aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-10-30tracing/syscalls: Ignore numbers outside NR_syscalls' rangeRabin Vincent1-4/+4
ARM has some private syscalls (for example, set_tls(2)) which lie outside the range of NR_syscalls. If any of these are called while syscall tracing is being performed, out-of-bounds array access will occur in the ftrace and perf sys_{enter,exit} handlers. # trace-cmd record -e raw_syscalls:* true && trace-cmd report ... true-653 [000] 384.675777: sys_enter: NR 192 (0, 1000, 3, 4000022, ffffffff, 0) true-653 [000] 384.675812: sys_exit: NR 192 = 1995915264 true-653 [000] 384.675971: sys_enter: NR 983045 (76f74480, 76f74000, 76f74b28, 76f74480, 76f76f74, 1) true-653 [000] 384.675988: sys_exit: NR 983045 = 0 ... # trace-cmd record -e syscalls:* true [ 17.289329] Unable to handle kernel paging request at virtual address aaaaaace [ 17.289590] pgd = 9e71c000 [ 17.289696] [aaaaaace] *pgd=00000000 [ 17.289985] Internal error: Oops: 5 [#1] PREEMPT SMP ARM [ 17.290169] Modules linked in: [ 17.290391] CPU: 0 PID: 704 Comm: true Not tainted 3.18.0-rc2+ #21 [ 17.290585] task: 9f4dab00 ti: 9e710000 task.ti: 9e710000 [ 17.290747] PC is at ftrace_syscall_enter+0x48/0x1f8 [ 17.290866] LR is at syscall_trace_enter+0x124/0x184 Fix this by ignoring out-of-NR_syscalls-bounds syscall numbers. Commit cd0980fc8add "tracing: Check invalid syscall nr while tracing syscalls" added the check for less than zero, but it should have also checked for greater than NR_syscalls. Link: http://lkml.kernel.org/p/[email protected] Fixes: cd0980fc8add "tracing: Check invalid syscall nr while tracing syscalls" Cc: [email protected] # 2.6.33+ Signed-off-by: Rabin Vincent <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>
2014-10-30Merge branch 'ufo-fix'David S. Miller5-27/+74
Ben Hutchings says: ==================== drivers/net,ipv6: Fix IPv6 fragment ID selection for virtio The virtio net protocol supports UFO but does not provide for passing a fragment ID for fragmentation of IPv6 packets. We used to generate a fragment ID wherever such a packet was fragmented, but currently we always use ID=0! v2: Add blank lines after declarations ==================== Signed-off-by: David S. Miller <[email protected]>
2014-10-30drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packetsBen Hutchings4-1/+44
UFO is now disabled on all drivers that work with virtio net headers, but userland may try to send UFO/IPv6 packets anyway. Instead of sending with ID=0, we should select identifiers on their behalf (as we used to). Signed-off-by: Ben Hutchings <[email protected]> Fixes: 916e4cf46d02 ("ipv6: reuse ip6_frag_id from ip6_ufo_append_data") Signed-off-by: David S. Miller <[email protected]>
2014-10-30drivers/net: Disable UFO through virtioBen Hutchings3-26/+30
IPv6 does not allow fragmentation by routers, so there is no fragmentation ID in the fixed header. UFO for IPv6 requires the ID to be passed separately, but there is no provision for this in the virtio net protocol. Until recently our software implementation of UFO/IPv6 generated a new ID, but this was a bug. Now we will use ID=0 for any UFO/IPv6 packet passed through a tap, which is even worse. Unfortunately there is no distinction between UFO/IPv4 and v6 features, so disable UFO on taps and virtio_net completely until we have a proper solution. We cannot depend on VM managers respecting the tap feature flags, so keep accepting UFO packets but log a warning the first time we do this. Signed-off-by: Ben Hutchings <[email protected]> Fixes: 916e4cf46d02 ("ipv6: reuse ip6_frag_id from ip6_ufo_append_data") Signed-off-by: David S. Miller <[email protected]>
2014-10-30net: skb_fclone_busy() needs to detect orphaned skbEric Dumazet3-4/+8
Some drivers are unable to perform TX completions in a bound time. They instead call skb_orphan() Problem is skb_fclone_busy() has to detect this case, otherwise we block TCP retransmits and can freeze unlucky tcp sessions on mostly idle hosts. Signed-off-by: Eric Dumazet <[email protected]> Fixes: 1f3279ae0c13 ("tcp: avoid retransmits of TCP packets hanging in host queues") Signed-off-by: David S. Miller <[email protected]>
