Commit Graph

457234 Commits

Author SHA1 Message Date
Chris Wilson 487777673e drm/i915/userptr: Keep spin_lock/unlock in the same block
Move the code around in order to acquire and release the spinlock in the
same function and in the same block. This keeps static analysers happy
and the reader sane.

Suggested-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-07-25 09:39:03 +02:00
George Cherian 33cf756569 can: c_can_platform: Fix raminit, use devm_ioremap() instead of devm_ioremap_resource()
The raminit register is shared register for both can0 and can1. Since commit:

    32766ff net: can: Convert to use devm_ioremap_resource

devm_ioremap_resource() is used to map raminit register. When using both
interfaces the mapping for the can1 interface fails, leading to a non
functional can interface.

Signed-off-by: George Cherian <george.cherian@ti.com>
Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
Cc: linux-stable <stable@vger.kernel.org> # >= v3.11
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2014-07-25 09:23:08 +02:00
Dmitry Kravkov fe26566d8a bnx2x: fix crash during TSO tunneling
When TSO packet is transmitted additional BD w/o mapping is used
to describe the packed. The BD needs special handling in tx
completion.

kernel: Call Trace:
kernel: <IRQ>  [<ffffffff815e19ba>] dump_stack+0x19/0x1b
kernel: [<ffffffff8105dee1>] warn_slowpath_common+0x61/0x80
kernel: [<ffffffff8105df5c>] warn_slowpath_fmt+0x5c/0x80
kernel: [<ffffffff814a8c0d>] ? find_iova+0x4d/0x90
kernel: [<ffffffff814ab0e2>] intel_unmap_page.part.36+0x142/0x160
kernel: [<ffffffff814ad0e6>] intel_unmap_page+0x26/0x30
kernel: [<ffffffffa01f55d7>] bnx2x_free_tx_pkt+0x157/0x2b0 [bnx2x]
kernel: [<ffffffffa01f8dac>] bnx2x_tx_int+0xac/0x220 [bnx2x]
kernel: [<ffffffff8101a0d9>] ? read_tsc+0x9/0x20
kernel: [<ffffffffa01f8fdb>] bnx2x_poll+0xbb/0x3c0 [bnx2x]
kernel: [<ffffffff814d041a>] net_rx_action+0x15a/0x250
kernel: [<ffffffff81067047>] __do_softirq+0xf7/0x290
kernel: [<ffffffff815f3a5c>] call_softirq+0x1c/0x30
kernel: [<ffffffff81014d25>] do_softirq+0x55/0x90
kernel: [<ffffffff810673e5>] irq_exit+0x115/0x120
kernel: [<ffffffff815f4358>] do_IRQ+0x58/0xf0
kernel: [<ffffffff815e94ad>] common_interrupt+0x6d/0x6d
kernel: <EOI>  [<ffffffff810bbff7>] ? clockevents_notify+0x127/0x140
kernel: [<ffffffff814834df>] ? cpuidle_enter_state+0x4f/0xc0
kernel: [<ffffffff81483615>] cpuidle_idle_call+0xc5/0x200
kernel: [<ffffffff8101bc7e>] arch_cpu_idle+0xe/0x30
kernel: [<ffffffff810b4725>] cpu_startup_entry+0xf5/0x290
kernel: [<ffffffff815cfee1>] start_secondary+0x265/0x27b
kernel: ---[ end trace 11aa7726f18d7e80 ]---

Fixes: a848ade408 ("bnx2x: add CSUM and TSO support for encapsulation protocols")
Reported-by: Yulong Pei <ypei@redhat.com>
Cc: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: Dmitry Kravkov <Dmitry.Kravkov@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-24 23:43:57 -07:00
hayeswang a3cc465d95 r8152: fix the checking of the usb speed
When the usb speed of the RTL8152 is not high speed, the USB_DEV_STAT[2:1]
should be equal to [0 1]. That is, the STAT_SPEED_FULL should be equal
to 2.

There is a easy way to check the usb speed by the speed field of the
struct usb_device. Use it to replace the original metheod.

Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Spotted-by: Andrey Utkin <andrey.krieger.utkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-24 23:37:36 -07:00
David S. Miller e62f77579c Merge tag 'master-2014-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
John W. Linville says:

====================
pull request: wireless 2014-07-24

Please pull this batch of fixes intended for the 3.16 stream...

For the mac80211 fixes, Johannes says:

"I have two fixes: one for tracing that fixes a long-standing NULL
pointer dereference, and one for a mac80211 issue that causes iwlmvm to
send invalid frames during authentication/association."

and,

"One more fix - for a bug in the newly introduced code that obtains rate
control information for stations."

For the iwlwifi fixes, Emmanuel says:

"It includes a merge damage fix. This region has been changed in -next
and -fixes quite a few times and apparently, I failed to handle it
properly, so here the fix.  Along with that I have a fix from Eliad
to properly handle overlapping BSS in AP mode."

On top of that, Felix provides and ath9k fix for Tx stalls that happen
after an aggregation session failure.

Please let me know if there are problems!  There are some changes
here that will cause merge conflicts in -next.  Once you merge this
I can pull it into wireless-next and resolve those issues.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-24 23:22:15 -07:00
David S. Miller a88a7be6a2 Merge branch 'mdio_module_unload'
Ezequiel Garcia says:

====================
net: phy: Prevent an MDIO bus from being unloaded while in use

Changes from v1:
  * Dropped the unneeded module_put() on phy_attach_direct().

The motivation of this small series is to fix the current lack of relationship
between an ethernet driver and the MDIO bus behind the PHY device. In such
cases, we would find no visible link between the drivers:

  $ lsmod
  Module                  Size  Used by    Not tainted
  mvmdio                  2941  0
  mvneta                 22069  0

Which means nothing prevents the MDIO driver from being removed:

  $ modprobe -r mvmdio

  # Unable to handle kernel NULL pointer dereference at virtual address 00000060
  pgd = c0004000
  [00000060] *pgd=00000000
  Internal error: Oops: 17 [#1] SMP ARM
  Modules linked in: mvneta [last unloaded: mvmdio]
  CPU: 0 PID: 22 Comm: kworker/0:1 Not tainted 3.16.0-rc5-01127-g62c0816-dirty #608
  Workqueue: events_power_efficient phy_state_machine
  task: df5ec840 ti: df67a000 task.ti: df67a000
  PC is at phy_state_machine+0x1c/0x468
  LR is at phy_state_machine+0x18/0x468
  [snip]

This patchset fixes this problem by adding a pair of module_{get,put},
so the module reference count is increased when the PHY device is attached
and is decreased when the PHY is detached.

Tested with mvneta and mv643xx_eth drivers, which depend on the mvmdio
driver to handle MDIO. This series applies on both net and net-next branches.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-24 18:10:02 -07:00
Ezequiel Garcia b3565f278a net: phy: Ensure the MDIO bus module is held
This commit adds proper module_{get,put} to prevent the MDIO bus module
from being unloaded while the phydev is connected. By doing so, we fix
a kernel panic produced when a MDIO driver is removed, but the phydev
that relies on it is attached and running.

