Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1201166 > unrolled thread
| Started by | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| First post | 2015-08-05 23:50 +0200 |
| Last post | 2015-08-06 00:30 +0200 |
| Articles | 20 on this page of 111 — 2 participants |
Back to article view | Back to linux.kernel
[3.19.y-ckt stable] Linux 3.19.8-ckt5 stable review Kamal Mostafa <kamal@canonical.com> - 2015-08-05 23:50 +0200
[PATCH 3.19.y-ckt 086/107] staging: vt6656: check ieee80211_bss_conf bssid not NULL Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 098/107] net: call rcu_read_lock early in process_backlog Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 094/107] ARM: 8404/1: dma-mapping: fix off-by-one error in bitmap size check Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 091/107] drm/radeon: fix user ptr race condition Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 079/107] can: c_can: Fix default pinmux glitch at init Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 088/107] scsi: fix host max depth checking for the 'queue_depth' sysfs interface Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 103/107] net: graceful exit from netif_alloc_netdev_queues() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 077/107] Btrfs: fix list transaction->pending_ordered corruption Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 100/107] bridge: mdb: start delete timer for temp static entries Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 081/107] ARC: make sure instruction_pointer() returns unsigned value Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 080/107] ARM: dts: dra7x-evm: Prevent glitch on DCAN1 pinmux Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 104/107] net: dsa: Fix off-by-one in switch address parsing Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 092/107] drm/radeon/ci: silence a harmless PCC warning Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 085/107] staging: vt6655: check ieee80211_bss_conf bssid not NULL Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 089/107] drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 084/107] Btrfs: fix file corruption after cloning inline extents Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 096/107] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
Re: [PATCH 3.19.y-ckt 096/107] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() Jan Kara <jack@suse.cz> - 2015-08-06 17:20 +0200
Re: [PATCH 3.19.y-ckt 096/107] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 18:00 +0200
[PATCH 3.19.y-ckt 001/107] ieee802154: Fix sockaddr_ieee802154 implicit padding information leak. Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 011/107] KEYS: ensure we free the assoc array edit if edit is valid Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 083/107] Revert "drm/i915: Declare the swizzling unknown for L-shaped configurations" Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 063/107] USB: cp210x: add ID for Aruba Networks controllers Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 105/107] perf hists browser: Take the --comm, --dsos, etc filters into account Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 095/107] dma-debug: skip debug_dma_assert_idle() when disabled Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 087/107] st: null pointer dereference panic caused by use after kref_put by st_open Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 082/107] s390/process: fix sfpc inline assembly Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 090/107] drm/radeon: Don't flush the GART TLB if rdev->gart.ptr == NULL Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 106/107] net: dsa: Test array index before use Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 066/107] usb: f_mass_storage: limit number of reported LUNs Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 073/107] drivers: net: cpsw: fix crash while accessing second slave ethernet interface Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 107/107] rds: rds_ib_device.refcount overflow Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 097/107] ipv6: Make MLD packets to only be processed locally Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 099/107] ip_tunnel: fix ipv4 pmtu check to honor inner ip header df Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 093/107] genirq: Prevent resend to interrupts marked IRQ_NESTED_THREAD Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 102/107] net: do not process device backlog during unregistration Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 101/107] bridge: mdb: zero out the local br_ip variable before use Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:00 +0200
[PATCH 3.19.y-ckt 004/107] x86/asm/entry/64: Remove a redundant jump Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 060/107] ARC: Override toplevel default -O2 with -O3 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 071/107] ARM: dts: mx23: fix iio-hwmon support Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 069/107] drm: add a check for x/y in drm_mode_setcrtc Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 064/107] dm btree: silence lockdep lock inversion in dm_btree_del() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 054/107] iio: light: tcs3414: Fix bug preventing to set integration time Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 068/107] drm/rockchip: use drm_gem_mmap helpers Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 062/107] USB: option: add 2020:4000 ID Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 076/107] Btrfs: fix memory leak in the extent_same ioctl Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 067/107] s390/sclp: clear upper register halves in _sclp_print_early Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 052/107] iio: DAC: ad5624r_spi: fix bit shift of output data value Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 070/107] bio integrity: do not assume bio_integrity_pool exists if bioset exists Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 051/107] iio: inv-mpu: Specify the expected format/precision for write channels Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 056/107] iio: tmp006: Check channel info on write Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 075/107] KVM: VMX: fix vmwrite to invalid VMCS Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 048/107] drivers: clk: st: Fix flexgen lock init Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 027/107] drm/i915: Declare the swizzling unknown for L-shaped configurations Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
Re: [PATCH 3.19.y-ckt 027/107] drm/i915: Declare the swizzling unknown for L-shaped configurations Kamal Mostafa <kamal@canonical.com> - 2015-08-06 19:00 +0200
[PATCH 3.19.y-ckt 061/107] crypto: omap-des - Fix unmapping of dma channels Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 072/107] tracing: Have branch tracer use recursive field of task struct Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 078/107] can: rcar_can: fix IRQ check Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 065/107] usb: musb: host: rely on port_mode to call musb_start() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 003/107] x86/asm/entry/64: Fold the 'test_in_nmi' macro into its only user Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 049/107] iio: adc: rockchip_saradc: add missing MODULE_* data Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 058/107] dm thin: allocate the cell_sort_array dynamically Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 059/107] kbuild: Allow arch Makefiles to override {cpp,ld,c}flags Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 047/107] ARM: 8393/1: smp: Fix suspicious RCU usage with ipi tracepoints Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 057/107] dm btree remove: fix bug in redistribute3 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 050/107] iio: twl4030-madc: Pass the IRQF_ONESHOT flag Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 053/107] iio: adc: at91_adc: allow to use full range of startup time Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 055/107] ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 074/107] USB: serial: Destroy serial_minors IDR on module exit Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:10 +0200
[PATCH 3.19.y-ckt 021/107] ext4: replace open coded nofail allocation in ext4_free_blocks() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 032/107] MIPS: kernel: cps-vec: Replace KSEG0 with CKSEG0 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 043/107] freeing unlinked file indefinitely delayed Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 023/107] ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 034/107] drm/radeon: Clean up reference counting and pinning of the cursor BOs Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 036/107] mm: avoid setting up anonymous pages into file mapping Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 020/107] ext4: correctly migrate a file with a hole at the beginning Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 042/107] 9p: don't leave a half-initialized inode sitting around Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 040/107] cxl: Check if afu is not null in cxl_slbia Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 022/107] ARM: dts: am57xx-beagle-x15: Provide supply for usb2_phy2 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 028/107] MIPS: kernel: smp-cps: Fix 64-bit compatibility errors due to pointer casting Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 039/107] hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 029/107] MIPS: kernel: cps-vec: Replace 'la' macro with PTR_LA Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 017/107] ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 037/107] selinux: don't waste ebitmap space when importing NetLabel categories Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 015/107] Btrfs: fix fsync data loss after append write Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 031/107] MIPS: kernel: cps-vec: Use ta0-ta3 pseudo-registers for 64-bit Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 044/107] clk: qcom: Use parent rate when set rate to pixel RCG clock Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 018/107] ext4: fix reservation release on invalidatepage for delalloc fs Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 019/107] ext4: be more strict when migrating to non-extent based file Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 035/107] drm/radeon: unpin cursor BOs on suspend and pin them again on resume (v2) Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 026/107] drm/radeon: fix HDP flushing Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 030/107] MIPS: kernel: cps-vec: Replace mips32r2 ISA level with mips64r2 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 033/107] MIPS: cps-vec: Use macros for various arithmetics and memory operations Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 045/107] drivers: clk: st: Incorrect register offset used for lock_status Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 046/107] drivers: clk: st: Fix mux bit-setting for Cortex A9 clocks Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 038/107] hpfs: kstrdup() out of memory handling Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 025/107] cxl: Fix off by one error allowing subsequent mmap page to be accessed Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 041/107] parisc: Fix some PTE/TLB race conditions and optimize __flush_tlb_range based on timing results Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 024/107] powerpc/powernv: Fix race in updating core_idle_state Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:20 +0200
[PATCH 3.19.y-ckt 016/107] bufferhead: Add _gfp version for sb_getblk() Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 013/107] Btrfs: use kmem_cache_free when freeing entry in inode cache Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 006/107] x86/nmi/64: Remove asm code that saves cr2 Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 008/107] x86/nmi/64: Improve nested NMI comments Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 012/107] sg_start_req(): make sure that there's not too many elements in iovec Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 005/107] x86/nmi: Enable nested do_nmi handling for 64-bit kernels Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 007/107] x86/nmi/64: Switch stacks on userspace NMI entry Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 002/107] evm: labeling pseudo filesystems exception Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 014/107] Btrfs: fix race between caching kthread and returning inode to inode cache Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 009/107] x86/nmi/64: Reorder nested NMI checks Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
[PATCH 3.19.y-ckt 010/107] x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection Kamal Mostafa <kamal@canonical.com> - 2015-08-06 00:30 +0200
Page 1 of 6 [1] 2 3 4 5 6 Next page →
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-05 23:50 +0200 |
| Subject | [3.19.y-ckt stable] Linux 3.19.8-ckt5 stable review |
| Message-ID | <pUeJs-5l3-25@gated-at.bofh.it> |
This is the start of the review cycle for the Linux 3.19.8-ckt5 stable kernel.
