Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1203509 > unrolled thread

[PATCH 3.14 00/29] 3.14.50-stable review

Started byGreg Kroah-Hartman <gregkh@linuxfoundation.org>
First post2015-08-09 00:50 +0200
Last post2015-08-10 07:10 +0200
Articles 20 — 3 participants

Back to article view | Back to linux.kernel


Contents

  [PATCH 3.14 00/29] 3.14.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 11/29] mmc: sdhci-esdhc: Make 8BIT bus work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 04/29] ARC: make sure instruction_pointer() returns unsigned value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 26/29] avr32: handle NULL as a valid clock object Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 07/29] ALSA: usb-audio: add dB range mapping for some devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 15/29] Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 16/29] blkcg: fix gendisk reference leak in blkg_conf_prep() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 17/29] ata: pmp: add quirk for Marvell 4140 SATA PMP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 24/29] rds: rds_ib_device.refcount overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 23/29] x86/efi: Use all 64 bit of efi_memmap in setup_e820() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 20/29] xhci: report U3 when link is in resume state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 10/29] mac80211: clear subdir_stations when removing debugfs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 19/29] xhci: Calculate old endpoints correctly on device reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 03/29] s390/sclp: clear upper register halves in _sclp_print_early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 27/29] iscsi-target: Fix use-after-free during TPG session shutdown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 02/29] freeing unlinked file indefinitely delayed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    [PATCH 3.14 01/29] mm: avoid setting up anonymous pages into file mapping Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
    Re: [PATCH 3.14 00/29] 3.14.50-stable review Guenter Roeck <linux@roeck-us.net> - 2015-08-09 05:20 +0200
      Re: [PATCH 3.14 00/29] 3.14.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-10 21:20 +0200
    Re: [PATCH 3.14 00/29] 3.14.50-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2015-08-10 07:10 +0200

#1203509 — [PATCH 3.14 00/29] 3.14.50-stable review

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 00/29] 3.14.50-stable review
Message-ID<pVktr-3jX-7@gated-at.bofh.it>
This is the start of the stable review cycle for the 3.14.50 release.
There are 29 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Mon Aug 10 22:06:58 UTC 2015.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.50-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 3.14.50-rc1

Fupan Li <fupan.li@windriver.com>
    efi: fix 32bit kernel boot failed problem using efi

Nicholas Bellinger <nab@linux-iscsi.org>
    iscsi-target: Fix iser explicit logout TX kthread leak

Nicholas Bellinger <nab@linux-iscsi.org>
    iscsi-target: Fix use-after-free during TPG session shutdown

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    avr32: handle NULL as a valid clock object

Marc-André Lureau <marcandre.lureau@redhat.com>
    vhost: actually track log eventfd file

Wengang Wang <wen.gang.wang@oracle.com>
    rds: rds_ib_device.refcount overflow

Dmitry Skorodumov <sdmitry@parallels.com>
    x86/efi: Use all 64 bit of efi_memmap in setup_e820()

Zhuang Jin Can <jin.can.zhuang@intel.com>
    xhci: do not report PLC when link is in internal resume state

Zhuang Jin Can <jin.can.zhuang@intel.com>
    xhci: prevent bus_suspend if SS port resuming in phase 1

Zhuang Jin Can <jin.can.zhuang@intel.com>
    xhci: report U3 when link is in resume state

Brian Campbell <bacam@z273.org.uk>
    xhci: Calculate old endpoints correctly on device reset

Oliver Neukum <oneukum@suse.com>
    usb-storage: ignore ZTE MF 823 card reader in mode 0x1225

Lior Amsalem <alior@marvell.com>
    ata: pmp: add quirk for Marvell 4140 SATA PMP

Tejun Heo <tj@kernel.org>
    blkcg: fix gendisk reference leak in blkg_conf_prep()

Bernhard Bender <bernhard.bender@bytecmed.com>
    Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen

Chris Metcalf <cmetcalf@ezchip.com>
    tile: use free_bootmem_late() for initrd

NeilBrown <neilb@suse.com>
    md/raid1: fix test for 'was read error from last working device'.

