aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2018-04-16Merge airlied/drm-next into drm-misc-fixesSean Paul1417-40248/+147120
Fast forwarding -fixes for 4.17. Signed-off-by: Sean Paul <[email protected]>
2018-04-17powerpc/lib: Fix off-by-one in alternate feature patchingMichael Ellerman1-1/+1
When we patch an alternate feature section, we have to adjust any relative branches that branch out of the alternate section. But currently we have a bug if we have a branch that points to past the last instruction of the alternate section, eg: FTR_SECTION_ELSE 1: b 2f or 6,6,6 2: ALT_FTR_SECTION_END(...) nop This will result in a relative branch at 1 with a target that equals the end of the alternate section. That branch does not need adjusting when it's moved to the non-else location. Currently we do adjust it, resulting in a branch that goes off into the link-time location of the else section, which is junk. The fix is to not patch branches that have a target == end of the alternate section. Fixes: d20fe50a7b3c ("KVM: PPC: Book3S HV: Branch inside feature section") Fixes: 9b1a735de64c ("powerpc: Add logic to patch alternative feature sections") Cc: [email protected] # v2.6.27+ Signed-off-by: Michael Ellerman <[email protected]>
2018-04-16xen: xen-pciback: Replace GFP_ATOMIC with GFP_KERNEL in pcistub_reg_addJia-Ju Bai1-1/+1
pcistub_reg_add() is never called in atomic context. pcistub_reg_add() is only called by pcistub_quirk_add, which is only set in DRIVER_ATTR(). Despite never getting called from atomic context, pcistub_reg_add() calls kzalloc() with GFP_ATOMIC, which does not sleep for allocation. GFP_ATOMIC is not necessary and can be replaced with GFP_KERNEL, which can sleep and improve the possibility of sucessful allocation. This is found by a static analysis tool named DCNS written by myself. And I also manually check it. Signed-off-by: Jia-Ju Bai <[email protected]> Reviewed-by: Boris Ostrovsky <[email protected]> Signed-off-by: Boris Ostrovsky <[email protected]>
2018-04-16xen: xen-pciback: Replace GFP_ATOMIC with GFP_KERNEL in ↵Jia-Ju Bai1-1/+1
xen_pcibk_config_quirks_init xen_pcibk_config_quirks_init() is never called in atomic context. The call chains ending up at xen_pcibk_config_quirks_init() are: [1] xen_pcibk_config_quirks_init() <- xen_pcibk_config_init_dev() <- pcistub_init_device() <- pcistub_seize() <- pcistub_probe() [2] xen_pcibk_config_quirks_init() <- xen_pcibk_config_init_dev() <- pcistub_init_device() <- pcistub_init_devices_late() <- xen_pcibk_init() pcistub_probe() is only set as ".probe" in struct pci_driver. xen_pcibk_init() is is only set as a parameter of module_init(). These functions are not called in atomic context. Despite never getting called from atomic context, xen_pcibk_config_quirks_init() calls kzalloc() with GFP_ATOMIC, which does not sleep for allocation. GFP_ATOMIC is not necessary and can be replaced with GFP_KERNEL, which can sleep and improve the possibility of sucessful allocation. Signed-off-by: Jia-Ju Bai <[email protected]> Reviewed-by: Boris Ostrovsky <[email protected]> Signed-off-by: Boris Ostrovsky <[email protected]>
2018-04-16xen: xen-pciback: Replace GFP_ATOMIC with GFP_KERNEL in pcistub_device_allocJia-Ju Bai1-1/+1
pcistub_device_alloc() is never called in atomic context. The call chain ending up at pcistub_device_alloc() is: [1] pcistub_device_alloc() <- pcistub_seize() <- pcistub_probe() pcistub_probe() is only set as ".probe" in struct pci_driver. This function is not called in atomic context. Despite never getting called from atomic context, pcistub_device_alloc() calls kzalloc() with GFP_ATOMIC, which does not sleep for allocation. GFP_ATOMIC is not necessary and can be replaced with GFP_KERNEL, which can sleep and improve the possibility of sucessful allocation. Signed-off-by: Jia-Ju Bai <[email protected]> Reviewed-by: Boris Ostrovsky <[email protected]> Signed-off-by: Boris Ostrovsky <[email protected]>
2018-04-16xen: xen-pciback: Replace GFP_ATOMIC with GFP_KERNEL in pcistub_init_deviceJia-Ju Bai1-1/+1