This version contains 107 new patches, summarized below. The new patches are
posted as replies to this message and also available in this git branch:
http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.19.y-review
git://kernel.ubuntu.com/ubuntu/linux.git linux-3.19.y-review
The review period for version 3.19.8-ckt5 will be open for the next three days.
To report a problem, please reply to the relevant follow-up patch message.
For more information about the Linux 3.19.y-ckt extended stable kernel version,
see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable .
-Kamal
--
Documentation/kbuild/makefiles.txt | 8 +
Makefile | 9 +-
arch/arc/Makefile | 3 +-
arch/arc/include/asm/ptrace.h | 2 +-
arch/arm/boot/dts/am57xx-beagle-x15.dts | 4 +
arch/arm/boot/dts/dra7-evm.dts | 5 +-
arch/arm/boot/dts/dra72-evm.dts | 5 +-
arch/arm/boot/dts/imx23.dtsi | 1 +
arch/arm/kernel/smp.c | 4 +-
arch/arm/mm/dma-mapping.c | 2 +-
arch/mips/kernel/cps-vec.S | 96 ++++----
arch/mips/kernel/smp-cps.c | 6 +-
arch/parisc/include/asm/pgtable.h | 55 +++--
arch/parisc/include/asm/tlbflush.h | 53 +++--
arch/parisc/kernel/cache.c | 105 +++++----
arch/parisc/kernel/entry.S | 163 +++++++-------
arch/parisc/kernel/traps.c | 4 -
arch/powerpc/kernel/idle_power7.S | 31 ++-
arch/s390/kernel/process.c | 2 +-
arch/s390/kernel/sclp.S | 4 +
arch/x86/kernel/entry_64.S | 324 +++++++++++++++++----------
arch/x86/kernel/nmi.c | 123 +++++-----
arch/x86/kvm/cpuid.c | 2 +
arch/x86/kvm/x86.c | 5 -
block/bio-integrity.c | 4 +-
drivers/acpi/osl.c | 12 +-
drivers/acpi/resource.c | 162 --------------
drivers/clk/qcom/clk-rcg2.c | 8 +-
drivers/clk/st/clk-flexgen.c | 2 +
drivers/clk/st/clkgen-fsyn.c | 2 +-
drivers/clk/st/clkgen-mux.c | 2 +-
drivers/crypto/omap-des.c | 3 -
drivers/gpu/drm/drm_crtc.c | 7 +-
drivers/gpu/drm/radeon/ci_dpm.c | 2 +-
drivers/gpu/drm/radeon/radeon_cursor.c | 84 +++----
drivers/gpu/drm/radeon/radeon_device.c | 34 ++-
drivers/gpu/drm/radeon/radeon_gart.c | 12 +-
drivers/gpu/drm/radeon/radeon_gem.c | 2 +
drivers/gpu/drm/radeon/radeon_mode.h | 1 -
drivers/gpu/drm/radeon/radeon_object.c | 1 -
drivers/gpu/drm/radeon/si_dpm.c | 1 +
drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 67 +++---
drivers/iio/adc/at91_adc.c | 8 +-
drivers/iio/adc/rockchip_saradc.c | 4 +
drivers/iio/adc/twl4030-madc.c | 3 +-
drivers/iio/dac/ad5624r_spi.c | 4 +-
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 19 ++
drivers/iio/light/tcs3414.c | 2 +-
drivers/iio/temperature/tmp006.c | 3 +
drivers/md/dm-thin.c | 13 +-
drivers/md/persistent-data/dm-btree-remove.c | 6 +-
drivers/md/persistent-data/dm-btree.c | 2 +-
drivers/misc/cxl/context.c | 4 +-
drivers/misc/cxl/main.c | 2 +-
drivers/net/can/c_can/c_can.c | 10 +-
drivers/net/can/rcar_can.c | 3 +-
drivers/net/ethernet/ti/cpsw.c | 6 +-
drivers/pnp/system.c | 35 +--
drivers/scsi/scsi_sysfs.c | 2 +-
drivers/scsi/sg.c | 3 +
drivers/scsi/st.c | 2 +-
drivers/staging/vt6655/device_main.c | 2 +-
drivers/staging/vt6656/main_usb.c | 2 +-
drivers/usb/gadget/function/f_mass_storage.c | 16 +-
drivers/usb/musb/musb_virthub.c | 4 +-
drivers/usb/serial/cp210x.c | 1 +
drivers/usb/serial/option.c | 1 +
drivers/usb/serial/usb-serial.c | 1 +
fs/9p/vfs_inode.c | 3 +-
fs/9p/vfs_inode_dotl.c | 3 +-
fs/btrfs/inode-map.c | 17 +-
fs/btrfs/ioctl.c | 18 +-
fs/btrfs/transaction.c | 4 +-
fs/btrfs/tree-log.c | 14 +-
fs/dcache.c | 3 +
fs/ext4/extents.c | 6 +-
fs/ext4/inode.c | 15 +-
fs/ext4/mballoc.c | 16 +-
fs/ext4/migrate.c | 17 +-
fs/hpfs/super.c | 18 +-
fs/notify/mark.c | 34 ++-
include/linux/acpi.h | 10 -
include/linux/buffer_head.h | 7 +
kernel/irq/resend.c | 18 +-
kernel/trace/trace.h | 1 +
kernel/trace/trace_branch.c | 17 +-
lib/dma-debug.c | 3 +
mm/memory.c | 20 +-
net/bridge/br_mdb.c | 5 +
net/core/dev.c | 39 ++--
net/dsa/dsa.c | 6 +-
net/ieee802154/dgram.c | 6 +
net/ipv4/ip_tunnel.c | 8 +-
net/ipv6/ip6_input.c | 6 +-
net/rds/ib_rdma.c | 4 +-
security/integrity/evm/evm_main.c | 11 +
security/keys/keyring.c | 8 +-
security/selinux/ss/ebitmap.c | 6 +
sound/usb/quirks-table.h | 68 ++++++
tools/perf/ui/browsers/hists.c | 2 +-
100 files changed, 1112 insertions(+), 881 deletions(-)
Adriana Reus (1):
iio: inv-mpu: Specify the expected format/precision for write channels
Al Viro (3):
sg_start_req(): make sure that there's not too many elements in iovec
9p: don't leave a half-initialized inode sitting around
freeing unlinked file indefinitely delayed
Alex Deucher (2):
drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5
drm/radeon/ci: silence a harmless PCC warning
Alexey Brodkin (1):
ARC: make sure instruction_pointer() returns unsigned value
Andy Lutomirski (6):
x86/nmi: Enable nested do_nmi handling for 64-bit kernels
x86/nmi/64: Remove asm code that saves cr2
x86/nmi/64: Switch stacks on userspace NMI entry
x86/nmi/64: Improve nested NMI comments
x86/nmi/64: Reorder nested NMI checks
x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection
Angga (1):
ipv6: Make MLD packets to only be processed locally
Arnaldo Carvalho de Melo (1):
perf hists browser: Take the --comm, --dsos, etc filters into account
Chris Wilson (1):
drm/i915: Declare the swizzling unknown for L-shaped configurations
Christian König (1):
drm/radeon: fix user ptr race condition
Claudio Cappelli (1):
USB: option: add 2020:4000 ID
Colin Ian King (1):
KEYS: ensure we free the assoc array edit if edit is valid
Daniel Axtens (1):
cxl: Check if afu is not null in cxl_slbia
Daniel Kurtz (1):
drm/rockchip: use drm_gem_mmap helpers
Daniel Vetter (1):
Revert "drm/i915: Declare the swizzling unknown for L-shaped configurations"
Dennis Yang (1):
dm btree remove: fix bug in redistribute3
Denys Vlasenko (2):
x86/asm/entry/64: Fold the 'test_in_nmi' macro into its only user
x86/asm/entry/64: Remove a redundant jump
Dominic Sacré (1):
ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4
Eric Dumazet (1):
net: graceful exit from netif_alloc_netdev_queues()
Eryu Guan (2):
ext4: be more strict when migrating to non-extent based file
ext4: correctly migrate a file with a hole at the beginning
Fabio Estevam (1):
iio: twl4030-madc: Pass the IRQF_ONESHOT flag
Felipe Balbi (1):
usb: musb: host: rely on port_mode to call musb_start()
Filipe Manana (6):
Btrfs: use kmem_cache_free when freeing entry in inode cache
Btrfs: fix race between caching kthread and returning inode to inode cache
Btrfs: fix fsync data loss after append write
Btrfs: fix memory leak in the extent_same ioctl
Btrfs: fix list transaction->pending_ordered corruption
Btrfs: fix file corruption after cloning inline extents
Florian Fainelli (2):
net: dsa: Fix off-by-one in switch address parsing
net: dsa: Test array index before use
Gabriel Fernandez (1):
drivers: clk: st: Fix mux bit-setting for Cortex A9 clocks
Giuseppe Cavallaro (1):
drivers: clk: st: Fix flexgen lock init
Grigori Goronzy (2):
drm/radeon: fix HDP flushing
drm/radeon: unpin cursor BOs on suspend and pin them again on resume (v2)
Haggai Eran (1):
dma-debug: skip debug_dma_assert_idle() when disabled
Hai Li (1):
clk: qcom: Use parent rate when set rate to pixel RCG clock
Heiko Carstens (1):
s390/process: fix sfpc inline assembly
Heiko Stuebner (1):
iio: adc: rockchip_saradc: add missing MODULE_* data
Ian Munsie (1):
cxl: Fix off by one error allowing subsequent mmap page to be accessed
J.D. Schroeder (1):
can: c_can: Fix default pinmux glitch at init
JM Friedt (1):
iio: DAC: ad5624r_spi: fix bit shift of output data value
Jan Kara (1):
fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()
Jan Leupold (1):
iio: adc: at91_adc: allow to use full range of startup time
Jens Axboe (1):
scsi: fix host max depth checking for the 'queue_depth' sysfs interface
Joe Perches (1):
hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead
Joe Thornber (2):
dm thin: allocate the cell_sort_array dynamically
dm btree: silence lockdep lock inversion in dm_btree_del()
Johannes Thumshirn (1):
USB: serial: Destroy serial_minors IDR on module exit
John David Anglin (1):
parisc: Fix some PTE/TLB race conditions and optimize __flush_tlb_range based on timing results
Julian Anastasov (2):
net: call rcu_read_lock early in process_backlog
net: do not process device backlog during unregistration
Kirill A. Shutemov (1):
mm: avoid setting up anonymous pages into file mapping
Lennert Buytenhek (1):
ieee802154: Fix sockaddr_ieee802154 implicit padding information leak.
