Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1381489 > unrolled thread
| Started by | lizf@kernel.org |
|---|---|
| First post | 2016-04-18 12:50 +0200 |
| Last post | 2016-04-19 02:30 +0200 |
| Articles | 20 on this page of 82 — 4 participants |
Back to article view | Back to linux.kernel
[PATCH 3.4 00/92] 3.4.112-rc1 review lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 41/92] iwlwifi: dvm: fix D3 firmware PN programming lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 10/92] devres: fix devres_get() lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 19/92] SUNRPC: xs_reset_transport must mark the connection as disconnected lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 29/92] scsi_dh: fix randconfig build error lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 45/92] md/raid10: ensure device failure recorded before write request returns. lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 42/92] sched/core: Fix TASK_DEAD race in finish_task_switch() lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 16/92] DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 24/92] hpfs: update ctime and mtime on directory modification lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 31/92] powerpc/MSI: Fix race condition in tearing down MSI interrupts lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 26/92] fs: create and use seq_show_option for escaping lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 22/92] Add radeon suspend/resume quirk for HP Compaq dc5750. lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 46/92] md/raid10: don't clear bitmap bit when bad-block-list write fails. lizf@kernel.org - 2016-04-18 12:50 +0200
[PATCH 3.4 73/92] tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 67/92] x86/process: Add proper bound checks in 64bit get_wchan() lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 51/92] spi: Fix documentation of spi_alloc_master() lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 64/92] x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when sanitizing map lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 69/92] mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 85/92] mm: make sendfile(2) killable lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 56/92] usb: Use the USB_SS_MULT() macro to get the burst multiplier. lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 71/92] USB: Add reset-resume quirk for two Plantronics usb headphones. lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 76/92] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing) lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 72/92] usb: Add device quirk for Logitech PTZ cameras lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 68/92] genirq: Fix race in register_irq_proc() lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 92/92] x86/iopl/64: Properly context-switch IOPL on Xen PV lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 91/92] splice: sendfile() at once fails for big files lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 82/92] ASoC: wm8904: Correct number of EQ registers lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 90/92] pipe: Fix buffer offset after partially failed read lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 89/92] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 80/92] xhci: Add spurious wakeup quirk for LynxPoint-LP controllers lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 88/92] raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 83/92] iommu/amd: Don't clear DTE flags when modifying it lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 78/92] iommu/vt-d: fix range computation when making room for large pages lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 58/92] usb: xhci: Clear XHCI_STATE_DYING on start lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 52/92] btrfs: skip waiting on ordered range for special files lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 77/92] crypto: ahash - ensure statesize is non-zero lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 87/92] mvsas: Fix NULL pointer dereference in mvs_slot_task_free lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 86/92] dm btree: fix leak of bufio-backed block in btree_split_beneath error path lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 74/92] drivers/tty: require read access for controlling terminal lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 60/92] cifs: use server timestamp for ntlmv2 authentication lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 75/92] ALSA: synth: Fix conflicting OSS device registration on AWE32 lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 81/92] crypto: api - Only abort operations on fatal signal lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 84/92] drm/nouveau/gem: return only valid domain when there's only one lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 61/92] ocfs2/dlm: fix deadlock when dispatch assert master lizf@kernel.org - 2016-04-18 13:00 +0200
Re: [PATCH 3.4 61/92] ocfs2/dlm: fix deadlock when dispatch assert master Joseph Qi <joseph.qi@huawei.com> - 2016-04-18 13:40 +0200
Re: [PATCH 3.4 61/92] ocfs2/dlm: fix deadlock when dispatch assert master Zefan Li <lizefan@huawei.com> - 2016-04-19 02:20 +0200
[PATCH 3.4 79/92] xhci: handle no ping response error properly lizf@kernel.org - 2016-04-18 13:00 +0200
[PATCH 3.4 57/92] xhci: give command abortion one more chance before killing xhci lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 50/92] spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 48/92] md/raid1: don't clear bitmap bit when bad-block-list write fails. lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 43/92] IB/cm: Fix rb-tree duplicate free and use-after-free lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 49/92] drm: crtc: integer overflow in drm_property_create_blob() lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 55/92] KVM: x86: trap AMD MSRs for the TSeg base and mask lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 63/92] m68k: Define asmlinkage_protect lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 54/92] regmap: debugfs: Don't bother actually printing when calculating max length lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 66/92] UBI: return ENOSPC if no enough space available lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 59/92] xhci: change xhci 1.0 only restrictions to support xhci 1.1 lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 53/92] regmap: debugfs: Ensure we don't underflow when printing access masks lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 65/92] UBI: Validate data_size lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 62/92] ath9k: declare required extra tx headroom lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 70/92] clocksource: Fix abs() usage w/ 64bit values lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 47/92] md/raid1: ensure device failure recorded before write request returns. lizf@kernel.org - 2016-04-18 13:10 +0200
[PATCH 3.4 09/92] auxdisplay: ks0108: fix refcount lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 25/92] crypto: ghash-clmulni: specify context size for ghash async algorithm lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 20/92] IB/mlx4: Use correct SL on AH query under RoCE lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 21/92] IB/uverbs: Fix race between ib_uverbs_open and remove_one lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 30/92] ARM: 8429/1: disable GCC SRA optimization lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 33/92] ARM: 7880/1: Clear the IT state independent of the Thumb-2 mode lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 13/92] usb: host: ehci-sys: delete useless bus_to_hcd conversion lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 40/92] md/raid0: apply base queue limits *before* disk_stack_limits lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 15/92] eCryptfs: Invalidate dcache entries when lower i_nlink is zero lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 38/92] ASoC: fix broken pxa SoC support lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 06/92] powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 11/92] windfarm: decrement client count when unregistering lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 36/92] module: Fix locking in symbol_put_addr() lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 17/92] of/address: Don't loop forever in of_find_matching_node_by_address(). lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 14/92] USB: ftdi_sio: Added custom PID for CustomWare products lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 23/92] IB/uverbs: reject invalid or unknown opcodes lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 27/92] hfs,hfsplus: cache pages correctly between bnode_create and bnode_free lizf@kernel.org - 2016-04-18 13:20 +0200
[PATCH 3.4 05/92] PCI: Add VPD function 0 quirk for Intel Ethernet devices lizf@kernel.org - 2016-04-18 13:30 +0200
Re: [PATCH 3.4 00/92] 3.4.112-rc1 review Guenter Roeck <linux@roeck-us.net> - 2016-04-18 18:40 +0200
Re: [PATCH 3.4 00/92] 3.4.112-rc1 review Zefan Li <lizefan@huawei.com> - 2016-04-19 02:30 +0200
Page 1 of 5 [1] 2 3 4 5 Next page →
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 00/92] 3.4.112-rc1 review |
| Message-ID | <rpeUF-424-3@gated-at.bofh.it> |
From: Zefan Li <lizefan@huawei.com>
This is the start of the stable review cycle for the 3.4.112 release.
There are 92 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Apr 20 10:44:28 UTC 2016.
Anything received after that time might be too late.
A combined patch relative to 3.4.111 will be posted as an additional
response to this. A shortlog and diffstat can be found below.
thanks,
Zefan Li
--------------------
Andreas Schwab (1):
m68k: Define asmlinkage_protect
Andrey Ryabinin (1):
crypto: ghash-clmulni: specify context size for ghash async algorithm
Andy Lutomirski (1):
x86/iopl/64: Properly context-switch IOPL on Xen PV
Ard Biesheuvel (1):
ARM: 8429/1: disable GCC SRA optimization
Arnaldo Carvalho de Melo (1):
perf header: Fixup reading of HEADER_NRCPUS feature
Ben Hutchings (3):
genirq: Fix race in register_irq_proc()
usb: Use the USB_SS_MULT() macro to decode burst multiplier for log
message
pipe: Fix buffer offset after partially failed read
Bjorn Helgaas (1):
PCI: Fix TI816X class code quirk
Bob Copeland (1):
mac80211: enable assoc check for mesh interfaces
Cathy Avery (1):
xen-blkfront: check for null drvdata in blkback_changed
(XenbusStateClosing)
Charles Keepax (1):
ASoC: wm8904: Correct number of EQ registers
Christian Zander (1):
iommu/vt-d: fix range computation when making room for large pages
Christoph Hellwig (2):
IB/uverbs: reject invalid or unknown opcodes
scsi_dh: fix randconfig build error
Christophe Leroy (1):
splice: sendfile() at once fails for big files
Chuck Lever (1):
svcrdma: Fix send_reply() scatter/gather set-up
Dan Carpenter (1):
drm: crtc: integer overflow in drm_property_create_blob()
David Daney (1):
of/address: Don't loop forever in of_find_matching_node_by_address().
David Härdeman (1):
rc-core: fix remove uevent generation
David Woodhouse (1):
x86/platform: Fix Geode LX timekeeping in the generic x86 build
Doron Tsur (1):
IB/cm: Fix rb-tree duplicate free and use-after-free
Dāvis Mosāns (1):
mvsas: Fix NULL pointer dereference in mvs_slot_task_free
Felix Fietkau (1):
ath9k: declare required extra tx headroom
Grant Likely (1):
drivercore: Fix unregistration path of platform devices
Guenter Roeck (1):
spi: Fix documentation of spi_alloc_master()
Herbert Xu (2):
ipv6: Fix IPsec pre-encap fragmentation check
crypto: api - Only abort operations on fatal signal
Hin-Tak Leung (2):
hfs,hfsplus: cache pages correctly between bnode_create and bnode_free
hfs: fix B-tree corruption after insertion at position 0
Ilia Mirkin (1):
drm/nouveau/gem: return only valid domain when there's only one
James Hogan (1):
MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
Jan Kara (1):
mm: make sendfile(2) killable
Jann Horn (1):
drivers/tty: require read access for controlling terminal
Jeff Mahoney (1):
btrfs: skip waiting on ordered range for special files
Jeffery Miller (1):
Add radeon suspend/resume quirk for HP Compaq dc5750.
