- 29 Aug, 2014 4 commits
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dmLinus Torvalds authored
Pull device mapper fix from Mike Snitzer: "Fix a 3.17-rc1 regression introduced by switching the DM crypt target to using per-bio data" * tag 'dm-3.17-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm crypt: fix access beyond the end of allocated space
-
git://git.kernel.dk/linux-blockLinus Torvalds authored
Pull block layer fixes from Jens Axboe: "A smaller collection of fixes that have come up since the initial merge window pull request. This contains: - error handling cleanup and support for larger than 16 byte cdbs in sg_io() from Christoph. The latter just matches what bsg and friends support, sg_io() got left out in the merge. - an option for brd to expose partitions in /proc/partitions. They are hidden by default for compat reasons. From Dmitry Monakhov. - a few blk-mq fixes from me - killing a dead/unused flag, fix for merging happening even if turned off, and correction of a few comments. - removal of unnecessary ->owner setting in systemace. From Michal Simek. - two related fixes for a problem with nesting freezing of queues in blk-mq. One from Ming Lei removing an unecessary freeze operation, and another from Tejun fixing the nesting regression introduced in the merge window. - fix for a BUG_ON() at bio_endio time when protection info is attached and the IO has an error. From Sagi Grimberg. - two scsi_ioctl bug fixes for regressions with scsi-mq from Tony Battersby. - a cfq weight update fix and subsequent comment update from Toshiaki Makita" * 'for-linus' of git://git.kernel.dk/linux-block: cfq-iosched: Add comments on update timing of weight cfq-iosched: Fix wrong children_weight calculation block: fix error handling in sg_io fix regression in SCSI_IOCTL_SEND_COMMAND scsi-mq: fix requests that use a separate CDB buffer block: support > 16 byte CDBs for SG_IO block: cleanup error handling in sg_io brd: add ram disk visibility option block: systemace: Remove .owner field for driver blk-mq: blk_mq_freeze_queue() should allow nesting blk-mq: correct a few wrong/bad comments block: Fix BUG_ON when pi errors occur blk-mq: don't allow merges if turned off for the queue blk-mq: get rid of unused BLK_MQ_F_SHOULD_SORT flag blk-mq: fix WARNING "percpu_ref_kill() called more than once!"
-
Will Deacon authored
write{b,w,l,q}_relaxed are implemented by some architectures in order to permit memory-mapped I/O writes with weaker barrier semantics than the non-relaxed variants. This patch implements these write macros for Alpha, in the same vein as the relaxed read macros, which are already implemented. Acked-by: Richard Henderson <rth@twiddle.net> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Michael Cree authored
Signed-off-by: Michael Cree <mcree@orcon.net.nz> Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
- 28 Aug, 2014 20 commits
-
-
Mikulas Patocka authored
The DM crypt target accesses memory beyond allocated space resulting in a crash on 32 bit x86 systems. This bug is very old (it dates back to 2.6.25 commit 3a7f6c99 "dm crypt: use async crypto"). However, this bug was masked by the fact that kmalloc rounds the size up to the next power of two. This bug wasn't exposed until 3.17-rc1 commit 298a9fa0 ("dm crypt: use per-bio data"). By switching to using per-bio data there was no longer any padding beyond the end of a dm-crypt allocated memory block. To minimize allocation overhead dm-crypt puts several structures into one block allocated with kmalloc. The block holds struct ablkcipher_request, cipher-specific scratch pad (crypto_ablkcipher_reqsize(any_tfm(cc))), struct dm_crypt_request and an initialization vector. The variable dmreq_start is set to offset of struct dm_crypt_request within this memory block. dm-crypt allocates the block with this size: cc->dmreq_start + sizeof(struct dm_crypt_request) + cc->iv_size. When accessing the initialization vector, dm-crypt uses the function iv_of_dmreq, which performs this calculation: ALIGN((unsigned long)(dmreq + 1), crypto_ablkcipher_alignmask(any_tfm(cc)) + 1). dm-crypt allocated "cc->iv_size" bytes beyond the end of dm_crypt_request structure. However, when dm-crypt accesses the initialization vector, it takes a pointer to the end of dm_crypt_request, aligns it, and then uses it as the initialization vector. If the end of dm_crypt_request is not aligned on a crypto_ablkcipher_alignmask(any_tfm(cc)) boundary the alignment causes the initialization vector to point beyond the allocated space. Fix this bug by calculating the variable iv_size_padding and adding it to the allocated size. Also correct the alignment of dm_crypt_request. struct dm_crypt_request is specific to dm-crypt (it isn't used by the crypto subsystem at all), so it is aligned on __alignof__(struct dm_crypt_request). Also align per_bio_data_size on ARCH_KMALLOC_MINALIGN, so that it is aligned as if the block was allocated with kmalloc. Reported-by: Krzysztof Kolasa <kkolasa@winsoft.pl> Tested-by: Milan Broz <gmazyland@gmail.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com>