Signed-off-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-24 18:09:52 -07:00
Ezequiel Garcia a71e3c3796 net: phy: Set the driver when registering an MDIO bus device
mdiobus_register() registers a device which is already bound to a driver.
Hence, the driver pointer should be set properly in order to track down
the driver associated to the MDIO bus.

This will be used to allow ethernet driver to pin down a MDIO bus driver,
preventing it from being unloaded while the PHY device is running.

Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-24 18:09:52 -07:00
Yaniv Rosner 042d7654ec bnx2x: fix set_setting for some PHYs
Allow set_settings() to complete succesfully even if link is
not estabilished and port type isn't known yet.

Signed-off-by: Yaniv Rosner <Yaniv.Rosner@qlogic.com>
Signed-off-by: Dmitry Kravkov <Dmitry.Kravkov@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-24 18:02:08 -07:00
David S. Miller 29be618076 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
Pablo Neira Ayuso says:

====================
Via Simon Horman, I received the following one-liner for your net tree:

1) Fix crash when exiting from netns that uses IPVS and conntrack,
   from Julian Anastasov via Simon Horman.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-24 18:00:05 -07:00
H. Peter Anvin bf72f5dee0 Promote one fix for 3.16
This fix was necessary after
 
 9c15a24b03 ("x86/mce: Improve mcheck_init_device() error handling")
 
 went in. What this patch did was, among others, check the return value
 of misc_register and exit early if it encountered an error. Original
 code sloppily didn't do that.
 
 However,
 
         cef12ee52b ("xen/mce: Add mcelog support for Xen platform")
 
 made it so that xen's init routine xen_late_init_mcelog runs first. This
 was needed for the xen mcelog device which is supposed to be independent
 from the baremetal one.
 
 Initially it was reported that misc_register() fails often on xen and
 that's why it needed fixing. However, it is *supposed* to fail by
 design, when running in dom0 so that the xen mcelog device file gets
 registered first.
 
 And *then* you need the notifier *not* unregistered on the error path so
 that the timer does get deleted properly in the CPU hotplug notifier.
 
 Btw, this fix is needed also on baremetal in the unlikely event that
 misc_register(&mce_chrdev_device) fails there too.
 
 I was unsure whether to rush it in now and decided to delay it to 3.17.
 However, xen people wanted it promoted as it breaks xen when doing cpu
 hotplug there. So, after a bit of simmering in tip/master for initial
 smoke testing, let's move it to 3.16. It fixes a semi-regression which
 got introduced in 3.16 so no need for stable tagging.
 
 tip/x86/ras contains that exact same commit but we can't remove it
 there as it is not the last one. It won't cause any merge issues, as I
 confirmed locally but I should state here the special situation of this
 one fix explicitly anyway.
 
 Thanks.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTzUMOAAoJEBLB8Bhh3lVKDC0P/3azgACl7qXkpUoFIUW4RSGJ
 3psmzjYd8RU2Trh7+8NFTUccLYIe6+4wyE8R4fgx1iV3kuUPOuAIRn0sRk4/TgCC
 IwA+j9v28jilFQvXuv+v105mIdiTmKJotcL3+k4I3HUR8RehnHK+BrlxR8e/zQzU
 W/Vk9cgz8wzPxMmmpvUE8OHmWYEk6h/rkCz6TF0bAJbgSq9iN37mmpKfXwwvaIRi
 CFP/UXIduipEuYUd+8fJqUg14roDFvA5hXPz7abM0gSr1NjR/k724f2G4iDnez0V
 pm8I+PmyEaZYI6udUrbyZ0X9wTcgHLe6GtwyEIBaOOqkMZbjC4anEe7VUJFIKr5/
 dNN538DGXxNfrf0u5lkHF/SCiE/T3eoP8imaMeZXwE04HHjWOfvqJs7miUPfGjKE
 VYvbY2fVbjbYCFjgqc2XkJgPpwGpOF2WCaXva2hyIRKrXsgt725wvoBCnNMX+AD7
 l71AeexVCN3TGmP7Twi7W8d23QPR0+M7x5SNkFaUTepJ2f+s3Fpeopq9mfbAtM6i
 p6fRDVncOBalNW3G5hED3YYcjfjQgpiKMQ7zm84K71NkSCBOsjiatFrPD+Y0lBwM
 LNtOViTXFvXW5xMBDDjQq3+InIbzt7MlQMVP4nP6rkEjOLfR60+ivr9sPUuqTb//
 hqI5bCPgWhxEBrzA7iIj
 =z/P/
 -----END PGP SIGNATURE-----

x86: Merge tag 'ras_urgent' into x86/urgent

Promote one fix for 3.16

This fix was necessary after

9c15a24b03 ("x86/mce: Improve mcheck_init_device() error handling")

went in. What this patch did was, among others, check the return value
of misc_register and exit early if it encountered an error. Original
code sloppily didn't do that.

However,

        cef12ee52b ("xen/mce: Add mcelog support for Xen platform")

made it so that xen's init routine xen_late_init_mcelog runs first. This
was needed for the xen mcelog device which is supposed to be independent
from the baremetal one.

Initially it was reported that misc_register() fails often on xen and
that's why it needed fixing. However, it is *supposed* to fail by
design, when running in dom0 so that the xen mcelog device file gets
registered first.

And *then* you need the notifier *not* unregistered on the error path so
that the timer does get deleted properly in the CPU hotplug notifier.

Btw, this fix is needed also on baremetal in the unlikely event that
misc_register(&mce_chrdev_device) fails there too.

I was unsure whether to rush it in now and decided to delay it to 3.17.
However, xen people wanted it promoted as it breaks xen when doing cpu
hotplug there. So, after a bit of simmering in tip/master for initial
smoke testing, let's move it to 3.16. It fixes a semi-regression which
got introduced in 3.16 so no need for stable tagging.

tip/x86/ras contains that exact same commit but we can't remove it
there as it is not the last one. It won't cause any merge issues, as I
confirmed locally but I should state here the special situation of this
one fix explicitly anyway.

Thanks.

Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
2014-07-24 16:32:31 -07:00
Jerome Glisse 1b2c4869d8 drm/radeon: fix cut and paste issue for hawaii.
This is a halfway fix for hawaii acceleration. More fixes to come
but hopefully isolated to userspace.

Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-07-25 09:17:35 +10:00
Dave Airlie 97cefc3e94 Merge branch 'drm-fixes-3.16' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
two more radeon fixes.

* 'drm-fixes-3.16' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: fix irq ring buffer overflow handling
  drm/radeon: fix error handling in radeon_vm_bo_set_addr
2014-07-25 09:17:08 +10:00
Dave Airlie 9d6ed3c695 Merge tag 'drm-intel-fixes-2014-07-24' of git://anongit.freedesktop.org/drm-intel into drm-fixes
This time in time! Just 32bit-pae fix from Hugh, semaphores fun from Chris
and a fix for runtime pm cherry-picked from next.