Joerg Roedel (1):
iommu/amd: Don't clear DTE flags when modifying it
Johannes Berg (1):
iwlwifi: dvm: fix D3 firmware PN programming
John Stultz (1):
clocksource: Fix abs() usage w/ 64bit values
Joseph Qi (1):
ocfs2/dlm: fix deadlock when dispatch assert master
Kees Cook (1):
fs: create and use seq_show_option for escaping
Kosuke Tatsukawa (1):
tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
Laura Abbott (1):
xhci: Add spurious wakeup quirk for LynxPoint-LP controllers
Malcolm Crossley (1):
x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when
sanitizing map
Mark Brown (2):
regmap: debugfs: Ensure we don't underflow when printing access masks
regmap: debugfs: Don't bother actually printing when calculating max
length
Mark Rustad (2):
PCI: Add dev_flags bit to access VPD through function 0
PCI: Add VPD function 0 quirk for Intel Ethernet devices
Masahiro Yamada (1):
devres: fix devres_get()
Mathias Nyman (4):
usb: Use the USB_SS_MULT() macro to get the burst multiplier.
xhci: give command abortion one more chance before killing xhci
xhci: change xhci 1.0 only restrictions to support xhci 1.1
xhci: handle no ping response error properly
Matthijs Kooijman (1):
USB: ftdi_sio: Added custom PID for CustomWare products
Mel Gorman (1):
mm: hugetlbfs: skip shared VMAs when unmapping private pages to
satisfy a fault
Mike Snitzer (1):
dm btree: fix leak of bufio-backed block in btree_split_beneath error
path
Mikulas Patocka (1):
hpfs: update ctime and mtime on directory modification
Nate Dailey (1):
raid1: include bio_end_io_list in nr_queued to prevent freeze_array
hang
NeilBrown (7):
md/raid0: update queue parameter in a safer location.
NFSv4: don't set SETATTR for O_RDONLY|O_EXCL
md/raid0: apply base queue limits *before* disk_stack_limits
md/raid10: ensure device failure recorded before write request
returns.
md/raid10: don't clear bitmap bit when bad-block-list write fails.
md/raid1: ensure device failure recorded before write request returns.
md/raid1: don't clear bitmap bit when bad-block-list write fails.
Noa Osherovich (1):
IB/mlx4: Use correct SL on AH query under RoCE
Paolo Bonzini (1):
KVM: x86: trap AMD MSRs for the TSeg base and mask
Paul Bolle (1):
windfarm: decrement client count when unregistering
Paul Mackerras (1):
powerpc/MSI: Fix race condition in tearing down MSI interrupts
Peter Chen (1):
usb: host: ehci-sys: delete useless bus_to_hcd conversion
Peter Seiderer (1):
cifs: use server timestamp for ntlmv2 authentication
Peter Zijlstra (2):
module: Fix locking in symbol_put_addr()
sched/core: Fix TASK_DEAD race in finish_task_switch()
Richard Weinberger (1):
UBI: Validate data_size
Robert Jarzmik (1):
ASoC: fix broken pxa SoC support
Roger Quadros (1):
usb: xhci: Clear XHCI_STATE_DYING on start
Russell King (2):
ARM: fix Thumb2 signal handling when ARMv6 is enabled
crypto: ahash - ensure statesize is non-zero
Stephen Chandler Paul (1):
DRM - radeon: Don't link train DisplayPort on HPD until we get the
dpcd
Sudip Mukherjee (1):
auxdisplay: ks0108: fix refcount
T.J. Purtell (1):
ARM: 7880/1: Clear the IT state independent of the Thumb-2 mode
Takashi Iwai (1):
ALSA: synth: Fix conflicting OSS device registration on AWE32
Tan, Jui Nee (1):
spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is
disabled
Thomas Gleixner (1):
x86/process: Add proper bound checks in 64bit get_wchan()
Thomas Huth (1):
powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers
Trond Myklebust (1):
SUNRPC: xs_reset_transport must mark the connection as disconnected
Tyler Hicks (1):
eCryptfs: Invalidate dcache entries when lower i_nlink is zero
Vasant Hegde (1):
powerpc/rtas: Validate rtas.entry before calling enter_rtas()
Vincent Palatin (1):
usb: Add device quirk for Logitech PTZ cameras
Yao-Wen Mao (1):
USB: Add reset-resume quirk for two Plantronics usb headphones.
Yishai Hadas (1):
IB/uverbs: Fix race between ib_uverbs_open and remove_one
shengyong (1):
UBI: return ENOSPC if no enough space available
arch/arm/Makefile | 8 ++++
arch/arm/kernel/signal.c | 19 +++++++--
arch/m68k/include/asm/linkage.h | 30 ++++++++++++++
arch/mips/mm/dma-default.c | 2 +-
arch/powerpc/include/asm/rtas.h | 1 +
arch/powerpc/kernel/rtas.c | 20 ++++++++++
arch/powerpc/platforms/powernv/pci.c | 4 +-
arch/powerpc/platforms/pseries/ras.c | 3 +-
arch/powerpc/sysdev/fsl_msi.c | 5 ++-
arch/powerpc/sysdev/mpic_pasemi_msi.c | 5 ++-
arch/powerpc/sysdev/mpic_u3msi.c | 5 ++-
arch/powerpc/sysdev/ppc4xx_msi.c | 5 ++-
arch/x86/crypto/ghash-clmulni-intel_glue.c | 1 +
arch/x86/include/asm/msr-index.h | 1 +
arch/x86/include/asm/xen/hypervisor.h | 2 +
arch/x86/kernel/process_64.c | 64 +++++++++++++++++++++++++-----
arch/x86/kernel/tsc.c | 17 ++++----
arch/x86/kvm/x86.c | 2 +
arch/x86/xen/enlighten.c | 2 +-
arch/x86/xen/setup.c | 2 +-
crypto/ablkcipher.c | 2 +-
crypto/ahash.c | 3 +-
crypto/algapi.c | 2 +-
crypto/api.c | 6 +--
crypto/crypto_user.c | 2 +-
drivers/auxdisplay/ks0108.c | 1 +
drivers/base/devres.c | 4 +-
drivers/base/platform.c | 8 +---
drivers/base/regmap/regmap-debugfs.c | 5 +--
drivers/block/xen-blkfront.c | 3 +-
drivers/gpu/drm/drm_crtc.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_gem.c | 5 ++-
drivers/gpu/drm/radeon/radeon_combios.c | 8 ++++
drivers/gpu/drm/radeon/radeon_connectors.c | 5 +++
drivers/infiniband/core/cm.c | 10 ++++-
drivers/infiniband/core/uverbs.h | 3 +-
drivers/infiniband/core/uverbs_cmd.c | 10 ++++-
drivers/infiniband/core/uverbs_main.c | 43 ++++++++++++++------
drivers/infiniband/hw/mlx4/ah.c | 6 ++-
drivers/iommu/amd_iommu.c | 4 +-
drivers/iommu/amd_iommu_types.h | 1 +
drivers/iommu/intel-iommu.c | 19 ++++++---
drivers/macintosh/windfarm_core.c | 2 +-
drivers/md/Kconfig | 2 +-
drivers/md/md.c | 1 +
drivers/md/persistent-data/dm-btree.c | 2 +-
drivers/md/raid0.c | 55 ++++++++++++++++---------
drivers/md/raid1.c | 41 +++++++++++++++++--
drivers/md/raid1.h | 5 +++
drivers/md/raid10.c | 42 ++++++++++++++++++--
drivers/md/raid10.h | 6 +++
drivers/media/rc/rc-main.c | 3 --
drivers/mtd/ubi/io.c | 5 +++
drivers/mtd/ubi/vtbl.c | 1 +
drivers/mtd/ubi/wl.c | 1 +
drivers/net/wireless/ath/ath9k/init.c | 1 +
drivers/net/wireless/iwlwifi/iwl-agn-lib.c | 2 +-
drivers/of/address.c | 6 +--
drivers/pci/access.c | 61 +++++++++++++++++++++++++++-
drivers/pci/quirks.c | 18 +++++++--
drivers/scsi/mvsas/mv_sas.c | 2 +
drivers/spi/spi-pxa2xx.c | 4 ++
drivers/spi/spi.c | 3 +-
drivers/tty/n_tty.c | 6 +--
drivers/tty/tty_io.c | 31 +++++++++++++--
drivers/usb/core/config.c | 8 ++--
drivers/usb/core/quirks.c | 13 ++++++
drivers/usb/host/ehci-sysfs.c | 8 ++--
drivers/usb/host/xhci-mem.c | 6 +--
drivers/usb/host/xhci-pci.c | 1 +
drivers/usb/host/xhci-ring.c | 33 +++++++++++----
drivers/usb/host/xhci.c | 3 +-
drivers/usb/serial/ftdi_sio.c | 4 ++
drivers/usb/serial/ftdi_sio_ids.h | 8 ++++
fs/btrfs/inode.c | 3 +-
fs/ceph/super.c | 8 ++--
fs/cifs/cifsencrypt.c | 51 +++++++++++++++++++++++-
fs/cifs/cifsfs.c | 4 +-
fs/ecryptfs/dentry.c | 32 +++++++--------
fs/ext4/super.c | 4 +-
fs/gfs2/super.c | 6 +--
fs/hfs/bnode.c | 9 ++---
fs/hfs/brec.c | 20 +++++-----
fs/hfs/super.c | 4 +-
fs/hfsplus/bnode.c | 3 --
fs/hfsplus/options.c | 4 +-
fs/hostfs/hostfs_kern.c | 2 +-
fs/hpfs/namei.c | 25 +++++++++++-
fs/nfs/nfs4proc.c | 2 +-
fs/ocfs2/dlm/dlmmaster.c | 4 +-
fs/ocfs2/dlm/dlmrecovery.c | 6 ++-
fs/ocfs2/super.c | 4 +-
fs/pipe.c | 5 ++-
fs/reiserfs/super.c | 8 ++--
fs/splice.c | 12 +++++-
fs/xfs/xfs_super.c | 4 +-
include/linux/pci.h | 2 +
include/linux/seq_file.h | 35 ++++++++++++++++
include/sound/wm8904.h | 2 +-
kernel/cgroup.c | 7 ++--
kernel/irq/proc.c | 19 ++++++++-
kernel/module.c | 8 +++-
kernel/sched/core.c | 10 ++---
kernel/sched/sched.h | 4 +-
kernel/time/clocksource.c | 2 +-
mm/filemap.c | 9 +++--
mm/hugetlb.c | 8 ++++
net/ipv6/xfrm6_output.c | 16 +++++---
net/mac80211/tx.c | 3 --
net/sunrpc/xprtrdma/svc_rdma_sendto.c | 11 ++++-
net/sunrpc/xprtsock.c | 2 +
security/selinux/hooks.c | 2 +-
sound/arm/Kconfig | 15 +++----
sound/soc/pxa/Kconfig | 2 -
sound/synth/emux/emux_oss.c | 3 +-
tools/perf/util/header.c | 22 ++++------
116 files changed, 871 insertions(+), 265 deletions(-)
--
1.9.1
[toc] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 41/92] iwlwifi: dvm: fix D3 firmware PN programming |
| Message-ID | <rpeUG-424-35@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Johannes Berg <johannes.berg@intel.com> 3.4.112-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit 5bd166872d8f99f156fac191299d24f828bb2348 upstream. The code to send the RX PN data (for each TID) to the firmware has a devastating bug: it overwrites the data for TID 0 with all the TID data, leaving the remaining TIDs zeroed. This will allow replays to actually be accepted by the firmware, which could allow waking up the system. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> [lizf: Backported to 3.4: adjust filename] Signed-off-by: Zefan Li <lizefan@huawei.com> --- drivers/net/wireless/iwlwifi/iwl-agn-lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c index 56f41c9..6314e24 100644 --- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c +++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c @@ -1063,7 +1063,7 @@ static void iwlagn_wowlan_program_keys(struct ieee80211_hw *hw, u8 *pn = seq.ccmp.pn; ieee80211_get_key_rx_seq(key, i, &seq); - aes_sc->pn = cpu_to_le64( + aes_sc[i].pn = cpu_to_le64( (u64)pn[5] | ((u64)pn[4] << 8) | ((u64)pn[3] << 16) | -- 1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 10/92] devres: fix devres_get() |
| Message-ID | <rpeUG-424-33@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Masahiro Yamada <yamada.masahiro@socionext.com>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 64526370d11ce8868ca495723d595b61e8697fbf upstream.