Lukas Czerner (1):
ext4: fix reservation release on invalidatepage for delalloc fs
Malcolm Priestley (2):
staging: vt6655: check ieee80211_bss_conf bssid not NULL
staging: vt6656: check ieee80211_bss_conf bssid not NULL
Marek Szyprowski (1):
ARM: 8404/1: dma-mapping: fix off-by-one error in bitmap size check
Markos Chandras (6):
MIPS: kernel: smp-cps: Fix 64-bit compatibility errors due to pointer casting
MIPS: kernel: cps-vec: Replace 'la' macro with PTR_LA
MIPS: kernel: cps-vec: Replace mips32r2 ISA level with mips64r2
MIPS: kernel: cps-vec: Use ta0-ta3 pseudo-registers for 64-bit
MIPS: kernel: cps-vec: Replace KSEG0 with CKSEG0
MIPS: cps-vec: Use macros for various arithmetics and memory operations
Martin Schwidefsky (1):
s390/sclp: clear upper register halves in _sclp_print_early
Michal Hocko (1):
ext4: replace open coded nofail allocation in ext4_free_blocks()
Michal Marek (1):
kbuild: Allow arch Makefiles to override {cpp,ld,c}flags
Michal Nazarewicz (1):
usb: f_mass_storage: limit number of reported LUNs
Michel Dänzer (2):
drm/radeon: Clean up reference counting and pinning of the cursor BOs
drm/radeon: Don't flush the GART TLB if rdev->gart.ptr == NULL
Mike Snitzer (1):
bio integrity: do not assume bio_integrity_pool exists if bioset exists
Mimi Zohar (1):
evm: labeling pseudo filesystems exception
Mugunthan V N (1):
drivers: net: cpsw: fix crash while accessing second slave ethernet interface
Nikolay Aleksandrov (1):
bridge: mdb: zero out the local br_ip variable before use
Nikolay Borisov (2):
bufferhead: Add _gfp version for sb_getblk()
ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp
Pankaj Dev (1):
drivers: clk: st: Incorrect register offset used for lock_status
Paul Moore (1):
selinux: don't waste ebitmap space when importing NetLabel categories
Peter Meerwald (2):
iio: light: tcs3414: Fix bug preventing to set integration time
iio: tmp006: Check channel info on write
Peter Sanford (1):
USB: cp210x: add ID for Aruba Networks controllers
Radim Krčmář (1):
KVM: VMX: fix vmwrite to invalid VMCS
Rafael J. Wysocki (1):
ACPI / PNP: Reserve ACPI resources at the fs_initcall_sync stage
Roger Quadros (2):
ARM: dts: am57xx-beagle-x15: Provide supply for usb2_phy2
ARM: dts: dra7x-evm: Prevent glitch on DCAN1 pinmux
Sanidhya Kashyap (1):
hpfs: kstrdup() out of memory handling
Satish Ashok (1):
bridge: mdb: start delete timer for temp static entries
Sergei Shtylyov (1):
can: rcar_can: fix IRQ check
Seymour, Shane M (1):
st: null pointer dereference panic caused by use after kref_put by st_open
Shreyas B. Prabhu (1):
powerpc/powernv: Fix race in updating core_idle_state
Stefan Wahren (1):
ARM: dts: mx23: fix iio-hwmon support
Stephen Boyd (1):
ARM: 8393/1: smp: Fix suspicious RCU usage with ipi tracepoints
Steven Rostedt (Red Hat) (1):
tracing: Have branch tracer use recursive field of task struct
Thomas Gleixner (1):
genirq: Prevent resend to interrupts marked IRQ_NESTED_THREAD
Timo Teräs (1):
ip_tunnel: fix ipv4 pmtu check to honor inner ip header df
Vineet Gupta (1):
ARC: Override toplevel default -O2 with -O3
Vutla, Lokesh (1):
crypto: omap-des - Fix unmapping of dma channels
Wengang Wang (1):
rds: rds_ib_device.refcount overflow
Zhao Junwang (1):
drm: add a check for x/y in drm_mode_setcrtc
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 086/107] staging: vt6656: check ieee80211_bss_conf bssid not NULL |
| Message-ID | <pUeT8-5wN-5@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Malcolm Priestley <tvboxspy@gmail.com> commit d309509f84725f99326cc73d3b00aae096b374ae upstream. Sometimes bssid can go null on failed association. Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- drivers/staging/vt6656/main_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c index b95d5b1..30fbda6 100644 --- a/drivers/staging/vt6656/main_usb.c +++ b/drivers/staging/vt6656/main_usb.c @@ -700,7 +700,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw, priv->current_aid = conf->aid; - if (changed & BSS_CHANGED_BSSID) + if (changed & BSS_CHANGED_BSSID && conf->bssid) vnt_mac_set_bssid_addr(priv, (u8 *)conf->bssid); -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 098/107] net: call rcu_read_lock early in process_backlog |
| Message-ID | <pUeT8-5wN-1@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <ja@ssi.bg>
commit 2c17d27c36dcce2b6bf689f41a46b9e909877c21 upstream.