2014-10-30gre: Use inner mac length when computing tunnel lengthTom Herbert1-1/+1
Currently, skb_inner_network_header is used but this does not account for Ethernet header for ETH_P_TEB. Use skb_inner_mac_header which handles TEB and also should work with IP encapsulation in which case inner mac and inner network headers are the same. Tested: Ran TCP_STREAM over GRE, worked as expected. Signed-off-by: Tom Herbert <[email protected]> Acked-by: Alexander Duyck <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-10-30Merge branch 'mellanox-net'David S. Miller3-4/+17
Or Gerlitz says: ==================== mlx4 driver encapsulation/steering fixes The 1st patch fixes a bug in the TX path that supports offloading the TX checksum of (VXLAN) encapsulated TCP packets. It turns out that the bug is revealed only when the receiver runs in non-offloaded mode, so we somehow missed it so far... please queue it for -stable >= 3.14 The 2nd patch makes sure not to leak steering entry on error flow, please queue it to 3.17-stable ==================== Signed-off-by: David S. Miller <[email protected]>
2014-10-30mlx4: Avoid leaking steering rules on flow creation error flowOr Gerlitz2-2/+12
If mlx4_ib_create_flow() attempts to create > 1 rules with the firmware, and one of these registrations fail, we leaked the already created flow rules. One example of the leak is when the registration of the VXLAN ghost steering rule fails, we didn't unregister the original rule requested by the user, introduced in commit d2fce8a9060d "mlx4: Set user-space raw Ethernet QPs to properly handle VXLAN traffic". While here, add dump of the VXLAN portion of steering rules so it can actually be seen when flow creation fails. Signed-off-by: Or Gerlitz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-10-30net/mlx4_en: Don't attempt to TX offload the outer UDP checksum for VXLANOr Gerlitz1-2/+5
For VXLAN/NVGRE encapsulation, the current HW doesn't support offloading both the outer UDP TX checksum and the inner TCP/UDP TX checksum. The driver doesn't advertize SKB_GSO_UDP_TUNNEL_CSUM, however we are wrongly telling the HW to offload the outer UDP checksum for encapsulated packets, fix that. Fixes: 837052d0ccc5 ('net/mlx4_en: Add netdev support for TCP/IP offloads of vxlan tunneling') Signed-off-by: Or Gerlitz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-10-30Merge branch 'master' of ↵David S. Miller4-3/+14
git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2014-10-30 This series contains updates to e1000, igb and ixgbe. Francesco Ruggeri fixes an issue with e1000 where in a VM the driver did not support unicast filtering. Roman Gushchin fixes an issue with igb where the driver was re-using mapped pages so that packets were still getting dropped even if all the memory issues are gone and there is free memory. Junwei Zhang found where in the ixgbe_clean_rx_ring() we were repeating the assignment of NULL to the receive buffer skb and fixes it. Emil fixes a race condition between setup_link and SFP detection routine in the watchdog when setting the advertised speed. ==================== Signed-off-by: David S. Miller <[email protected]>
2014-10-30ipv4: Do not cache routing failures due to disabled forwarding.Nicolas Cavallari1-0/+1
If we cache them, the kernel will reuse them, independently of whether forwarding is enabled or not. Which means that if forwarding is disabled on the input interface where the first routing request comes from, then that unreachable result will be cached and reused for other interfaces, even if forwarding is enabled on them. The opposite is also true. This can be verified with two interfaces A and B and an output interface C, where B has forwarding enabled, but not A and trying ip route get $dst iif A from $src && ip route get $dst iif B from $src Signed-off-by: Nicolas Cavallari <[email protected]> Reviewed-by: Julian Anastasov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-10-30fs: allow open(dir, O_TMPFILE|..., 0) with mode 0Eric Rannaud1-1/+2
