aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-09-20dma-buf/sync_file: fix documentation errorEmilio López1-8/+5
The ioctl name and description on the documentation block don't match the ioctl being defined. This was probably overlooked while renaming the ioctls during the sync file destaging. This patch provides a more accurate description of what the ioctl actually does. Signed-off-by: Emilio López <[email protected]> Reviewed-by: Gustavo Padovan <[email protected]> Signed-off-by: Sumit Semwal <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2016-09-20drm/virtio: add real fence context and seqnoGustavo Padovan3-1/+3
virtio fences were created with no fence context, which would make then clash with an allocated fence context. Signed-off-by: Gustavo Padovan <[email protected]> Message-id: [email protected] Signed-off-by: Gerd Hoffmann <[email protected]>
2016-09-20drm/virtio: drop virtio_gpu_execbuffer_ioctl() wrappingGustavo Padovan1-16/+8
Instead of wrapping virtio_gpu_execbuffer() to execute the ioctl just execute it directly. Signed-off-by: Gustavo Padovan <[email protected]> Message-id: [email protected] Signed-off-by: Gerd Hoffmann <[email protected]>
2016-09-20virtio-gpu: avoid possible NULL pointer dereferenceHeinrich Schuchardt1-2/+4
If output is NULL it is not permissable to dereference it. So we should leave the respective function in this case. The inconsistency was indicated by cppcheck. No actual NULL pointer dereference was observed. Signed-off-by: Heinrich Schuchardt <[email protected]> Message-id: [email protected] Signed-off-by: Gerd Hoffmann <[email protected]>
2016-09-20drm/qxl: reapply cursor after SetCrtc callsRay Strode2-1/+56
The qxl driver currently destroys and recreates the qxl "primary" any time the first crtc is set. A side-effect of destroying the primary is mouse state associated with the crtc is lost, which leads to disappearing mouse cursors on wayland sessions. This commit changes the driver to reapply the cursor any time SetCrtc is called. It achieves this by keeping a reference to the cursor bo on the qxl_crtc struct. Signed-off-by: Ray Strode <[email protected]> Message-id: [email protected] https://bugzilla.redhat.com/show_bug.cgi?id=1200901 Signed-off-by: Gerd Hoffmann <[email protected]>
2016-09-20bochs: ignore device if there isn't enougth memoryGerd Hoffmann1-0/+7
The qemu stdvga can be configured with a wide range of video memory, from 1 MB to 256 MB (default is 16 MB). In case it is configured with only 1 or 2 MB it isn't really usable with bochsdrm, due to depths other than 32bpp not being supported so that isn't enough memory for a reasonable sized framebuffer. So skip the device and let vgacon or vesafb+fbcon handle the it. Signed-off-by: Gerd Hoffmann <[email protected]>
2016-09-20dma-buf/sync_file: Increment refcount of fence when all are signaled.Rafael Antognolli1-4/+2
When we merge several fences, if all of them are signaled already, we still keep one of them. So instead of using add_fence(), which will not increase the refcount of signaled fences, we should explicitly call fence_get() for the fence we are keeping. This patch fixes a kernel panic that can be triggered by creating a fence that is expired (or increasing the timeline until it expires), then creating a merged fence out of it, and deleting the merged fence. This will make the original expired fence's refcount go to zero. Testcase: igt/sw_sync/sync_expired_merge Signed-off-by: Rafael Antognolli <[email protected]> Reviewed-by: Chris Wilson <[email protected]> Reviewed-by: Gustavo Padovan <[email protected]> Signed-off-by: Sumit Semwal <[email protected]> Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
2016-09-20drm/sti: fix compositor debugfs creationVincent Abriou3-16/+12
Fix typo and issue while creating the vid and mixer debugfs entries. Signed-off-by: Vincent Abriou <[email protected]> Acked-by: Benjamin Gaignard <[email protected]>
2016-09-20drm/sti: use valid video modeFabien Dessenne3-10/+10
In atomic mode the crtc_xxx (eg crtc_hdisplay) members of the mode structure may be unset before calling atomic_check/commit for planes. Instead of, use xxx members which are actually set. Signed-off-by: Fabien Dessenne <[email protected]> Acked-by: Vincent Abriou <[email protected]>
2016-09-20drm/sti: in crtc_atomic_flush, enable only planes of this crtcFabien Dessenne1-0/+4
crtc_atomic_flush performs some additional processing, like plane enable at mixer level. Enable only the planes attached to the CRTC. Signed-off-by: Fabien Dessenne <[email protected]> Acked-by: Vincent Abriou <[email protected]>
2016-09-20drm/sti: use vtg array instead of vtg_main/auxFabien Dessenne4-15/+10
This is more generic and more consistent with the other members of the sti_compositor struct. Signed-off-by: Fabien Dessenne <[email protected]> Acked-by: Vincent Abriou <[email protected]>