Incoming packet should be either in backlog queue or
in RCU read-side section. Otherwise, the final sequence of
flush_backlog() and synchronize_net() may miss packets
that can run without device reference:
CPU 1 CPU 2
skb->dev: no reference
process_backlog:__skb_dequeue
process_backlog:local_irq_enable
on_each_cpu for
flush_backlog => IPI(hardirq): flush_backlog
- packet not found in backlog
CPU delayed ...
synchronize_net
- no ongoing RCU
read-side sections
netdev_run_todo,
rcu_barrier: no
ongoing callbacks
__netif_receive_skb_core:rcu_read_lock
- too late
free dev
process packet for freed dev
Fixes: 6e583ce5242f ("net: eliminate refcounting in backlog queue")
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ kamal: backport to 3.19-stable: no CONFIG_NET_INGRESS; context ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/core/dev.c | 30 +++++++++++++++---------------
1 file changed, 15 insertions(+), 15 deletions(-)
diff --git a/net/core/dev.c b/net/core/dev.c
index 307e744f..dfb1072 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3606,8 +3606,6 @@ static int __netif_receive_skb_core(struct sk_buff *skb, bool pfmemalloc)
pt_prev = NULL;
- rcu_read_lock();
-
another_round:
skb->skb_iif = skb->dev->ifindex;
@@ -3617,7 +3615,7 @@ another_round:
skb->protocol == cpu_to_be16(ETH_P_8021AD)) {
skb = skb_vlan_untag(skb);
if (unlikely(!skb))
- goto unlock;
+ goto out;
}
#ifdef CONFIG_NET_CLS_ACT
@@ -3642,7 +3640,7 @@ skip_taps:
#ifdef CONFIG_NET_CLS_ACT
skb = handle_ing(skb, &pt_prev, &ret, orig_dev);
if (!skb)
- goto unlock;
+ goto out;
ncls:
#endif
@@ -3657,7 +3655,7 @@ ncls:
if (vlan_do_receive(&skb))
goto another_round;
else if (unlikely(!skb))
- goto unlock;
+ goto out;
}
rx_handler = rcu_dereference(skb->dev->rx_handler);
@@ -3669,7 +3667,7 @@ ncls:
switch (rx_handler(&skb)) {
case RX_HANDLER_CONSUMED:
ret = NET_RX_SUCCESS;
- goto unlock;
+ goto out;
case RX_HANDLER_ANOTHER:
goto another_round;
case RX_HANDLER_EXACT:
@@ -3721,8 +3719,7 @@ drop:
ret = NET_RX_DROP;
}
-unlock:
- rcu_read_unlock();
+out:
return ret;
}
@@ -3753,29 +3750,30 @@ static int __netif_receive_skb(struct sk_buff *skb)
static int netif_receive_skb_internal(struct sk_buff *skb)
{
+ int ret;
+
net_timestamp_check(netdev_tstamp_prequeue, skb);
if (skb_defer_rx_timestamp(skb))
return NET_RX_SUCCESS;
+ rcu_read_lock();
+
#ifdef CONFIG_RPS
if (static_key_false(&rps_needed)) {
struct rps_dev_flow voidflow, *rflow = &voidflow;
- int cpu, ret;
-
- rcu_read_lock();
-
- cpu = get_rps_cpu(skb->dev, skb, &rflow);
+ int cpu = get_rps_cpu(skb->dev, skb, &rflow);
if (cpu >= 0) {
ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail);
rcu_read_unlock();
return ret;
}
- rcu_read_unlock();
}
#endif
- return __netif_receive_skb(skb);
+ ret = __netif_receive_skb(skb);
+ rcu_read_unlock();
+ return ret;
}
/**
@@ -4319,8 +4317,10 @@ static int process_backlog(struct napi_struct *napi, int quota)
struct sk_buff *skb;
while ((skb = __skb_dequeue(&sd->process_queue))) {
+ rcu_read_lock();
local_irq_enable();
__netif_receive_skb(skb);
+ rcu_read_unlock();
local_irq_disable();
input_queue_head_incr(sd);
if (++work >= quota) {
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 094/107] ARM: 8404/1: dma-mapping: fix off-by-one error in bitmap size check |
| Message-ID | <pUeT8-5wN-7@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
commit 462859aa7bbe1ac83ec4377a0a06fe60778f3f27 upstream.
nr_bitmaps member of mapping structure stores the number of already
allocated bitmaps and it is interpreted as loop iterator (it starts from
0 not from 1), so a comparison against number of possible bitmap
extensions should include this fact. This patch fixes this by changing
the extension failure condition. This issue has been introduced by
commit 4d852ef8c2544ce21ae41414099a7504c61164a0 ("arm: dma-mapping: Add
support to extend DMA IOMMU mappings").
Reported-by: Hyungwon Hwang <human.hwang@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Hyungwon Hwang <human.hwang@samsung.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/arm/mm/dma-mapping.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 903dba0..bc074ef 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1919,7 +1919,7 @@ static int extend_iommu_mapping(struct dma_iommu_mapping *mapping)
{
int next_bitmap;
- if (mapping->nr_bitmaps > mapping->extensions)
+ if (mapping->nr_bitmaps >= mapping->extensions)
return -EINVAL;
next_bitmap = mapping->nr_bitmaps;
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 091/107] drm/radeon: fix user ptr race condition |
| Message-ID | <pUeT8-5wN-3@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
commit 12f1384da650bdb835fff63e66fe815ea882fc0e upstream.
Port of amdgpu patch 9298e52f8b51d1e4acd68f502832f3a97f8cf892.
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/radeon/radeon_gem.c | 1 +
drivers/gpu/drm/radeon/radeon_object.c | 1 -
2 files changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index e370cb4..186d0b7 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -36,6 +36,7 @@ void radeon_gem_object_free(struct drm_gem_object *gobj)
if (robj) {
if (robj->gem_base.import_attach)
drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg);
+ radeon_mn_unregister(robj);
radeon_bo_unref(&robj);
}
}
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 24f7d30..12ea1e5 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -75,7 +75,6 @@ static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo)
bo = container_of(tbo, struct radeon_bo, tbo);
radeon_update_memory_usage(bo, bo->tbo.mem.mem_type, -1);
- radeon_mn_unregister(bo);
mutex_lock(&bo->rdev->gem.mutex);
list_del_init(&bo->list);
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 079/107] can: c_can: Fix default pinmux glitch at init |
| Message-ID | <pUeT8-5wN-15@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "J.D. Schroeder" <jay.schroeder@garmin.com>
commit 033365191136c97f88c81b7bd0011414db28bb4e upstream.
The previous change 3973c526ae9c (net: can: c_can: Disable pins when CAN
interface is down) causes a slight glitch on the pinctrl settings when used.
Since commit ab78029 (drivers/pinctrl: grab default handles from device core),
the device core will automatically set the default pins. This causes the pins
to be momentarily set to the default and then to the sleep state in
register_c_can_dev(). By adding an optional "enable" state, boards can set the
default pin state to be disabled and avoid the glitch when the switch from
default to sleep first occurs. If the "enable" state is not available
c_can_pinctrl_select_state() falls back to using the "default" pinctrl state.
[Roger Q] - Forward port to v4.2 and use pinctrl_get_select().
Signed-off-by: J.D. Schroeder <jay.schroeder@garmin.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/can/c_can/c_can.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index c672c4d..84540b0 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -592,6 +592,7 @@ static int c_can_start(struct net_device *dev)
{
struct c_can_priv *priv = netdev_priv(dev);
int err;
+ struct pinctrl *p;
/* basic c_can configuration */
err = c_can_chip_config(dev);
@@ -604,8 +605,13 @@ static int c_can_start(struct net_device *dev)
priv->can.state = CAN_STATE_ERROR_ACTIVE;
- /* activate pins */
- pinctrl_pm_select_default_state(dev->dev.parent);
+ /* Attempt to use "active" if available else use "default" */
+ p = pinctrl_get_select(priv->device, "active");
+ if (!IS_ERR(p))
+ pinctrl_put(p);
+ else
+ pinctrl_pm_select_default_state(priv->device);
+
return 0;
}
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 088/107] scsi: fix host max depth checking for the 'queue_depth' sysfs interface |
| Message-ID | <pUeT8-5wN-11@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Jens Axboe <axboe@fb.com> commit 1278dd6809b11dc298e19d81ac0916275f7318c1 upstream. Commit 1e6f2416044c0 changed the scsi sysfs 'queue_depth' code to rejects depths higher than the scsi host template setting. But lots of hosts set this to 1, and update the settings in the scsi host when the controller/devices probing happens. This breaks (at least) mpt2sas and mpt3sas runtime setting of queue depth, returning EINVAL for all settings but '1'. And once it's set to 1, there's no way to go back up. Fixes: 1e6f2416044c0 "scsi: don't allow setting of queue_depth bigger than can_queue" Signed-off-by: Jens Axboe <axboe@fb.com> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: James Bottomley <JBottomley@Odin.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- drivers/scsi/scsi_sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c index 1ac38e7..9ad4116 100644 --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -859,7 +859,7 @@ sdev_store_queue_depth(struct device *dev, struct device_attribute *attr, depth = simple_strtoul(buf, NULL, 0); - if (depth < 1 || depth > sht->can_queue) + if (depth < 1 || depth > sdev->host->can_queue) return -EINVAL; retval = sht->change_queue_depth(sdev, depth); -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 103/107] net: graceful exit from netif_alloc_netdev_queues() |
| Message-ID | <pUeT8-5wN-19@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit d339727c2b1a10f25e6636670ab6e1841170e328 upstream.
User space can crash kernel with
ip link add ifb10 numtxqueues 100000 type ifb
We must replace a BUG_ON() by proper test and return -EINVAL for
crazy values.
