06 Jan, 2016 1 commit
    • Yuchung Cheng's avatar
      tcp: fix zero cwnd in tcp_cwnd_reduction · 8b8a321f
      Yuchung Cheng authored
      Patch 3759824d ("tcp: PRR uses CRB mode by default and SS mode
      conditionally") introduced a bug that cwnd may become 0 when both
      inflight and sndcnt are 0 (cwnd = inflight + sndcnt). This may lead
      to a div-by-zero if the connection starts another cwnd reduction
      phase by setting tp->prior_cwnd to the current cwnd (0) in
      tcp_init_cwnd_reduction().
      
      To prevent this we skip PRR operation when nothing is acked or
      sacked. Then cwnd must be positive in all cases as long as ssthresh
      is positive:
      
      1) The proportional reduction mode
         inflight > ssthresh > 0
      
      2) The reduction bound mode
        a) inflight == ssthresh > 0
      
        b) inflight < ssthresh
           sndcnt > 0 since newly_acked_sacked > 0 and inflight < ssthresh
      
      Therefore in all cases inflight and sndcnt can not both be 0.
      We check invalid tp->prior_cwnd to avoid potential div0 bugs.
      
      In reality this bug is triggered only with a sequence of less common
      events.  For example, the connection is terminating an ECN-triggered
      cwnd reduction with an inflight 0, then it receives reordered/old
      ACKs or DSACKs from prior transmission (which acks nothing). Or the
      connection is in fast recovery stage that marks everything lost,
      but fails to retransmit due to local issues, then receives data
      packets from other end which acks nothing.
      
      Fixes: 3759824d ("tcp: PRR uses CRB mode by default and SS mode conditionally")
      Reported-by: default avatarOleksandr Natalenko <oleksandr@natalenko.name>
      Signed-off-by: default avatarYuchung Cheng <ycheng@google.com>
      Signed-off-by: default avatarNeal Cardwell <ncardwell@google.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8b8a321f