pcistub_init_device() is never called in atomic context. The call chain ending up at pcistub_init_device() is: [1] pcistub_init_device() <- pcistub_seize() <- pcistub_probe() [2] pcistub_init_device() <- pcistub_init_devices_late() <- xen_pcibk_init() pcistub_probe() is only set as ".probe" in struct pci_driver. xen_pcibk_init() is is only set as a parameter of module_init(). These functions are not called in atomic context. Despite never getting called from atomic context, pcistub_init_device() calls kzalloc() with GFP_ATOMIC, which does not sleep for allocation. GFP_ATOMIC is not necessary and can be replaced with GFP_KERNEL, which can sleep and improve the possibility of sucessful allocation. This is found by a static analysis tool named DCNS written by myself. And I also manually check it. Signed-off-by: Jia-Ju Bai <[email protected]> Reviewed-by: Boris Ostrovsky <[email protected]> Signed-off-by: Boris Ostrovsky <[email protected]>
2018-04-16xen: xen-pciback: Replace GFP_ATOMIC with GFP_KERNEL in pcistub_probeJia-Ju Bai1-1/+1
pcistub_probe() is never called in atomic context. This function is only set as ".probe" in struct pci_driver. Despite never getting called from atomic context, pcistub_probe() calls kmalloc() with GFP_ATOMIC, which does not sleep for allocation. GFP_ATOMIC is not necessary and can be replaced with GFP_KERNEL, which can sleep and improve the possibility of sucessful allocation. This is found by a static analysis tool named DCNS written by myself. And I also manually check it. Signed-off-by: Jia-Ju Bai <[email protected]> Reviewed-by: Boris Ostrovsky <[email protected]> Signed-off-by: Boris Ostrovsky <[email protected]>
2018-04-16net: mvpp2: Fix TCAM filter reserved rangeMaxime Chevallier1-1/+1
Marvell's PPv2 controller has a Packet Header parser, which uses a fixed-size TCAM array of filter entries. The mvpp2 driver reserves some ranges among the 256 TCAM entries to perform MAC and VID filtering. The rest of the TCAM ids are freely usable for other features, such as IPv4 proto matching. This commit fixes the MVPP2_PE_LAST_FREE_TID define that sets the end of the "free range", which included the MAC range. This could therefore allow some other features to use entries dedicated to MAC filtering, lowering the number of unicast/multicast addresses that could be allowed before switching to promiscuous mode. Fixes: 10fea26ce2aa ("net: mvpp2: Add support for unicast filtering") Signed-off-by: Maxime Chevallier <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-16Revert "macsec: missing dev_put() on error in macsec_newlink()"Dan Carpenter1-3/+2
This patch is just wrong, sorry. I was trying to fix a static checker warning and misread the code. The reference taken in macsec_newlink() is released in macsec_free_netdev() when the netdevice is destroyed. This reverts commit 5dcd8400884cc4a043a6d4617e042489e5d566a9. Reported-by: Laura Abbott <[email protected]> Fixes: 5dcd8400884c ("macsec: missing dev_put() on error in macsec_newlink()") Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Sabrina Dubroca <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2018-04-16ALSA: hda - New VIA controller suppor no-snoop pathDavid Wang1-1/+2
This patch is used to tell kernel that new VIA HDAC controller also support no-snoop path. [ minor coding style fix by tiwai ] Signed-off-by: David Wang <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
2018-04-16MIPS: dts: Boston: Fix PCI bus dtc warnings:Matt Redfearn1-0/+6
dtc recently (v1.4.4-8-g756ffc4f52f6) added PCI bus checks. Fix the warnings now emitted: arch/mips/boot/dts/img/boston.dtb: Warning (pci_bridge): /pci@10000000: missing bus-range for PCI bridge arch/mips/boot/dts/img/boston.dtb: Warning (pci_bridge): /pci@12000000: missing bus-range for PCI bridge arch/mips/boot/dts/img/boston.dtb: Warning (pci_bridge): /pci@14000000: missing bus-range for PCI bridge Signed-off-by: Matt Redfearn <[email protected]> Cc: Ralf Baechle <[email protected]> Cc: Paul Burton <[email protected]> Cc: Rob Herring <[email protected]> Cc: Mark Rutland <[email protected]> Cc: [email protected] Cc: [email protected] Patchwork: https://patchwork.linux-mips.org/patch/19070/ Signed-off-by: James Hogan <[email protected]>