Paulo is still working on a fix for runtime pm when X does cursor fun when
the display is off, but that one isn't ready yet.

* tag 'drm-intel-fixes-2014-07-24' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Simplify i915_gem_release_all_mmaps()
  drm/i915: fix freeze with blank screen booting highmem
  drm/i915: Reorder the semaphore deadlock check, again
2014-07-25 09:16:28 +10:00
Malcolm Priestley 4aa0abed3a staging: vt6655: Fix disassociated messages every 10 seconds
byReAssocCount is incremented every second resulting in
disassociated message being send every 10 seconds whether
connection or not.

byReAssocCount should only advance while eCommandState
is in WLAN_ASSOCIATE_WAIT

Change existing scope to if condition.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-07-24 15:10:42 -07:00
Malcolm Priestley 6cff1f6ad4 staging: vt6655: Fix Warning on boot handle_irq_event_percpu.
WARNING: CPU: 0 PID: 929 at /home/apw/COD/linux/kernel/irq/handle.c:147 handle_irq_event_percpu+0x1d1/0x1e0()
irq 17 handler device_intr+0x0/0xa80 [vt6655_stage] enabled interrupts

Using spin_lock_irqsave appears to fix this.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-07-24 15:10:42 -07:00
HIMANGI SARAOGI 9794144d5a parisc: Eliminate memset after alloc_bootmem_pages
alloc_bootmem and related function always return zeroed region of
memory. Thus a memset after calls to these functions is unnecessary.

The following Coccinelle semantic patch was used for making the change:

@@
expression E,E1;
@@

E = \(alloc_bootmem\|alloc_bootmem_low\|alloc_bootmem_pages\|alloc_bootmem_low_pages\)(...)
... when != E
- memset(E,0,E1);

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Helge Deller <deller@gmx.de>
2014-07-24 22:05:08 +02:00
John David Anglin 20dbea4945 parisc: Remove SA_RESTORER define
The sa_restorer field in struct sigaction is obsolete and no longer in
the parisc implementation.  However, the core code assumes the field is
present if SA_RESTORER is defined. So, the define needs to be removed.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
2014-07-24 22:03:26 +02:00
Uwe Kleine-König 91942d1766 ARM: 8112/1: only select ARM_PATCH_PHYS_VIRT if MMU is enabled
This fixes the following warning:

	warning: (ARCH_MULTIPLATFORM && ARCH_INTEGRATOR && ARCH_SHMOBILE_LEGACY) selects ARM_PATCH_PHYS_VIRT which has unmet direct dependencies (!XIP_KERNEL && MMU && (!ARCH_REALVIEW || !SPARSEMEM))

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2014-07-24 14:29:13 +01:00
Guenter Roeck 043572d544 hwmon: (smsc47m192) Fix temperature limit and vrm write operations
Temperature limit clamps are applied after converting the temperature
from milli-degrees C to degrees C, so either the clamp limit needs
to be specified in degrees C, not milli-degrees C, or clamping must
happen before converting to degrees C. Use the latter method to avoid
overflows.

vrm is an u8, so the written value needs to be limited to [0, 255].

Cc: Axel Lin <axel.lin@ingics.com>
Cc: stable@vger.kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Jean Delvare <jdelvare@suse.de>
2014-07-24 06:25:25 -07:00
Arnd Bergmann bf1d9879ea Two regression fixes for omaps and one fix for device signaling:
- L2 cache regression fix for a warning about trying to access
   a read-only register
 
 - GPMC ECC software fallback regression fix for omap3
 
 - Fix for dra7 pinctrl pull-up direction that causes signal issues
   for anybody trying to use the internal pull up or down
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJT0PDDAAoJEBvUPslcq6Vz2kkP/2XcaWEl5xWEP6vTFDwy1RDL
 apjp2qURWpJ579bT5y5KlGP8vyBeSLfdXl+ccCuHhBrRtYCZfsUdRaii/AHDcsd/
 N0p1ZaAQLwfMXUo1sVgW2grSOJEo8QZs8DEZ7eJfE8SnH2g/i4j+VFknYOO1t6vA
 +QoHRWcY0CRLNVHSyGGFk235pfdq1ZAKskayzQ4wCjOXuH2tKILjFsiCxItPStih
 CmKqZCoO+BQMz7dLTGZsdchDTqf0PceMh7w6PWO65QeJxr16nWmGbqnZRlUGeBqo
 vTZO1Rsfb4DlRYRGBxJ1ybVJw2cgmsx8fWKv4eYVrulGNKUE2m3UYj+oYCst0g5i
 VOPMwLiLapciCZi/4er2VWtb9sFWY6XaTAJHVRtrtX6RZgZC5c3cWGzkykXOkF7N
 Ut7He/TT41uc5OIjuG6WGQNCIfKOmfBcSDeNRqyr9YzZpn6lbJ+U4kk0kco1pyda
 IHrRUD+yHuXK0FjZvZMDlWmKqP3QLK+xjL7LRzsiJ4yfymikckjS2RH0iP9PGuCV
 T68PPl+rzyHjmVUnbBCgLnatTAQ9uHPCb4Eb5rRZaiO+4nUyqeqikMWU/DsiS4jc
 1igudgOx53/0zCCQC/VHVL9HGb4fSrbevMzq8YR3uyyS2b/R8FFbGs6Y6TCIDWdi
 TUSv/ckpA4uUbe22SFTn
 =/FMt
 -----END PGP SIGNATURE-----

Merge tag 'omap-for-v3.16/fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes

Merge "Two regression fixes for omaps and one fix for device
signaling" from Tony Lindgren:

- L2 cache regression fix for a warning about trying to access
  a read-only register

- GPMC ECC software fallback regression fix for omap3

- Fix for dra7 pinctrl pull-up direction that causes signal issues
  for anybody trying to use the internal pull up or down

* tag 'omap-for-v3.16/fixes-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: OMAP2+: gpmc: fix gpmc_hwecc_bch_capable()
  pinctrl: dra: dt-bindings: Fix pull enable/disable
  ARM: OMAP2+: l2c: squelch warning dump on power control setting

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-07-24 14:06:33 +02:00
Arnd Bergmann 683809f27e Second Round of Renesas ARM Based SoC Fixes for v3.16
* Fix SD2CKCR register address of r8a7791 (R-Car M2) SoC
 
   This corrects a bug introduced in v3.14 by
   59e79895b9 ("ARM: shmobile: r8a7791: Add clocks").
 
   However, it does not manifest in mainline code until
   SDHI devices were enabled on the Koelsch board in v3.15 by
   2c60a7df72 ("ARM: shmobile: Add SDHI devices for Koelsch DTS").
 