2016-09-20drm/sti: use different notifier_block for each pipeFabien Dessenne3-7/+9
Each pipe shall have its own notifier block to manage the vblank event. This fixes issues where a client registered on given pipe is later abusively notified of events on the other pipe. Signed-off-by: Fabien Dessenne <[email protected]> Acked-by: Vincent Abriou <[email protected]>
2016-09-20drm/sti: fix atomic_disable checkFabien Dessenne3-9/+9
When a drm_plane is being disabled, its ->crtc member is set to NULL before the .atomic_disable() func is called. To get the crtc of the plane, read old_state->crtc instead of drm_plane->crtc Signed-off-by: Fabien Dessenne <[email protected]> Acked-by: Vincent Abriou <[email protected]>
2016-09-20drm/sti: run gdp init sequence only onceFabien Dessenne1-2/+2
Do not rely on plane->status to define whether this is the first update but rather check for gdp->vtg. This avoids multiple and unwanted calls to sti_vtg_register_client() which breaks the kernel scheduler. Signed-off-by: Fabien Dessenne <[email protected]> Acked-by: Vincent Abriou <[email protected]>
2016-09-20drm/sti: run hqvdp init sequence only onceFabien Dessenne1-2/+2
Do not rely on plane->status to define whether this is the first update but rather check for hqvdp->xp70_initialized bit status. This avoids multiple and unwanted calls to sti_vtg_register_client() which breaks the kernel scheduler. Signed-off-by: Fabien Dessenne <[email protected]> Acked-by: Vincent Abriou <[email protected]>
2016-09-20drm/sti: fix debug logsFabien Dessenne3-4/+4
Add some missing \n in logs. Signed-off-by: Fabien Dessenne <[email protected]> Acked-by: Vincent Abriou <[email protected]>
2016-09-20drm/sti: dpms function missing for HDMI connectorVincent Abriou1-0/+1
Signed-off-by: Vincent Abriou <[email protected]> Acked-by: Benjamin Gaignard <[email protected]>
2016-09-20drm/sti: Fix sparse warningsVille Syrjälä10-13/+19
drm/sti/sti_mixer.c:361:6: warning: symbol 'sti_mixer_set_matrix' was not declared. Should it be static? drm/sti/sti_gdp.c:476:5: warning: symbol 'sti_gdp_field_cb' was not declared. Should it be static? drm/sti/sti_gdp.c:885:24: warning: symbol 'sti_gdp_plane_helpers_funcs' was not declared. Should it be static? drm/sti/sti_cursor.c:348:24: warning: symbol 'sti_cursor_plane_helpers_funcs' was not declared. Should it be static? drm/sti/sti_compositor.c:28:28: warning: symbol 'stih407_compositor_data' was not declared. Should it be static? drm/sti/sti_compositor.c:49:28: warning: symbol 'stih416_compositor_data' was not declared. Should it be static? drm/sti/sti_vtg.c:75:1: warning: symbol 'vtg_lookup' was not declared. Should it be static? drm/sti/sti_vtg.c:476:24: warning: symbol 'sti_vtg_driver' was not declared. Should it be static? drm/sti/sti_dvo.c:109:5: warning: symbol 'dvo_awg_generate_code' was not declared. Should it be static? drm/sti/sti_dvo.c:602:24: warning: symbol 'sti_dvo_driver' was not declared. Should it be static? drm/sti/sti_vtac.c:209:24: warning: symbol 'sti_vtac_driver' was not declared. Should it be static? drm/sti/sti_tvout.c:914:24: warning: symbol 'sti_tvout_driver' was not declared. Should it be static? drm/sti/sti_hqvdp.c:786:5: warning: symbol 'sti_hqvdp_vtg_cb' was not declared. Should it be static? drm/sti/sti_hqvdp.c:1253:24: warning: symbol 'sti_hqvdp_plane_helpers_funcs' was not declared. Should it be static? drm/sti/sti_hqvdp.c:1292:5: warning: symbol 'sti_hqvdp_bind' was not declared. Should it be static? drm/sti/sti_hqvdp.c:1385:24: warning: symbol 'sti_hqvdp_driver' was not declared. Should it be static? drm/sti/sti_drv.c:143:6: warning: symbol 'sti_drm_dbg_cleanup' was not declared. Should it be static? Cc: Benjamin Gaignard <[email protected]> Cc: Vincent Abriou <[email protected]> Signed-off-by: Ville Syrjälä <[email protected]> Acked-by: Vincent Abriou <[email protected]>
2016-09-20drm: sti: fix coccicheck warningsBenjamin Gaignard1-4/+4
Fix four warnings shown by coccicheck. Signed-off-by: Benjamin Gaignard <[email protected]> Acked-by: Vincent Abriou <[email protected]>
2016-09-20drm: sti: Replace drm_fb_get_bpp_depth() with drm_format_plane_cpp()Laurent Pinchart1-3/+3
The driver needs the number of bytes per pixel, not the bpp and depth info meant for fbdev compatibility. Use the right API. Signed-off-by: Laurent Pinchart <[email protected]> Acked-by: Vincent Abriou <[email protected]>
2016-09-20qed: Fix stack corruption on probeYuval Mintz1-2/+2
Commit fe56b9e6a8d95 ("qed: Add module with basic common support") has introduced a stack corruption during probe, where filling a local struct with data to be sent to management firmware is incorrectly filled; The data is written outside of the struct and corrupts the stack. Changes from v1: ---------------- - Correct the value written [Caught by David Laight] Fixes: fe56b9e6a8d95 ("qed: Add module with basic common support") Signed-off-by: Yuval Mintz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-20MAINTAINERS: Add an entry for the core network DSA codeAndrew Lunn1-0/+9