The man page for open(2) indicates that when O_CREAT is specified, the 'mode' argument applies only to future accesses to the file: Note that this mode applies only to future accesses of the newly created file; the open() call that creates a read-only file may well return a read/write file descriptor. The man page for open(2) implies that 'mode' is treated identically by O_CREAT and O_TMPFILE. O_TMPFILE, however, behaves differently: int fd = open("/tmp", O_TMPFILE | O_RDWR, 0); assert(fd == -1); assert(errno == EACCES); int fd = open("/tmp", O_TMPFILE | O_RDWR, 0600); assert(fd > 0); For O_CREAT, do_last() sets acc_mode to MAY_OPEN only: if (*opened & FILE_CREATED) { /* Don't check for write permission, don't truncate */ open_flag &= ~O_TRUNC; will_truncate = false; acc_mode = MAY_OPEN; path_to_nameidata(path, nd); goto finish_open_created; } But for O_TMPFILE, do_tmpfile() passes the full op->acc_mode to may_open(). This patch lines up the behavior of O_TMPFILE with O_CREAT. After the inode is created, may_open() is called with acc_mode = MAY_OPEN, in do_tmpfile(). A different, but related glibc bug revealed the discrepancy: https://sourceware.org/bugzilla/show_bug.cgi?id=17523 The glibc lazily loads the 'mode' argument of open() and openat() using va_arg() only if O_CREAT is present in 'flags' (to support both the 2 argument and the 3 argument forms of open; same idea for openat()). However, the glibc ignores the 'mode' argument if O_TMPFILE is in 'flags'. On x86_64, for open(), it magically works anyway, as 'mode' is in RDX when entering open(), and is still in RDX on SYSCALL, which is where the kernel looks for the 3rd argument of a syscall. But openat() is not quite so lucky: 'mode' is in RCX when entering the glibc wrapper for openat(), while the kernel looks for the 4th argument of a syscall in R10. Indeed, the syscall calling convention differs from the regular calling convention in this respect on x86_64. So the kernel sees mode = 0 when trying to use glibc openat() with O_TMPFILE, and fails with EACCES. Signed-off-by: Eric Rannaud <[email protected]> Acked-by: Andy Lutomirski <[email protected]> Cc: [email protected] Signed-off-by: Linus Torvalds <[email protected]>
2014-10-30cxgb4 : Fix missing initialization of win0_lockAnish Bhatt1-0/+1
win0_lock was being used un-initialized, resulting in warning traces being seen when lock debugging is enabled (and just wrong) Fixes : fc5ab0209650 ('cxgb4: Replaced the backdoor mechanism to access the HW memory with PCIe Window method') Signed-off-by: Anish Bhatt <[email protected]> Signed-off-by: Casey Leedom <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-10-30Merge branch 'r8152-net'David S. Miller1-5/+9
Hayes Wang says: ==================== r8152: patches for autosuspend There are unexpected processes when enabling autosuspend. These patches are used to fix them. ==================== Signed-off-by: David S. Miller <[email protected]>
2014-10-30r8152: check WORK_ENABLE in suspend functionhayeswang1-1/+1
Avoid unnecessary behavior when autosuspend occurs during open(). The relative processes should only be run after finishing open(). Signed-off-by: Hayes Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-10-30r8152: reset tp->speed before autoresuming in open functionhayeswang1-0/+5
If (tp->speed & LINK_STATUS) is not zero, the rtl8152_resume() would call rtl_start_rx() before enabling the tx/rx. Avoid this by resetting it to zero. Signed-off-by: Hayes Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-10-30r8152: clear SELECTIVE_SUSPEND when autoresuminghayeswang1-4/+3
The flag of SELECTIVE_SUSPEND should be cleared when autoresuming. Otherwise, when the system suspend and resume occur, it may have the wrong flow. Besides, because the flag of SELECTIVE_SUSPEND couldn't be used to check if the hw enables the relative feature, it should alwayes be disabled in close(). Signed-off-by: Hayes Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2014-10-30rtlwifi: rtl8192se: Fix firmware loadingLarry Finger1-2/+2