Currently, devres_get() passes devres_free() the pointer to devres,
but devres_free() should be given with the pointer to resource data.
Fixes: 9ac7849e35f7 ("devres: device resource management")
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/base/devres.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/base/devres.c b/drivers/base/devres.c
index 524bf96..06c541d 100644
--- a/drivers/base/devres.c
+++ b/drivers/base/devres.c
@@ -254,10 +254,10 @@ void * devres_get(struct device *dev, void *new_res,
if (!dr) {
add_dr(dev, &new_dr->node);
dr = new_dr;
- new_dr = NULL;
+ new_res = NULL;
}
spin_unlock_irqrestore(&dev->devres_lock, flags);
- devres_free(new_dr);
+ devres_free(new_res);
return dr->data;
}
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 19/92] SUNRPC: xs_reset_transport must mark the connection as disconnected |
| Message-ID | <rpeUH-424-41@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Trond Myklebust <trond.myklebust@primarydata.com>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 0c78789e3a030615c6650fde89546cadf40ec2cc upstream.
In case the reconnection attempt fails.
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
[lizf: Backported to 3.4: add definition of variable xprt]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
net/sunrpc/xprtsock.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 31275e5..d4a564f 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -811,6 +811,7 @@ static void xs_reset_transport(struct sock_xprt *transport)
{
struct socket *sock = transport->sock;
struct sock *sk = transport->inet;
+ struct rpc_xprt *xprt = &transport->xprt;
if (sk == NULL)
return;
@@ -824,6 +825,7 @@ static void xs_reset_transport(struct sock_xprt *transport)
sk->sk_user_data = NULL;
xs_restore_old_callbacks(transport, sk);
+ xprt_clear_connected(xprt);
write_unlock_bh(&sk->sk_callback_lock);
sk->sk_no_check = 0;
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 29/92] scsi_dh: fix randconfig build error |
| Message-ID | <rpeUH-424-49@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Christoph Hellwig <hch@lst.de> 3.4.112-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit 294ab783ad98066b87296db1311c7ba2a60206a5 upstream. It looks like the Kconfig check that was meant to fix this (commit fe9233fb6914a0eb20166c967e3020f7f0fba2c9 [SCSI] scsi_dh: fix kconfig related build errors) was actually reversed, but no-one noticed until the new set of patches which separated DM and SCSI_DH). Fixes: fe9233fb6914a0eb20166c967e3020f7f0fba2c9 Signed-off-by: Christoph Hellwig <hch@lst.de> Tested-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: James Bottomley <JBottomley@Odin.com> Signed-off-by: Zefan Li <lizefan@huawei.com> --- drivers/md/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig index da4dc25..5187030 100644 --- a/drivers/md/Kconfig +++ b/drivers/md/Kconfig @@ -330,7 +330,7 @@ config DM_MULTIPATH # of SCSI_DH if the latter isn't defined but if # it is, DM_MULTIPATH must depend on it. We get a build # error if SCSI_DH=m and DM_MULTIPATH=y - depends on SCSI_DH || !SCSI_DH + depends on !SCSI_DH || SCSI ---help--- Allow volume managers to support multipath hardware. -- 1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 45/92] md/raid10: ensure device failure recorded before write request returns. |
| Message-ID | <rpeUH-424-45@gated-at.bofh.it> |
| In reply to | #1381489 |
From: NeilBrown <neilb@suse.com>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 95af587e95aacb9cfda4a9641069a5244a540dc8 upstream.
When a write to one of the legs of a RAID10 fails, the failure is
recorded in the metadata of the other legs so that after a restart
the data on the failed drive wont be trusted even if that drive seems
to be working again (maybe a cable was unplugged).
Currently there is no interlock between the write request completing
and the metadata update. So it is possible that the write will
complete, the app will confirm success in some way, and then the
machine will crash before the metadata update completes.
This is an extremely small hole for a racy to fit in, but it is
theoretically possible and so should be closed.
So:
- set MD_CHANGE_PENDING when requesting a metadata update for a
failed device, so we can know with certainty when it completes
- queue requests that experienced an error on a new queue which
is only processed after the metadata update completes
- call raid_end_bio_io() on bios in that queue when the time comes.
Signed-off-by: NeilBrown <neilb@suse.com>
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/md/raid10.c | 29 ++++++++++++++++++++++++++++-
drivers/md/raid10.h | 6 ++++++
2 files changed, 34 insertions(+), 1 deletion(-)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 149426c..b0ad772 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1463,6 +1463,7 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
set_bit(Blocked, &rdev->flags);
set_bit(Faulty, &rdev->flags);
set_bit(MD_CHANGE_DEVS, &mddev->flags);
+ set_bit(MD_CHANGE_PENDING, &mddev->flags);
printk(KERN_ALERT
"md/raid10:%s: Disk failure on %s, disabling device.\n"
"md/raid10:%s: Operation continuing on %d devices.\n",
@@ -2536,6 +2537,7 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
}
put_buf(r10_bio);
} else {
+ bool fail = false;
for (m = 0; m < conf->copies; m++) {
int dev = r10_bio->devs[m].devnum;
struct bio *bio = r10_bio->devs[m].bio;
@@ -2548,6 +2550,7 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
rdev_dec_pending(rdev, conf->mddev);
} else if (bio != NULL &&
!test_bit(BIO_UPTODATE, &bio->bi_flags)) {
+ fail = true;
if (!narrow_write_error(r10_bio, m)) {
md_error(conf->mddev, rdev);
set_bit(R10BIO_Degraded,
@@ -2568,7 +2571,13 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
if (test_bit(R10BIO_WriteError,
&r10_bio->state))
close_write(r10_bio);
- raid_end_bio_io(r10_bio);
+ if (fail) {
+ spin_lock_irq(&conf->device_lock);
+ list_add(&r10_bio->retry_list, &conf->bio_end_io_list);
+ spin_unlock_irq(&conf->device_lock);
+ md_wakeup_thread(conf->mddev->thread);
+ } else
+ raid_end_bio_io(r10_bio);
}
}
@@ -2582,6 +2591,23 @@ static void raid10d(struct mddev *mddev)
md_check_recovery(mddev);
+ if (!list_empty_careful(&conf->bio_end_io_list) &&
+ !test_bit(MD_CHANGE_PENDING, &mddev->flags)) {
+ LIST_HEAD(tmp);
+ spin_lock_irqsave(&conf->device_lock, flags);
+ if (!test_bit(MD_CHANGE_PENDING, &mddev->flags)) {
+ list_add(&tmp, &conf->bio_end_io_list);
+ list_del_init(&conf->bio_end_io_list);
+ }
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+ while (!list_empty(&tmp)) {
+ r10_bio = list_first_entry(&conf->bio_end_io_list,
+ struct r10bio, retry_list);
+ list_del(&r10_bio->retry_list);
+ raid_end_bio_io(r10_bio);
+ }
+ }
+
blk_start_plug(&plug);
for (;;) {
@@ -3286,6 +3312,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
spin_lock_init(&conf->device_lock);
INIT_LIST_HEAD(&conf->retry_list);
+ INIT_LIST_HEAD(&conf->bio_end_io_list);
spin_lock_init(&conf->resync_lock);
init_waitqueue_head(&conf->wait_barrier);
diff --git a/drivers/md/raid10.h b/drivers/md/raid10.h
index 24d45b8..8085d90 100644
--- a/drivers/md/raid10.h
+++ b/drivers/md/raid10.h
@@ -42,6 +42,12 @@ struct r10conf {
sector_t chunk_mask;
struct list_head retry_list;
+ /* A separate list of r1bio which just need raid_end_bio_io called.
+ * This mustn't happen for writes which had any errors if the superblock
+ * needs to be written.
+ */
+ struct list_head bio_end_io_list;
+
/* queue pending writes and submit them on unplug */
struct bio_list pending_bio_list;
int pending_count;
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 42/92] sched/core: Fix TASK_DEAD race in finish_task_switch() |
| Message-ID | <rpeUH-424-43@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Peter Zijlstra <peterz@infradead.org>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 95913d97914f44db2b81271c2e2ebd4d2ac2df83 upstream.