   It also manifests on the Henninger board when
   SDHI devices were enabled in v3.16-rc1 by
   1299df03d7 ("ARM: shmobile: henninger: add SDHI0/2 DT support")
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJT0FapAAoJENfPZGlqN0++socQAI25b++UQ89EiUQE/98yB/vq
 ma63gl346dXdv6lb8iN+rx9Vk3wtzNuroozds2iulmAnutMTdQ83huektaYdPkQ4
 T+RxOl4liJUbQRBg2+8UBtiaTB+oGQWbRkqt/MOvniTbOqYKs71Oym901ULlQMKL
 9RSyWORUx5x2c+zZMJ0eU8T6Bl9hf0P0ikHwUv9ZYIQzrYxjJubdmyVoNI6slxF9
 S4O4sUZfOSVqfSis5rEfWgG29jBYjlGdTyFXp1+kE19J02wikGRTjgM9bWkxarrF
 wfa+ZQXjMywsdY8rCSxeNEYFuS3NW7s4ylRIC4UfpvSg1cvNVVE5m4BK0E2IOIyJ
 kW/zSimYfh/RJSX+HMZ2hfipvFDE6dDOL5PHpwJ8fhWfM5Yinn1Wgfa2mUDxsPFe
 CAfhtiTB56Rhzo+ln9UcNwaakZs/uSsG0jq3lI2zNTUd+1VMS+7xB/3pdKQjDGo/
 75+UKvdcqJ4yprfcvKwIp0LsJCKWIm1hQTqSFWuYfpVaNbM+9CFQculw0YZxOWxc
 xFr3LznFidUJCHKiM4ngnPBsLfDCdjVU5MyqDXcW9iVEKeSQJJ01CCORA4MjTUT5
 niZEMcAoIMaeXeuVnL5FlRK5Owd6SgryWpy4XUlf+ioGLLE5EzuLqA9TJe4eo41P
 caa5gpyUDbTjH1J4GktY
 =SQyi
 -----END PGP SIGNATURE-----

Merge tag 'renesas-fixes2-for-v3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes

Merge "Second Round of Renesas ARM Based SoC Fixes for v3.16" from Simon Horman

* Fix SD2CKCR register address of r8a7791 (R-Car M2) SoC

  This corrects a bug introduced in v3.14 by
  59e79895b9 ("ARM: shmobile: r8a7791: Add clocks").

  However, it does not manifest in mainline code until
  SDHI devices were enabled on the Koelsch board in v3.15 by
  2c60a7df72 ("ARM: shmobile: Add SDHI devices for Koelsch DTS").

  It also manifests on the Henninger board when
  SDHI devices were enabled in v3.16-rc1 by
  1299df03d7 ("ARM: shmobile: henninger: add SDHI0/2 DT support")

* tag 'renesas-fixes2-for-v3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  ARM: shmobile: r8a7791: Fix SD2CKCR register address

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2014-07-24 13:24:57 +02:00
Vasily Averin 295dc39d94 fs: umount on symlink leaks mnt count
Currently umount on symlink blocks following umount:

/vz is separate mount

# ls /vz/ -al | grep test
drwxr-xr-x.  2 root root       4096 Jul 19 01:14 testdir
lrwxrwxrwx.  1 root root         11 Jul 19 01:16 testlink -> /vz/testdir
# umount -l /vz/testlink
umount: /vz/testlink: not mounted (expected)

# lsof /vz
# umount /vz
umount: /vz: device is busy. (unexpected)

In this case mountpoint_last() gets an extra refcount on path->mnt

Signed-off-by: Vasily Averin <vvs@openvz.org>
Acked-by: Ian Kent <raven@themaw.net>
Acked-by: Jeff Layton <jlayton@primarydata.com>
Cc: stable@vger.kernel.org
Signed-off-by: Christoph Hellwig <hch@lst.de>
2014-07-24 06:18:12 -04:00
Boaz Harrosh 6fcc5420bf direct-io: fix uninitialized warning in do_direct_IO()
The following warnings:

  fs/direct-io.c: In function ‘__blockdev_direct_IO’:
  fs/direct-io.c:1011:12: warning: ‘to’ may be used uninitialized in this function [-Wmaybe-uninitialized]
  fs/direct-io.c:913:16: note: ‘to’ was declared here
  fs/direct-io.c:1011:12: warning: ‘from’ may be used uninitialized in this function [-Wmaybe-uninitialized]
  fs/direct-io.c:913:10: note: ‘from’ was declared here

are false positive because dio_get_page() either fails, or sets both
'from' and 'to'.

Paul Bolle said ...
Maybe it's better to move initializing "to" and "from" out of
dio_get_page(). That _might_ make it easier for both the the reader and
the compiler to understand what's going on. Something like this:

Christoph Hellwig said ...
The fix of moving the code definitively looks nicer, while I think
uninitialized_var is horrible wart that won't get anywhere near my code.

Boaz Harrosh: I agree with Christoph and Paul

Signed-off-by: Boaz Harrosh <boaz@plexistor.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
2014-07-24 06:17:07 -04:00
Stephen Boyd f723aa1817 sched_clock: Avoid corrupting hrtimer tree during suspend
During suspend we call sched_clock_poll() to update the epoch and
accumulated time and reprogram the sched_clock_timer to fire
before the next wrap-around time. Unfortunately,
sched_clock_poll() doesn't restart the timer, instead it relies
on the hrtimer layer to do that and during suspend we aren't
calling that function from the hrtimer layer. Instead, we're
reprogramming the expires time while the hrtimer is enqueued,
which can cause the hrtimer tree to be corrupted. Furthermore, we
restart the timer during suspend but we update the epoch during
resume which seems counter-intuitive.

Let's fix this by saving the accumulated state and canceling the
timer during suspend. On resume we can update the epoch and
restart the timer similar to what we would do if we were starting
the clock for the first time.

Fixes: a08ca5d108 "sched_clock: Use an hrtimer instead of timer"
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Link: http://lkml.kernel.org/r/1406174630-23458-1-git-send-email-john.stultz@linaro.org
Cc: Ingo Molnar <mingo@kernel.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2014-07-24 12:02:49 +02:00
Chris Wilson ec8b0dd51c drm/i915: Allow overlapping userptr objects
Whilst I strongly advise against doing so for the implicit coherency
issues between the multiple buffer objects accessing the same backing
store, it nevertheless is a valid use case, akin to mmaping the same
file multiple times.

The reason why we forbade it earlier was that our use of the interval
tree for fast invalidation upon vma changes excluded overlapping
objects. So in the case where the user wishes to create such pairs of
overlapping objects, we degrade the range invalidation to walkin the
linear list of objects associated with the mm.