Jingju Hou <houjingj@marvell.com>
    mmc: sdhci-pxav3: fix platform_data is not initialized

Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
    mmc: sdhci-esdhc: Make 8BIT bus work

Tom Hughes <tom@compton.nu>
    mac80211: clear subdir_stations when removing debugfs

Seymour, Shane M <shane.seymour@hp.com>
    st: null pointer dereference panic caused by use after kref_put by st_open

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix MacBook Pro 5,2 quirk

Yao-Wen Mao <yaowen@google.com>
    ALSA: usb-audio: add dB range mapping for some devices

Dominic Sacré <dominic.sacre@gmx.de>
    ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4

Thomas Gleixner <tglx@linutronix.de>
    genirq: Prevent resend to interrupts marked IRQ_NESTED_THREAD

Alexey Brodkin <abrodkin@synopsys.com>
    ARC: make sure instruction_pointer() returns unsigned value

Martin Schwidefsky <schwidefsky@de.ibm.com>
    s390/sclp: clear upper register halves in _sclp_print_early

Al Viro <viro@ZenIV.linux.org.uk>
    freeing unlinked file indefinitely delayed

Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    mm: avoid setting up anonymous pages into file mapping


-------------

Diffstat:

 Makefile                                   |  4 +-
 arch/arc/include/asm/ptrace.h              |  2 +-
 arch/avr32/mach-at32ap/clock.c             | 20 ++++++++-
 arch/s390/kernel/sclp.S                    |  4 ++
 arch/tile/kernel/setup.c                   |  2 +-
 arch/x86/boot/compressed/eboot.c           |  4 ++
 arch/x86/boot/compressed/head_32.S         |  2 +-
 block/blk-cgroup.c                         |  6 ++-
 drivers/ata/libata-pmp.c                   |  7 +++
 drivers/input/touchscreen/usbtouchscreen.c |  3 ++
 drivers/md/raid1.c                         |  2 +-
 drivers/mmc/host/sdhci-esdhc.h             |  2 +-
 drivers/mmc/host/sdhci-pxav3.c             |  1 +
 drivers/scsi/st.c                          |  2 +-
 drivers/target/iscsi/iscsi_target.c        | 30 ++++++++++---
 drivers/usb/host/xhci-hub.c                | 22 +++++++---
 drivers/usb/host/xhci-ring.c               |  3 ++
 drivers/usb/host/xhci.c                    |  3 ++
 drivers/usb/host/xhci.h                    |  1 +
 drivers/usb/storage/unusual_devs.h         | 12 ++++++
 drivers/vhost/vhost.c                      |  1 +
 fs/dcache.c                                |  3 ++
 kernel/irq/resend.c                        | 18 +++++---
 mm/memory.c                                | 13 ++++--
 net/mac80211/debugfs_netdev.c              |  1 +
 net/rds/ib_rdma.c                          |  4 +-
 sound/pci/hda/patch_realtek.c              |  2 +-
 sound/usb/mixer_maps.c                     | 24 +++++++++++
 sound/usb/quirks-table.h                   | 68 ++++++++++++++++++++++++++++++
 29 files changed, 233 insertions(+), 33 deletions(-)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]


#1203510 — [PATCH 3.14 11/29] mmc: sdhci-esdhc: Make 8BIT bus work

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 11/29] mmc: sdhci-esdhc: Make 8BIT bus work
Message-ID<pVl6a-45c-5@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>

commit 8e91125ff3f57f15c6568e2a6d32743b3f7815e4 upstream.

Support for 8BIT bus with was added some time ago to sdhci-esdhc but
then missed to remove the 8BIT from the reserved bit mask which made
8BIT non functional.

Fixes: 66b50a00992d ("mmc: esdhc: Add support for 8-bit bus width and..")
Signed-off-by: Joakim Tjernlund <joakim.tjernlund@transmode.se>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/sdhci-esdhc.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/mmc/host/sdhci-esdhc.h
+++ b/drivers/mmc/host/sdhci-esdhc.h
@@ -47,6 +47,6 @@
 #define ESDHC_DMA_SYSCTL	0x40c
 #define ESDHC_DMA_SNOOP		0x00000040
 
-#define ESDHC_HOST_CONTROL_RES	0x05
+#define ESDHC_HOST_CONTROL_RES	0x01
 
 #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203512 — [PATCH 3.14 04/29] ARC: make sure instruction_pointer() returns unsigned value

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 04/29] ARC: make sure instruction_pointer() returns unsigned value
Message-ID<pVl6a-45c-7@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexey Brodkin <abrodkin@synopsys.com>

commit f51e2f1911122879eefefa4c592dea8bf794b39c upstream.

Currently instruction_pointer() returns pt_regs->ret and so return value
is of type "long", which implicitly stands for "signed long".

While that's perfectly fine when dealing with 32-bit values if return
value of instruction_pointer() gets assigned to 64-bit variable sign
extension may happen.

And at least in one real use-case it happens already.
In perf_prepare_sample() return value of perf_instruction_pointer()
(which is an alias to instruction_pointer() in case of ARC) is assigned
to (struct perf_sample_data)->ip (which type is "u64").

And what we see if instuction pointer points to user-space application
that in case of ARC lays below 0x8000_0000 "ip" gets set properly with
leading 32 zeros. But if instruction pointer points to kernel address
space that starts from 0x8000_0000 then "ip" is set with 32 leadig
"f"-s. I.e. id instruction_pointer() returns 0x8100_0000, "ip" will be
assigned with 0xffff_ffff__8100_0000. Which is obviously wrong.