So the problem this patch is trying to address is as follows:
CPU0 CPU1
context_switch(A, B)
ttwu(A)
LOCK A->pi_lock
A->on_cpu == 0
finish_task_switch(A)
prev_state = A->state <-.
WMB |
A->on_cpu = 0; |
UNLOCK rq0->lock |
| context_switch(C, A)
`-- A->state = TASK_DEAD
prev_state == TASK_DEAD
put_task_struct(A)
context_switch(A, C)
finish_task_switch(A)
A->state == TASK_DEAD
put_task_struct(A)
The argument being that the WMB will allow the load of A->state on CPU0
to cross over and observe CPU1's store of A->state, which will then
result in a double-drop and use-after-free.
Now the comment states (and this was true once upon a long time ago)
that we need to observe A->state while holding rq->lock because that
will order us against the wakeup; however the wakeup will not in fact
acquire (that) rq->lock; it takes A->pi_lock these days.
We can obviously fix this by upgrading the WMB to an MB, but that is
expensive, so we'd rather avoid that.
The alternative this patch takes is: smp_store_release(&A->on_cpu, 0),
which avoids the MB on some archs, but not important ones like ARM.
Reported-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Cc: manfred@colorfullife.com
Cc: will.deacon@arm.com
Fixes: e4a52bcb9a18 ("sched: Remove rq->lock from the first half of ttwu()")
Link: http://lkml.kernel.org/r/20150929124509.GG3816@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[lizf: Backported to 3.4: use smb_mb() instead of smp_store_release(), which
is not defined in 3.4.y]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
kernel/sched/core.c | 10 +++++-----
kernel/sched/sched.h | 4 +++-
2 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 15be435..609a226 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1949,11 +1949,11 @@ static void finish_task_switch(struct rq *rq, struct task_struct *prev)
* If a task dies, then it sets TASK_DEAD in tsk->state and calls
* schedule one last time. The schedule call will never return, and
* the scheduled task must drop that reference.
- * The test for TASK_DEAD must occur while the runqueue locks are
- * still held, otherwise prev could be scheduled on another cpu, die
- * there before we look at prev->state, and then the reference would
- * be dropped twice.
- * Manfred Spraul <manfred@colorfullife.com>
+ *
+ * We must observe prev->state before clearing prev->on_cpu (in
+ * finish_lock_switch), otherwise a concurrent wakeup can get prev
+ * running on another CPU and we could rave with its RUNNING -> DEAD
+ * transition, resulting in a double drop.
*/
prev_state = prev->state;
finish_arch_switch(prev);
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 4a5e739..44f4058 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -702,8 +702,10 @@ static inline void finish_lock_switch(struct rq *rq, struct task_struct *prev)
* After ->on_cpu is cleared, the task can be moved to a different CPU.
* We must ensure this doesn't happen until the switch is completely
* finished.
+ *
+ * Pairs with the control dependency and rmb in try_to_wake_up().
*/
- smp_wmb();
+ smp_mb();
prev->on_cpu = 0;
#endif
#ifdef CONFIG_DEBUG_SPINLOCK
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 16/92] DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd |
| Message-ID | <rpeUH-424-55@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Stephen Chandler Paul <cpaul@redhat.com>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 924f92bf12bfbef3662619e3ed24a1cea7c1cbcd upstream.
Most of the time this isn't an issue since hotplugging an adaptor will
trigger a crtc mode change which in turn, causes the driver to probe
every DisplayPort for a dpcd. However, in cases where hotplugging
doesn't cause a mode change (specifically when one unplugs a monitor
from a DisplayPort connector, then plugs that same monitor back in
seconds later on the same port without any other monitors connected), we
never probe for the dpcd before starting the initial link training. What
happens from there looks like this:
- GPU has only one monitor connected. It's connected via
DisplayPort, and does not go through an adaptor of any sort.
- User unplugs DisplayPort connector from GPU.
- Change in HPD is detected by the driver, we probe every
DisplayPort for a possible connection.
- Probe the port the user originally had the monitor connected
on for it's dpcd. This fails, and we clear the first (and only
the first) byte of the dpcd to indicate we no longer have a
dpcd for this port.
- User plugs the previously disconnected monitor back into the
same DisplayPort.
- radeon_connector_hotplug() is called before everyone else,
and tries to handle the link training. Since only the first
byte of the dpcd is zeroed, the driver is able to complete
link training but does so against the wrong dpcd, causing it
to initialize the link with the wrong settings.
- Display stays blank (usually), dpcd is probed after the
initial link training, and the driver prints no obvious
messages to the log.
In theory, since only one byte of the dpcd is chopped off (specifically,
the byte that contains the revision information for DisplayPort), it's
not entirely impossible that this bug may not show on certain monitors.
For instance, the only reason this bug was visible on my ASUS PB238
monitor was due to the fact that this monitor using the enhanced framing
symbol sequence, the flag for which is ignored if the radeon driver
thinks that the DisplayPort version is below 1.1.
Signed-off-by: Stephen Chandler Paul <cpaul@redhat.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/gpu/drm/radeon/radeon_connectors.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 9184bbe..9c5d96c 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -82,6 +82,11 @@ void radeon_connector_hotplug(struct drm_connector *connector)
if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) {
drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
} else if (radeon_dp_needs_link_train(radeon_connector)) {
+ /* Don't try to start link training before we
+ * have the dpcd */
+ if (!radeon_dp_getdpcd(radeon_connector))
+ return;
+
/* set it to OFF so that drm_helper_connector_dpms()
* won't return immediately since the current state
* is ON at this point.
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 24/92] hpfs: update ctime and mtime on directory modification |
| Message-ID | <rpeUH-424-47@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Mikulas Patocka <mikulas@twibright.com>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit f49a26e7718dd30b49e3541e3e25aecf5e7294e2 upstream.
Update ctime and mtime when a directory is modified. (though OS/2 doesn't
update them anyway)
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
fs/hpfs/namei.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
index 30dd7b1..bdb86a8 100644
--- a/fs/hpfs/namei.c
+++ b/fs/hpfs/namei.c
@@ -8,6 +8,17 @@
#include <linux/sched.h>
#include "hpfs_fn.h"
+static void hpfs_update_directory_times(struct inode *dir)
+{
+ time_t t = get_seconds();
+ if (t == dir->i_mtime.tv_sec &&
+ t == dir->i_ctime.tv_sec)
+ return;
+ dir->i_mtime.tv_sec = dir->i_ctime.tv_sec = t;
+ dir->i_mtime.tv_nsec = dir->i_ctime.tv_nsec = 0;
+ hpfs_write_inode_nolock(dir);
+}
+
static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
{
const unsigned char *name = dentry->d_name.name;
@@ -99,6 +110,7 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
result->i_mode = mode | S_IFDIR;
hpfs_write_inode_nolock(result);
}
+ hpfs_update_directory_times(dir);
d_instantiate(dentry, result);
hpfs_unlock(dir->i_sb);
return 0;
@@ -187,6 +199,7 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, s
result->i_mode = mode | S_IFREG;
hpfs_write_inode_nolock(result);
}
+ hpfs_update_directory_times(dir);
d_instantiate(dentry, result);
hpfs_unlock(dir->i_sb);
return 0;
@@ -262,6 +275,7 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, de
insert_inode_hash(result);
hpfs_write_inode_nolock(result);
+ hpfs_update_directory_times(dir);
d_instantiate(dentry, result);
brelse(bh);
hpfs_unlock(dir->i_sb);
@@ -340,6 +354,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
insert_inode_hash(result);
hpfs_write_inode_nolock(result);
+ hpfs_update_directory_times(dir);
d_instantiate(dentry, result);
hpfs_unlock(dir->i_sb);
return 0;
@@ -423,6 +438,8 @@ again:
out1:
hpfs_brelse4(&qbh);
out:
+ if (!err)
+ hpfs_update_directory_times(dir);
hpfs_unlock(dir->i_sb);
return err;
}
@@ -477,6 +494,8 @@ static int hpfs_rmdir(struct inode *dir, struct dentry *dentry)
out1:
hpfs_brelse4(&qbh);
out:
+ if (!err)
+ hpfs_update_directory_times(dir);
hpfs_unlock(dir->i_sb);
return err;
}
@@ -595,7 +614,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
goto end1;
}
- end:
+end:
hpfs_i(i)->i_parent_dir = new_dir->i_ino;
if (S_ISDIR(i->i_mode)) {
inc_nlink(new_dir);
@@ -610,6 +629,10 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
brelse(bh);
}
end1:
+ if (!err) {
+ hpfs_update_directory_times(old_dir);
+ hpfs_update_directory_times(new_dir);
+ }
hpfs_unlock(i->i_sb);
return err;
}
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 31/92] powerpc/MSI: Fix race condition in tearing down MSI interrupts |
| Message-ID | <rpeUH-424-51@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Paul Mackerras <paulus@ozlabs.org>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit e297c939b745e420ef0b9dc989cb87bda617b399 upstream.
This fixes a race which can result in the same virtual IRQ number
being assigned to two different MSI interrupts. The most visible
consequence of that is usually a warning and stack trace from the
sysfs code about an attempt to create a duplicate entry in sysfs.
The race happens when one CPU (say CPU 0) is disposing of an MSI
while another CPU (say CPU 1) is setting up an MSI. CPU 0 calls
(for example) pnv_teardown_msi_irqs(), which calls
msi_bitmap_free_hwirqs() to indicate that the MSI (i.e. its
hardware IRQ number) is no longer in use. Then, before CPU 0 gets
to calling irq_dispose_mapping() to free up the virtal IRQ number,
CPU 1 comes in and calls msi_bitmap_alloc_hwirqs() to allocate an
MSI, and gets the same hardware IRQ number that CPU 0 just freed.
CPU 1 then calls irq_create_mapping() to get a virtual IRQ number,
which sees that there is currently a mapping for that hardware IRQ
number and returns the corresponding virtual IRQ number (which is
the same virtual IRQ number that CPU 0 was using). CPU 0 then
calls irq_dispose_mapping() and frees that virtual IRQ number.