2018-04-16s390: rename default_defconfig to debug_defconfigHeiko Carstens1-0/+0
The name debug_defconfig reflects what the config is actually good for and should be less confusing. Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390: remove gcov defconfigHeiko Carstens1-661/+0
This config is not needed anymore. Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390: update defconfigMartin Schwidefsky3-18/+46
Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16aspeed: watchdog: Set bootstatus during probeEddie James1-0/+7
Check the aspeed timeout status register to see if the system has booted from the secondary boot source. If so, set the watchdog device bootstatus flag for "Card previously reset the CPU." Signed-off-by: Eddie James <[email protected]> Reviewed-by: Guenter Roeck <[email protected]> Signed-off-by: Guenter Roeck <[email protected]> Signed-off-by: Wim Van Sebroeck <[email protected]>
2018-04-16watchdog: renesas-wdt: Add support for WDIOF_CARDRESETVeeraiyan Chidambaram1-2/+4
This patch adds the WDIOF_CARDRESET support for the Renesas platform watchdog, to know if the board reboot is due to a watchdog reset. This is done via the WOVF bit (bit 4) of the RWTCSRA register, which indicates if RWTCNT overflowed, triggering the reset in last boot. Signed-off-by: Veeraiyan Chidambaram <[email protected]> [takeshi.kihara.df: changed to read the RWTCSRA register while clock is enabled] Signed-off-by: Takeshi Kihara <[email protected]> Signed-off-by: Wolfram Sang <[email protected]> Reviewed-by: Guenter Roeck <[email protected]> Reviewed-by: Vladimir Zapolskiy <[email protected]> Reviewed-by: Geert Uytterhoeven <[email protected]> Signed-off-by: Guenter Roeck <[email protected]> Signed-off-by: Wim Van Sebroeck <[email protected]>
2018-04-16watchdog: wafer5823wdt: Mark expected switch fall-throughGustavo A. R. Silva1-1/+1
In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that in this particular case I replaced "Fall" with a proper "Fall through" comment, which is what GCC is expecting to find. Signed-off-by: Gustavo A. R. Silva <[email protected]> Reviewed-by: Guenter Roeck <[email protected]> Signed-off-by: Guenter Roeck <[email protected]> Signed-off-by: Wim Van Sebroeck <[email protected]>
2018-04-16watchdog: w83977f_wdt: Mark expected switch fall-throughGustavo A. R. Silva1-1/+1
In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that in this particular case I replaced "Fall" with a proper "Fall through" comment, which is what GCC is expecting to find. Signed-off-by: Gustavo A. R. Silva <[email protected]> Reviewed-by: Guenter Roeck <[email protected]> Signed-off-by: Guenter Roeck <[email protected]> Signed-off-by: Wim Van Sebroeck <[email protected]>
2018-04-16watchdog: sch311x_wdt: Mark expected switch fall-throughGustavo A. R. Silva1-1/+1
In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that in this particular case I replaced "Fall" with a proper "Fall through" comment, which is what GCC is expecting to find. Signed-off-by: Gustavo A. R. Silva <[email protected]> Reviewed-by: Guenter Roeck <[email protected]> Signed-off-by: Guenter Roeck <[email protected]> Signed-off-by: Wim Van Sebroeck <[email protected]>
2018-04-16watchdog: hpwdt: change maintainer.Jerry Hoemann1-1/+1
Signed-off-by: Jerry Hoemann <[email protected]> Reviewed-by: Guenter Roeck <[email protected]> Acked-by: Jimmy Vance <[email protected]> Signed-off-by: Guenter Roeck <[email protected]> Signed-off-by: Wim Van Sebroeck <[email protected]>
2018-04-16fs: ext2: Adding new return type vm_fault_tSouptick Joarder1-2/+2
Use new return type vm_fault_t for page_mkwrite, pfn_mkwrite and fault handler. Signed-off-by: Souptick Joarder <[email protected]> Reviewed-by: Matthew Wilcox <[email protected]> Signed-off-by: Jan Kara <[email protected]>
2018-04-16isofs: fix potential memory leak in mount option parsingChengguang Xu1-0/+3
When specifying string type mount option (e.g., iocharset) several times in a mount, current option parsing may cause memory leak. Hence, call kfree for previous one in this case. Meanwhile, check memory allocation result for it. Signed-off-by: Chengguang Xu <[email protected]> Signed-off-by: Jan Kara <[email protected]>