Fixes: 60877a32bce00 ("net: allow large number of tx queues")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/core/dev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/core/dev.c b/net/core/dev.c
index 3638a78..9c14e87 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6189,7 +6189,8 @@ static int netif_alloc_netdev_queues(struct net_device *dev)
struct netdev_queue *tx;
size_t sz = count * sizeof(*tx);
- BUG_ON(count < 1 || count > 0xffff);
+ if (count < 1 || count > 0xffff)
+ return -EINVAL;
tx = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
if (!tx) {
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 077/107] Btrfs: fix list transaction->pending_ordered corruption |
| Message-ID | <pUeT8-5wN-9@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit d3efe08400317888f559bbedf0e42cd31575d0ef upstream.
When we call btrfs_commit_transaction(), we splice the list "ordered"
of our transaction handle into the transaction's "pending_ordered"
list, but we don't re-initialize the "ordered" list of our transaction
handle, this means it still points to the same elements it used to
before the splice. Then we check if the current transaction's state is
>= TRANS_STATE_COMMIT_START and if it is we end up calling
btrfs_end_transaction() which simply splices again the "ordered" list
of our handle into the transaction's "pending_ordered" list, leaving
multiple pointers to the same ordered extents which results in list
corruption when we are iterating, removing and freeing ordered extents
at btrfs_wait_pending_ordered(), resulting in access to dangling
pointers / use-after-free issues.
Similarly, btrfs_end_transaction() can end up in some cases calling
btrfs_commit_transaction(), and both did a list splice of the transaction
handle's "ordered" list into the transaction's "pending_ordered" without
re-initializing the handle's "ordered" list, resulting in exactly the
same problem.
This produces the following warning on a kernel with linked list
debugging enabled:
[109749.265416] ------------[ cut here ]------------
[109749.266410] WARNING: CPU: 7 PID: 324 at lib/list_debug.c:59 __list_del_entry+0x5a/0x98()
[109749.267969] list_del corruption. prev->next should be ffff8800ba087e20, but was fffffff8c1f7c35d
(...)
[109749.287505] Call Trace:
[109749.288135] [<ffffffff8145f077>] dump_stack+0x4f/0x7b
[109749.298080] [<ffffffff81095de5>] ? console_unlock+0x356/0x3a2
[109749.331605] [<ffffffff8104b3b0>] warn_slowpath_common+0xa1/0xbb
[109749.334849] [<ffffffff81260642>] ? __list_del_entry+0x5a/0x98
[109749.337093] [<ffffffff8104b410>] warn_slowpath_fmt+0x46/0x48
[109749.337847] [<ffffffff81260642>] __list_del_entry+0x5a/0x98
[109749.338678] [<ffffffffa053e8bf>] btrfs_wait_pending_ordered+0x46/0xdb [btrfs]
[109749.340145] [<ffffffffa058a65f>] ? __btrfs_run_delayed_items+0x149/0x163 [btrfs]
[109749.348313] [<ffffffffa054077d>] btrfs_commit_transaction+0x36b/0xa10 [btrfs]
[109749.349745] [<ffffffff81087310>] ? trace_hardirqs_on+0xd/0xf
[109749.350819] [<ffffffffa055370d>] btrfs_sync_file+0x36f/0x3fc [btrfs]
[109749.351976] [<ffffffff8118ec98>] vfs_fsync_range+0x8f/0x9e
[109749.360341] [<ffffffff8118ecc3>] vfs_fsync+0x1c/0x1e
[109749.368828] [<ffffffff8118ee1d>] do_fsync+0x34/0x4e
[109749.369790] [<ffffffff8118f045>] SyS_fsync+0x10/0x14
[109749.370925] [<ffffffff81465197>] system_call_fastpath+0x12/0x6f
[109749.382274] ---[ end trace 48e0d07f7c03d95a ]---
On a non-debug kernel this leads to invalid memory accesses, causing a
crash. Fix this by using list_splice_init() instead of list_splice() in
btrfs_commit_transaction() and btrfs_end_transaction().
Fixes: 50d9aa99bd35 ("Btrfs: make sure logged extents complete in the current transaction V3"
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
fs/btrfs/transaction.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index e88b59d..2818994 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -750,7 +750,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
if (!list_empty(&trans->ordered)) {
spin_lock(&info->trans_lock);
- list_splice(&trans->ordered, &cur_trans->pending_ordered);
+ list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
spin_unlock(&info->trans_lock);
}
@@ -1795,7 +1795,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
}
spin_lock(&root->fs_info->trans_lock);
- list_splice(&trans->ordered, &cur_trans->pending_ordered);
+ list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
if (cur_trans->state >= TRANS_STATE_COMMIT_START) {
spin_unlock(&root->fs_info->trans_lock);
atomic_inc(&cur_trans->use_count);
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 100/107] bridge: mdb: start delete timer for temp static entries |
| Message-ID | <pUeT9-5wN-21@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Satish Ashok <sashok@cumulusnetworks.com>
commit f7e2965db17dd3b60f05fad88e7afc79ea75b48f upstream.
Start the delete timer when adding temp static entries so they can expire.
Signed-off-by: Satish Ashok <sashok@cumulusnetworks.com>
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Fixes: ccb1c31a7a87 ("bridge: add flags to distinguish permanent mdb entires")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/bridge/br_mdb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index d8b1833..2192740 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -322,6 +322,7 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
struct net_bridge_port_group *p;
struct net_bridge_port_group __rcu **pp;
struct net_bridge_mdb_htable *mdb;
+ unsigned long now = jiffies;
int err;
mdb = mlock_dereference(br->mdb, br);
@@ -346,6 +347,8 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
if (unlikely(!p))
return -ENOMEM;
rcu_assign_pointer(*pp, p);
+ if (state == MDB_TEMPORARY)
+ mod_timer(&p->timer, now + br->multicast_membership_interval);
br_mdb_notify(br->dev, port, group, RTM_NEWMDB);
return 0;
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 081/107] ARC: make sure instruction_pointer() returns unsigned value |
| Message-ID | <pUeT8-5wN-13@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <abrodkin@synopsys.com>
commit f51e2f1911122879eefefa4c592dea8bf794b39c upstream.
Currently instruction_pointer() returns pt_regs->ret and so return value
is of type "long", which implicitly stands for "signed long".
While that's perfectly fine when dealing with 32-bit values if return
value of instruction_pointer() gets assigned to 64-bit variable sign
extension may happen.
And at least in one real use-case it happens already.
In perf_prepare_sample() return value of perf_instruction_pointer()
(which is an alias to instruction_pointer() in case of ARC) is assigned
to (struct perf_sample_data)->ip (which type is "u64").
And what we see if instuction pointer points to user-space application
that in case of ARC lays below 0x8000_0000 "ip" gets set properly with
leading 32 zeros. But if instruction pointer points to kernel address
space that starts from 0x8000_0000 then "ip" is set with 32 leadig
"f"-s. I.e. id instruction_pointer() returns 0x8100_0000, "ip" will be
assigned with 0xffff_ffff__8100_0000. Which is obviously wrong.
In particular that issuse broke output of perf, because perf was unable
to associate addresses like 0xffff_ffff__8100_0000 with anything from
/proc/kallsyms.
That's what we used to see:
----------->8----------
6.27% ls [unknown] [k] 0xffffffff8046c5cc
2.96% ls libuClibc-0.9.34-git.so [.] memcpy
2.25% ls libuClibc-0.9.34-git.so [.] memset
1.66% ls [unknown] [k] 0xffffffff80666536
1.54% ls libuClibc-0.9.34-git.so [.] 0x000224d6
1.18% ls libuClibc-0.9.34-git.so [.] 0x00022472
----------->8----------
With that change perf output looks much better now:
----------->8----------
8.21% ls [kernel.kallsyms] [k] memset
3.52% ls libuClibc-0.9.34-git.so [.] memcpy
2.11% ls libuClibc-0.9.34-git.so [.] malloc
1.88% ls libuClibc-0.9.34-git.so [.] memset
1.64% ls [kernel.kallsyms] [k] _raw_spin_unlock_irqrestore
1.41% ls [kernel.kallsyms] [k] __d_lookup_rcu
----------->8----------
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: arc-linux-dev@synopsys.com
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/arc/include/asm/ptrace.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
index 1bfeec2..2a58af7 100644
--- a/arch/arc/include/asm/ptrace.h
+++ b/arch/arc/include/asm/ptrace.h
@@ -63,7 +63,7 @@ struct callee_regs {
long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
};
-#define instruction_pointer(regs) ((regs)->ret)
+#define instruction_pointer(regs) (unsigned long)((regs)->ret)
#define profile_pc(regs) instruction_pointer(regs)
/* return 1 if user mode or 0 if kernel mode */
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 080/107] ARM: dts: dra7x-evm: Prevent glitch on DCAN1 pinmux |
| Message-ID | <pUeT9-5wN-25@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <rogerq@ti.com>
commit 2acb5c301edf39ab6d066687ce70da1166e4de9e upstream.