A situation where overlapping objects could arise is the lax implementation
of MIT-SHM Pixmaps in the xserver. A second situation is where the user
wishes to have different access modes to a region of memory (e.g. access
through a read-only userptr buffer and through a normal userptr buffer).

v2: Compile for mmu-notifiers after tweaking
v3: Rename is_linear/has_linear

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: "Li, Victor Y" <victor.y.li@intel.com>
Cc: "Kelley, Sean V" <sean.v.kelley@intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Cc: "Gong, Zhipeng" <zhipeng.gong@intel.com>
Cc: Akash Goel <akash.goel@intel.com>
Cc: "Volkin, Bradley D" <bradley.d.volkin@intel.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-07-24 11:00:00 +02:00
Daniel Vetter 03dae59c72 drm/i915: Ditch UMS config option
Let's march ahead with the deprecation plan laid out in

commit b30324adaf
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Wed Nov 13 22:11:25 2013 +0100

    drm/i915: Deprecated UMS support

Thus far no regression report yet, so the transparent fallback plan
seems to pan out.

Cc: Dave Airlie <airlied@gmail.com>
Cc: David Herrmann <dh.herrmann@gmail.com>
Suggested-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Dave Airlie <airlied@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-07-24 10:59:53 +02:00
David S. Miller 11f1fb3459 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
Steffen Klassert says:

====================
pull request (net): ipsec 2014-07-23

Just two fixes this time, both are stable candidates.

1) Fix the dst_entry refcount on socket policy usage.

2) Fix a wrong SPI check that prevents AH SAs from getting
   installed, dependent on the SPI. From Tobias Brunner.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-23 21:56:36 -07:00
Linus Torvalds 82e13c71bc Merge branch 'for-3.16' of git://linux-nfs.org/~bfields/linux
Pull nfsd bugfix from Bruce Fields:
 "Another regression from the xdr encoding rewrite"

* 'for-3.16' of git://linux-nfs.org/~bfields/linux:
  NFSD: Fix crash encoding lock reply on 32-bit
2014-07-23 17:55:11 -07:00
Linus Torvalds 98de5ab713 Fix arm64 regression introduced by limiting the CMA buffer to ZONE_DMA
on platforms where RAM starts above 4GB (and ZONE_DMA becoming 0).
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.9 (GNU/Linux)
 
 iQIcBAABAgAGBQJTz+NOAAoJEGvWsS0AyF7xmxQP+wYU76kz2mAyroFdVSCAidqc
 k8DgpYDkDRpxWmkoTYYAuLlMbMk6po+HyX+Gz0ZZw2A8c7bnf3+/ljVk7Y88Shs5
 B+uRLrvIb6BCuroM9oGMUxYF5s+jPmBSLvh+jefypSLrffYoGBAbXN2w9M0CP4Uh
 NiUFSNczs/F6Se7uP1vd8PiN6pJxZfWsb2nFKW3Gzi5Oo2x5JR/kLhJXM/9k6ahE
 XAskRjiHE52pfoyiC66ZLvT1PeZ/smz6quaWquoQ/9obwISWPqIRkF5UoMwpuJOY
 n9R4G7BjJH/dD7yYpgMYzANxOYMwKLtSbwJ6YO1iazWXy3t6+aF1ZsfFb7f42Ysw
 Rnpa4OGUCgWqqge+B8j2Zm7nX/TW/HpX/5YKHhTYH4dU/xsHcM4/IR+jkZ91HyJ5
 RVa9SC3wH6OEASxmN4T3pP24pT9IHKR4ckviBrrAskby7QZ1Ud+HPp2lrxdt8R3N
 m/Ee8iUPOA+uZMXYihx2Bb7E5IaMr2Dzk040nzOc+9lOOpgv2iVqgHQ5gme2DRko
 6QX6575IvqTgl4gqiQmpII4Pqu9r0NR2EWYlsLqXsiqnoWBy4ltRdvsZqy4VpP0s
 FIIC1cOXDhiNWHU5Q+QAC4CEnsnMlnb9hfbAfrLOVpyotY7ry27zGx67EdF4h8d0
 4U+HGdmgxDJf9WtAbR0X
 =NrXJ
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fix from Catalin Marinas:
 "Fix arm64 regression introduced by limiting the CMA buffer to ZONE_DMA
  on platforms where RAM starts above 4GB (and ZONE_DMA becoming 0)"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: Create non-empty ZONE_DMA when DRAM starts above 4GB
2014-07-23 17:47:36 -07:00
Linus Torvalds 29ae8a6a28 Xtensa fixes for 3.16:
- resolve FIXMEs in double exception handler for window overflow. This
    fix makes native building of linux on xtensa host possible;
  - fix sysmem region removal issue introduced in 3.15.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJTzhdsAAoJEI9vqH3mFV2ss5QP/1EVWvoI59eK3QQjrKdCRk/C
 bLi7yCgZHh75ZTPvHpwVWFkIc0C1w7wprgJJVe9LjT4BPs609IRPrwMq4CLznNpn
 nT3PcxyfJxv6q1sv/Aj4h3X/bqLMbBMclldqD4rH1WGpwLpxDjVlcfGc+7592L8a
 LInSpBsby4G44gW/4ed5I5bIKNiQYPN9WkGsHEH3gGJLosQtEOmPYV+cu/2P4rVF
 cWFHLKVSzSEEYQ7EvqWPYeBu6tp4HyHZHKwNTOaJbUg1POLn7cEH8O503nsRQ/DB
 KKEG5vy/EBvB20U819VgmtS22/C07wT7dvMNy2B0IV/T4KCLpTDE5SmFdZc20HGc
 W3/BHpBDiRQvdxsUnDEWibhgz4fgFkUi0/t20qKMJEWbHOKvrfAuM/KAgMDayWu+
 RNZuIf3sA2mxg25b9cnFFOwhBRVCJl/zhYnQl3VuDbn3qdCHfFeNz6MAYyzNGPbd
 PSRpsS8bG0y1eVaHlKc0wUrXx2COYDiKBrJ8OgswQxa+J4oTW2bS29j3ZdEeVLf5
 +aDln0FjqxRMSjPe3sq1Ex0qKW15lImSK/znjrVWOFUdPrc+FhGtkWrjc5jC6NUH
 8VN9ktuBh/ZKUT7/hLf5xWUljV5wEKZ3aeFTMT+zSQ93n/xf+lNMpDmjda+o8jru
 Wrc2dWoE2o1UjCnTqbop
 =khlu
 -----END PGP SIGNATURE-----

Merge tag 'xtensa-next-20140721' of git://github.com/czankel/xtensa-linux

Pull Xtensa fixes from Chris Zankel:
 - resolve FIXMEs in double exception handler for window overflow. This
   fix makes native building of linux on xtensa host possible;
 - fix sysmem region removal issue introduced in 3.15.