2018-04-16rbd: notrim map optionIlya Dryomov1-5/+14
Add an option to turn off discard and write zeroes offload support to avoid deprovisioning a fully provisioned image. When enabled, discard requests will fail with -EOPNOTSUPP, write zeroes requests will fall back to manually zeroing. Signed-off-by: Ilya Dryomov <[email protected]> Tested-by: Hitoshi Kamei <[email protected]>
2018-04-16rbd: adjust queue limits for "fancy" stripingIlya Dryomov1-9/+8
In order to take full advantage of merging in ceph_file_to_extents(), allow object set sized I/Os. If the layout is not "fancy", an object set consists of just one object. Signed-off-by: Ilya Dryomov <[email protected]>
2018-04-16rbd: avoid Wreturn-type warningsArnd Bergmann1-3/+3
In some configurations gcc cannot see that rbd_assert(0) leads to an unreachable code path: drivers/block/rbd.c: In function 'rbd_img_is_write': drivers/block/rbd.c:1397:1: error: control reaches end of non-void function [-Werror=return-type] drivers/block/rbd.c: In function '__rbd_obj_handle_request': drivers/block/rbd.c:2499:1: error: control reaches end of non-void function [-Werror=return-type] drivers/block/rbd.c: In function 'rbd_obj_handle_write': drivers/block/rbd.c:2471:1: error: control reaches end of non-void function [-Werror=return-type] As the rbd_assert() here shows has no extra information beyond the verbose BUG(), we can simply use BUG() directly in its place. This is reliably detected as not returning on any architecture, since it doesn't depend on the unlikely() comparison that confused gcc. Fixes: 3da691bf4366 ("rbd: new request handling code") Signed-off-by: Arnd Bergmann <[email protected]> Reviewed-by: Ilya Dryomov <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]>
2018-04-16ceph: always update atime/mtime/ctime for new inodeYan, Zheng1-3/+7
For new inode, atime/mtime/ctime are uninitialized. Don't compare against them. Cc: [email protected] Signed-off-by: "Yan, Zheng" <[email protected]> Reviewed-by: Ilya Dryomov <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]>
2018-04-16rbd: support timeout in rbd_wait_state_locked()Dongsheng Yang1-1/+21
currently, the rbd_wait_state_locked() will wait forever if we can't get our state locked. Example: rbd map --exclusive test1 --> /dev/rbd0 rbd map test1 --> /dev/rbd1 dd if=/dev/zero of=/dev/rbd1 bs=1M count=1 --> IO blocked To avoid this problem, this patch introduce a timeout design in rbd_wait_state_locked(). Then rbd_wait_state_locked() will return error when we reach a timeout. This patch allow user to set the lock_timeout in rbd mapping. Signed-off-by: Dongsheng Yang <[email protected]> Reviewed-by: Ilya Dryomov <[email protected]> Signed-off-by: Ilya Dryomov <[email protected]>
2018-04-16rbd: refactor rbd_wait_state_locked()Ilya Dryomov1-17/+26
In preparation for lock_timeout option, make rbd_wait_state_locked() return error codes. Signed-off-by: Ilya Dryomov <[email protected]>
2018-04-16s390: add support for IBM z14 Model ZR1Heiko Carstens3-4/+6
Just add the new machine type number to the two places that matter. Cc: <[email protected]> # v4.14+ Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390: remove couple of duplicate includesVasily Gorbik2-2/+0
Removing couple of duplicate includes, found by "make includecheck". That leaves 1 duplicate include in arch/s390/kernel/entry.S, which is there for a reason (it includes generated asm/syscall_table.h twice). Signed-off-by: Vasily Gorbik <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/boot: remove unused COMPILE_VERSION and ccflags-yVasily Gorbik1-6/+0
ccflags-y has no effect (no code is built in that directory, arch/s390/boot/compressed/Makefile defines its own KBUILD_CFLAGS). Removing ccflags-y together with COMPILE_VERSION. Reviewed-by: Heiko Carstens <[email protected]> Signed-off-by: Vasily Gorbik <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/nospec: include cpu.hSebastian Ott1-0/+1