The core distributed switch architecture code currently does not have a MAINTAINERS entry, which results in some contributions not landing in the right peoples inbox. Signed-off-by: Andrew Lunn <[email protected]> Acked-by: Florian Fainelli <[email protected]> Acked-by: Vivien Didelot <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-20net: ipv6: fallback to full lookup if table lookup is unsuitableVincent Bernat1-1/+10
Commit 8c14586fc320 ("net: ipv6: Use passed in table for nexthop lookups") introduced a regression: insertion of an IPv6 route in a table not containing the appropriate connected route for the gateway but which contained a non-connected route (like a default gateway) fails while it was previously working: $ ip link add eth0 type dummy $ ip link set up dev eth0 $ ip addr add 2001:db8::1/64 dev eth0 $ ip route add ::/0 via 2001:db8::5 dev eth0 table 20 $ ip route add 2001:db8:cafe::1/128 via 2001:db8::6 dev eth0 table 20 RTNETLINK answers: No route to host $ ip -6 route show table 20 default via 2001:db8::5 dev eth0 metric 1024 pref medium After this patch, we get: $ ip route add 2001:db8:cafe::1/128 via 2001:db8::6 dev eth0 table 20 $ ip -6 route show table 20 2001:db8:cafe::1 via 2001:db8::6 dev eth0 metric 1024 pref medium default via 2001:db8::5 dev eth0 metric 1024 pref medium Fixes: 8c14586fc320 ("net: ipv6: Use passed in table for nexthop lookups") Signed-off-by: Vincent Bernat <[email protected]> Acked-by: David Ahern <[email protected]> Tested-by: David Ahern <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-20drm/sun4i: dotclock: Round to closest clock rateChen-Yu Tsai1-1/+2
With display pixel clocks we want to have the closest possible clock rate, to minimize timing and refresh rate skews. Whether the actual clock rate is higher or lower than the requested rate is less important. Also check candidates against the requested rate, rather than the ideal parent rate, the varying dividers also influence the difference between the requested rate and the rounded rate. Signed-off-by: Chen-Yu Tsai <[email protected]> Signed-off-by: Maxime Ripard <[email protected]>
2016-09-19Merge branch 'mlx5-fixes'David S. Miller3-8/+17
Or Gerlitz says: ==================== mlx5 fixes to 4.8-rc6 This series series has a fix from Roi to memory corruption bug in the bulk flow counters code and two late and hopefully last fixes from me to the new eswitch offloads code. Series done over net commit 37dd348 "bna: fix crash in bnad_get_strings()" ==================== Signed-off-by: David S. Miller <[email protected]>
2016-09-19net/mlx5: E-Switch, Handle mode change failuresOr Gerlitz1-6/+14
E-switch mode changes involve creating HW tables, potentially allocating netdevices, etc, and things can fail. Add an attempt to rollback to the existing mode when changing to the new mode fails. Only if rollback fails, getting proper SRIOV functionality requires module unload or sriov disablement/enablement. Signed-off-by: Or Gerlitz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-19net/mlx5: E-Switch, Fix error flow in the SRIOV e-switch init codeOr Gerlitz1-0/+1
When enablement of the SRIOV e-switch in certain mode (switchdev or legacy) fails, we must set the mode to none. Otherwise, we'll run into double free based crashes when further attempting to deal with the e-switch (such as when disabling sriov or unloading the driver). Signed-off-by: Or Gerlitz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-19net/mlx5: Fix flow counter bulk command out mailbox allocationRoi Dayan1-2/+2
The FW command output length should be only the length of struct mlx5_cmd_fc_bulk out field. Failing to do so will cause the memcpy call which is invoked later in the driver to write over wrong memory address and corrupt kernel memory which results in random crashes. This bug was found using the kernel address sanitizer (kasan). Fixes: a351a1b03bf1 ('net/mlx5: Introduce bulk reading of flow counters') Signed-off-by: Roi Dayan <[email protected]> Signed-off-by: Or Gerlitz <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2016-09-20irqchip/gicv3: Silence noisy DEBUG_PER_CPU_MAPS warningJames Morse1-3/+4