Driver core sets "default" pinmux on on probe and CAN driver
sets "sleep" pinmux during register. This causes a small window
where the CAN pins are in "default" state with the DCAN module
being disabled.
Change the "default" state to be like sleep so this glitch is
avoided. Add a new "active" state that is used by the driver
when CAN is actually active.
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/arm/boot/dts/dra7-evm.dts | 5 +++--
arch/arm/boot/dts/dra72-evm.dts | 5 +++--
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index ad4118f..3af44b8 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -657,7 +657,8 @@
&dcan1 {
status = "ok";
- pinctrl-names = "default", "sleep";
- pinctrl-0 = <&dcan1_pins_default>;
+ pinctrl-names = "default", "sleep", "active";
+ pinctrl-0 = <&dcan1_pins_sleep>;
pinctrl-1 = <&dcan1_pins_sleep>;
+ pinctrl-2 = <&dcan1_pins_default>;
};
diff --git a/arch/arm/boot/dts/dra72-evm.dts b/arch/arm/boot/dts/dra72-evm.dts
index 89085d0..64da6bb 100644
--- a/arch/arm/boot/dts/dra72-evm.dts
+++ b/arch/arm/boot/dts/dra72-evm.dts
@@ -457,7 +457,8 @@
&dcan1 {
status = "ok";
- pinctrl-names = "default", "sleep";
- pinctrl-0 = <&dcan1_pins_default>;
+ pinctrl-names = "default", "sleep", "active";
+ pinctrl-0 = <&dcan1_pins_sleep>;
pinctrl-1 = <&dcan1_pins_sleep>;
+ pinctrl-2 = <&dcan1_pins_default>;
};
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 104/107] net: dsa: Fix off-by-one in switch address parsing |
| Message-ID | <pUeT9-5wN-27@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
commit c8cf89f73f3d9ecbdea479778f0ac714be79be33 upstream.
cd->sw_addr is used as a MDIO bus address, which cannot exceed
PHY_MAX_ADDR (32), our check was off-by-one.
Fixes: 5e95329b701c ("dsa: add device tree bindings to register DSA switches")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/dsa/dsa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 3731714..ed1bcee 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -627,7 +627,7 @@ static int dsa_of_probe(struct platform_device *pdev)
continue;
cd->sw_addr = be32_to_cpup(sw_addr);
- if (cd->sw_addr > PHY_MAX_ADDR)
+ if (cd->sw_addr >= PHY_MAX_ADDR)
continue;
if (!of_property_read_u32(np, "eeprom-length", &eeprom_len))
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 092/107] drm/radeon/ci: silence a harmless PCC warning |
| Message-ID | <pUeT9-5wN-31@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit bda5e3e97ffe80c5a793383df5681d3581d46ac8 upstream.
This has been a source of confusion. Make it debug only.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/radeon/ci_dpm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index f373a81..c4dc1e1 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -5781,7 +5781,7 @@ int ci_dpm_init(struct radeon_device *rdev)
tmp |= DPM_ENABLED;
break;
default:
- DRM_ERROR("Invalid PCC GPIO: %u!\n", gpio.shift);
+ DRM_DEBUG("Invalid PCC GPIO: %u!\n", gpio.shift);
break;
}
WREG32_SMC(CNB_PWRMGT_CNTL, tmp);
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 085/107] staging: vt6655: check ieee80211_bss_conf bssid not NULL |
| Message-ID | <pUeT9-5wN-23@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <tvboxspy@gmail.com>
commit 8e8e9198920ddfa920191069ae02eba75d39e653 upstream.
Sometimes bssid can go null on failed association.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/staging/vt6655/device_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index fea0214..4968d8a 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -1451,7 +1451,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
priv->current_aid = conf->aid;
- if (changed & BSS_CHANGED_BSSID) {
+ if (changed & BSS_CHANGED_BSSID && conf->bssid) {
unsigned long flags;
spin_lock_irqsave(&priv->lock, flags);
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 089/107] drm/radeon: add a dpm quirk for Sapphire Radeon R9 270X 2GB GDDR5 |
| Message-ID | <pUeT9-5wN-33@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 5dfc71bc44d91d1620505c064fa22b0b3db58a9d upstream.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=76490
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/radeon/si_dpm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 50313d7..fe252b0 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2922,6 +2922,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
{ PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
+ { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
{ 0, 0, 0, 0 },
};
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 084/107] Btrfs: fix file corruption after cloning inline extents |
| Message-ID | <pUeT8-5wN-17@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit ed958762644b404654a6f5d23e869f496fe127c6 upstream.
Using the clone ioctl (or extent_same ioctl, which calls the same extent
cloning function as well) we end up allowing copy an inline extent from
the source file into a non-zero offset of the destination file. This is
something not expected and that the btrfs code is not prepared to deal
with - all inline extents must be at a file offset equals to 0.
For example, the following excerpt of a test case for fstests triggers
a crash/BUG_ON() on a write operation after an inline extent is cloned
into a non-zero offset:
_scratch_mkfs >>$seqres.full 2>&1
_scratch_mount
# Create our test files. File foo has the same 2K of data at offset 4K
# as file bar has at its offset 0.
$XFS_IO_PROG -f -s -c "pwrite -S 0xaa 0 4K" \
-c "pwrite -S 0xbb 4k 2K" \
-c "pwrite -S 0xcc 8K 4K" \
$SCRATCH_MNT/foo | _filter_xfs_io
# File bar consists of a single inline extent (2K size).
$XFS_IO_PROG -f -s -c "pwrite -S 0xbb 0 2K" \
$SCRATCH_MNT/bar | _filter_xfs_io
# Now call the clone ioctl to clone the extent of file bar into file
# foo at its offset 4K. This made file foo have an inline extent at
# offset 4K, something which the btrfs code can not deal with in future
# IO operations because all inline extents are supposed to start at an
# offset of 0, resulting in all sorts of chaos.
# So here we validate that clone ioctl returns an EOPNOTSUPP, which is
# what it returns for other cases dealing with inlined extents.
$CLONER_PROG -s 0 -d $((4 * 1024)) -l $((2 * 1024)) \
$SCRATCH_MNT/bar $SCRATCH_MNT/foo
# Because of the inline extent at offset 4K, the following write made
# the kernel crash with a BUG_ON().
$XFS_IO_PROG -c "pwrite -S 0xdd 6K 2K" $SCRATCH_MNT/foo | _filter_xfs_io
status=0
exit
The stack trace of the BUG_ON() triggered by the last write is:
[152154.035903] ------------[ cut here ]------------
[152154.036424] kernel BUG at mm/page-writeback.c:2286!