Fix the following sparse warnings: symbol 'cpu_show_spectre_v1' was not declared. Should it be static? symbol 'cpu_show_spectre_v2' was not declared. Should it be static? Signed-off-by: Sebastian Ott <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/decompressor: Ignore file vmlinux.bin.fullThomas Richter1-0/+1
Commit 81796a3c6a4a ("s390/decompressor: trim uncompressed image head during the build") introduced a new file named vmlinux.bin.full in directory arch/s390/boot/compressed. Add this file to the list of ignored files so it does not show up on git status. Signed-off-by: Thomas Richter <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/kexec_file: add generated files to .gitignoreHeiko Carstens1-0/+2
Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/Kconfig: Move kexec config options to "Processor type and features"Philipp Rudo1-21/+20
The config options for kexec are currently not under any menu directory. Up until now this was not a problem as standard kexec is always compiled in and thus does not create a menu entry. This changed when kexec_file_load was enabled. Its config option requires a menu entry which, when added beneath standard kexec option, appears on the main directory above "General Setup". Thus move the whole block further down such that the entry in now in "Processor type and features". While at it also update the help text for kexec file. Signed-off-by: Philipp Rudo <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/kexec_file: Add ELF loaderPhilipp Rudo4-0/+150
Add an ELF loader for kexec_file. The main task here is to do proper sanity checks on the ELF file. Basically all other functionality was already implemented for the image loader. Signed-off-by: Philipp Rudo <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/kexec_file: Add crash support to image loaderPhilipp Rudo4-6/+234
Add support to load a crash kernel to the image loader. This requires extending the purgatory. Signed-off-by: Philipp Rudo <[email protected]> Reviewed-by: Martin Schwidefsky <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/kexec_file: Add image loaderPhilipp Rudo4-1/+176
Add an image loader for kexec_file_load. For simplicity first skip crash support. The functions defined in machine_kexec_file will later be shared with the ELF loader. Signed-off-by: Philipp Rudo <[email protected]> Reviewed-by: Martin Schwidefsky <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/kexec_file: Add kexec_file_load system callPhilipp Rudo6-0/+144
This patch adds the kexec_file_load system call to s390 as well as the arch specific functions common code requires to work. Loaders for the different file types will be added later. Signed-off-by: Philipp Rudo <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/kexec_file: Add purgatoryPhilipp Rudo7-0/+198
The common code expects the architecture to have a purgatory that runs between the two kernels. Add it now. For simplicity first skip crash support. Signed-off-by: Philipp Rudo <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/kexec_file: Prepare setup.h for kexec_file_loadPhilipp Rudo1-13/+27
kexec_file_load needs to prepare the new kernels before they are loaded. For that it has to know the offsets in head.S, e.g. to register the new command line. Unfortunately there are no macros right now defining those offsets. Define them now. Signed-off-by: Philipp Rudo <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/smsgiucv: disable SMSG on module unloadMartin Schwidefsky1-1/+1
The module exit function of the smsgiucv module uses the incorrect CP command to disable SMSG messages. The correct command is "SET SMSG OFF". Use it. Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16s390/sclp: avoid potential usage of uninitialized valueVasily Gorbik1-1/+1
sclp_early_printk could be used before .bss section is zeroed (i.e. from als.c during the decompressor phase), therefore values used by sclp_early_printk should be located in the .data section. Another reason for that is to avoid potential initrd corruption, if some code in future would use sclp_early_printk before initrd is moved from possibly overlapping with .bss section region to a safe location. Fixes: 0b0d1173d8ae ("s390/sclp: 32 bit event mask compatibility mode") Signed-off-by: Vasily Gorbik <[email protected]> Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2018-04-16Merge tag 'perf-core-for-mingo-4.17-20180413' of ↵Ingo Molnar25-48/+178