gic_raise_softirq() walks the list of cpus using for_each_cpu(), it calls gic_compute_target_list() which advances the iterator by the number of CPUs in the cluster. If gic_compute_target_list() reaches the last CPU it leaves the iterator pointing at the last CPU. This means the next time round the for_each_cpu() loop cpumask_next() will be called with an invalid CPU. This triggers a warning when built with CONFIG_DEBUG_PER_CPU_MAPS: [ 3.077738] GICv3: CPU1: found redistributor 1 region 0:0x000000002f120000 [ 3.077943] CPU1: Booted secondary processor [410fd0f0] [ 3.078542] ------------[ cut here ]------------ [ 3.078746] WARNING: CPU: 1 PID: 0 at ../include/linux/cpumask.h:121 gic_raise_softirq+0x12c/0x170 [ 3.078812] Modules linked in: [ 3.078869] [ 3.078930] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.8.0-rc5+ #5188 [ 3.078994] Hardware name: Foundation-v8A (DT) [ 3.079059] task: ffff80087a1a0080 task.stack: ffff80087a19c000 [ 3.079145] PC is at gic_raise_softirq+0x12c/0x170 [ 3.079226] LR is at gic_raise_softirq+0xa4/0x170 [ 3.079296] pc : [<ffff0000083ead24>] lr : [<ffff0000083eac9c>] pstate: 200001c9 [ 3.081139] Call trace: [ 3.081202] Exception stack(0xffff80087a19fbe0 to 0xffff80087a19fd10) [ 3.082269] [<ffff0000083ead24>] gic_raise_softirq+0x12c/0x170 [ 3.082354] [<ffff00000808e614>] smp_send_reschedule+0x34/0x40 [ 3.082433] [<ffff0000080e80a0>] resched_curr+0x50/0x88 [ 3.082512] [<ffff0000080e89d0>] check_preempt_curr+0x60/0xd0 [ 3.082593] [<ffff0000080e8a60>] ttwu_do_wakeup+0x20/0xe8 [ 3.082672] [<ffff0000080e8bb8>] ttwu_do_activate+0x90/0xc0 [ 3.082753] [<ffff0000080ea9a4>] try_to_wake_up+0x224/0x370 [ 3.082836] [<ffff0000080eabc8>] default_wake_function+0x10/0x18 [ 3.082920] [<ffff000008103134>] __wake_up_common+0x5c/0xa0 [ 3.083003] [<ffff0000081031f4>] __wake_up_locked+0x14/0x20 [ 3.083086] [<ffff000008103f80>] complete+0x40/0x60 [ 3.083168] [<ffff00000808df7c>] secondary_start_kernel+0x15c/0x1d0 [ 3.083240] [<00000000808911a4>] 0x808911a4 [ 3.113401] Detected PIPT I-cache on CPU2 Avoid updating the iterator if the next call to cpumask_next() would cause the for_each_cpu() loop to exit. There is no change to gic_raise_softirq()'s behaviour, (cpumask_next()s eventual call to _find_next_bit() will return early as start >= nbits), this patch just silences the warning. Fixes: 021f653791ad ("irqchip: gic-v3: Initial support for GICv3") Signed-off-by: James Morse <[email protected]> Acked-by: Marc Zyngier <[email protected]> Cc: [email protected] Cc: Jason Cooper <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Thomas Gleixner <[email protected]>
2016-09-19Merge branch 'akpm' (patches from Andrew)Linus Torvalds22-146/+240
Merge fixes from Andrew Morton: "20 fixes" * emailed patches from Andrew Morton <[email protected]>: rapidio/rio_cm: avoid GFP_KERNEL in atomic context Revert "ocfs2: bump up o2cb network protocol version" ocfs2: fix start offset to ocfs2_zero_range_for_truncate() cgroup: duplicate cgroup reference when cloning sockets mm: memcontrol: make per-cpu charge cache IRQ-safe for socket accounting ocfs2: fix double unlock in case retry after free truncate log fanotify: fix list corruption in fanotify_get_response() fsnotify: add a way to stop queueing events on group shutdown ocfs2: fix trans extend while free cached blocks ocfs2: fix trans extend while flush truncate log ipc/shm: fix crash if CONFIG_SHMEM is not set mm: fix the page_swap_info() BUG_ON check autofs: use dentry flags to block walks during expire MAINTAINERS: update email for VLYNQ bus entry mm: avoid endless recursion in dump_page() mm, thp: fix leaking mapped pte in __collapse_huge_page_swapin() khugepaged: fix use-after-free in collapse_huge_page() MAINTAINERS: Maik has moved ocfs2/dlm: fix race between convert and migration mem-hotplug: don't clear the only node in new_node_page()
2016-09-19rapidio/rio_cm: avoid GFP_KERNEL in atomic contextAlexandre Bounine1-3/+16
As reported by Alexey Khoroshilov (https://lkml.org/lkml/2016/9/9/737): riocm_send_close() is called from rio_cm_shutdown() under spin_lock_bh(idr_lock), but riocm_send_close() uses a GFP_KERNEL allocation. Fix by taking riocm_send_close() outside of spinlock protected code. [[email protected]: remove unneeded `if (!list_empty())'] Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Alexandre Bounine <[email protected]> Reported-by: Alexey Khoroshilov <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19Revert "ocfs2: bump up o2cb network protocol version"Junxiao Bi1-4/+1
This reverts commit 38b52efd218b ("ocfs2: bump up o2cb network protocol version"). This commit made rolling upgrade fail. When one node is upgraded to new version with this commit, the remaining nodes will fail to establish connections to it, then the application like VMs on the remaining nodes can't be live migrated to the upgraded one. This will cause an outage. Since negotiate hb timeout behavior didn't change without this commit, so revert it. Fixes: 38b52efd218bf ("ocfs2: bump up o2cb network protocol version") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Junxiao Bi <[email protected]> Cc: Mark Fasheh <[email protected]> Cc: Joel Becker <[email protected]> Cc: Joseph Qi <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19ocfs2: fix start offset to ocfs2_zero_range_for_truncate()Ashish Samant1-10/+24