* tag 'xtensa-next-20140721' of git://github.com/czankel/xtensa-linux:
  xtensa: fix sysmem reservation at the end of existing block
  xtensa: add fixup for double exception raised in window overflow
2014-07-23 17:46:46 -07:00
Linus Torvalds 02ec474746 Pin control fixes for v3.16:
- An IRQ handling fix for the STi driver, also for stable
 - Another IRQ fix for the RCAR GPIO driver
 - A MAINTAINERS entry
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTz6+qAAoJEEEQszewGV1z+o0QAJSXONx5WyVHNXGII24loIyQ
 035O3ENmTLP2RNiibREcOk4tAD3IuIW/GYL+rx1yCCU5fAzKdoG7bG53DfariTWO
 zSe+mUxdspKEiWGs3vXP5G2+UOD0dM+GytqduAIw6Uuwd9WcZkd46D4BLmFq0V0A
 ZcY4oGaB1JetEu2LVLAuMaUkWeRMVH3SQX+YwM7dNigljgMJSHo2FduRN0+A8nJD
 TpvdsZbAzsdNyH6oOnzzOAnpIRyL/TthPwnwUcEKVtcv8zj9A4gjB9fBObuR2v5L
 rncVdVV/2anWIsSjSnaXOSLni18wIxB1YDRanTI1tH3xAfCNQNCBjPrDzdoQcMvP
 B7MkYqRnl/ZGUq74kAixAozQJBLfzyLhV5G+1zAty81x1+gLITUD3ZkqwBqGvinY
 UMg2s3eHvW20ypc2i9cTj3VZeepjyzbQ0JaF7o1GiU3By9Igy+WJPu0OlDyxGoi0
 fZZRQHfyERcGqG71RwP7aBqWJLoerOG6hJ50vbcqlKw8/EBOJNN7eROvfNk06IYp
 2RqjXGu2MKcFZWGh6Os7tO1WUp14fXX6W3szwB47EGZAPrcgTb/3NMXoj61t6dba
 uGM/PXu5xensdc98r2Hd4iOp2Z6LN9/f/9Iqm9gR1dq8B6qn2389gNXIU6j3onFh
 UUzA3NVT3W5WiNdLU1es
 =pzyJ
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v3.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:
 "Here are three pin control fixes for the v3.16 series.  Sorry that
  some of these arrive late, the summer heat in Sweden makes me slow.

   - an IRQ handling fix for the STi driver, also for stable
   - another IRQ fix for the RCAR GPIO driver
   - a MAINTAINERS entry"

* tag 'pinctrl-v3.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  gpio: rcar: Add support for DT IRQ flags
  MAINTAINERS: Add entry for the Renesas pin controller driver
  pinctrl: st: Fix irqmux handler
2014-07-23 17:42:37 -07:00
Linus Torvalds ea9339e564 Merge branch 'for-3.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata
Pull libata regression fix from Tejun Heo:
 "The last libata/for-3.16-fixes pull contained a regression introduced
  by 1871ee134b ("libata: support the ata host which implements a
  queue depth less than 32") which in turn was a fix for a regression
  introduced earlier while changing queue tag order to accomodate hard
  drives which perform poorly if tags are not allocated in circular
  order (ugh...).

  The regression happens only for SAS controllers making use of libata
  to serve ATA devices.  They don't fill an ata_host field which is used
  by the new tag allocation function leading to NULL dereference.

  This patch adds a new intermediate field ata_host->n_tags which is
  initialized for both SAS and !SAS cases to fix the issue"

* 'for-3.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
  libata: introduce ata_host->n_tags to avoid oops on SAS controllers
2014-07-23 17:39:28 -07:00
Dave Airlie e05444be70 drm/i915: fix initial fbdev setup warnings
This chunk was no longer required from what I can see, or
at least it is doing the wrong thing, as I confused
intel_connector->encoder and connector->encoder. Drop it
for now, to remove the warnings at bootup.

Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-07-24 10:27:42 +10:00
Dave Airlie 09b64267c1 drm/i915: don't suspend gt until after we disable irqs and display (v2)
When I moved the irq disable down to after display disable,
I didn't realise the gt suspend also required irqs off, so move it
down as well.

Fixes WARNs seen at suspend/resume time.

v2: moved the rps flush down as well.

Tested-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-07-24 10:26:58 +10:00
Linus Torvalds b292d6b5c4 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input layer fixes from Dmitry Torokhov:
 "A few fixups for the input subsystem"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: document INPUT_PROP_TOPBUTTONPAD
  Input: fix defuzzing logic
  Input: sirfsoc-onkey - fix GPL v2 license string typo
  Input: st-keyscan - fix 'defined but not used' compiler warnings
  Input: synaptics - add min/max quirk for pnp-id LEN2002 (Edge E531)
  Input: i8042 - add Acer Aspire 5710 to nomux blacklist
  Input: ti_am335x_tsc - warn about incorrect spelling
  Input: wacom - cleanup multitouch code when touch_max is 2
2014-07-23 15:42:53 -07:00
Linus Torvalds 7442cf9ac2 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
Pull powerpc fixes from Ben Herrenschmidt:
 "Here is a handful of powerpc fixes for 3.16.  They are all pretty
  simple and self contained and should still make this release"

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc: use _GLOBAL_TOC for memmove
  powerpc/pseries: dynamically added OF nodes need to call of_node_init
  powerpc: subpage_protect: Increase the array size to take care of 64TB
  powerpc: Fix bugs in emulate_step()
  powerpc: Disable doorbells on Power8 DD1.x
2014-07-23 15:34:13 -07:00
Linus Torvalds 355cb09304 This fixes the broken duplicate slab name check in
kmem_cache_sanity_check() that has been repeatedly reported (as recently
 as today against Fedora rawhide).  Pekka seemed to have it staged for a
 late 3.15-rc in his 'slab/urgent' branch but never sent a pull request,
 see: https://lkml.org/lkml/2014/5/23/648
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJTzuh9AAoJEMUj8QotnQNa4kkH/A0cHsQ3RraN1vvJvvQwiKgo
 fXaLDCikEoAKUNEs5394fd8HKcHrR3JAS3I1PpeiKaqO2TsQO+yGuoQyqNptUsCJ
 w0u46BWsQXXe1cUFlpWYFoZ0uCaUQ9XcIKCtR0uExSXYj48ILu855ObLSEAr/zSU
 IdXnrNrt6MGAzTkBG6gJ3gBan+DkjVb//2Es3M86xibotferxKfOTa9tUcRFRaCg
 Sl85hnfIZgA7SXf1sOMPP+B7e9TFFrrTARsXecqMgCsiIE8Pkcg8sbTHPtHM4th6
 upzk7MjvEvYmFGN20LF9EVO9JiPwqitZjS2v8RceHzPssvHazWu5xgABWLKoy4c=
 =8SD1
 -----END PGP SIGNATURE-----

Merge tag 'urgent-slab-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

Pull slab fix from Mike Snitzer:
 "This fixes the broken duplicate slab name check in
  kmem_cache_sanity_check() that has been repeatedly reported (as
  recently as today against Fedora rawhide).