An error in the code makes the allocated space for firmware to be too small. Signed-off-by: Larry Finger <[email protected]> Cc: Murilo Opsfelder Araujo <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2014-10-30rtlwifi: rtl8192ce: Add missing section to read descriptor settingLarry Finger2-0/+5
The new version of rtlwifi needs code in rtl92ce_get_desc() that returns the buffer address for read operations. Signed-off-by: Larry Finger <[email protected]> Cc: Murilo Opsfelder Araujo <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2014-10-30rtlwifi: rtl8192se: Add missing section to read descriptor settingLarry Finger2-0/+5
The new version of rtlwifi needs code in rtl92se_get_desc() that returns the buffer address for read operations. Signed-off-by: Larry Finger <[email protected]> Cc: Murilo Opsfelder Araujo <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2014-10-30rtlwifi: rtl8192se: Fix duplicate calls to ieee80211_register_hw()Larry Finger1-17/+0
Driver rtlwifi has been modified to call ieee80211_register_hw() from the probe routine; however, the existing call in the callback routine for deferred firmware loading was not removed. Signed-off-by: Larry Finger <[email protected]> Cc: Murilo Opsfelder Araujo <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2014-10-30rtlwifi: rtl8192ce: rtl8192de: rtl8192se: Fix handling for missing ↵Larry Finger5-0/+10
get_btc_status The recent changes in checking for Bluetooth status added some callbacks to code in rtlwifi. To make certain that all callbacks are defined, a dummy routine has been added to rtlwifi, and the drivers that need to use it are modified. Signed-off-by: Larry Finger <[email protected]> Cc: Murilo Opsfelder Araujo <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2014-10-30mwifiex: restart rxreorder timer correctlyMarc Yang3-12/+43
During 11n RX reordering, if there is a hole in RX table, driver will not send packets to kernel until the rxreorder timer expires or the table is full. However, currently driver always restarts rxreorder timer when receiving a packet, which causes the timer hardly to expire. So while connected with to 11n AP in a busy environment, ping packets may get blocked for about 30 seconds. This patch fixes this timer restarting by ensuring rxreorder timer would only be restarted either timer is not set or start_win has changed. Signed-off-by: Chin-Ran Lo <[email protected]> Signed-off-by: Plus Chen <[email protected]> Signed-off-by: Marc Yang <[email protected]> Signed-off-by: Cathy Luo <[email protected]> Signed-off-by: Avinash Patil <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2014-10-30ath9k: fix some debugfs outputDan Carpenter1-1/+1
The right shift operation has higher precedence than the mask so we left shift by "(i * 3)" and then immediately right shift by "(i * 3)" then we mask. It should be left shift, mask, and then right shift. Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2014-10-30wireless: rt2x00: add new rt2800usb deviceCyril Brulebois1-0/+1
0x1b75 0xa200 AirLive WN-200USB wireless 11b/g/n dongle References: https://bugs.debian.org/766802 Reported-by: Martin Mokrejs <[email protected]> Cc: [email protected] Signed-off-by: Cyril Brulebois <[email protected]> Acked-by: Stanislaw Gruszka <[email protected]> Signed-off-by: John W. Linville <[email protected]>
2014-10-30PCI: Rename sysfs 'enabled' file back to 'enable'Greg Kroah-Hartman1-4/+4
Back in commit 5136b2da770d ("PCI: convert bus code to use dev_groups"), I misstyped the 'enable' sysfs filename as 'enabled', which broke the userspace API. This patch fixes that issue by renaming the file back. Fixes: 5136b2da770d ("PCI: convert bus code to use dev_groups") Reported-by: Jeff Epler <[email protected]> Tested-by: Jeff Epler <[email protected]> # on v3.14-rt Signed-off-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Bjorn Helgaas <[email protected]> CC: [email protected] # 3.13
2014-10-30Merge tag 'fbdev-fixes-3.18' of ↵Linus Torvalds29-46/+67