In particular that issuse broke output of perf, because perf was unable
to associate addresses like 0xffff_ffff__8100_0000 with anything from
/proc/kallsyms.

That's what we used to see:
 ----------->8----------
  6.27%  ls       [unknown]                [k] 0xffffffff8046c5cc
  2.96%  ls       libuClibc-0.9.34-git.so  [.] memcpy
  2.25%  ls       libuClibc-0.9.34-git.so  [.] memset
  1.66%  ls       [unknown]                [k] 0xffffffff80666536
  1.54%  ls       libuClibc-0.9.34-git.so  [.] 0x000224d6
  1.18%  ls       libuClibc-0.9.34-git.so  [.] 0x00022472
 ----------->8----------

With that change perf output looks much better now:
 ----------->8----------
  8.21%  ls       [kernel.kallsyms]        [k] memset
  3.52%  ls       libuClibc-0.9.34-git.so  [.] memcpy
  2.11%  ls       libuClibc-0.9.34-git.so  [.] malloc
  1.88%  ls       libuClibc-0.9.34-git.so  [.] memset
  1.64%  ls       [kernel.kallsyms]        [k] _raw_spin_unlock_irqrestore
  1.41%  ls       [kernel.kallsyms]        [k] __d_lookup_rcu
 ----------->8----------

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: arc-linux-dev@synopsys.com
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arc/include/asm/ptrace.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arc/include/asm/ptrace.h
+++ b/arch/arc/include/asm/ptrace.h
@@ -63,7 +63,7 @@ struct callee_regs {
 	long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
 };
 
-#define instruction_pointer(regs)	((regs)->ret)
+#define instruction_pointer(regs)	(unsigned long)((regs)->ret)
 #define profile_pc(regs)		instruction_pointer(regs)
 
 /* return 1 if user mode or 0 if kernel mode */


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203513 — [PATCH 3.14 26/29] avr32: handle NULL as a valid clock object

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 26/29] avr32: handle NULL as a valid clock object
Message-ID<pVl6a-45c-11@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit 5c02a4206538da12c040b51778d310df84c6bf6c upstream.

Since NULL is used as valid clock object on optional clocks we have to handle
this case in avr32 implementation as well.

Fixes: e1824dfe0d8e (net: macb: Adjust tx_clk when link speed changes)
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Hans-Christian Egtvedt <egtvedt@samfundet.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/avr32/mach-at32ap/clock.c |   20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

--- a/arch/avr32/mach-at32ap/clock.c
+++ b/arch/avr32/mach-at32ap/clock.c
@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk)
 {
 	unsigned long flags;
 
+	if (!clk)
+		return 0;
+
 	spin_lock_irqsave(&clk_lock, flags);
 	__clk_enable(clk);
 	spin_unlock_irqrestore(&clk_lock, flags);
@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk)
 {
 	unsigned long flags;
 
+	if (IS_ERR_OR_NULL(clk))
+		return;
+
 	spin_lock_irqsave(&clk_lock, flags);
 	__clk_disable(clk);
 	spin_unlock_irqrestore(&clk_lock, flags);
@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *c
 	unsigned long flags;
 	unsigned long rate;
 
+	if (!clk)
+		return 0;
+
 	spin_lock_irqsave(&clk_lock, flags);
 	rate = clk->get_rate(clk);
 	spin_unlock_irqrestore(&clk_lock, flags);
@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, uns
 {
 	unsigned long flags, actual_rate;
 
+	if (!clk)
+		return 0;
+
 	if (!clk->set_rate)
 		return -ENOSYS;
 
@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsign
 	unsigned long flags;
 	long ret;
 
+	if (!clk)
+		return 0;
+
 	if (!clk->set_rate)
 		return -ENOSYS;
 
@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, stru
 	unsigned long flags;
 	int ret;
 
+	if (!clk)
+		return 0;
+
 	if (!clk->set_parent)
 		return -ENOSYS;
 
@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent);
 
 struct clk *clk_get_parent(struct clk *clk)
 {
-	return clk->parent;
+	return !clk ? NULL : clk->parent;
 }
 EXPORT_SYMBOL(clk_get_parent);
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203514 — [PATCH 3.14 07/29] ALSA: usb-audio: add dB range mapping for some devices

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 07/29] ALSA: usb-audio: add dB range mapping for some devices
Message-ID<pVl6a-45c-17@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yao-Wen Mao <yaowen@google.com>

commit 2d1cb7f658fb9c3ba8f9dab8aca297d4dfdec835 upstream.

Add the correct dB ranges of Bose Companion 5 and Drangonfly DAC 1.2.