-
git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlightLinus Torvalds authored
Pull backlight fix from Lee Jones: "One simple fix to invalidate GPIO non-request" * tag 'backlight-fixes-3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: pwm-backlight: Fix bogus request for GPIO#0 when instantiated from DT
-
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfdLinus Torvalds authored
Pull mfd fixes from Lee Jones: "Couple of simple fixes due for the 3.17 rcs (and a sneaky document addition that slipped from the previous pull-request)" * tag 'mfd-fixes-3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: mfd: twl4030-power: Fix PM idle pin configuration to not conflict with regulators mfd: tc3589x: Add device tree bindings mfd: ab8500-core: Use 'ifdef' for config options mfd: htc-i2cpld: Fix %d confusingly prefixed with 0x in format string mfd: omap-usb-host: Fix %d confusingly prefixed with 0x in format string
-
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrlLinus Torvalds authored
Pull pin-control fixes from Linus Walleij: "My first (a bit delayed) pack of pin control fixes for the v3.17 series, only driver fixes: - SH-PFC (Renesas) r8a7791 CAN bus pin group problem - Rockchip (GPIO0 configuration) - Tegra-xusb (interrupt handling) - Exynos (GPIO interrupt locking) - Qualcomm (fix misleading example interrupts) - minor non-critical fixes for abx500 and AT91 also sneaked in, because I initially intended this pull for post RC-1, hope it's still OK" * tag 'pinctrl-v3.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: qcom: apq8064: Correct interrupts in example pinctrl: exynos: Lock GPIOs as interrupts when used as EINTs pinctrl: pinctrl-at91.c: fix decimal printf format specifiers prefixed with 0x pinctrl: abx500: remove useless check pinctrl: tegra-xusb: testing wrong variable in probe() pinctrl: tegra-xusb: fix an off by one test pinctrl: rockchip: fix rk3288 gpio0 configuration sh-pfc: r8a7791: fix CAN pin groups
-
git://git.kernel.org/pub/scm/linux/kernel/git/sumits/dma-bufLinus Torvalds authored
Pull dma-buf fixes from Sumit Semwal: "The major changes for 3.17 already went via Greg-KH's tree this time as well; this is a small pull request for dma-buf - all documentation related" * tag 'for-3.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/sumits/dma-buf: dma-buf/fence: Fix one more kerneldoc warning dma-buf/fence: Fix a kerneldoc warning Documentation/dma-buf-sharing.txt: update API descriptions
-
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/soundLinus Torvalds authored
Pull sound fixes from Takashi Iwai: "Here contains not many exciting changes but just a few minor ones: An off-by-one proc write fix, a couple of trivial incldue guard fixes, Acer laptop pinconfig fix, and a fix for DSD formats that are still rarely used" * tag 'sound-3.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Set up initial pins for Acer Aspire V5 ALSA: pcm: Fix the silence data for DSD formats ALSA: ctxfi: ct20k1reg: Fix typo in include guard ALSA: hda: ca0132_regs.h: Fix typo in include guard ALSA: core: fix buffer overflow in snd_info_get_line()
-
git://people.freedesktop.org/~airlied/linuxLinus Torvalds authored
Pull drm fixes from Dave Airlie: "Nothing major, one core oops fixes, some radeon oops fixes, some sti driver fixups, msm driver fixes and a minor Kconfig update for the ww mutex debugging" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/ast: Add missing entry to dclk_table[] drm: fix division-by-zero on dumb_create() ww-mutex: clarify help text for DEBUG_WW_MUTEX_SLOWPATH radeon: Test for PCI root bus before assuming bus->self drm/radeon: handle broken disabled rb mask gracefully (6xx/7xx) (v2) drm/radeon: save/restore the PD addr on suspend/resume drm/msm: Fix missing unlock on error in msm_fbdev_create() drm/msm: fix compile error for non-dt builds drm/msm/mdp4: request vblank during modeset drm/msm: avoid flood of kernel logs on faults drm: sti: Add missing dependency on RESET_CONTROLLER drm: sti: Make of_device_id array const drm: sti: Fix return value check in sti_drm_platform_probe() drm: sti: hda: fix return value check in sti_hda_probe() drm: sti: hdmi: fix return value check in sti_hdmi_probe() drm: sti: tvout: fix return value check in sti_tvout_probe()
-
Tony Lindgren authored