git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux Pull fbdev fixes from Tomi Valkeinen: - fix fb console option parsing - fixes for OMAPDSS/OMAPFB crashes related to module unloading and device/driver binding & unbinding. - fix for OMAP HDMI PLL locking failing in certain cases - misc minor fixes for atmel lcdfb and OMAP * tag 'fbdev-fixes-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: omap: dss: connector-analog-tv: Add missing module device table OMAPDSS: DSI: Fix PLL_SELFEQDCO field width OMAPDSS: fix dispc register dump for preload & mflag OMAPDSS: DISPC: fix mflag offset OMAPDSS: HDMI: fix regsd write OMAPDSS: HDMI: fix PLL GO bit handling OMAPFB: fix releasing overlays OMAPFB: fix overlay disable when freeing resources. OMAPDSS: apply: wait pending updates on manager disable OMAPFB: remove __exit annotation OMAPDSS: set suppress_bind_attrs OMAPFB: add missing MODULE_ALIAS() drivers: video: fbdev: atmel_lcdfb.c: remove unnecessary header video/console: Resolve several shadow warnings fbcon: Fix option parsing control flow in fb_console_setup
2014-10-30Merge tag 'sound-3.18-rc3' of ↵Linus Torvalds21-1484/+99
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Although the diffstat looks scary, it's just because of the removal of the dead code (s6000), thus it must not affect anything serious. Other than that, all small fixes. The only core fix is zero-clear for a PCM compat ioctl. The rest are driver-specific, bebob, sgtl500, adau1761, intel-sst, ad1889 and a few HD-audio quirks as usual" * tag 'sound-3.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Add workaround for CMI8888 snoop behavior ALSA: pcm: Zero-clear reserved fields of PCM status ioctl in compat mode ALSA: bebob: Uninitialized id returned by saffirepro_both_clk_src_get ALSA: hda/realtek - New SSID for Headset quirk ALSA: ad1889: Fix probable mask then right shift defects ALSA: bebob: fix wrong decoding of clock information for Terratec PHASE 88 Rack FW ALSA: hda/realtek - Update restore default value for ALC283 ALSA: hda/realtek - Update restore default value for ALC282 ASoC: fsl: use strncpy() to prevent copying of over-long names ASoC: adau1761: Fix input PGA volume ASoC: s6000: remove driver ASoC: Intel: HSW/BDW only support S16 and S24 formats. ASoC: sgtl500: Document the required supplies
2014-10-30ext4: make ext4_ext_convert_to_initialized() return proper number of blocksJan Kara1-5/+4
ext4_ext_convert_to_initialized() can return more blocks than are actually allocated from map->m_lblk in case where initial part of the on-disk extent is zeroed out. Luckily this doesn't have serious consequences because the caller currently uses the return value only to unmap metadata buffers. Anyway this is a data corruption/exposure problem waiting to happen so fix it. Coverity-id: 1226848 Signed-off-by: Jan Kara <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]>
2014-10-30ext4: bail early when clearing inode journal flag failsJan Kara1-1/+6
When clearing inode journal flag, we call jbd2_journal_flush() to force all the journalled data to their final locations. Currently we ignore when this fails and continue clearing inode journal flag. This isn't a big problem because when jbd2_journal_flush() fails, journal is likely aborted anyway. But it can still lead to somewhat confusing results so rather bail out early. Coverity-id: 989044 Signed-off-by: Jan Kara <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]>
2014-10-30ext4: bail out from make_indexed_dir() on first errorJan Kara1-10/+18
When ext4_handle_dirty_dx_node() or ext4_handle_dirty_dirent_node() fail, there's really something wrong with the fs and there's no point in continuing further. Just return error from make_indexed_dir() in that case. Also initialize frames array so that if we return early due to error, dx_release() doesn't try to dereference uninitialized memory (which could happen also due to error in do_split()). Coverity-id: 741300 Signed-off-by: Jan Kara <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]> Cc: [email protected]
2014-10-30jbd2: use a better hash function for the revoke tableTheodore Ts'o1-8/+2
The old hash function didn't work well for 64-bit block numbers, and used undefined (negative) shift right behavior. Use the generic 64-bit hash function instead. Signed-off-by: Theodore Ts'o <[email protected]> Reported-by: Andrey Ryabinin <[email protected]>