Signed-off-by: Yao-Wen Mao <yaowen@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/mixer_maps.c |   24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -336,6 +336,20 @@ static const struct usbmix_name_map scms
 	{ 0 }
 };
 
+/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
+static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
+static struct usbmix_name_map bose_companion5_map[] = {
+	{ 3, NULL, .dB = &bose_companion5_dB },
+	{ 0 }	/* terminator */
+};
+
+/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
+static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
+static struct usbmix_name_map dragonfly_1_2_map[] = {
+	{ 7, NULL, .dB = &dragonfly_1_2_dB },
+	{ 0 }	/* terminator */
+};
+
 /*
  * Control map entries
  */
@@ -442,6 +456,16 @@ static struct usbmix_ctl_map usbmix_ctl_
 		.id = USB_ID(0x25c4, 0x0003),
 		.map = scms_usb3318_map,
 	},
+	{
+		/* Bose Companion 5 */
+		.id = USB_ID(0x05a7, 0x1020),
+		.map = bose_companion5_map,
+	},
+	{
+		/* Dragonfly DAC 1.2 */
+		.id = USB_ID(0x21b4, 0x0081),
+		.map = dragonfly_1_2_map,
+	},
 	{ 0 } /* terminator */
 };
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203516 — [PATCH 3.14 15/29] Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 15/29] Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen
Message-ID<pVl6a-45c-9@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bernhard Bender <bernhard.bender@bytecmed.com>

commit 968491709e5b1aaf429428814fff3d932fa90b60 upstream.

This patch fixes a problem in the usbtouchscreen driver for DMC TSC-30
touch screen.  Due to a missing delay between the RESET and SET_RATE
commands, the touch screen may become unresponsive during system startup or
driver loading.

According to the DMC documentation, a delay is needed after the RESET
command to allow the chip to complete its internal initialization. As this
delay is not guaranteed, we had a system where the touch screen
occasionally did not send any touch data. There was no other indication of
the problem.

The patch fixes the problem by adding a 150ms delay between the RESET and
SET_RATE commands.

Suggested-by: Jakob Mustafa <jakob.mustafa@bytecmed.com>
Signed-off-by: Bernhard Bender <bernhard.bender@bytecmed.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/touchscreen/usbtouchscreen.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -625,6 +625,9 @@ static int dmc_tsc10_init(struct usbtouc
 		goto err_out;
 	}
 
+	/* TSC-25 data sheet specifies a delay after the RESET command */
+	msleep(150);
+
 	/* set coordinate output rate */
 	buf[0] = buf[1] = 0xFF;
 	ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203518 — [PATCH 3.14 16/29] blkcg: fix gendisk reference leak in blkg_conf_prep()

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 16/29] blkcg: fix gendisk reference leak in blkg_conf_prep()
Message-ID<pVl6a-45c-19@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tejun Heo <tj@kernel.org>

commit 5f6c2d2b7dbb541c1e922538c49fa04c494ae3d7 upstream.

When a blkcg configuration is targeted to a partition rather than a
whole device, blkg_conf_prep fails with -EINVAL; unfortunately, it
forgets to put the gendisk ref in that case.  Fix it.

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 block/blk-cgroup.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -703,8 +703,12 @@ int blkg_conf_prep(struct blkcg *blkcg,
 		return -EINVAL;
 
 	disk = get_gendisk(MKDEV(major, minor), &part);
-	if (!disk || part)
+	if (!disk)
 		return -EINVAL;
+	if (part) {
+		put_disk(disk);
+		return -EINVAL;
+	}
 
 	rcu_read_lock();
 	spin_lock_irq(disk->queue->queue_lock);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203520 — [PATCH 3.14 17/29] ata: pmp: add quirk for Marvell 4140 SATA PMP

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 17/29] ata: pmp: add quirk for Marvell 4140 SATA PMP
Message-ID<pVl6a-45c-23@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lior Amsalem <alior@marvell.com>

commit 945b47441d83d2392ac9f984e0267ad521f24268 upstream.

This commit adds the necessary quirk to make the Marvell 4140 SATA PMP
work properly. This PMP doesn't like SRST on port number 4 (the host
port) so this commit marks this port as not supporting SRST.

Signed-off-by: Lior Amsalem <alior@marvell.com>
Reviewed-by: Nadav Haklai <nadavh@marvell.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/libata-pmp.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_p
 				       ATA_LFLAG_NO_SRST |
 				       ATA_LFLAG_ASSUME_ATA;
 		}
+	} else if (vendor == 0x11ab && devid == 0x4140) {
+		/* Marvell 4140 quirks */
+		ata_for_each_link(link, ap, EDGE) {
+			/* port 4 is for SEMB device and it doesn't like SRST */
+			if (link->pmp == 4)
+				link->flags |= ATA_LFLAG_DISABLED;
+		}
 	}
 }
 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203522 — [PATCH 3.14 24/29] rds: rds_ib_device.refcount overflow

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 24/29] rds: rds_ib_device.refcount overflow
Message-ID<pVl6b-45c-29@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wengang Wang <wen.gang.wang@oracle.com>

commit 4fabb59449aa44a585b3603ffdadd4c5f4d0c033 upstream.