[152154.036424] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[152154.036424] Modules linked in: btrfs dm_flakey dm_mod crc32c_generic xor raid6_pq nfsd auth_rpcgss oid_registry nfs_acl nfs lockd grace fscache sunrpc loop fuse parport_pc acpi_cpu$
[152154.036424] CPU: 2 PID: 17873 Comm: xfs_io Tainted: G W 4.1.0-rc6-btrfs-next-11+ #2
[152154.036424] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014
[152154.036424] task: ffff880429f70990 ti: ffff880429efc000 task.ti: ffff880429efc000
[152154.036424] RIP: 0010:[<ffffffff8111a9d5>] [<ffffffff8111a9d5>] clear_page_dirty_for_io+0x1e/0x90
[152154.036424] RSP: 0018:ffff880429effc68 EFLAGS: 00010246
[152154.036424] RAX: 0200000000000806 RBX: ffffea0006a6d8f0 RCX: 0000000000000001
[152154.036424] RDX: 0000000000000000 RSI: ffffffff81155d1b RDI: ffffea0006a6d8f0
[152154.036424] RBP: ffff880429effc78 R08: ffff8801ce389fe0 R09: 0000000000000001
[152154.036424] R10: 0000000000002000 R11: ffffffffffffffff R12: ffff8800200dce68
[152154.036424] R13: 0000000000000000 R14: ffff8800200dcc88 R15: ffff8803d5736d80
[152154.036424] FS: 00007fbf119f6700(0000) GS:ffff88043d280000(0000) knlGS:0000000000000000
[152154.036424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[152154.036424] CR2: 0000000001bdc000 CR3: 00000003aa555000 CR4: 00000000000006e0
[152154.036424] Stack:
[152154.036424] ffff8803d5736d80 0000000000000001 ffff880429effcd8 ffffffffa04e97c1
[152154.036424] ffff880429effd68 ffff880429effd60 0000000000000001 ffff8800200dc9c8
[152154.036424] 0000000000000001 ffff8800200dcc88 0000000000000000 0000000000001000
[152154.036424] Call Trace:
[152154.036424] [<ffffffffa04e97c1>] lock_and_cleanup_extent_if_need+0x147/0x18d [btrfs]
[152154.036424] [<ffffffffa04ea82c>] __btrfs_buffered_write+0x245/0x4c8 [btrfs]
[152154.036424] [<ffffffffa04ed14b>] ? btrfs_file_write_iter+0x150/0x3e0 [btrfs]
[152154.036424] [<ffffffffa04ed15a>] ? btrfs_file_write_iter+0x15f/0x3e0 [btrfs]
[152154.036424] [<ffffffffa04ed2c7>] btrfs_file_write_iter+0x2cc/0x3e0 [btrfs]
[152154.036424] [<ffffffff81165a4a>] __vfs_write+0x7c/0xa5
[152154.036424] [<ffffffff81165f89>] vfs_write+0xa0/0xe4
[152154.036424] [<ffffffff81166855>] SyS_pwrite64+0x64/0x82
[152154.036424] [<ffffffff81465197>] system_call_fastpath+0x12/0x6f
[152154.036424] Code: 48 89 c7 e8 0f ff ff ff 5b 41 5c 5d c3 0f 1f 44 00 00 55 48 89 e5 41 54 53 48 89 fb e8 ae ef 00 00 49 89 c4 48 8b 03 a8 01 75 02 <0f> 0b 4d 85 e4 74 59 49 8b 3c 2$
[152154.036424] RIP [<ffffffff8111a9d5>] clear_page_dirty_for_io+0x1e/0x90
[152154.036424] RSP <ffff880429effc68>
[152154.242621] ---[ end trace e3d3376b23a57041 ]---
Fix this by returning the error EOPNOTSUPP if an attempt to copy an
inline extent into a non-zero offset happens, just like what is done for
other scenarios that would require copying/splitting inline extents,
which were introduced by the following commits:
00fdf13a2e9f ("Btrfs: fix a crash of clone with inline extents's split")
3f9e3df8da3c ("btrfs: replace error code from btrfs_drop_extents")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
fs/btrfs/ioctl.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 6bd84a8..d054504 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3425,6 +3425,20 @@ process_slot:
u64 trim = 0;
u64 aligned_end = 0;
+ /*
+ * Don't copy an inline extent into an offset
+ * greater than zero. Having an inline extent
+ * at such an offset results in chaos as btrfs
+ * isn't prepared for such cases. Just skip
+ * this case for the same reasons as commented
+ * at btrfs_ioctl_clone().
+ */
+ if (last_dest_end > 0) {
+ ret = -EOPNOTSUPP;
+ btrfs_end_transaction(trans, root);
+ goto out;
+ }
+
if (off > key.offset) {
skip = off - key.offset;
new_key.offset += skip;
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 00:00 +0200 |
| Subject | [PATCH 3.19.y-ckt 096/107] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() |
| Message-ID | <pUeT9-5wN-35@gated-at.bofh.it> |
| In reply to | #1201166 |
3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit a2673b6e040663bf16a552f8619e6bde9f4b9acf upstream.
fsnotify_clear_marks_by_group_flags() can race with
fsnotify_destroy_marks() so when fsnotify_destroy_mark_locked() drops
mark_mutex, a mark from the list iterated by
fsnotify_clear_marks_by_group_flags() can be freed and we dereference free
memory in the loop there.
Fix the problem by keeping mark_mutex held in
fsnotify_destroy_mark_locked(). The reason why we drop that mutex is that
we need to call a ->freeing_mark() callback which may acquire mark_mutex
again. To avoid this and similar lock inversion issues, we move the call
to ->freeing_mark() callback to the kthread destroying the mark.
Signed-off-by: Jan Kara <jack@suse.cz>
Reported-by: Ashish Sangwan <a.sangwan@samsung.com>
Suggested-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
fs/notify/mark.c | 34 ++++++++++++++--------------------
1 file changed, 14 insertions(+), 20 deletions(-)
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index 92e48c7..3e594ce4 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -152,31 +152,15 @@ void fsnotify_destroy_mark_locked(struct fsnotify_mark *mark,
BUG();
list_del_init(&mark->g_list);
-
spin_unlock(&mark->lock);
if (inode && (mark->flags & FSNOTIFY_MARK_FLAG_OBJECT_PINNED))
iput(inode);
- /* release lock temporarily */
- mutex_unlock(&group->mark_mutex);
spin_lock(&destroy_lock);
list_add(&mark->g_list, &destroy_list);
spin_unlock(&destroy_lock);
wake_up(&destroy_waitq);
- /*
- * We don't necessarily have a ref on mark from caller so the above destroy
- * may have actually freed it, unless this group provides a 'freeing_mark'
- * function which must be holding a reference.
- */
-
- /*
- * Some groups like to know that marks are being freed. This is a
- * callback to the group function to let it know that this mark
- * is being freed.
- */
- if (group->ops->freeing_mark)
- group->ops->freeing_mark(mark, group);
/*
* __fsnotify_update_child_dentry_flags(inode);
@@ -191,8 +175,6 @@ void fsnotify_destroy_mark_locked(struct fsnotify_mark *mark,
*/
atomic_dec(&group->num_marks);
-
- mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
}
void fsnotify_destroy_mark(struct fsnotify_mark *mark,
@@ -205,7 +187,10 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark,
/*
* Destroy all marks in the given list. The marks must be already detached from
- * the original inode / vfsmount.
+ * the original inode / vfsmount. Note that we can race with
+ * fsnotify_clear_marks_by_group_flags(). However we hold a reference to each
+ * mark so they won't get freed from under us and nobody else touches our
+ * free_list list_head.
*/
void fsnotify_destroy_marks(struct list_head *to_free)
{
@@ -406,7 +391,7 @@ struct fsnotify_mark *fsnotify_find_mark(struct hlist_head *head,
}
/*
- * clear any marks in a group in which mark->flags & flags is true
+ * Clear any marks in a group in which mark->flags & flags is true.
*/
void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group,
unsigned int flags)
@@ -460,6 +445,7 @@ static int fsnotify_mark_destroy(void *ignored)
{
struct fsnotify_mark *mark, *next;
struct list_head private_destroy_list;
+ struct fsnotify_group *group;
for (;;) {
spin_lock(&destroy_lock);
@@ -471,6 +457,14 @@ static int fsnotify_mark_destroy(void *ignored)
list_for_each_entry_safe(mark, next, &private_destroy_list, g_list) {
list_del_init(&mark->g_list);
+ group = mark->group;
+ /*
+ * Some groups like to know that marks are being freed.
+ * This is a callback to the group function to let it
+ * know that this mark is being freed.
+ */
+ if (group && group->ops->freeing_mark)
+ group->ops->freeing_mark(mark, group);
fsnotify_put_mark(mark);
}
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Jan Kara <jack@suse.cz> |
|---|---|
| Date | 2015-08-06 17:20 +0200 |
| Subject | Re: [PATCH 3.19.y-ckt 096/107] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() |
| Message-ID | <pUv7A-4og-29@gated-at.bofh.it> |
| In reply to | #1201190 |
On Wed 05-08-15 14:49:28, Kamal Mostafa wrote:
> 3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
The patch was later reverted so please don't push it to stable.
Honza
>
> ------------------
>
> From: Jan Kara <jack@suse.cz>
>
> commit a2673b6e040663bf16a552f8619e6bde9f4b9acf upstream.
>
> fsnotify_clear_marks_by_group_flags() can race with
> fsnotify_destroy_marks() so when fsnotify_destroy_mark_locked() drops
> mark_mutex, a mark from the list iterated by
> fsnotify_clear_marks_by_group_flags() can be freed and we dereference free
> memory in the loop there.
>
> Fix the problem by keeping mark_mutex held in
> fsnotify_destroy_mark_locked(). The reason why we drop that mutex is that
> we need to call a ->freeing_mark() callback which may acquire mark_mutex
> again. To avoid this and similar lock inversion issues, we move the call
> to ->freeing_mark() callback to the kthread destroying the mark.