Now, if another CPU comes along and calls irq_create_mapping(), it
is likely to get the virtual IRQ number that was just freed,
resulting in the same virtual IRQ number apparently being used for
two different hardware interrupts.
To fix this race, we just move the call to msi_bitmap_free_hwirqs()
to after the call to irq_dispose_mapping(). Since virq_to_hw()
doesn't work for the virtual IRQ number after irq_dispose_mapping()
has been called, we need to call it before irq_dispose_mapping() and
remember the result for the msi_bitmap_free_hwirqs() call.
The pattern of calling msi_bitmap_free_hwirqs() before
irq_dispose_mapping() appears in 5 places under arch/powerpc, and
appears to have originated in commit 05af7bd2d75e ("[POWERPC] MPIC
U3/U4 MSI backend") from 2007.
Fixes: 05af7bd2d75e ("[POWERPC] MPIC U3/U4 MSI backend")
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
[bwh: Backported to 3.2:
- powernv uses a private functions instead of msi_bitmap_free_hwirqs()
- Adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
arch/powerpc/platforms/powernv/pci.c | 4 +++-
arch/powerpc/sysdev/fsl_msi.c | 5 +++--
arch/powerpc/sysdev/mpic_pasemi_msi.c | 5 +++--
arch/powerpc/sysdev/mpic_u3msi.c | 5 +++--
arch/powerpc/sysdev/ppc4xx_msi.c | 5 +++--
5 files changed, 15 insertions(+), 9 deletions(-)
diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
index be3cfc5..5b127c8 100644
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -137,6 +137,7 @@ static void pnv_teardown_msi_irqs(struct pci_dev *pdev)
struct pci_controller *hose = pci_bus_to_host(pdev->bus);
struct pnv_phb *phb = hose->private_data;
struct msi_desc *entry;
+ irq_hw_number_t hwirq;
if (WARN_ON(!phb))
return;
@@ -144,9 +145,10 @@ static void pnv_teardown_msi_irqs(struct pci_dev *pdev)
list_for_each_entry(entry, &pdev->msi_list, list) {
if (entry->irq == NO_IRQ)
continue;
+ hwirq = virq_to_hw(entry->irq);
irq_set_msi_desc(entry->irq, NULL);
- pnv_put_msi(phb, virq_to_hw(entry->irq));
irq_dispose_mapping(entry->irq);
+ pnv_put_msi(phb, hwirq);
}
}
#endif /* CONFIG_PCI_MSI */
diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c
index 6e097de..fd1a96b 100644
--- a/arch/powerpc/sysdev/fsl_msi.c
+++ b/arch/powerpc/sysdev/fsl_msi.c
@@ -108,15 +108,16 @@ static void fsl_teardown_msi_irqs(struct pci_dev *pdev)
{
struct msi_desc *entry;
struct fsl_msi *msi_data;
+ irq_hw_number_t hwirq;
list_for_each_entry(entry, &pdev->msi_list, list) {
if (entry->irq == NO_IRQ)
continue;
+ hwirq = virq_to_hw(entry->irq);
msi_data = irq_get_chip_data(entry->irq);
irq_set_msi_desc(entry->irq, NULL);
- msi_bitmap_free_hwirqs(&msi_data->bitmap,
- virq_to_hw(entry->irq), 1);
irq_dispose_mapping(entry->irq);
+ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
}
return;
diff --git a/arch/powerpc/sysdev/mpic_pasemi_msi.c b/arch/powerpc/sysdev/mpic_pasemi_msi.c
index 38e6238..e873616 100644
--- a/arch/powerpc/sysdev/mpic_pasemi_msi.c
+++ b/arch/powerpc/sysdev/mpic_pasemi_msi.c
@@ -74,6 +74,7 @@ static int pasemi_msi_check_device(struct pci_dev *pdev, int nvec, int type)
static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev)
{
struct msi_desc *entry;
+ irq_hw_number_t hwirq;
pr_debug("pasemi_msi_teardown_msi_irqs, pdev %p\n", pdev);
@@ -81,10 +82,10 @@ static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev)
if (entry->irq == NO_IRQ)
continue;
+ hwirq = virq_to_hw(entry->irq);
irq_set_msi_desc(entry->irq, NULL);
- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
- virq_to_hw(entry->irq), ALLOC_CHUNK);
irq_dispose_mapping(entry->irq);
+ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, ALLOC_CHUNK);
}
return;
diff --git a/arch/powerpc/sysdev/mpic_u3msi.c b/arch/powerpc/sysdev/mpic_u3msi.c
index 9a7aa0e..dfc3486 100644
--- a/arch/powerpc/sysdev/mpic_u3msi.c
+++ b/arch/powerpc/sysdev/mpic_u3msi.c
@@ -124,15 +124,16 @@ static int u3msi_msi_check_device(struct pci_dev *pdev, int nvec, int type)
static void u3msi_teardown_msi_irqs(struct pci_dev *pdev)
{
struct msi_desc *entry;
+ irq_hw_number_t hwirq;
list_for_each_entry(entry, &pdev->msi_list, list) {
if (entry->irq == NO_IRQ)
continue;
+ hwirq = virq_to_hw(entry->irq);
irq_set_msi_desc(entry->irq, NULL);
- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
- virq_to_hw(entry->irq), 1);
irq_dispose_mapping(entry->irq);
+ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, 1);
}
return;
diff --git a/arch/powerpc/sysdev/ppc4xx_msi.c b/arch/powerpc/sysdev/ppc4xx_msi.c
index 1c2d7af..4aae9c8 100644
--- a/arch/powerpc/sysdev/ppc4xx_msi.c
+++ b/arch/powerpc/sysdev/ppc4xx_msi.c
@@ -114,16 +114,17 @@ void ppc4xx_teardown_msi_irqs(struct pci_dev *dev)
{
struct msi_desc *entry;
struct ppc4xx_msi *msi_data = &ppc4xx_msi;
+ irq_hw_number_t hwirq;
dev_dbg(&dev->dev, "PCIE-MSI: tearing down msi irqs\n");
list_for_each_entry(entry, &dev->msi_list, list) {
if (entry->irq == NO_IRQ)
continue;
+ hwirq = virq_to_hw(entry->irq);
irq_set_msi_desc(entry->irq, NULL);
- msi_bitmap_free_hwirqs(&msi_data->bitmap,
- virq_to_hw(entry->irq), 1);
irq_dispose_mapping(entry->irq);
+ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
}
}
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 26/92] fs: create and use seq_show_option for escaping |
| Message-ID | <rpeUH-424-59@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Kees Cook <keescook@chromium.org>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit a068acf2ee77693e0bf39d6e07139ba704f461c3 upstream.
Many file systems that implement the show_options hook fail to correctly
escape their output which could lead to unescaped characters (e.g. new
lines) leaking into /proc/mounts and /proc/[pid]/mountinfo files. This
could lead to confusion, spoofed entries (resulting in things like
systemd issuing false d-bus "mount" notifications), and who knows what
else. This looks like it would only be the root user stepping on
themselves, but it's possible weird things could happen in containers or
in other situations with delegated mount privileges.
Here's an example using overlay with setuid fusermount trusting the
contents of /proc/mounts (via the /etc/mtab symlink). Imagine the use
of "sudo" is something more sneaky:
$ BASE="ovl"
$ MNT="$BASE/mnt"
$ LOW="$BASE/lower"
$ UP="$BASE/upper"
$ WORK="$BASE/work/ 0 0
none /proc fuse.pwn user_id=1000"
$ mkdir -p "$LOW" "$UP" "$WORK"
$ sudo mount -t overlay -o "lowerdir=$LOW,upperdir=$UP,workdir=$WORK" none /mnt
$ cat /proc/mounts
none /root/ovl/mnt overlay rw,relatime,lowerdir=ovl/lower,upperdir=ovl/upper,workdir=ovl/work/ 0 0
none /proc fuse.pwn user_id=1000 0 0
$ fusermount -u /proc
$ cat /proc/mounts
cat: /proc/mounts: No such file or directory
This fixes the problem by adding new seq_show_option and
seq_show_option_n helpers, and updating the vulnerable show_option
handlers to use them as needed. Some, like SELinux, need to be open
coded due to unusual existing escape mechanisms.