  Pekka seemed to have it staged for a late 3.15-rc in his 'slab/urgent'
  branch but never sent a pull request, see:
      https://lkml.org/lkml/2014/5/23/648"

* tag 'urgent-slab-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  slab_common: fix the check for duplicate slab names
2014-07-23 15:14:46 -07:00
Linus Torvalds ed4a1084bc Merge branch 'akpm' (patches from Andrew Morton)
Merge fixes from Andrew Morton:
 "10 fixes"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  mm: hugetlb: fix copy_hugetlb_page_range()
  simple_xattr: permit 0-size extended attributes
  mm/fs: fix pessimization in hole-punching pagecache
  shmem: fix splicing from a hole while it's punched
  shmem: fix faulting into a hole, not taking i_mutex
  mm: do not call do_fault_around for non-linear fault
  sh: also try passing -m4-nofpu for SH2A builds
  zram: avoid lockdep splat by revalidate_disk
  mm/rmap.c: fix pgoff calculation to handle hugepage correctly
  coredump: fix the setting of PF_DUMPCORE
2014-07-23 15:11:11 -07:00
Naoya Horiguchi 0253d634e0 mm: hugetlb: fix copy_hugetlb_page_range()
Commit 4a705fef98 ("hugetlb: fix copy_hugetlb_page_range() to handle
migration/hwpoisoned entry") changed the order of
huge_ptep_set_wrprotect() and huge_ptep_get(), which leads to breakage
in some workloads like hugepage-backed heap allocation via libhugetlbfs.
This patch fixes it.

The test program for the problem is shown below:

  $ cat heap.c
  #include <unistd.h>
  #include <stdlib.h>
  #include <string.h>

  #define HPS 0x200000

  int main() {
  	int i;
  	char *p = malloc(HPS);
  	memset(p, '1', HPS);
  	for (i = 0; i < 5; i++) {
  		if (!fork()) {
  			memset(p, '2', HPS);
  			p = malloc(HPS);
  			memset(p, '3', HPS);
  			free(p);
  			return 0;
  		}
  	}
  	sleep(1);
  	free(p);
  	return 0;
  }

  $ export HUGETLB_MORECORE=yes ; export HUGETLB_NO_PREFAULT= ; hugectl --heap ./heap

Fixes 4a705fef98 ("hugetlb: fix copy_hugetlb_page_range() to handle
migration/hwpoisoned entry"), so is applicable to -stable kernels which
include it.

Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Reported-by: Guillaume Morin <guillaume@morinfr.org>
Suggested-by: Guillaume Morin <guillaume@morinfr.org>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: <stable@vger.kernel.org>	[2.6.37+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-07-23 15:10:55 -07:00
Hugh Dickins 4e66d445d0 simple_xattr: permit 0-size extended attributes
If a filesystem uses simple_xattr to support user extended attributes,
LTP setxattr01 and xfstests generic/062 fail with "Cannot allocate
memory": simple_xattr_alloc()'s wrap-around test mistakenly excludes
values of zero size.  Fix that off-by-one (but apparently no filesystem
needs them yet).

Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Jeff Layton <jlayton@poochiereds.net>
Cc: Aristeu Rozanski <aris@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-07-23 15:10:55 -07:00
Hugh Dickins 792ceaefe6 mm/fs: fix pessimization in hole-punching pagecache
I wanted to revert my v3.1 commit d0823576bf ("mm: pincer in
truncate_inode_pages_range"), to keep truncate_inode_pages_range() in
synch with shmem_undo_range(); but have stepped back - a change to
hole-punching in truncate_inode_pages_range() is a change to
hole-punching in every filesystem (except tmpfs) that supports it.

If there's a logical proof why no filesystem can depend for its own
correctness on the pincer guarantee in truncate_inode_pages_range() - an
instant when the entire hole is removed from pagecache - then let's
revisit later.  But the evidence is that only tmpfs suffered from the
livelock, and we have no intention of extending hole-punch to ramfs.  So
for now just add a few comments (to match or differ from those in
shmem_undo_range()), and fix one silliness noticed in d0823576bf4b...

Its "index == start" addition to the hole-punch termination test was
incomplete: it opened a way for the end condition to be missed, and the
loop go on looking through the radix_tree, all the way to end of file.
Fix that pessimization by resetting index when detected in inner loop.

Note that it's actually hard to hit this case, without the obsessive
concurrent faulting that trinity does: normally all pages are removed in
the initial trylock_page() pass, and this loop finds nothing to do.  I
had to "#if 0" out the initial pass to reproduce bug and test fix.

Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Lukas Czerner <lczerner@redhat.com>
Cc: Dave Jones <davej@redhat.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-07-23 15:10:55 -07:00
Hugh Dickins b1a366500b shmem: fix splicing from a hole while it's punched
shmem_fault() is the actual culprit in trinity's hole-punch starvation,
and the most significant cause of such problems: since a page faulted is
one that then appears page_mapped(), needing unmap_mapping_range() and
i_mmap_mutex to be unmapped again.

But it is not the only way in which a page can be brought into a hole in
the radix_tree while that hole is being punched; and Vlastimil's testing
implies that if enough other processors are busy filling in the hole,
then shmem_undo_range() can be kept from completing indefinitely.

shmem_file_splice_read() is the main other user of SGP_CACHE, which can
instantiate shmem pagecache pages in the read-only case (without holding
i_mutex, so perhaps concurrently with a hole-punch).  Probably it's
silly not to use SGP_READ already (using the ZERO_PAGE for holes): which
ought to be safe, but might bring surprises - not a change to be rushed.

shmem_read_mapping_page_gfp() is an internal interface used by
drivers/gpu/drm GEM (and next by uprobes): it should be okay.  And
shmem_file_read_iter() uses the SGP_DIRTY variant of SGP_CACHE, when
called internally by the kernel (perhaps for a stacking filesystem,
which might rely on holes to be reserved): it's unclear whether it could
be provoked to keep hole-punch busy or not.

We could apply the same umbrella as now used in shmem_fault() to
shmem_file_splice_read() and the others; but it looks ugly, and use over
a range raises questions - should it actually be per page? can these get
starved themselves?

The origin of this part of the problem is my v3.1 commit d0823576bf
("mm: pincer in truncate_inode_pages_range"), once it was duplicated
into shmem.c.  It seemed like a nice idea at the time, to ensure
(barring RCU lookup fuzziness) that there's an instant when the entire
hole is empty; but the indefinitely repeated scans to ensure that make
it vulnerable.

Revert that "enhancement" to hole-punch from shmem_undo_range(), but
retain the unproblematic rescanning when it's truncating; add a couple
of comments there.

Remove the "indices[0] >= end" test: that is now handled satisfactorily
by the inner loop, and mem_cgroup_uncharge_start()/end() are too light
to be worth avoiding here.

But if we do not always loop indefinitely, we do need to handle the case
of swap swizzled back to page before shmem_free_swap() gets it: add a
retry for that case, as suggested by Konstantin Khlebnikov; and for the
case of page swizzled back to swap, as suggested by Johannes Weiner.