Commit 43fef47f (mfd: twl4030-power: Add a configuration to turn off oscillator during off-idle) added support for configuring the PMIC to cut off resources during deeper idle states to save power. This however caused regression for n900 display power that needed the PMIC configuration to be disabled with commit d937678a (ARM: dts: Revert enabling of twl configuration for n900). Turns out the root cause of the problem is that we must use TWL4030_RESCONFIG_UNDEF instead of DEV_GRP_NULL to avoid disabling regulators that may have been enabled before the init function for twl4030-power.c runs. With TWL4030_RESCONFIG_UNDEF we let the regulator framework control the regulators like it should. Here we need to only configure the sys_clken and sys_off_mode triggers for the regulators that cannot be done by the regulator framework as it's not running at that point. This allows us to enable the PMIC configuration for n900. Fixes: 43fef47f (mfd: twl4030-power: Add a configuration to turn off oscillator during off-idle) Cc: stable@vger.kernel.org # v3.16 Signed-off-by: Tony Lindgren <tony@atomide.com> Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi> Signed-off-by: Lee Jones <lee.jones@linaro.org>
-
Linus Walleij authored
This defines the device tree bindings for the Toshiba TC3589x series of multi-purpose expanders. Only the stuff I can test is defined: GPIO and keypad. Others may implement more subdevices further down the road. This is to complement commit a435ae1d "mfd: Enable the tc3589x for Device Tree" which left off the definition of the device tree bindings. Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Lee Jones <lee.jones@linaro.org>
-
Toshiaki Makita authored
Explain that weight has to be updated on activation. This complements previous fix e15693ef ("cfq-iosched: Fix wrong children_weight calculation"). Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> Signed-off-by: Jens Axboe <axboe@fb.com>
-
Thierry Reding authored
The seqno_fence_init() function's cond argument isn't described in the kerneldoc comment. Fix that to silence a warning when building DocBook documentation. Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
-
Thierry Reding authored
kerneldoc doesn't know how to parse variables, so don't let it try. Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
-
Gioh Kim authored
Update some descriptions for API arguments and descriptions. Signed-off-by: Gioh Kim <gioh.kim@lge.com> Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
-
Y.C. Chen authored
This avoid reading past the end of the list for certain modes Signed-off-by: Y.C. Chen <yc_chen@aspeedtech.com> Reviewed-by: Egbert Eich <eich@freedesktop.org> Signed-off-by: Dave Airlie <airlied@redhat.com>
-
Dave Airlie authored
Merge branch 'drm-3.17-rc2-sti-fixes' of git://git.linaro.org/people/benjamin.gaignard/kernel into drm-fixes I have tested the 6 patches send on mailing list since you merge the sti driver. I haven't seen issue with those patches except for the missing dependency on Kconfig where I have change "depends on" to "select". * 'drm-3.17-rc2-sti-fixes' of git://git.linaro.org/people/benjamin.gaignard/kernel: drm: sti: Add missing dependency on RESET_CONTROLLER drm: sti: Make of_device_id array const drm: sti: Fix return value check in sti_drm_platform_probe() drm: sti: hda: fix return value check in sti_hda_probe() drm: sti: hdmi: fix return value check in sti_hdmi_probe() drm: sti: tvout: fix return value check in sti_tvout_probe()
-
git://people.freedesktop.org/~robclark/linuxDave Airlie authored
misc msm fixes from Rob. * 'msm-fixes-3.17' of git://people.freedesktop.org/~robclark/linux: drm/msm: Fix missing unlock on error in msm_fbdev_create() drm/msm: fix compile error for non-dt builds drm/msm/mdp4: request vblank during modeset drm/msm: avoid flood of kernel logs on faults
-
David Herrmann authored
Kinda unexpected, but DIV_ROUND_UP() can overflow if passed an argument bigger than UINT_MAX - DIVISOR. Fix this by testing for "!cpp" before using it in the following division. Note that DIV_ROUND_UP() is defined as: #define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d)) ..this will obviously overflow if (n + d - 1) is bigger than UINT_MAX. Reported-by: Tommi Rantala <tt.rantala@gmail.com> Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
-
Rob Clark authored
We really don't want distro's enabling this in their kernels. Try and make that more clear. Signed-off-by: Rob Clark <robdclark@gmail.com> Acked-by: Maarten Lankhorst <maarten.lankhorst@canonical.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
-
git://people.freedesktop.org/~agd5f/linuxDave Airlie authored
Just a few more radeon fixes for 3.17. * 'drm-fixes-3.17' of git://people.freedesktop.org/~agd5f/linux: radeon: Test for PCI root bus before assuming bus->self drm/radeon: handle broken disabled rb mask gracefully (6xx/7xx) (v2) drm/radeon: save/restore the PD addr on suspend/resume
-
git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux-securityLinus Torvalds authored
Pull tomoyo fix from Serge Hallyn. * 'sec-v3.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux-security: tomoyo: Fix pathname calculation breakage.