Fixes: 3e0249f9c05c ("RDS/IB: add refcount tracking to struct rds_ib_device")

There lacks a dropping on rds_ib_device.refcount in case rds_ib_alloc_fmr
failed(mr pool running out). this lead to the refcount overflow.

A complain in line 117(see following) is seen. From vmcore:
s_ib_rdma_mr_pool_depleted is 2147485544 and rds_ibdev->refcount is -2147475448.
That is the evidence the mr pool is used up. so rds_ib_alloc_fmr is very likely
to return ERR_PTR(-EAGAIN).

115 void rds_ib_dev_put(struct rds_ib_device *rds_ibdev)
116 {
117         BUG_ON(atomic_read(&rds_ibdev->refcount) <= 0);
118         if (atomic_dec_and_test(&rds_ibdev->refcount))
119                 queue_work(rds_wq, &rds_ibdev->free_work);
120 }

fix is to drop refcount when rds_ib_alloc_fmr failed.

Signed-off-by: Wengang Wang <wen.gang.wang@oracle.com>
Reviewed-by: Haggai Eran <haggaie@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/rds/ib_rdma.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *
 	}
 
 	ibmr = rds_ib_alloc_fmr(rds_ibdev);
-	if (IS_ERR(ibmr))
+	if (IS_ERR(ibmr)) {
+		rds_ib_dev_put(rds_ibdev);
 		return ibmr;
+	}
 
 	ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
 	if (ret == 0)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203523 — [PATCH 3.14 23/29] x86/efi: Use all 64 bit of efi_memmap in setup_e820()

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 23/29] x86/efi: Use all 64 bit of efi_memmap in setup_e820()
Message-ID<pVl6b-45c-31@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Skorodumov <sdmitry@parallels.com>

commit 7cc03e48965453b5df1cce5062c826189b04b960 upstream.

The efi_info structure stores low 32 bits of memory map
in efi_memmap and high 32 bits in efi_memmap_hi.

While constructing pointer in the setup_e820(), need
to take into account all 64 bit of the pointer.

It is because on 64bit machine the function
efi_get_memory_map() may return full 64bit pointer and before
the patch that pointer was truncated.

The issue is triggered on Parallles virtual machine and
fixed with this patch.

Signed-off-by: Dmitry Skorodumov <sdmitry@parallels.com>
Cc: Denis V. Lunev <den@openvz.org>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/boot/compressed/eboot.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -560,6 +560,10 @@ static efi_status_t setup_e820(struct bo
 		unsigned int e820_type = 0;
 		unsigned long m = efi->efi_memmap;
 
+#ifdef CONFIG_X86_64
+		m |= (u64)efi->efi_memmap_hi << 32;
+#endif
+
 		d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
 		switch (d->type) {
 		case EFI_RESERVED_TYPE:


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203525 — [PATCH 3.14 20/29] xhci: report U3 when link is in resume state

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 20/29] xhci: report U3 when link is in resume state
Message-ID<pVl6b-45c-33@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhuang Jin Can <jin.can.zhuang@intel.com>

commit 243292a2ad3dc365849b820a64868927168894ac upstream.

xhci_hub_report_usb3_link_state() returns pls as U0 when the link
is in resume state, and this causes usb core to think the link is in
U0 while actually it's in resume state. When usb core transfers
control request on the link, it fails with TRB error as the link
is not ready for transfer.

To fix the issue, report U3 when the link is in resume state, thus
usb core knows the link it's not ready for transfer.

Signed-off-by: Zhuang Jin Can <jin.can.zhuang@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/xhci-hub.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -480,10 +480,13 @@ static void xhci_hub_report_usb3_link_st
 	u32 pls = status_reg & PORT_PLS_MASK;
 
 	/* resume state is a xHCI internal state.
-	 * Do not report it to usb core.
+	 * Do not report it to usb core, instead, pretend to be U3,
+	 * thus usb core knows it's not ready for transfer
 	 */
-	if (pls == XDEV_RESUME)
+	if (pls == XDEV_RESUME) {
+		*status |= USB_SS_PORT_LS_U3;
 		return;
+	}
 
 	/* When the CAS bit is set then warm reset
 	 * should be performed on port


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203529 — [PATCH 3.14 10/29] mac80211: clear subdir_stations when removing debugfs

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 10/29] mac80211: clear subdir_stations when removing debugfs
Message-ID<pVl6c-45c-47@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tom Hughes <tom@compton.nu>

commit 4479004e6409087d1b4986881dc98c6c15dffb28 upstream.