git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull tooling improvements and fixes from Arnaldo Carvalho de Melo: perf annotate fixes and improvements: - Allow showing offsets in more than just jump targets, use the new 'O' hotkey in the TUI, config ~/.perfconfig annotate.offset_level for it and for --stdio2 (Arnaldo Carvalho de Melo) - Use the resolved variable names from objdump disassembled lines to make them more compact, just like was already done for some instructions, like "mov", this eventually will be done more generally, but lets now add some more to the existing mechanism (Arnaldo Carvalho de Melo) perf record fixes: - Change warning for missing topology sysfs entry to debug, as not all architectures have those files, s390 being one of those (Thomas Richter) perf sched fixes: - Fix -g/--call-graph documentation (Takuya Yamamoto) perf stat: - Enable 1ms interval for printing event counters values in (Alexey Budankov) perf test fixes: - Run dwarf unwind on arm32 (Kim Phillips) - Remove unused ptrace.h include from LLVM test, sidesteping older clang's lack of support for some asm constructs (Arnaldo Carvalho de Melo) perf version fixes: - Do not print info about HAVE_LIBAUDIT_SUPPORT in 'perf version --build-options' when HAVE_SYSCALL_TABLE_SUPPORT is true, as libaudit won't be used in that case, print info about syscall_table support instead (Jin Yao) Build system fixes: - Use HAVE_..._SUPPORT used consistently (Jin Yao) - Restore READ_ONCE() C++ compatibility in tools/include (Mark Rutland) - Give hints about package names needed to build jvmti (Arnaldo Carvalho de Melo) Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
2018-04-16mm,vmscan: Allow preallocating memory for register_shrinker().Tetsuo Handa3-8/+29
syzbot is catching so many bugs triggered by commit 9ee332d99e4d5a97 ("sget(): handle failures of register_shrinker()"). That commit expected that calling kill_sb() from deactivate_locked_super() without successful fill_super() is safe, but the reality was different; some callers assign attributes which are needed for kill_sb() after sget() succeeds. For example, [1] is a report where sb->s_mode (which seems to be either FMODE_READ | FMODE_EXCL | FMODE_WRITE or FMODE_READ | FMODE_EXCL) is not assigned unless sget() succeeds. But it does not worth complicate sget() so that register_shrinker() failure path can safely call kill_block_super() via kill_sb(). Making alloc_super() fail if memory allocation for register_shrinker() failed is much simpler. Let's avoid calling deactivate_locked_super() from sget_userns() by preallocating memory for the shrinker and making register_shrinker() in sget_userns() never fail. [1] https://syzkaller.appspot.com/bug?id=588996a25a2587be2e3a54e8646728fb9cae44e7 Signed-off-by: Tetsuo Handa <[email protected]> Reported-by: syzbot <[email protected]> Cc: Al Viro <[email protected]> Cc: Michal Hocko <[email protected]> Signed-off-by: Al Viro <[email protected]>
2018-04-15rpc_pipefs: fix double-dput()Al Viro1-0/+1
if we ever hit rpc_gssd_dummy_depopulate() dentry passed to it has refcount equal to 1. __rpc_rmpipe() drops it and dput() done after that hits an already freed dentry. Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2018-04-15orangefs_kill_sb(): deal with allocation failuresAl Viro1-0/+5
orangefs_fill_sb() might've failed to allocate ORANGEFS_SB(s); don't oops in that case. Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2018-04-15jffs2_kill_sb(): deal with failed allocationsAl Viro1-1/+1
jffs2_fill_super() might fail to allocate jffs2_sb_info; jffs2_kill_sb() must survive that. Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2018-04-15hypfs_kill_super(): deal with failed allocationsAl Viro1-1/+1
hypfs_fill_super() might fail to allocate sbi; hypfs_kill_super() should not oops on that. Cc: [email protected] Signed-off-by: Al Viro <[email protected]>
2018-04-15Linux 4.17-rc1Linus Torvalds1-2/+2