>
> Signed-off-by: Jan Kara <jack@suse.cz>
> Reported-by: Ashish Sangwan <a.sangwan@samsung.com>
> Suggested-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> Signed-off-by: Kamal Mostafa <kamal@canonical.com>
> ---
> fs/notify/mark.c | 34 ++++++++++++++--------------------
> 1 file changed, 14 insertions(+), 20 deletions(-)
>
> diff --git a/fs/notify/mark.c b/fs/notify/mark.c
> index 92e48c7..3e594ce4 100644
> --- a/fs/notify/mark.c
> +++ b/fs/notify/mark.c
> @@ -152,31 +152,15 @@ void fsnotify_destroy_mark_locked(struct fsnotify_mark *mark,
> BUG();
>
> list_del_init(&mark->g_list);
> -
> spin_unlock(&mark->lock);
>
> if (inode && (mark->flags & FSNOTIFY_MARK_FLAG_OBJECT_PINNED))
> iput(inode);
> - /* release lock temporarily */
> - mutex_unlock(&group->mark_mutex);
>
> spin_lock(&destroy_lock);
> list_add(&mark->g_list, &destroy_list);
> spin_unlock(&destroy_lock);
> wake_up(&destroy_waitq);
> - /*
> - * We don't necessarily have a ref on mark from caller so the above destroy
> - * may have actually freed it, unless this group provides a 'freeing_mark'
> - * function which must be holding a reference.
> - */
> -
> - /*
> - * Some groups like to know that marks are being freed. This is a
> - * callback to the group function to let it know that this mark
> - * is being freed.
> - */
> - if (group->ops->freeing_mark)
> - group->ops->freeing_mark(mark, group);
>
> /*
> * __fsnotify_update_child_dentry_flags(inode);
> @@ -191,8 +175,6 @@ void fsnotify_destroy_mark_locked(struct fsnotify_mark *mark,
> */
>
> atomic_dec(&group->num_marks);
> -
> - mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
> }
>
> void fsnotify_destroy_mark(struct fsnotify_mark *mark,
> @@ -205,7 +187,10 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark,
>
> /*
> * Destroy all marks in the given list. The marks must be already detached from
> - * the original inode / vfsmount.
> + * the original inode / vfsmount. Note that we can race with
> + * fsnotify_clear_marks_by_group_flags(). However we hold a reference to each
> + * mark so they won't get freed from under us and nobody else touches our
> + * free_list list_head.
> */
> void fsnotify_destroy_marks(struct list_head *to_free)
> {
> @@ -406,7 +391,7 @@ struct fsnotify_mark *fsnotify_find_mark(struct hlist_head *head,
> }
>
> /*
> - * clear any marks in a group in which mark->flags & flags is true
> + * Clear any marks in a group in which mark->flags & flags is true.
> */
> void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group,
> unsigned int flags)
> @@ -460,6 +445,7 @@ static int fsnotify_mark_destroy(void *ignored)
> {
> struct fsnotify_mark *mark, *next;
> struct list_head private_destroy_list;
> + struct fsnotify_group *group;
>
> for (;;) {
> spin_lock(&destroy_lock);
> @@ -471,6 +457,14 @@ static int fsnotify_mark_destroy(void *ignored)
>
> list_for_each_entry_safe(mark, next, &private_destroy_list, g_list) {
> list_del_init(&mark->g_list);
> + group = mark->group;
> + /*
> + * Some groups like to know that marks are being freed.
> + * This is a callback to the group function to let it
> + * know that this mark is being freed.
> + */
> + if (group && group->ops->freeing_mark)
> + group->ops->freeing_mark(mark, group);
> fsnotify_put_mark(mark);
> }
>
> --
> 1.9.1
>
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-08-06 18:00 +0200 |
| Subject | Re: [PATCH 3.19.y-ckt 096/107] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() |
| Message-ID | <pUvKi-57B-27@gated-at.bofh.it> |
| In reply to | #1201842 |
On Thu, 2015-08-06 at 17:12 +0200, Jan Kara wrote:
> On Wed 05-08-15 14:49:28, Kamal Mostafa wrote:
> > 3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know.
>
> The patch was later reverted so please don't push it to stable.
>
> Honza
Thanks very much Jan. Dropped from 3.19-stable.
-Kamal
> > ------------------
> >
> > From: Jan Kara <jack@suse.cz>
> >
> > commit a2673b6e040663bf16a552f8619e6bde9f4b9acf upstream.
> >
> > fsnotify_clear_marks_by_group_flags() can race with
> > fsnotify_destroy_marks() so when fsnotify_destroy_mark_locked() drops
> > mark_mutex, a mark from the list iterated by
> > fsnotify_clear_marks_by_group_flags() can be freed and we dereference free
> > memory in the loop there.
> >
> > Fix the problem by keeping mark_mutex held in
> > fsnotify_destroy_mark_locked(). The reason why we drop that mutex is that
> > we need to call a ->freeing_mark() callback which may acquire mark_mutex
> > again. To avoid this and similar lock inversion issues, we move the call
> > to ->freeing_mark() callback to the kthread destroying the mark.
> >
> > Signed-off-by: Jan Kara <jack@suse.cz>
> > Reported-by: Ashish Sangwan <a.sangwan@samsung.com>
> > Suggested-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
> > Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> > Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> > Signed-off-by: Kamal Mostafa <kamal@canonical.com>
> > ---
> > fs/notify/mark.c | 34 ++++++++++++++--------------------
> > 1 file changed, 14 insertions(+), 20 deletions(-)
> >
> > diff --git a/fs/notify/mark.c b/fs/notify/mark.c
> > index 92e48c7..3e594ce4 100644
> > --- a/fs/notify/mark.c
> > +++ b/fs/notify/mark.c
> > @@ -152,31 +152,15 @@ void fsnotify_destroy_mark_locked(struct fsnotify_mark *mark,
> > BUG();
> >
> > list_del_init(&mark->g_list);
> > -
> > spin_unlock(&mark->lock);
> >
> > if (inode && (mark->flags & FSNOTIFY_MARK_FLAG_OBJECT_PINNED))
> > iput(inode);
> > - /* release lock temporarily */
> > - mutex_unlock(&group->mark_mutex);
> >
> > spin_lock(&destroy_lock);
> > list_add(&mark->g_list, &destroy_list);
> > spin_unlock(&destroy_lock);
> > wake_up(&destroy_waitq);
> > - /*
> > - * We don't necessarily have a ref on mark from caller so the above destroy
> > - * may have actually freed it, unless this group provides a 'freeing_mark'
> > - * function which must be holding a reference.
> > - */
> > -
> > - /*
> > - * Some groups like to know that marks are being freed. This is a
> > - * callback to the group function to let it know that this mark
> > - * is being freed.
> > - */
> > - if (group->ops->freeing_mark)
> > - group->ops->freeing_mark(mark, group);
> >
> > /*
> > * __fsnotify_update_child_dentry_flags(inode);
> > @@ -191,8 +175,6 @@ void fsnotify_destroy_mark_locked(struct fsnotify_mark *mark,
> > */
> >
> > atomic_dec(&group->num_marks);
> > -
> > - mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
> > }
> >
> > void fsnotify_destroy_mark(struct fsnotify_mark *mark,
> > @@ -205,7 +187,10 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark,
> >
> > /*
> > * Destroy all marks in the given list. The marks must be already detached from
> > - * the original inode / vfsmount.
> > + * the original inode / vfsmount. Note that we can race with
> > + * fsnotify_clear_marks_by_group_flags(). However we hold a reference to each
> > + * mark so they won't get freed from under us and nobody else touches our
> > + * free_list list_head.
> > */
> > void fsnotify_destroy_marks(struct list_head *to_free)
> > {
> > @@ -406,7 +391,7 @@ struct fsnotify_mark *fsnotify_find_mark(struct hlist_head *head,
> > }
> >
> > /*
> > - * clear any marks in a group in which mark->flags & flags is true
> > + * Clear any marks in a group in which mark->flags & flags is true.
> > */
> > void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group,
> > unsigned int flags)
> > @@ -460,6 +445,7 @@ static int fsnotify_mark_destroy(void *ignored)
> > {
> > struct fsnotify_mark *mark, *next;
> > struct list_head private_destroy_list;
> > + struct fsnotify_group *group;
> >
> > for (;;) {
> > spin_lock(&destroy_lock);
> > @@ -471,6 +457,14 @@ static int fsnotify_mark_destroy(void *ignored)
> >
> > list_for_each_entry_safe(mark, next, &private_destroy_list, g_list) {
> > list_del_init(&mark->g_list);
> > + group = mark->group;
> > + /*
> > + * Some groups like to know that marks are being freed.
> > + * This is a callback to the group function to let it
> > + * know that this mark is being freed.
> > + */
> > + if (group && group->ops->freeing_mark)
> > + group->ops->freeing_mark(mark, group);
> > fsnotify_put_mark(mark);
> > }
> >
> > --
> > 1.9.1
> >
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
Page 1 of 6 [1] 2 3 4 5 6 Next page →
Back to top | Article view | linux.kernel
csiph-web