-
- 27 Aug, 2014 8 commits
-
-
Alex Williamson authored
If we assign a Radeon device to a virtual machine, we can no longer assume a fixed hardware topology, like the GPU having a parent device. This patch simply adds a few pci_is_root_bus() tests to avoid passing a NULL pointer to PCI access functions, allowing the radeon driver to work in a QEMU 440FX machine with an assigned HD8570 on the emulated PCI root bus. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hidLinus Torvalds authored
Pull HID fixes from Jiri Kosina: - fixes for potential memory corruption problems in magicmouse and picolcd drivers (the HW would have to be manufactured to be deliberately evil to trigger those) which were found by Steven Vittitoe - fix for false error message appearing in dmesg from logitech-dj driver, from Benjamin Tissoires * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: picolcd: sanity check report size in raw_event() callback HID: magicmouse: sanity check report size in raw_event() callback HID: logitech-dj: prevent false errors to be shown
-
git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfsLinus Torvalds authored
Pull btrfs fixes from Chris Mason: "The biggest of these comes from Liu Bo, who tracked down a hang we've been hitting since moving to kernel workqueues (it's a btrfs bug, not in the generic code). His patch needs backporting to 3.16 and 3.15 stable, which I'll send once this is in. Otherwise these are assorted fixes. Most were integrated last week during KS, but I wanted to give everyone the chance to test the result, so I waited for rc2 to come out before sending" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: (24 commits) Btrfs: fix task hang under heavy compressed write Btrfs: fix filemap_flush call in btrfs_file_release Btrfs: fix crash on endio of reading corrupted block btrfs: fix leak in qgroup_subtree_accounting() error path btrfs: Use right extent length when inserting overlap extent map. Btrfs: clone, don't create invalid hole extent map Btrfs: don't monopolize a core when evicting inode Btrfs: fix hole detection during file fsync Btrfs: ensure tmpfile inode is always persisted with link count of 0 Btrfs: race free update of commit root for ro snapshots Btrfs: fix regression of btrfs device replace Btrfs: don't consider the missing device when allocating new chunks Btrfs: Fix wrong device size when we are resizing the device Btrfs: don't write any data into a readonly device when scrub Btrfs: Fix the problem that the replace destroys the seed filesystem btrfs: Return right extent when fiemap gives unaligned offset and len. Btrfs: fix wrong extent mapping for DirectIO Btrfs: fix wrong write range for filemap_fdatawrite_range() Btrfs: fix wrong missing device counter decrease Btrfs: fix unzeroed members in fs_devices when creating a fs from seed fs ...