If we don't do this, and we then fail to recreate the debugfs
directory during a mode change, then we will fail later trying
to add stations to this now bogus directory:

BUG: unable to handle kernel NULL pointer dereference at 0000006c
IP: [<c0a92202>] mutex_lock+0x12/0x30
Call Trace:
[<c0678ab4>] start_creating+0x44/0xc0
[<c0679203>] debugfs_create_dir+0x13/0xf0
[<f8a938ae>] ieee80211_sta_debugfs_add+0x6e/0x490 [mac80211]

Signed-off-by: Tom Hughes <tom@compton.nu>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/debugfs_netdev.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -712,6 +712,7 @@ void ieee80211_debugfs_remove_netdev(str
 
 	debugfs_remove_recursive(sdata->vif.debugfs_dir);
 	sdata->vif.debugfs_dir = NULL;
+	sdata->debugfs.subdir_stations = NULL;
 }
 
 void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203532 — [PATCH 3.14 19/29] xhci: Calculate old endpoints correctly on device reset

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 19/29] xhci: Calculate old endpoints correctly on device reset
Message-ID<pVl6c-45c-53@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brian Campbell <bacam@z273.org.uk>

commit 326124a027abc9a7f43f72dc94f6f0f7a55b02b3 upstream.

When resetting a device the number of active TTs may need to be
corrected by xhci_update_tt_active_eps, but the number of old active
endpoints supplied to it was always zero, so the number of TTs and the
bandwidth reserved for them was not updated, and could rise
unnecessarily.

This affected systems using Intel's Patherpoint chipset, which rely on
software bandwidth checking.  For example, a Lenovo X230 would lose the
ability to use ports on the docking station after enough suspend/resume
cycles because the bandwidth calculated would rise with every cycle when
a suitable device is attached.

The correct number of active endpoints is calculated in the same way as
in xhci_reserve_bandwidth.

Signed-off-by: Brian Campbell <bacam@z273.org.uk>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/xhci.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3424,6 +3424,9 @@ int xhci_discover_or_reset_device(struct
 			return -EINVAL;
 	}
 
+	if (virt_dev->tt_info)
+		old_active_eps = virt_dev->tt_info->active_eps;
+
 	if (virt_dev->udev != udev) {
 		/* If the virt_dev and the udev does not match, this virt_dev
 		 * may belong to another udev.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203535 — [PATCH 3.14 03/29] s390/sclp: clear upper register halves in _sclp_print_early

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 03/29] s390/sclp: clear upper register halves in _sclp_print_early
Message-ID<pVl6c-45c-59@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

commit f9c87a6f46d508eae0d9ae640be98d50f237f827 upstream.

If the kernel is compiled with gcc 5.1 and the XZ compression option
the decompress_kernel function calls _sclp_print_early in 64-bit mode
while the content of the upper register half of %r6 is non-zero.
This causes a specification exception on the servc instruction in
_sclp_servc.

The _sclp_print_early function saves and restores the upper registers
halves but it fails to clear them for the 31-bit code of the mini sclp
driver.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/kernel/sclp.S |    4 ++++
 1 file changed, 4 insertions(+)

--- a/arch/s390/kernel/sclp.S
+++ b/arch/s390/kernel/sclp.S
@@ -276,6 +276,8 @@ ENTRY(_sclp_print_early)
 	jno	.Lesa2
 	ahi	%r15,-80
 	stmh	%r6,%r15,96(%r15)		# store upper register halves
+	basr	%r13,0
+	lmh	%r0,%r15,.Lzeroes-.(%r13)	# clear upper register halves
 .Lesa2:
 #endif
 	lr	%r10,%r2			# save string pointer
@@ -299,6 +301,8 @@ ENTRY(_sclp_print_early)
 #endif
 	lm	%r6,%r15,120(%r15)		# restore registers
 	br	%r14
+.Lzeroes:
+	.fill	64,4,0
 
 .LwritedataS4:
 	.long	0x00760005			# SCLP command for write data


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203537 — [PATCH 3.14 27/29] iscsi-target: Fix use-after-free during TPG session shutdown

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 27/29] iscsi-target: Fix use-after-free during TPG session shutdown
Message-ID<pVl6c-45c-63@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicholas Bellinger <nab@linux-iscsi.org>

commit 417c20a9bdd1e876384127cf096d8ae8b559066c upstream.

This patch fixes a use-after-free bug in iscsit_release_sessions_for_tpg()
where se_portal_group->session_lock was incorrectly released/re-acquired
while walking the active se_portal_group->tpg_sess_list.

The can result in a NULL pointer dereference when iscsit_close_session()
shutdown happens in the normal path asynchronously to this code, causing
a bogus dereference of an already freed list entry to occur.