Signed-off-by: Hugh Dickins <hughd@google.com>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Suggested-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Lukas Czerner <lczerner@redhat.com>
Cc: Dave Jones <davej@redhat.com>
Cc: <stable@vger.kernel.org>	[3.1+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-07-23 15:10:55 -07:00
Hugh Dickins 8e205f779d shmem: fix faulting into a hole, not taking i_mutex
Commit f00cdc6df7 ("shmem: fix faulting into a hole while it's
punched") was buggy: Sasha sent a lockdep report to remind us that
grabbing i_mutex in the fault path is a no-no (write syscall may already
hold i_mutex while faulting user buffer).

We tried a completely different approach (see following patch) but that
proved inadequate: good enough for a rational workload, but not good
enough against trinity - which forks off so many mappings of the object
that contention on i_mmap_mutex while hole-puncher holds i_mutex builds
into serious starvation when concurrent faults force the puncher to fall
back to single-page unmap_mapping_range() searches of the i_mmap tree.

So return to the original umbrella approach, but keep away from i_mutex
this time.  We really don't want to bloat every shmem inode with a new
mutex or completion, just to protect this unlikely case from trinity.
So extend the original with wait_queue_head on stack at the hole-punch
end, and wait_queue item on the stack at the fault end.

This involves further use of i_lock to guard against the races: lockdep
has been happy so far, and I see fs/inode.c:unlock_new_inode() holds
i_lock around wake_up_bit(), which is comparable to what we do here.
i_lock is more convenient, but we could switch to shmem's info->lock.

This issue has been tagged with CVE-2014-4171, which will require commit
f00cdc6df7 and this and the following patch to be backported: we
suggest to 3.1+, though in fact the trinity forkbomb effect might go
back as far as 2.6.16, when madvise(,,MADV_REMOVE) came in - or might
not, since much has changed, with i_mmap_mutex a spinlock before 3.0.
Anyone running trinity on 3.0 and earlier? I don't think we need care.

Signed-off-by: Hugh Dickins <hughd@google.com>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Tested-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Lukas Czerner <lczerner@redhat.com>
Cc: Dave Jones <davej@redhat.com>
Cc: <stable@vger.kernel.org>	[3.1+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-07-23 15:10:54 -07:00
Konstantin Khlebnikov c118678bc7 mm: do not call do_fault_around for non-linear fault
Ingo Korb reported that "repeated mapping of the same file on tmpfs
using remap_file_pages sometimes triggers a BUG at mm/filemap.c:202 when
the process exits".

He bisected the bug to d7c1755179 ("mm: implement ->map_pages for
shmem/tmpfs"), although the bug was actually added by commit
8c6e50b029 ("mm: introduce vm_ops->map_pages()").

The problem is caused by calling do_fault_around for a _non-linear_
fault.  In this case pgoff is shifted and might become negative during
calculation.

Faulting around non-linear page-fault makes no sense and breaks the
logic in do_fault_around because pgoff is shifted.

Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
Reported-by: Ingo Korb <ingo.korb@tu-dortmund.de>
Tested-by: Ingo Korb <ingo.korb@tu-dortmund.de>
Cc: Hugh Dickins <hughd@google.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Dave Jones <davej@redhat.com>
Cc: Ning Qu <quning@google.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: <stable@vger.kernel.org>	[3.15.x]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-07-23 15:10:54 -07:00
Geert Uytterhoeven b1923b55af sh: also try passing -m4-nofpu for SH2A builds
When compiling a SH2A kernel (e.g.  se7206_defconfig or rsk7203_defconfig)
using sh4-linux-gcc, linking fails with:

  net/built-in.o: In function `__sk_run_filter':
  net/core/filter.c:566: undefined reference to `__fpscr_values'
  net/core/filter.c:269: undefined reference to `__fpscr_values'
  ...
  net/built-in.o:net/core/filter.c:580: more undefined references to `__fpscr_values' follow

This happens because sh4-linux-gcc doesn't support the "-m2a-nofpu",
which is thus filtered out by "$(call cc-option, ...)".

As compiling using sh4-linux-gcc is useful for compile coverage, also
try passing "-m4-nofpu" (which is presumably filtered out when using a
real sh2a-linux toolchain) to disable the generation of FPU instructions
and references to __fpscr_values[].

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Tony Breeds <tony@bakeyournoodle.com>
Cc: Alexei Starovoitov <ast@plumgrid.com>
Cc: Fengguang Wu <fengguang.wu@intel.com>
Cc: Daniel Borkmann <dborkman@redhat.com>
Cc: Magnus Damm <magnus.damm@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-07-23 15:10:54 -07:00
Minchan Kim b4c5c60920 zram: avoid lockdep splat by revalidate_disk
Sasha reported lockdep warning [1] introduced by [2].

It could be fixed by doing disk revalidation out of the init_lock.  It's
okay because disk capacity change is protected by init_lock so that
revalidate_disk always sees up-to-date value so there is no race.

[1] https://lkml.org/lkml/2014/7/3/735
[2] zram: revalidate disk after capacity change

Fixes 2e32baea46 ("zram: revalidate disk after capacity change").

Signed-off-by: Minchan Kim <minchan@kernel.org>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Cc: "Alexander E. Patrakov" <patrakov@gmail.com>
Cc: Nitin Gupta <ngupta@vflare.org>
Cc: Jerome Marchand <jmarchan@redhat.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-07-23 15:10:54 -07:00
Naoya Horiguchi a0f7a756c2 mm/rmap.c: fix pgoff calculation to handle hugepage correctly
I triggered VM_BUG_ON() in vma_address() when I tried to migrate an
anonymous hugepage with mbind() in the kernel v3.16-rc3.  This is
because pgoff's calculation in rmap_walk_anon() fails to consider
compound_order() only to have an incorrect value.

This patch introduces page_to_pgoff(), which gets the page's offset in
PAGE_CACHE_SIZE.

Kirill pointed out that page cache tree should natively handle
hugepages, and in order to make hugetlbfs fit it, page->index of
hugetlbfs page should be in PAGE_CACHE_SIZE.  This is beyond this patch,
but page_to_pgoff() contains the point to be fixed in a single function.

Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Hillf Danton <dhillf@gmail.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-07-23 15:10:54 -07:00
Silesh C V aed8adb768 coredump: fix the setting of PF_DUMPCORE
Commit 079148b919 ("coredump: factor out the setting of PF_DUMPCORE")
cleaned up the setting of PF_DUMPCORE by removing it from all the
linux_binfmt->core_dump() and moving it to zap_threads().But this ended
up clearing all the previously set flags.  This causes issues during
core generation when tsk->flags is checked again (eg.  for PF_USED_MATH
to dump floating point registers).  Fix this.

Signed-off-by: Silesh C V <svellattu@mvista.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Cc: Mandeep Singh Baines <msb@chromium.org>
Cc: <stable@vger.kernel.org>	[3.10+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-07-23 15:10:54 -07:00
Wei Yongjun dd1d3f8f99 hyperv: Fix error return code in netvsc_init_buf()
Fix to return -ENOMEM from the kalloc error handling
case instead of 0.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-23 14:55:47 -07:00