2014-10-30ext4: prevent bugon on race between write/fcntlDmitry Monakhov1-1/+1
O_DIRECT flags can be toggeled via fcntl(F_SETFL). But this value checked twice inside ext4_file_write_iter() and __generic_file_write() which result in BUG_ON inside ext4_direct_IO. Let's initialize iocb->private unconditionally. TESTCASE: xfstest:generic/036 https://patchwork.ozlabs.org/patch/402445/ #TYPICAL STACK TRACE: kernel BUG at fs/ext4/inode.c:2960! invalid opcode: 0000 [#1] SMP Modules linked in: brd iTCO_wdt lpc_ich mfd_core igb ptp dm_mirror dm_region_hash dm_log dm_mod CPU: 6 PID: 5505 Comm: aio-dio-fcntl-r Not tainted 3.17.0-rc2-00176-gff5c017 #161 Hardware name: Intel Corporation W2600CR/W2600CR, BIOS SE5C600.86B.99.99.x028.061320111235 06/13/2011 task: ffff88080e95a7c0 ti: ffff88080f908000 task.ti: ffff88080f908000 RIP: 0010:[<ffffffff811fabf2>] [<ffffffff811fabf2>] ext4_direct_IO+0x162/0x3d0 RSP: 0018:ffff88080f90bb58 EFLAGS: 00010246 RAX: 0000000000000400 RBX: ffff88080fdb2a28 RCX: 00000000a802c818 RDX: 0000040000080000 RSI: ffff88080d8aeb80 RDI: 0000000000000001 RBP: ffff88080f90bbc8 R08: 0000000000000000 R09: 0000000000001581 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88080d8aeb80 R13: ffff88080f90bbf8 R14: ffff88080fdb28c8 R15: ffff88080fdb2a28 FS: 00007f23b2055700(0000) GS:ffff880818400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f23b2045000 CR3: 000000080cedf000 CR4: 00000000000407e0 Stack: ffff88080f90bb98 0000000000000000 7ffffffffffffffe ffff88080fdb2c30 0000000000000200 0000000000000200 0000000000000001 0000000000000200 ffff88080f90bbc8 ffff88080fdb2c30 ffff88080f90be08 0000000000000200 Call Trace: [<ffffffff8112ca9d>] generic_file_direct_write+0xed/0x180 [<ffffffff8112f2b2>] __generic_file_write_iter+0x222/0x370 [<ffffffff811f495b>] ext4_file_write_iter+0x34b/0x400 [<ffffffff811bd709>] ? aio_run_iocb+0x239/0x410 [<ffffffff811bd709>] ? aio_run_iocb+0x239/0x410 [<ffffffff810990e5>] ? local_clock+0x25/0x30 [<ffffffff810abd94>] ? __lock_acquire+0x274/0x700 [<ffffffff811f4610>] ? ext4_unwritten_wait+0xb0/0xb0 [<ffffffff811bd756>] aio_run_iocb+0x286/0x410 [<ffffffff810990e5>] ? local_clock+0x25/0x30 [<ffffffff810ac359>] ? lock_release_holdtime+0x29/0x190 [<ffffffff811bc05b>] ? lookup_ioctx+0x4b/0xf0 [<ffffffff811bde3b>] do_io_submit+0x55b/0x740 [<ffffffff811bdcaa>] ? do_io_submit+0x3ca/0x740 [<ffffffff811be030>] SyS_io_submit+0x10/0x20 [<ffffffff815ce192>] system_call_fastpath+0x16/0x1b Code: 01 48 8b 80 f0 01 00 00 48 8b 18 49 8b 45 10 0f 85 f1 01 00 00 48 03 45 c8 48 3b 43 48 0f 8f e3 01 00 00 49 83 7c 24 18 00 75 04 <0f> 0b eb fe f0 ff 83 ec 01 00 00 49 8b 44 24 18 8b 00 85 c0 89 RIP [<ffffffff811fabf2>] ext4_direct_IO+0x162/0x3d0 RSP <ffff88080f90bb58> Reported-by: Sasha Levin <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]> Signed-off-by: Dmitry Monakhov <[email protected]> Cc: [email protected]
2014-10-30ext4: remove extent status procfs files if journal load failsDarrick J. Wong1-2/+3
If we can't load the journal, remove the procfs files for the extent status information file to avoid leaking resources. Signed-off-by: Darrick J. Wong <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]> Cc: [email protected]
2014-10-30ext4: disallow changing journal_csum option during remountDarrick J. Wong1-0/+8
ext4 does not permit changing the metadata or journal checksum feature flag while mounted. Until we decide to support that, don't allow a remount to change the journal_csum flag (right now we silently fail to change anything). Signed-off-by: Darrick J. Wong <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]>
2014-10-30ext4: enable journal checksum when metadata checksum feature enabledDarrick J. Wong1-0/+4
If metadata checksumming is turned on for the FS, we need to tell the journal to use checksumming too. Signed-off-by: Darrick J. Wong <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]> Cc: [email protected]
2014-10-30ext4: fix oops when loading block bitmap failedJan Kara1-0/+4