[akpm@linux-foundation.org: add lost chunk, per Kees]
[keescook@chromium.org: seq_show_option should be using const parameters]
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Acked-by: Jan Kara <jack@suse.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Cc: J. R. Okajima <hooanon05g@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[lizf: Backported to 3.4:
- adjust context
- one more place in ceph needs to be changed
- drop changes to overlayfs
- drop showing vers in cifs]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
fs/ceph/super.c | 8 +++++---
fs/cifs/cifsfs.c | 4 ++--
fs/ext4/super.c | 4 ++--
fs/gfs2/super.c | 6 +++---
fs/hfs/super.c | 4 ++--
fs/hfsplus/options.c | 4 ++--
fs/hostfs/hostfs_kern.c | 2 +-
fs/ocfs2/super.c | 4 ++--
fs/reiserfs/super.c | 8 +++++---
fs/xfs/xfs_super.c | 4 ++--
include/linux/seq_file.h | 35 +++++++++++++++++++++++++++++++++++
kernel/cgroup.c | 7 ++++---
security/selinux/hooks.c | 2 +-
13 files changed, 66 insertions(+), 26 deletions(-)
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index f4fa5cf..e5eacd9 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -383,8 +383,10 @@ static int ceph_show_options(struct seq_file *m, struct dentry *root)
if (opt->flags & CEPH_OPT_NOCRC)
seq_puts(m, ",nocrc");
- if (opt->name)
- seq_printf(m, ",name=%s", opt->name);
+ if (opt->name) {
+ seq_puts(m, ",name=");
+ seq_escape(m, opt->name, ", \t\n\\");
+ }
if (opt->key)
seq_puts(m, ",secret=<hidden>");
@@ -429,7 +431,7 @@ static int ceph_show_options(struct seq_file *m, struct dentry *root)
if (fsopt->max_readdir_bytes != CEPH_MAX_READDIR_BYTES_DEFAULT)
seq_printf(m, ",readdir_max_bytes=%d", fsopt->max_readdir_bytes);
if (strcmp(fsopt->snapdir_name, CEPH_SNAPDIRNAME_DEFAULT))
- seq_printf(m, ",snapdirname=%s", fsopt->snapdir_name);
+ seq_show_option(m, "snapdirname", fsopt->snapdir_name);
return 0;
}
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index c0f65e8..5b730ba 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -373,10 +373,10 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER)
seq_printf(s, ",multiuser");
else if (tcon->ses->user_name)
- seq_printf(s, ",username=%s", tcon->ses->user_name);
+ seq_show_option(s, "username", tcon->ses->user_name);
if (tcon->ses->domainName)
- seq_printf(s, ",domain=%s", tcon->ses->domainName);
+ seq_show_option(s, "domain", tcon->ses->domainName);
if (srcaddr->sa_family != AF_UNSPEC) {
struct sockaddr_in *saddr4;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 2e26a54..3de888c3 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1682,10 +1682,10 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
}
if (sbi->s_qf_names[USRQUOTA])
- seq_printf(seq, ",usrjquota=%s", sbi->s_qf_names[USRQUOTA]);
+ seq_show_option(seq, "usrjquota", sbi->s_qf_names[USRQUOTA]);
if (sbi->s_qf_names[GRPQUOTA])
- seq_printf(seq, ",grpjquota=%s", sbi->s_qf_names[GRPQUOTA]);
+ seq_show_option(seq, "grpjquota", sbi->s_qf_names[GRPQUOTA]);
if (test_opt(sb, USRQUOTA))
seq_puts(seq, ",usrquota");
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 6172fa7..4db9a9a 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1298,11 +1298,11 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root)
if (is_ancestor(root, sdp->sd_master_dir))
seq_printf(s, ",meta");
if (args->ar_lockproto[0])
- seq_printf(s, ",lockproto=%s", args->ar_lockproto);
+ seq_show_option(s, "lockproto", args->ar_lockproto);
if (args->ar_locktable[0])
- seq_printf(s, ",locktable=%s", args->ar_locktable);
+ seq_show_option(s, "locktable", args->ar_locktable);
if (args->ar_hostdata[0])
- seq_printf(s, ",hostdata=%s", args->ar_hostdata);
+ seq_show_option(s, "hostdata", args->ar_hostdata);
if (args->ar_spectator)
seq_printf(s, ",spectator");
if (args->ar_localflocks)
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index 7b4c537..be0e218 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -138,9 +138,9 @@ static int hfs_show_options(struct seq_file *seq, struct dentry *root)
struct hfs_sb_info *sbi = HFS_SB(root->d_sb);
if (sbi->s_creator != cpu_to_be32(0x3f3f3f3f))
- seq_printf(seq, ",creator=%.4s", (char *)&sbi->s_creator);
+ seq_show_option_n(seq, "creator", (char *)&sbi->s_creator, 4);
if (sbi->s_type != cpu_to_be32(0x3f3f3f3f))
- seq_printf(seq, ",type=%.4s", (char *)&sbi->s_type);
+ seq_show_option_n(seq, "type", (char *)&sbi->s_type, 4);
seq_printf(seq, ",uid=%u,gid=%u", sbi->s_uid, sbi->s_gid);
if (sbi->s_file_umask != 0133)
seq_printf(seq, ",file_umask=%o", sbi->s_file_umask);
diff --git a/fs/hfsplus/options.c b/fs/hfsplus/options.c
index 06fa561..38e41d0 100644
--- a/fs/hfsplus/options.c
+++ b/fs/hfsplus/options.c
@@ -211,9 +211,9 @@ int hfsplus_show_options(struct seq_file *seq, struct dentry *root)
struct hfsplus_sb_info *sbi = HFSPLUS_SB(root->d_sb);
if (sbi->creator != HFSPLUS_DEF_CR_TYPE)
- seq_printf(seq, ",creator=%.4s", (char *)&sbi->creator);
+ seq_show_option_n(seq, "creator", (char *)&sbi->creator, 4);
if (sbi->type != HFSPLUS_DEF_CR_TYPE)
- seq_printf(seq, ",type=%.4s", (char *)&sbi->type);
+ seq_show_option_n(seq, "type", (char *)&sbi->type, 4);
seq_printf(seq, ",umask=%o,uid=%u,gid=%u", sbi->umask,
sbi->uid, sbi->gid);
if (sbi->part >= 0)
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index 07c516b..fe63b15 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -264,7 +264,7 @@ static int hostfs_show_options(struct seq_file *seq, struct dentry *root)
size_t offset = strlen(root_ino) + 1;
if (strlen(root_path) > offset)
- seq_printf(seq, ",%s", root_path + offset);
+ seq_show_option(seq, root_path + offset, NULL);
return 0;
}
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 68f4541..91a0020 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1578,8 +1578,8 @@ static int ocfs2_show_options(struct seq_file *s, struct dentry *root)
seq_printf(s, ",localflocks,");
if (osb->osb_cluster_stack[0])
- seq_printf(s, ",cluster_stack=%.*s", OCFS2_STACK_LABEL_LEN,
- osb->osb_cluster_stack);
+ seq_show_option_n(s, "cluster_stack", osb->osb_cluster_stack,
+ OCFS2_STACK_LABEL_LEN);
if (opts & OCFS2_MOUNT_USRQUOTA)
seq_printf(s, ",usrquota");
if (opts & OCFS2_MOUNT_GRPQUOTA)
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 8169be9..e12357b 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -645,18 +645,20 @@ static int reiserfs_show_options(struct seq_file *seq, struct dentry *root)
seq_puts(seq, ",acl");
if (REISERFS_SB(s)->s_jdev)
- seq_printf(seq, ",jdev=%s", REISERFS_SB(s)->s_jdev);
+ seq_show_option(seq, "jdev", REISERFS_SB(s)->s_jdev);
if (journal->j_max_commit_age != journal->j_default_max_commit_age)
seq_printf(seq, ",commit=%d", journal->j_max_commit_age);
#ifdef CONFIG_QUOTA
if (REISERFS_SB(s)->s_qf_names[USRQUOTA])
- seq_printf(seq, ",usrjquota=%s", REISERFS_SB(s)->s_qf_names[USRQUOTA]);
+ seq_show_option(seq, "usrjquota",
+ REISERFS_SB(s)->s_qf_names[USRQUOTA]);
else if (opts & (1 << REISERFS_USRQUOTA))
seq_puts(seq, ",usrquota");
if (REISERFS_SB(s)->s_qf_names[GRPQUOTA])
- seq_printf(seq, ",grpjquota=%s", REISERFS_SB(s)->s_qf_names[GRPQUOTA]);
+ seq_show_option(seq, "grpjquota",
+ REISERFS_SB(s)->s_qf_names[GRPQUOTA]);
else if (opts & (1 << REISERFS_GRPQUOTA))
seq_puts(seq, ",grpquota");
if (REISERFS_SB(s)->s_jquota_fmt) {
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index dab9a5f..d6c787d 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -523,9 +523,9 @@ xfs_showargs(
seq_printf(m, "," MNTOPT_LOGBSIZE "=%dk", mp->m_logbsize >> 10);
if (mp->m_logname)
- seq_printf(m, "," MNTOPT_LOGDEV "=%s", mp->m_logname);
+ seq_show_option(m, MNTOPT_LOGDEV, mp->m_logname);
if (mp->m_rtname)
- seq_printf(m, "," MNTOPT_RTDEV "=%s", mp->m_rtname);
+ seq_show_option(m, MNTOPT_RTDEV, mp->m_rtname);
if (mp->m_dalign > 0)
seq_printf(m, "," MNTOPT_SUNIT "=%d",
diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
index fc61854..149b92f 100644
--- a/include/linux/seq_file.h
+++ b/include/linux/seq_file.h
@@ -127,6 +127,41 @@ int seq_put_decimal_ull(struct seq_file *m, char delimiter,
int seq_put_decimal_ll(struct seq_file *m, char delimiter,
long long num);
+/**
+ * seq_show_options - display mount options with appropriate escapes.
+ * @m: the seq_file handle
+ * @name: the mount option name
+ * @value: the mount option name's value, can be NULL
+ */
+static inline void seq_show_option(struct seq_file *m, const char *name,
+ const char *value)
+{
+ seq_putc(m, ',');
+ seq_escape(m, name, ",= \t\n\\");
+ if (value) {
+ seq_putc(m, '=');
+ seq_escape(m, value, ", \t\n\\");
+ }
+}
+
+/**
+ * seq_show_option_n - display mount options with appropriate escapes
+ * where @value must be a specific length.
+ * @m: the seq_file handle
+ * @name: the mount option name
+ * @value: the mount option name's value, cannot be NULL
+ * @length: the length of @value to display
+ *
+ * This is a macro since this uses "length" to define the size of the
+ * stack buffer.