If we punch a hole on a reflink such that following conditions are met: 1. start offset is on a cluster boundary 2. end offset is not on a cluster boundary 3. (end offset is somewhere in another extent) or (hole range > MAX_CONTIG_BYTES(1MB)), we dont COW the first cluster starting at the start offset. But in this case, we were wrongly passing this cluster to ocfs2_zero_range_for_truncate() to zero out. This will modify the cluster in place and zero it in the source too. Fix this by skipping this cluster in such a scenario. To reproduce: 1. Create a random file of say 10 MB xfs_io -c 'pwrite -b 4k 0 10M' -f 10MBfile 2. Reflink it reflink -f 10MBfile reflnktest 3. Punch a hole at starting at cluster boundary with range greater that 1MB. You can also use a range that will put the end offset in another extent. fallocate -p -o 0 -l 1048615 reflnktest 4. sync 5. Check the first cluster in the source file. (It will be zeroed out). dd if=10MBfile iflag=direct bs=<cluster size> count=1 | hexdump -C Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ashish Samant <[email protected]> Reported-by: Saar Maoz <[email protected]> Reviewed-by: Srinivas Eeda <[email protected]> Cc: Mark Fasheh <[email protected]> Cc: Joel Becker <[email protected]> Cc: Junxiao Bi <[email protected]> Cc: Joseph Qi <[email protected]> Cc: Eric Ren <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19cgroup: duplicate cgroup reference when cloning socketsJohannes Weiner2-1/+10
When a socket is cloned, the associated sock_cgroup_data is duplicated but not its reference on the cgroup. As a result, the cgroup reference count will underflow when both sockets are destroyed later on. Fixes: bd1060a1d671 ("sock, cgroup: add sock->sk_cgroup") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Johannes Weiner <[email protected]> Acked-by: Tejun Heo <[email protected]> Cc: Michal Hocko <[email protected]> Cc: Vladimir Davydov <[email protected]> Cc: <[email protected]> [4.5+] Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19mm: memcontrol: make per-cpu charge cache IRQ-safe for socket accountingJohannes Weiner1-9/+22
During cgroup2 rollout into production, we started encountering css refcount underflows and css access crashes in the memory controller. Splitting the heavily shared css reference counter into logical users narrowed the imbalance down to the cgroup2 socket memory accounting. The problem turns out to be the per-cpu charge cache. Cgroup1 had a separate socket counter, but the new cgroup2 socket accounting goes through the common charge path that uses a shared per-cpu cache for all memory that is being tracked. Those caches are safe against scheduling preemption, but not against interrupts - such as the newly added packet receive path. When cache draining is interrupted by network RX taking pages out of the cache, the resuming drain operation will put references of in-use pages, thus causing the imbalance. Disable IRQs during all per-cpu charge cache operations. Fixes: f7e1cb6ec51b ("mm: memcontrol: account socket memory in unified hierarchy memory controller") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Johannes Weiner <[email protected]> Acked-by: Tejun Heo <[email protected]> Cc: "David S. Miller" <[email protected]> Cc: Michal Hocko <[email protected]> Cc: Vladimir Davydov <[email protected]> Cc: <[email protected]> [4.5+] Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19ocfs2: fix double unlock in case retry after free truncate logJoseph Qi1-2/+12
If ocfs2_reserve_cluster_bitmap_bits() fails with ENOSPC, it will try to free truncate log and then retry. Since ocfs2_try_to_free_truncate_log will lock/unlock global bitmap inode, we have to unlock it before calling this function. But when retry reserve and it fails with no global bitmap inode lock taken, it will unlock again in error handling branch and BUG. This issue also exists if no need retry and then ocfs2_inode_lock fails. So fix it. Fixes: 2070ad1aebff ("ocfs2: retry on ENOSPC if sufficient space in truncate log") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Joseph Qi <[email protected]> Signed-off-by: Jiufei Xue <[email protected]> Cc: Mark Fasheh <[email protected]> Cc: Joel Becker <[email protected]> Cc: Junxiao Bi <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19fanotify: fix list corruption in fanotify_get_response()Jan Kara4-42/+25
fanotify_get_response() calls fsnotify_remove_event() when it finds that group is being released from fanotify_release() (bypass_perm is set). However the event it removes need not be only in the group's notification queue but it can have already moved to access_list (userspace read the event before closing the fanotify instance fd) which is protected by a different lock. Thus when fsnotify_remove_event() races with fanotify_release() operating on access_list, the list can get corrupted. Fix the problem by moving all the logic removing permission events from the lists to one place - fanotify_release(). Fixes: 5838d4442bd5 ("fanotify: fix double free of pending permission events") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Jan Kara <[email protected]> Reported-by: Miklos Szeredi <[email protected]> Tested-by: Miklos Szeredi <[email protected]> Reviewed-by: Miklos Szeredi <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19fsnotify: add a way to stop queueing events on group shutdownJan Kara3-1/+29