To address this bug, walk the session list checking for the same state
as before, but move entries to a local list to avoid dropping the lock
while walking the active list.

As before, signal using iscsi_session->session_restatement=1 for those
list entries to be released locally by iscsit_free_session() code.

Reported-by: Sunilkumar Nadumuttlu <sjn@datera.io>
Cc: Sunilkumar Nadumuttlu <sjn@datera.io>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/target/iscsi/iscsi_target.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4709,6 +4709,7 @@ int iscsit_release_sessions_for_tpg(stru
 	struct iscsi_session *sess;
 	struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
 	struct se_session *se_sess, *se_sess_tmp;
+	LIST_HEAD(free_list);
 	int session_count = 0;
 
 	spin_lock_bh(&se_tpg->session_lock);
@@ -4730,14 +4731,17 @@ int iscsit_release_sessions_for_tpg(stru
 		}
 		atomic_set(&sess->session_reinstatement, 1);
 		spin_unlock(&sess->conn_lock);
-		spin_unlock_bh(&se_tpg->session_lock);
 
-		iscsit_free_session(sess);
-		spin_lock_bh(&se_tpg->session_lock);
+		list_move_tail(&se_sess->sess_list, &free_list);
+	}
+	spin_unlock_bh(&se_tpg->session_lock);
 
+	list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
+		sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
+
+		iscsit_free_session(sess);
 		session_count++;
 	}
-	spin_unlock_bh(&se_tpg->session_lock);
 
 	pr_debug("Released %d iSCSI Session(s) from Target Portal"
 			" Group: %hu\n", session_count, tpg->tpgt);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203542 — [PATCH 3.14 02/29] freeing unlinked file indefinitely delayed

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 02/29] freeing unlinked file indefinitely delayed
Message-ID<pVl6d-45c-77@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Al Viro <viro@ZenIV.linux.org.uk>

commit 75a6f82a0d10ef8f13cd8fe7212911a0252ab99e upstream.

	Normally opening a file, unlinking it and then closing will have
the inode freed upon close() (provided that it's not otherwise busy and
has no remaining links, of course).  However, there's one case where that
does *not* happen.  Namely, if you open it by fhandle with cold dcache,
then unlink() and close().

	In normal case you get d_delete() in unlink(2) notice that dentry
is busy and unhash it; on the final dput() it will be forcibly evicted from
dcache, triggering iput() and inode removal.  In this case, though, we end
up with *two* dentries - disconnected (created by open-by-fhandle) and
regular one (used by unlink()).  The latter will have its reference to inode
dropped just fine, but the former will not - it's considered hashed (it
is on the ->s_anon list), so it will stay around until the memory pressure
will finally do it in.  As the result, we have the final iput() delayed
indefinitely.  It's trivial to reproduce -

void flush_dcache(void)
{
        system("mount -o remount,rw /");
}

static char buf[20 * 1024 * 1024];

main()
{
        int fd;
        union {
                struct file_handle f;
                char buf[MAX_HANDLE_SZ];
        } x;
        int m;

        x.f.handle_bytes = sizeof(x);
        chdir("/root");
        mkdir("foo", 0700);
        fd = open("foo/bar", O_CREAT | O_RDWR, 0600);
        close(fd);
        name_to_handle_at(AT_FDCWD, "foo/bar", &x.f, &m, 0);
        flush_dcache();
        fd = open_by_handle_at(AT_FDCWD, &x.f, O_RDWR);
        unlink("foo/bar");
        write(fd, buf, sizeof(buf));
        system("df .");			/* 20Mb eaten */
        close(fd);
        system("df .");			/* should've freed those 20Mb */
        flush_dcache();
        system("df .");			/* should be the same as #2 */
}

will spit out something like
Filesystem     1K-blocks   Used Available Use% Mounted on
/dev/root         322023 303843      1131 100% /
Filesystem     1K-blocks   Used Available Use% Mounted on
/dev/root         322023 303843      1131 100% /
Filesystem     1K-blocks   Used Available Use% Mounted on
/dev/root         322023 283282     21692  93% /
- inode gets freed only when dentry is finally evicted (here we trigger
than by remount; normally it would've happened in response to memory
pressure hell knows when).

Acked-by: J. Bruce Fields <bfields@fieldses.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/dcache.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -587,6 +587,9 @@ repeat:
 	if (unlikely(d_unhashed(dentry)))
 		goto kill_it;
 
+	if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
+		goto kill_it;
+
 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
 		if (dentry->d_op->d_delete(dentry))
 			goto kill_it;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203544 — [PATCH 3.14 01/29] mm: avoid setting up anonymous pages into file mapping

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-09 00:50 +0200
Subject[PATCH 3.14 01/29] mm: avoid setting up anonymous pages into file mapping
Message-ID<pVl6d-45c-75@gated-at.bofh.it>
In reply to#1203509
3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>

commit 6b7339f4c31ad69c8e9c0b2859276e22cf72176d upstream.