+ */
+#define seq_show_option_n(m, name, value, length) { \
+ char val_buf[length + 1]; \
+ strncpy(val_buf, value, length); \
+ val_buf[length] = '\0'; \
+ seq_show_option(m, name, val_buf); \
+}
+
#define SEQ_START_TOKEN ((void *)1)
/*
* Helpers for iteration over list_head-s in seq_files
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 34eda95..7ff5702 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1071,15 +1071,16 @@ static int cgroup_show_options(struct seq_file *seq, struct dentry *dentry)
mutex_lock(&cgroup_root_mutex);
for_each_subsys(root, ss)
- seq_printf(seq, ",%s", ss->name);
+ seq_show_option(seq, ss->name, NULL);
if (test_bit(ROOT_NOPREFIX, &root->flags))
seq_puts(seq, ",noprefix");
if (strlen(root->release_agent_path))
- seq_printf(seq, ",release_agent=%s", root->release_agent_path);
+ seq_show_option(seq, "release_agent",
+ root->release_agent_path);
if (clone_children(&root->top_cgroup))
seq_puts(seq, ",clone_children");
if (strlen(root->name))
- seq_printf(seq, ",name=%s", root->name);
+ seq_show_option(seq, "name", root->name);
mutex_unlock(&cgroup_root_mutex);
return 0;
}
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index cbae6d3..312d2fb 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1012,7 +1012,7 @@ static void selinux_write_opts(struct seq_file *m,
seq_puts(m, prefix);
if (has_comma)
seq_putc(m, '\"');
- seq_puts(m, opts->mnt_opts[i]);
+ seq_escape(m, opts->mnt_opts[i], "\"\n\\");
if (has_comma)
seq_putc(m, '\"');
}
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 22/92] Add radeon suspend/resume quirk for HP Compaq dc5750. |
| Message-ID | <rpeUH-424-61@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Jeffery Miller <jmiller@neverware.com> 3.4.112-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit 09bfda10e6efd7b65bcc29237bee1765ed779657 upstream. With the radeon driver loaded the HP Compaq dc5750 Small Form Factor machine fails to resume from suspend. Adding a quirk similar to other devices avoids the problem and the system resumes properly. Signed-off-by: Jeffery Miller <jmiller@neverware.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Zefan Li <lizefan@huawei.com> --- drivers/gpu/drm/radeon/radeon_combios.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c index b72eb50..69c2dd0 100644 --- a/drivers/gpu/drm/radeon/radeon_combios.c +++ b/drivers/gpu/drm/radeon/radeon_combios.c @@ -3399,6 +3399,14 @@ void radeon_combios_asic_init(struct drm_device *dev) rdev->pdev->subsystem_device == 0x30ae) return; + /* quirk for rs4xx HP Compaq dc5750 Small Form Factor to make it resume + * - it hangs on resume inside the dynclk 1 table. + */ + if (rdev->family == CHIP_RS480 && + rdev->pdev->subsystem_vendor == 0x103c && + rdev->pdev->subsystem_device == 0x280a) + return; + /* DYN CLK 1 */ table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE); if (table) -- 1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 12:50 +0200 |
| Subject | [PATCH 3.4 46/92] md/raid10: don't clear bitmap bit when bad-block-list write fails. |
| Message-ID | <rpeUH-424-65@gated-at.bofh.it> |
| In reply to | #1381489 |
From: NeilBrown <neilb@suse.com>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit c340702ca26a628832fade4f133d8160a55c29cc upstream.
When a write fails and a bad-block-list is present, we can
update the bad-block-list instead of writing the data. If
this succeeds then it is OK clear the relevant bitmap-bit as
no further 'sync' of the block is needed.
However if writing the bad-block-list fails then we need to
treat the write as failed and particularly must not clear
the bitmap bit. Otherwise the device can be re-added (after
any hardware connection issues are resolved) and because the
relevant bit in the bitmap is clear, that block will not be
resynced. This leads to data corruption.
We already delay the final bio_endio() on the write until
the bad-block-list is written so that when the write
returns: either that data is safe, the bad-block record is
safe, or the fact that the device is faulty is safe.
However we *don't* delay the clearing of the bitmap, so the
bitmap bit can be recorded as cleared before we know if the
bad-block-list was written safely.
So: delay that until the write really is safe.
i.e. move the call to close_write() until just before
calling bio_endio(), and recheck the 'is array degraded'
status before making that call.
This bug goes back to v3.1 when bad-block-lists were
introduced, though it only affects arrays created with
mdadm-3.3 or later as only those have bad-block lists.
Backports will require at least
Commit: 95af587e95aa ("md/raid10: ensure device failure recorded before write request returns.")
as well. I'll send that to 'stable' separately.
Note that of the two tests of R10BIO_WriteError that this
patch adds, the first is certain to fail and the second is
certain to succeed. However doing it this way makes the
patch more obviously correct. I will tidy the code up in a
future merge window.
Reported-by: Nate Dailey <nate.dailey@stratus.com>
Fixes: bd870a16c594 ("md/raid10: Handle write errors by updating badblock log.")
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/md/raid10.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index b0ad772..1b77980 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2568,16 +2568,17 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
rdev_dec_pending(rdev, conf->mddev);
}
}
- if (test_bit(R10BIO_WriteError,
- &r10_bio->state))
- close_write(r10_bio);
if (fail) {
spin_lock_irq(&conf->device_lock);
list_add(&r10_bio->retry_list, &conf->bio_end_io_list);
spin_unlock_irq(&conf->device_lock);
md_wakeup_thread(conf->mddev->thread);
- } else
+ } else {
+ if (test_bit(R10BIO_WriteError,
+ &r10_bio->state))
+ close_write(r10_bio);
raid_end_bio_io(r10_bio);
+ }
}
}
@@ -2604,6 +2605,12 @@ static void raid10d(struct mddev *mddev)
r10_bio = list_first_entry(&conf->bio_end_io_list,
struct r10bio, retry_list);
list_del(&r10_bio->retry_list);
+ if (mddev->degraded)
+ set_bit(R10BIO_Degraded, &r10_bio->state);
+
+ if (test_bit(R10BIO_WriteError,
+ &r10_bio->state))
+ close_write(r10_bio);
raid_end_bio_io(r10_bio);
}
}
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 13:00 +0200 |
| Subject | [PATCH 3.4 73/92] tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c |
| Message-ID | <rpf4l-46M-1@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Kosuke Tatsukawa <tatsu@ab.jp.nec.com>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit e81107d4c6bd098878af9796b24edc8d4a9524fd upstream.
My colleague ran into a program stall on a x86_64 server, where
n_tty_read() was waiting for data even if there was data in the buffer
in the pty. kernel stack for the stuck process looks like below.
#0 [ffff88303d107b58] __schedule at ffffffff815c4b20
#1 [ffff88303d107bd0] schedule at ffffffff815c513e
#2 [ffff88303d107bf0] schedule_timeout at ffffffff815c7818
#3 [ffff88303d107ca0] wait_woken at ffffffff81096bd2
#4 [ffff88303d107ce0] n_tty_read at ffffffff8136fa23
#5 [ffff88303d107dd0] tty_read at ffffffff81368013
#6 [ffff88303d107e20] __vfs_read at ffffffff811a3704
#7 [ffff88303d107ec0] vfs_read at ffffffff811a3a57
#8 [ffff88303d107f00] sys_read at ffffffff811a4306
#9 [ffff88303d107f50] entry_SYSCALL_64_fastpath at ffffffff815c86d7
There seems to be two problems causing this issue.
First, in drivers/tty/n_tty.c, __receive_buf() stores the data and
updates ldata->commit_head using smp_store_release() and then checks
the wait queue using waitqueue_active(). However, since there is no
memory barrier, __receive_buf() could return without calling
wake_up_interactive_poll(), and at the same time, n_tty_read() could
start to wait in wait_woken() as in the following chart.
__receive_buf() n_tty_read()
------------------------------------------------------------------------
if (waitqueue_active(&tty->read_wait))
/* Memory operations issued after the
RELEASE may be completed before the
RELEASE operation has completed */
add_wait_queue(&tty->read_wait, &wait);
...
if (!input_available_p(tty, 0)) {
smp_store_release(&ldata->commit_head,
ldata->read_head);
...
timeout = wait_woken(&wait,
TASK_INTERRUPTIBLE, timeout);
------------------------------------------------------------------------
The second problem is that n_tty_read() also lacks a memory barrier
call and could also cause __receive_buf() to return without calling
wake_up_interactive_poll(), and n_tty_read() to wait in wait_woken()
as in the chart below.
__receive_buf() n_tty_read()
------------------------------------------------------------------------
spin_lock_irqsave(&q->lock, flags);
/* from add_wait_queue() */
...
if (!input_available_p(tty, 0)) {
/* Memory operations issued after the
RELEASE may be completed before the
RELEASE operation has completed */
smp_store_release(&ldata->commit_head,
ldata->read_head);
if (waitqueue_active(&tty->read_wait))
__add_wait_queue(q, wait);
spin_unlock_irqrestore(&q->lock,flags);
/* from add_wait_queue() */
...
timeout = wait_woken(&wait,
TASK_INTERRUPTIBLE, timeout);
------------------------------------------------------------------------
There are also other places in drivers/tty/n_tty.c which have similar
calls to waitqueue_active(), so instead of adding many memory barrier
calls, this patch simply removes the call to waitqueue_active(),
leaving just wake_up*() behind.
This fixes both problems because, even though the memory access before
or after the spinlocks in both wake_up*() and add_wait_queue() can
sneak into the critical section, it cannot go past it and the critical
section assures that they will be serialized (please see "INTER-CPU
ACQUIRING BARRIER EFFECTS" in Documentation/memory-barriers.txt for a
better explanation). Moreover, the resulting code is much simpler.
Latency measurement using a ping-pong test over a pty doesn't show any
visible performance drop.
Signed-off-by: Kosuke Tatsukawa <tatsu@ab.jp.nec.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[lizf: Backported to 3.4:
- adjust context
- s/wake_up_interruptible_poll/wake_up_interruptible/
- drop changes to __receive_buf() and n_tty_set_termios()]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/tty/n_tty.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index fa0376b..fc8822f 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1297,8 +1297,7 @@ handle_newline:
tty->canon_data++;
spin_unlock_irqrestore(&tty->read_lock, flags);
kill_fasync(&tty->fasync, SIGIO, POLL_IN);
- if (waitqueue_active(&tty->read_wait))
- wake_up_interruptible(&tty->read_wait);
+ wake_up_interruptible(&tty->read_wait);
return;
}
}
@@ -1421,8 +1420,7 @@ static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
if ((!tty->icanon && (tty->read_cnt >= tty->minimum_to_wake)) ||
L_EXTPROC(tty)) {
kill_fasync(&tty->fasync, SIGIO, POLL_IN);
- if (waitqueue_active(&tty->read_wait))
- wake_up_interruptible(&tty->read_wait);
+ wake_up_interruptible(&tty->read_wait);
}
/*
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 13:00 +0200 |
| Subject | [PATCH 3.4 67/92] x86/process: Add proper bound checks in 64bit get_wchan() |
| Message-ID | <rpf4m-46M-7@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Thomas Gleixner <tglx@linutronix.de>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit eddd3826a1a0190e5235703d1e666affa4d13b96 upstream.
Dmitry Vyukov reported the following using trinity and the memory
error detector AddressSanitizer
(https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel).