Implement a function that can be called when a group is being shutdown to stop queueing new events to the group. Fanotify will use this. Fixes: 5838d4442bd5 ("fanotify: fix double free of pending permission events") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Jan Kara <[email protected]> Reviewed-by: Miklos Szeredi <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19ocfs2: fix trans extend while free cached blocksJunxiao Bi1-18/+9
The root cause of this issue is the same with the one fixed by the last patch, but this time credits for allocator inode and group descriptor may not be consumed before trans extend. The following error was caught: WARNING: CPU: 0 PID: 2037 at fs/jbd2/transaction.c:269 start_this_handle+0x4c3/0x510 [jbd2]() Modules linked in: ocfs2 nfsd lockd grace nfs_acl auth_rpcgss sunrpc autofs4 ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs sd_mod sg ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi cxgb3 mdio ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr ipv6 iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ppdev xen_kbdfront fb_sys_fops sysimgblt sysfillrect syscopyarea xen_netfront parport_pc parport pcspkr i2c_piix4 i2c_core acpi_cpufreq ext4 jbd2 mbcache xen_blkfront floppy pata_acpi ata_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod CPU: 0 PID: 2037 Comm: rm Tainted: G W 4.1.12-37.6.3.el6uek.bug24573128v2.x86_64 #2 Hardware name: Xen HVM domU, BIOS 4.4.4OVM 02/11/2016 Call Trace: dump_stack+0x48/0x5c warn_slowpath_common+0x95/0xe0 warn_slowpath_null+0x1a/0x20 start_this_handle+0x4c3/0x510 [jbd2] jbd2__journal_restart+0x161/0x1b0 [jbd2] jbd2_journal_restart+0x13/0x20 [jbd2] ocfs2_extend_trans+0x74/0x220 [ocfs2] ocfs2_free_cached_blocks+0x16b/0x4e0 [ocfs2] ocfs2_run_deallocs+0x70/0x270 [ocfs2] ocfs2_commit_truncate+0x474/0x6f0 [ocfs2] ocfs2_truncate_for_delete+0xbd/0x380 [ocfs2] ocfs2_wipe_inode+0x136/0x6a0 [ocfs2] ocfs2_delete_inode+0x2a2/0x3e0 [ocfs2] ocfs2_evict_inode+0x28/0x60 [ocfs2] evict+0xab/0x1a0 iput_final+0xf6/0x190 iput+0xc8/0xe0 do_unlinkat+0x1b7/0x310 SyS_unlinkat+0x22/0x40 system_call_fastpath+0x12/0x71 ---[ end trace a62437cb060baa71 ]--- JBD2: rm wants too many credits (149 > 128) Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Junxiao Bi <[email protected]> Reviewed-by: Joseph Qi <[email protected]> Cc: Mark Fasheh <[email protected]> Cc: Joel Becker <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19ocfs2: fix trans extend while flush truncate logJunxiao Bi1-19/+10
Every time, ocfs2_extend_trans() included a credit for truncate log inode, but as that inode had been managed by jbd2 running transaction first time, it will not consume that credit until jbd2_journal_restart(). Since total credits to extend always included the un-consumed ones, there will be more and more un-consumed credit, at last jbd2_journal_restart() will fail due to credit number over the half of max transction credit. The following error was caught when unlinking a large file with many extents: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 13626 at fs/jbd2/transaction.c:269 start_this_handle+0x4c3/0x510 [jbd2]() Modules linked in: ocfs2 nfsd lockd grace nfs_acl auth_rpcgss sunrpc autofs4 ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs sd_mod sg ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi cxgb3 mdio ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr ipv6 iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ppdev xen_kbdfront xen_netfront fb_sys_fops sysimgblt sysfillrect syscopyarea parport_pc parport pcspkr i2c_piix4 i2c_core acpi_cpufreq ext4 jbd2 mbcache xen_blkfront floppy pata_acpi ata_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod CPU: 0 PID: 13626 Comm: unlink Tainted: G W 4.1.12-37.6.3.el6uek.x86_64 #2 Hardware name: Xen HVM domU, BIOS 4.4.4OVM 02/11/2016 Call Trace: dump_stack+0x48/0x5c warn_slowpath_common+0x95/0xe0 warn_slowpath_null+0x1a/0x20 start_this_handle+0x4c3/0x510 [jbd2] jbd2__journal_restart+0x161/0x1b0 [jbd2] jbd2_journal_restart+0x13/0x20 [jbd2] ocfs2_extend_trans+0x74/0x220 [ocfs2] ocfs2_replay_truncate_records+0x93/0x360 [ocfs2] __ocfs2_flush_truncate_log+0x13e/0x3a0 [ocfs2] ocfs2_remove_btree_range+0x458/0x7f0 [ocfs2] ocfs2_commit_truncate+0x1b3/0x6f0 [ocfs2] ocfs2_truncate_for_delete+0xbd/0x380 [ocfs2] ocfs2_wipe_inode+0x136/0x6a0 [ocfs2] ocfs2_delete_inode+0x2a2/0x3e0 [ocfs2] ocfs2_evict_inode+0x28/0x60 [ocfs2] evict+0xab/0x1a0 iput_final+0xf6/0x190 iput+0xc8/0xe0 do_unlinkat+0x1b7/0x310 SyS_unlink+0x16/0x20 system_call_fastpath+0x12/0x71 ---[ end trace 28aa7410e69369cf ]--- JBD2: unlink wants too many credits (251 > 128) Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Junxiao Bi <[email protected]> Reviewed-by: Joseph Qi <[email protected]> Cc: Mark Fasheh <[email protected]> Cc: Joel Becker <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19ipc/shm: fix crash if CONFIG_SHMEM is not setKirill A. Shutemov1-0/+9