Reading page fault handler code I've noticed that under right
circumstances kernel would map anonymous pages into file mappings: if
the VMA doesn't have vm_ops->fault() and the VMA wasn't fully populated
on ->mmap(), kernel would handle page fault to not populated pte with
do_anonymous_page().

Let's change page fault handler to use do_anonymous_page() only on
anonymous VMA (->vm_ops == NULL) and make sure that the VMA is not
shared.

For file mappings without vm_ops->fault() or shred VMA without vm_ops,
page fault on pte_none() entry would lead to SIGBUS.

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


---
 mm/memory.c |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3234,6 +3234,10 @@ static int do_anonymous_page(struct mm_s
 
 	pte_unmap(page_table);
 
+	/* File mapping without ->vm_ops ? */
+	if (vma->vm_flags & VM_SHARED)
+		return VM_FAULT_SIGBUS;
+
 	/* Check if we need to add a guard page to the stack */
 	if (check_stack_guard_page(vma, address) < 0)
 		return VM_FAULT_SIGSEGV;
@@ -3502,6 +3506,9 @@ static int do_linear_fault(struct mm_str
 			- vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
 
 	pte_unmap(page_table);
+	/* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
+	if (!vma->vm_ops->fault)
+		return VM_FAULT_SIGBUS;
 	return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte);
 }
 
@@ -3650,11 +3657,9 @@ static int handle_pte_fault(struct mm_st
 	entry = ACCESS_ONCE(*pte);
 	if (!pte_present(entry)) {
 		if (pte_none(entry)) {
-			if (vma->vm_ops) {
-				if (likely(vma->vm_ops->fault))
-					return do_linear_fault(mm, vma, address,
+			if (vma->vm_ops)
+				return do_linear_fault(mm, vma, address,
 						pte, pmd, flags, entry);
-			}
 			return do_anonymous_page(mm, vma, address,
 						 pte, pmd, flags);
 		}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203567

FromGuenter Roeck <linux@roeck-us.net>
Date2015-08-09 05:20 +0200
Message-ID<pVpjr-1S7-3@gated-at.bofh.it>
In reply to#1203509
On 08/08/2015 03:07 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.14.50 release.
> There are 29 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon Aug 10 22:06:58 UTC 2015.
> Anything received after that time might be too late.
>
Build results:
	total: 135 pass: 135 fail: 0
Qemu test results:
	total: 58 pass: 56 fail: 2
Failed tests:
	arm:realview-eb-mpcore:arm_realview_eb_defconfig
	arm:realview-eb:arm_realview_eb_defconfig

As with 3.10, the failed qemu tests are not new problems, but found due to
newly introduced tests. Request to include the fix in -stable is here [1].

Details are available at http://server.roeck-us.net:8010/builders.

Guenter

---
[1] http://permalink.gmane.org/gmane.linux.kernel.stable/145285

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1204504

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-08-10 21:20 +0200
Message-ID<pW0M2-73c-35@gated-at.bofh.it>
In reply to#1203567
On Sat, Aug 08, 2015 at 08:16:25PM -0700, Guenter Roeck wrote:
> On 08/08/2015 03:07 PM, Greg Kroah-Hartman wrote:
> >This is the start of the stable review cycle for the 3.14.50 release.
> >There are 29 patches in this series, all will be posted as a response
> >to this one.  If anyone has any issues with these being applied, please
> >let me know.
> >
> >Responses should be made by Mon Aug 10 22:06:58 UTC 2015.
> >Anything received after that time might be too late.
> >
> Build results:
> 	total: 135 pass: 135 fail: 0
> Qemu test results:
> 	total: 58 pass: 56 fail: 2
> Failed tests:
> 	arm:realview-eb-mpcore:arm_realview_eb_defconfig
> 	arm:realview-eb:arm_realview_eb_defconfig
> 
> As with 3.10, the failed qemu tests are not new problems, but found due to
> newly introduced tests. Request to include the fix in -stable is here [1].

Will queue that up for the next round, thanks.

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1203767

FromSudip Mukherjee <sudipm.mukherjee@gmail.com>
Date2015-08-10 07:10 +0200
Message-ID<pVNvt-3Zb-13@gated-at.bofh.it>
In reply to#1203509
On Sat, Aug 08, 2015 at 03:07:23PM -0700, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.14.50 release.
> There are 29 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Mon Aug 10 22:06:58 UTC 2015.
> Anything received after that time might be too late.
Compiled and booted on x86_32. No errors in dmesg.

regards
sudip
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]


Back to top | Article view | linux.kernel


csiph-web