-
Linus Torvalds authored
Merge tag 'trace-fixes-v3.17-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull trace buffer epoll hang fix from Steven Rostedt: "Josef Bacik found a bug in the ring_buffer_poll_wait() where the condition variable (waiters_pending) was set before being added to the poll queue via poll_wait(). This allowed for a small race window to happen where an event could come in, check the condition variable see it set to true, clear it, and then wake all the waiters. But because the waiter set the variable before adding itself to the queue, the waker could have cleared the variable after it was set and then miss waking it up as it wasn't added to the queue yet. Discussing this bug, we realized that a memory barrier needed to be added too, for the rare case that something polls for a single trace event to happen (and just one, no more to come in), and miss the wakeup due to memory ordering. Ideally, a memory barrier needs to be added on the writer side too, but as that will kill tracing performance and this is for a situation that tracing wasn't even designed for (who traces one instance of an event, use a printk instead!), this isn't worth adding the barrier. But we can in the future add the barrier for when the buffer goes from empty to the first event, as that would cover this case" * tag 'trace-fixes-v3.17-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: trace: Fix epoll hang when we race with new entries
-
Jiri Kosina authored
The report passed to us from transport driver could potentially be arbitrarily large, therefore we better sanity-check it so that raw_data that we hold in picolcd_pending structure are always kept within proper bounds. Cc: stable@vger.kernel.org Reported-by: Steven Vittitoe <scvitti@google.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
-
Jiri Kosina authored
The report passed to us from transport driver could potentially be arbitrarily large, therefore we better sanity-check it so that magicmouse_emit_touch() gets only valid values of raw_id. Cc: stable@vger.kernel.org Reported-by: Steven Vittitoe <scvitti@google.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
-
Takashi Iwai authored
Acer Aspire V5 doesn't set up the pins correctly at the cold boot while the pins are corrected after the warm reboot. This patch gives the proper pin configs statically in the driver as a workaround. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=81561Signed-off-by: Takashi Iwai <tiwai@suse.de>
-
Tetsuo Handa authored
Commit 7177a9c4 ("fs: call rename2 if exists") changed "struct inode_operations"->rename == NULL if "struct inode_operations"->rename2 != NULL . TOMOYO needs to check for both ->rename and ->rename2 , or a system on (e.g.) ext4 filesystem won't boot. Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
-
- 26 Aug, 2014 8 commits
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linuxLinus Torvalds authored
Pull s390 updates from Martin Schwidefsky: - wire up the system calls seccomp, getrandom and memfd_create - use static system information as input to add_device_randomness - .. and three bug fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/sclp: remove unnecessary XTABS flag s390/3215: fix tty output containing tabs s390: wire up memfd_create syscall s390: add system information as device randomness s390/kdump: Clear subchannel ID to signal non-CCW/SCSI IPL s390: wire up seccomp and getrandom syscalls
-
Pranith Kumar authored
Update the description for per cpu operations to clarify use cases of this_cpu operations and add considerations for remote access. Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> Signed-off-by: Christoph Lameter <cl@linux.com> Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Randy Dunlap authored
Fix scripts/kernel-doc to recognize __meminit in a function prototype and to strip it, as done with many other attributes. Fixes this warning: Warning(..//mm/page_alloc.c:2973): cannot understand function prototype: 'void * __meminit alloc_pages_exact_nid(int nid, size_t size, gfp_t gfp_mask) ' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-
Alex Deucher authored
This is a port of cedb655a to older asics. Fixes a possible divide by 0 if the harvest register is invalid. v2: drop some additional harvest munging. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
-
Christian König authored
This fixes a problem with GPU resets and TLB flushes on SI/CIK. Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-
Toshiaki Makita authored
cfq_group_service_tree_add() is applying new_weight at the beginning of the function via cfq_update_group_weight(). This actually allows weight to change between adding it to and subtracting it from children_weight, and triggers WARN_ON_ONCE() in cfq_group_service_tree_del(), or even causes oops by divide error during vfr calculation in cfq_group_service_tree_add(). The detailed scenario is as follows: 1. Create blkio cgroups X and Y as a child of X. Set X's weight to 500 and perform some I/O to apply new_weight. This X's I/O completes before starting Y's I/O. 2. Y starts I/O and cfq_group_service_tree_add() is called with Y. 3. cfq_group_service_tree_add() walks up the tree during children_weight calculation and adds parent X's weight (500) to children_weight of root. children_weight becomes 500. 4. Set X's weight to 1000. 5. X starts I/O and cfq_group_service_tree_add() is called with X. 6. cfq_group_service_tree_add() applies its new_weight (1000). 7. I/O of Y completes and cfq_group_service_tree_del() is called with Y. 8. I/O of X completes and cfq_group_service_tree_del() is called with X. 9. cfq_group_service_tree_del() subtracts X's weight (1000) from children_weight of root. children_weight becomes -500. This triggers WARN_ON_ONCE(). 10. Set X's weight to 500. 11. X starts I/O and cfq_group_service_tree_add() is called with X. 12. cfq_group_service_tree_add() applies its new_weight (500) and adds it to children_weight of root. children_weight becomes 0. Calcularion of vfr triggers oops by divide error. weight should be updated right before adding it to children_weight. Reported-by: Ruki Sekiya <sekiya.ruki@lab.ntt.co.jp> Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp> Acked-by: Tejun Heo <tj@kernel.org> Cc: stable@vger.kernel.org Signed-off-by: Jens Axboe <axboe@fb.com>
-
Wei Yongjun authored
Add the missing unlock before return from function msm_fbdev_create() in the error handling case. Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn> Signed-off-by: Rob Clark <robdclark@gmail.com>
-
Rob Clark authored
Signed-off-by: Rob Clark <robdclark@gmail.com>
-