Commit c01d5b300774 ("shmem: get_unmapped_area align huge page") makes use of shm_get_unmapped_area() in shm_file_operations() unconditional to CONFIG_MMU. As Tony Battersby pointed this can lead NULL-pointer dereference on machine with CONFIG_MMU=y and CONFIG_SHMEM=n. In this case ipc/shm is backed by ramfs which doesn't provide f_op->get_unmapped_area for configurations with MMU. The solution is to provide dummy f_op->get_unmapped_area for ramfs when CONFIG_MMU=y, which just call current->mm->get_unmapped_area(). Fixes: c01d5b300774 ("shmem: get_unmapped_area align huge page") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Kirill A. Shutemov <[email protected]> Reported-by: Tony Battersby <[email protected]> Tested-by: Tony Battersby <[email protected]> Cc: Hugh Dickins <[email protected]> Cc: <[email protected]> [4.7.x] Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19mm: fix the page_swap_info() BUG_ON checkSantosh Shilimkar2-1/+3
Commit 62c230bc1790 ("mm: add support for a filesystem to activate swap files and use direct_IO for writing swap pages") replaced the swap_aops dirty hook from __set_page_dirty_no_writeback() with swap_set_page_dirty(). For normal cases without these special SWP flags code path falls back to __set_page_dirty_no_writeback() so the behaviour is expected to be the same as before. But swap_set_page_dirty() makes use of the page_swap_info() helper to get the swap_info_struct to check for the flags like SWP_FILE, SWP_BLKDEV etc as desired for those features. This helper has BUG_ON(!PageSwapCache(page)) which is racy and safe only for the set_page_dirty_lock() path. For the set_page_dirty() path which is often needed for cases to be called from irq context, kswapd() can toggle the flag behind the back while the call is getting executed when system is low on memory and heavy swapping is ongoing. This ends up with undesired kernel panic. This patch just moves the check outside the helper to its users appropriately to fix kernel panic for the described path. Couple of users of helpers already take care of SwapCache condition so I skipped them. Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Santosh Shilimkar <[email protected]> Cc: Mel Gorman <[email protected]> Cc: Joe Perches <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Rik van Riel <[email protected]> Cc: David S. Miller <[email protected]> Cc: Jens Axboe <[email protected]> Cc: Michal Hocko <[email protected]> Cc: Hugh Dickins <[email protected]> Cc: Al Viro <[email protected]> Cc: <[email protected]> [4.7.x] Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19autofs: use dentry flags to block walks during expireIan Kent1-13/+42
Somewhere along the way the autofs expire operation has changed to hold a spin lock over expired dentry selection. The autofs indirect mount expired dentry selection is complicated and quite lengthy so it isn't appropriate to hold a spin lock over the operation. Commit 47be61845c77 ("fs/dcache.c: avoid soft-lockup in dput()") added a might_sleep() to dput() causing a WARN_ONCE() about this usage to be issued. But the spin lock doesn't need to be held over this check, the autofs dentry info. flags are enough to block walks into dentrys during the expire. I've left the direct mount expire as it is (for now) because it is much simpler and quicker than the indirect mount expire and adding spin lock release and re-aquires would do nothing more than add overhead. Fixes: 47be61845c77 ("fs/dcache.c: avoid soft-lockup in dput()") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ian Kent <[email protected]> Reported-by: Takashi Iwai <[email protected]> Tested-by: Takashi Iwai <[email protected]> Cc: Takashi Iwai <[email protected]> Cc: NeilBrown <[email protected]> Cc: Al Viro <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19MAINTAINERS: update email for VLYNQ bus entryFlorian Fainelli1-1/+1
Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Florian Fainelli <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19mm: avoid endless recursion in dump_page()Kirill A. Shutemov1-2/+4