When we fail to load block bitmap in __ext4_new_inode() we will dereference NULL pointer in ext4_journal_get_write_access(). So check for error from ext4_read_block_bitmap(). Coverity-id: 989065 Cc: [email protected] Signed-off-by: Jan Kara <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]>
2014-10-30ext4: fix overflow when updating superblock backups after resizeJan Kara1-1/+1
When there are no meta block groups update_backups() will compute the backup block in 32-bit arithmetics thus possibly overflowing the block number and corrupting the filesystem. OTOH filesystems without meta block groups larger than 16 TB should be rare. Fix the problem by doing the counting in 64-bit arithmetics. Coverity-id: 741252 CC: [email protected] Signed-off-by: Jan Kara <[email protected]> Signed-off-by: Theodore Ts'o <[email protected]> Reviewed-by: Lukas Czerner <[email protected]>
2014-10-30Merge branch '3.18/omapdss-fixes' into 3.18/fbdev-fixesTomi Valkeinen26-23/+46
2014-10-30omap: dss: connector-analog-tv: Add missing module device tableMarek Belisko1-0/+2
Without that fix connector-analog-tv driver isn't probed when compiled as module. Signed-off-by: H. Nikolaus Schaller <[email protected]> Signed-off-by: Tomi Valkeinen <[email protected]>
2014-10-30ixgbe: fix race when setting advertised speedEmil Tantilov1-0/+4
Following commands: modprobe ixgbe ifconfig ethX up ethtool -s ethX advertise 0x020 can lead to "setup link failed with code -14" error due to the setup_link call racing with the SFP detection routine in the watchdog. This patch resolves this issue by protecting the setup_link call with check for __IXGBE_IN_SFP_INIT. Reported-by: Scott Harrison <[email protected]> Signed-off-by: Emil Tantilov <[email protected]> Tested-by: Phil Schmitt <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]>
2014-10-30ixgbe: need not repeat init skb with NULLJunwei Zhang1-1/+1
Signed-off-by: Martin Zhang <[email protected]> Tested-by: Phil Schmitt <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]>
2014-10-30igb: don't reuse pages with pfmemalloc flagRoman Gushchin1-1/+5
Incoming packet is dropped silently by sk_filter(), if the skb was allocated from pfmemalloc reserves and the corresponding socket is not marked with the SOCK_MEMALLOC flag. Igb driver allocates pages for DMA with __skb_alloc_page(), which calls alloc_pages_node() with the __GFP_MEMALLOC flag. So, in case of OOM condition, igb can get pages with pfmemalloc flag set. If an incoming packet hits the pfmemalloc page and is large enough (small packets are copying into the memory, allocated with netdev_alloc_skb_ip_align(), so they are not affected), it will be dropped. This behavior is ok under high memory pressure, but the problem is that the igb driver reuses these mapped pages. So, packets are still dropping even if all memory issues are gone and there is a plenty of free memory. In my case, some TCP sessions hang on a small percentage (< 0.1%) of machines days after OOMs. Fix this by avoiding reuse of such pages. Signed-off-by: Roman Gushchin <[email protected]> Tested-by: Aaron Brown "[email protected]" Signed-off-by: Jeff Kirsher <[email protected]>
2014-10-30e1000: unset IFF_UNICAST_FLT on WMware 82545EMFrancesco Ruggeri1-1/+4
VMWare's e1000 implementation does not seem to support unicast filtering. This can be observed by configuring a macvlan interface on eth0 in a VM in VMWare Fusion 5.0.5, and trying to use that interface instead of eth0. Tested on 3.16. Signed-off-by: Francesco Ruggeri <[email protected]> Tested-by: Aaron Brown <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]>
2014-10-30Merge branch 'urgent-for-mingo' of ↵Ingo Molnar5-15/+66
git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/urgent Pull two RCU fixes from Paul E. McKenney: " - Complete the work of commit dd56af42bd82 (rcu: Eliminate deadlock between CPU hotplug and expedited grace periods), which was intended to allow synchronize_sched_expedited() to be safely used when holding locks acquired by CPU-hotplug notifiers. This commit makes the put_online_cpus() avoid the deadlock instead of just handling the get_online_cpus(). - Complete the work of commit 35ce7f29a44a (rcu: Create rcuo kthreads only for onlined CPUs), which was intended to allow RCU to avoid allocating unneeded kthreads on systems where the firmware says that there are more CPUs than are really present. This commit makes rcu_barrier() aware of the mismatch, so that it doesn't hang waiting for non-existent CPUs. " Signed-off-by: Ingo Molnar <[email protected]>