dump_page() uses page_mapcount() to get mapcount of the page. page_mapcount() has VM_BUG_ON_PAGE(PageSlab(page)) as mapcount doesn't make sense for slab pages and the field in struct page used for other information. It leads to recursion if dump_page() called for slub page and DEBUG_VM is enabled: dump_page() -> page_mapcount() -> VM_BUG_ON_PAGE() -> dump_page -> ... Let's avoid calling page_mapcount() for slab pages in dump_page(). Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Kirill A. Shutemov <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19mm, thp: fix leaking mapped pte in __collapse_huge_page_swapin()Ebru Akagunduz1-5/+5
Currently, khugepaged does not permit swapin if there are enough young pages in a THP. The problem is when a THP does not have enough young pages, khugepaged leaks mapped ptes. This patch prohibits leaking mapped ptes. Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ebru Akagunduz <[email protected]> Suggested-by: Andrea Arcangeli <[email protected]> Reviewed-by: Andrea Arcangeli <[email protected]> Reviewed-by: Rik van Riel <[email protected]> Cc: Vlastimil Babka <[email protected]> Cc: Mel Gorman <[email protected]> Cc: Kirill A. Shutemov <[email protected]> Cc: Johannes Weiner <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19khugepaged: fix use-after-free in collapse_huge_page()Kirill A. Shutemov1-7/+8
hugepage_vma_revalidate() tries to re-check if we still should try to collapse small pages into huge one after the re-acquiring mmap_sem. The problem Dmitry Vyukov reported[1] is that the vma found by hugepage_vma_revalidate() can be suitable for huge pages, but not the same vma we had before dropping mmap_sem. And dereferencing original vma can lead to fun results.. Let's use vma hugepage_vma_revalidate() found instead of assuming it's the same as what we had before the lock was dropped. [1] http://lkml.kernel.org/r/CACT4Y+Z3gigBvhca9kRJFcjX0G70V_nRhbwKBU+yGoESBDKi9Q@mail.gmail.com Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Kirill A. Shutemov <[email protected]> Reported-by: Dmitry Vyukov <[email protected]> Reviewed-by: Andrea Arcangeli <[email protected]> Cc: Ebru Akagunduz <[email protected]> Cc: Vlastimil Babka <[email protected]> Cc: Mel Gorman <[email protected]> Cc: Johannes Weiner <[email protected]> Cc: Vegard Nossum <[email protected]> Cc: Sasha Levin <[email protected]> Cc: Konstantin Khlebnikov <[email protected]> Cc: Andrey Ryabinin <[email protected]> Cc: Greg Thelen <[email protected]> Cc: Suleiman Souhlal <[email protected]> Cc: Hugh Dickins <[email protected]> Cc: David Rientjes <[email protected]> Cc: syzkaller <[email protected]> Cc: Kostya Serebryany <[email protected]> Cc: Alexander Potapenko <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19MAINTAINERS: Maik has movedSudip Mukherjee1-1/+1
Maik is no longer using the plusserver.de email, update with his current email. Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Sudip Mukherjee <[email protected]> Cc: Maik Broemme <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19ocfs2/dlm: fix race between convert and migrationJoseph Qi1-6/+6
Commit ac7cf246dfdb ("ocfs2/dlm: fix race between convert and recovery") checks if lockres master has changed to identify whether new master has finished recovery or not. This will introduce a race that right after old master does umount ( means master will change), a new convert request comes. In this case, it will reset lockres state to DLM_RECOVERING and then retry convert, and then fail with lockres->l_action being set to OCFS2_AST_INVALID, which will cause inconsistent lock level between ocfs2 and dlm, and then finally BUG. Since dlm recovery will clear lock->convert_pending in dlm_move_lockres_to_recovery_list, we can use it to correctly identify the race case between convert and recovery. So fix it. Fixes: ac7cf246dfdb ("ocfs2/dlm: fix race between convert and recovery") Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Joseph Qi <[email protected]> Signed-off-by: Jun Piao <[email protected]> Cc: Mark Fasheh <[email protected]> Cc: Joel Becker <[email protected]> Cc: Junxiao Bi <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2016-09-19mem-hotplug: don't clear the only node in new_node_page()Li Zhong1-1/+3
Commit 394e31d2ceb4 ("mem-hotplug: alloc new page from a nearest neighbor node when mem-offline") introduced new_node_page() for memory hotplug. In new_node_page(), the nid is cleared before calling __alloc_pages_nodemask(). But if it is the only node of the system, and the first round allocation fails, it will not be able to get memory from an empty nodemask, and will trigger oom. The patch checks whether it is the last node on the system, and if it is, then don't clear the nid in the nodemask. Fixes: 394e31d2ceb4 ("mem-hotplug: alloc new page from a nearest neighbor node when mem-offline") Link: http://lkml.kernel.org/r/1473044391.4250.19.camel@TP420 Signed-off-by: Li Zhong <[email protected]> Reported-by: John Allen <[email protected]> Acked-by: Vlastimil Babka <[email protected]> Cc: Xishi Qiu <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.