2014-10-30Merge tag 'perf-urgent-for-mingo' of ↵Ingo Molnar7-48/+131
git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: - Fix report -F (abort, in_tx, mispredict, etc) segfaults for sample.data files without branch info (Jiri Olsa) - Add patch that should have went in a previous patchkit to use global cache provided by libunwind (Namhyung Kim) - Make CPUINFO_PROC an array to support different kernels, problem detected when the information reported via /proc/cpuinfo changed on ARM (Wang Nan) - 'perf probe' --demangle typo fix and a new --quiet option (Masami Hiramatsu) Signed-off-by: Arnaldo Carvalho de Melo <[email protected]> Signed-off-by: Ingo Molnar <[email protected]>
2014-10-29Merge branch 'akpm' (incoming from Andrew Morton)Linus Torvalds27-349/+394
Merge misc fixes from Andrew Morton: "21 fixes" * emailed patches from Andrew Morton <[email protected]>: (21 commits) mm/balloon_compaction: fix deflation when compaction is disabled sh: fix sh770x SCIF memory regions zram: avoid NULL pointer access in concurrent situation mm/slab_common: don't check for duplicate cache names ocfs2: fix d_splice_alias() return code checking mm: rmap: split out page_remove_file_rmap() mm: memcontrol: fix missed end-writeback page accounting mm: page-writeback: inline account_page_dirtied() into single caller lib/bitmap.c: fix undefined shift in __bitmap_shift_{left|right}() drivers/rtc/rtc-bq32k.c: fix register value memory-hotplug: clear pgdat which is allocated by bootmem in try_offline_node() drivers/rtc/rtc-s3c.c: fix initialization failure without rtc source clock kernel/kmod: fix use-after-free of the sub_info structure drivers/rtc/rtc-pm8xxx.c: rework to support pm8941 rtc mm, thp: fix collapsing of hugepages on madvise drivers: of: add return value to of_reserved_mem_device_init() mm: free compound page with correct order gcov: add ARM64 to GCOV_PROFILE_ALL fsnotify: next_i is freed during fsnotify_unmount_inodes. mm/compaction.c: avoid premature range skip in isolate_migratepages_range ...
2014-10-29mm/balloon_compaction: fix deflation when compaction is disabledKonstantin Khlebnikov1-0/+2
If CONFIG_BALLOON_COMPACTION=n balloon_page_insert() does not link pages with balloon and doesn't set PagePrivate flag, as a result balloon_page_dequeue() cannot get any pages because it thinks that all of them are isolated. Without balloon compaction nobody can isolate ballooned pages. It's safe to remove this check. Fixes: d6d86c0a7f8d ("mm/balloon_compaction: redesign ballooned pages management"). Signed-off-by: Konstantin Khlebnikov <[email protected]> Reported-by: Matt Mullins <[email protected]> Cc: <[email protected]> [3.17] Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2014-10-29sh: fix sh770x SCIF memory regionsAndriy Skulysh1-3/+3
Resources scif1_resources & scif2_resources overlap. Actual SCIF region size is 0x10. This is regression from commit d850acf975be ("sh: Declare SCIF register base and IRQ as resources") Signed-off-by: Andriy Skulysh <[email protected]> Acked-by: Laurent Pinchart <[email protected]> Cc: Geert Uytterhoeven <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2014-10-29zram: avoid NULL pointer access in concurrent situationWeijie Yang1-4/+6
There is a rare NULL pointer bug in mem_used_total_show() and mem_used_max_store() in concurrent situation, like this: zram is not initialized, process A is a mem_used_total reader which runs periodically, while process B try to init zram. process A process B access meta, get a NULL value init zram, done init_done() is true access meta->mem_pool, get a NULL pointer BUG This patch fixes this issue. Signed-off-by: Weijie Yang <[email protected]> Acked-by: Minchan Kim <[email protected]> Acked-by: Sergey Senozhatsky <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.