[ 124.575597] ERROR: AddressSanitizer: heap-buffer-overflow on
address ffff88002e280000
[ 124.576801] ffff88002e280000 is located 131938492886538 bytes to
the left of 28857600-byte region [ffffffff81282e0a, ffffffff82e0830a)
[ 124.578633] Accessed by thread T10915:
[ 124.579295] inlined in describe_heap_address
./arch/x86/mm/asan/report.c:164
[ 124.579295] #0 ffffffff810dd277 in asan_report_error
./arch/x86/mm/asan/report.c:278
[ 124.580137] #1 ffffffff810dc6a0 in asan_check_region
./arch/x86/mm/asan/asan.c:37
[ 124.581050] #2 ffffffff810dd423 in __tsan_read8 ??:0
[ 124.581893] #3 ffffffff8107c093 in get_wchan
./arch/x86/kernel/process_64.c:444
The address checks in the 64bit implementation of get_wchan() are
wrong in several ways:
- The lower bound of the stack is not the start of the stack
page. It's the start of the stack page plus sizeof (struct
thread_info)
- The upper bound must be:
top_of_stack - TOP_OF_KERNEL_STACK_PADDING - 2 * sizeof(unsigned long).
The 2 * sizeof(unsigned long) is required because the stack pointer
points at the frame pointer. The layout on the stack is: ... IP FP
... IP FP. So we need to make sure that both IP and FP are in the
bounds.
Fix the bound checks and get rid of the mix of numeric constants, u64
and unsigned long. Making all unsigned long allows us to use the same
function for 32bit as well.
Use READ_ONCE() when accessing the stack. This does not prevent a
concurrent wakeup of the task and the stack changing, but at least it
avoids TOCTOU.
Also check task state at the end of the loop. Again that does not
prevent concurrent changes, but it avoids walking for nothing.
Add proper comments while at it.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Based-on-patch-from: Wolfram Gloger <wmglo@dent.med.uni-muenchen.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@alien8.de>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Kostya Serebryany <kcc@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: kasan-dev <kasan-dev@googlegroups.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Wolfram Gloger <wmglo@dent.med.uni-muenchen.de>
Link: http://lkml.kernel.org/r/20150930083302.694788319@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[lizf: Backported to 3.4:
- s/READ_ONCE/ACCESS_ONCE
- remove TOP_OF_KERNEL_STACK_PADDING]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
arch/x86/kernel/process_64.c | 52 +++++++++++++++++++++++++++++++++++---------
1 file changed, 42 insertions(+), 10 deletions(-)
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index d5d7313..f6698ad 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -470,27 +470,59 @@ void set_personality_ia32(bool x32)
}
EXPORT_SYMBOL_GPL(set_personality_ia32);
+/*
+ * Called from fs/proc with a reference on @p to find the function
+ * which called into schedule(). This needs to be done carefully
+ * because the task might wake up and we might look at a stack
+ * changing under us.
+ */
unsigned long get_wchan(struct task_struct *p)
{
- unsigned long stack;
- u64 fp, ip;
+ unsigned long start, bottom, top, sp, fp, ip;
int count = 0;
if (!p || p == current || p->state == TASK_RUNNING)
return 0;
- stack = (unsigned long)task_stack_page(p);
- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
+
+ start = (unsigned long)task_stack_page(p);
+ if (!start)
+ return 0;
+
+ /*
+ * Layout of the stack page:
+ *
+ * ----------- topmax = start + THREAD_SIZE - sizeof(unsigned long)
+ * PADDING
+ * ----------- top = topmax - TOP_OF_KERNEL_STACK_PADDING
+ * stack
+ * ----------- bottom = start + sizeof(thread_info)
+ * thread_info
+ * ----------- start
+ *
+ * The tasks stack pointer points at the location where the
+ * framepointer is stored. The data on the stack is:
+ * ... IP FP ... IP FP
+ *
+ * We need to read FP and IP, so we need to adjust the upper
+ * bound by another unsigned long.
+ */
+ top = start + THREAD_SIZE;
+ top -= 2 * sizeof(unsigned long);
+ bottom = start + sizeof(struct thread_info);
+
+ sp = ACCESS_ONCE(p->thread.sp);
+ if (sp < bottom || sp > top)
return 0;
- fp = *(u64 *)(p->thread.sp);
+
+ fp = ACCESS_ONCE(*(unsigned long *)sp);
do {
- if (fp < (unsigned long)stack ||
- fp >= (unsigned long)stack+THREAD_SIZE)
+ if (fp < bottom || fp > top)
return 0;
- ip = *(u64 *)(fp+8);
+ ip = ACCESS_ONCE(*(unsigned long *)(fp + sizeof(unsigned long)));
if (!in_sched_functions(ip))
return ip;
- fp = *(u64 *)fp;
- } while (count++ < 16);
+ fp = ACCESS_ONCE(*(unsigned long *)fp);
+ } while (count++ < 16 && p->state != TASK_RUNNING);
return 0;
}
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 13:00 +0200 |
| Subject | [PATCH 3.4 51/92] spi: Fix documentation of spi_alloc_master() |
| Message-ID | <rpf4m-46M-9@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Guenter Roeck <linux@roeck-us.net>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit a394d635193b641f2c86ead5ada5b115d57c51f8 upstream.
Actually, spi_master_put() after spi_alloc_master() must _not_ be followed
by kfree(). The memory is already freed with the call to spi_master_put()
through spi_master_class, which registers a release function. Calling both
spi_master_put() and kfree() results in often nasty (and delayed) crashes
elsewhere in the kernel, often in the networking stack.
This reverts commit eb4af0f5349235df2e4a5057a72fc8962d00308a.
Link to patch and concerns: https://lkml.org/lkml/2012/9/3/269
or
http://lkml.iu.edu/hypermail/linux/kernel/1209.0/00790.html
Alexey Klimov: This revert becomes valid after
94c69f765f1b4a658d96905ec59928e3e3e07e6a when spi-imx.c
has been fixed and there is no need to call kfree() so comment
for spi_alloc_master() should be fixed.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/spi/spi.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 3d8f662..a3f31e9 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -831,8 +831,7 @@ static struct class spi_master_class = {
*
* The caller is responsible for assigning the bus number and initializing
* the master's methods before calling spi_register_master(); and (after errors
- * adding the device) calling spi_master_put() and kfree() to prevent a memory
- * leak.
+ * adding the device) calling spi_master_put() to prevent a memory leak.
*/
struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
{
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 13:00 +0200 |
| Subject | [PATCH 3.4 64/92] x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when sanitizing map |
| Message-ID | <rpf4m-46M-21@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Malcolm Crossley <malcolm.crossley@citrix.com> 3.4.112-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit 64c98e7f49100b637cd20a6c63508caed6bbba7a upstream. Sanitizing the e820 map may produce extra E820 entries which would result in the topmost E820 entries being removed. The removed entries would typically include the top E820 usable RAM region and thus result in the domain having signicantly less RAM available to it. Fix by allowing sanitize_e820_map to use the full size of the allocated E820 array. Signed-off-by: Malcolm Crossley <malcolm.crossley@citrix.com> Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> Signed-off-by: David Vrabel <david.vrabel@citrix.com> [lizf: Backported to 3.4: s/map/xen_e820_map] Signed-off-by: Zefan Li <lizefan@huawei.com> --- arch/x86/xen/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c index f8b0260..f60abe6 100644 --- a/arch/x86/xen/setup.c +++ b/arch/x86/xen/setup.c @@ -274,7 +274,7 @@ char * __init xen_memory_setup(void) xen_ignore_unusable(map, memmap.nr_entries); /* Make sure the Xen-supplied memory map is well-ordered. */ - sanitize_e820_map(map, memmap.nr_entries, &memmap.nr_entries); + sanitize_e820_map(map, ARRAY_SIZE(map), &memmap.nr_entries); max_pages = xen_get_max_pages(); if (max_pages > max_pfn) -- 1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 13:00 +0200 |
| Subject | [PATCH 3.4 69/92] mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault |
| Message-ID | <rpf4m-46M-25@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Mel Gorman <mgorman@techsingularity.net> 3.4.112-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit 2f84a8990ebbe235c59716896e017c6b2ca1200f upstream. SunDong reported the following on https://bugzilla.kernel.org/show_bug.cgi?id=103841 I think I find a linux bug, I have the test cases is constructed. I can stable recurring problems in fedora22(4.0.4) kernel version, arch for x86_64. I construct transparent huge page, when the parent and child process with MAP_SHARE, MAP_PRIVATE way to access the same huge page area, it has the opportunity to lead to huge page copy on write failure, and then it will munmap the child corresponding mmap area, but then the child mmap area with VM_MAYSHARE attributes, child process munmap this area can trigger VM_BUG_ON in set_vma_resv_flags functions (vma - > vm_flags & VM_MAYSHARE). There were a number of problems with the report (e.g. it's hugetlbfs that triggers this, not transparent huge pages) but it was fundamentally correct in that a VM_BUG_ON in set_vma_resv_flags() can be triggered that looks like this vma ffff8804651fd0d0 start 00007fc474e00000 end 00007fc475e00000 next ffff8804651fd018 prev ffff8804651fd188 mm ffff88046b1b1800 prot 8000000000000027 anon_vma (null) vm_ops ffffffff8182a7a0 pgoff 0 file ffff88106bdb9800 private_data (null) flags: 0x84400fb(read|write|shared|mayread|maywrite|mayexec|mayshare|dontexpand|hugetlb) ------------ kernel BUG at mm/hugetlb.c:462! SMP Modules linked in: xt_pkttype xt_LOG xt_limit [..] CPU: 38 PID: 26839 Comm: map Not tainted 4.0.4-default #1 Hardware name: Dell Inc. PowerEdge R810/0TT6JF, BIOS 2.7.4 04/26/2012 set_vma_resv_flags+0x2d/0x30 The VM_BUG_ON is correct because private and shared mappings have different reservation accounting but the warning clearly shows that the VMA is shared. When a private COW fails to allocate a new page then only the process that created the VMA gets the page -- all the children unmap the page. If the children access that data in the future then they get killed. The problem is that the same file is mapped shared and private. During the COW, the allocation fails, the VMAs are traversed to unmap the other private pages but a shared VMA is found and the bug is triggered. This patch identifies such VMAs and skips them. Signed-off-by: Mel Gorman <mgorman@techsingularity.net> Reported-by: SunDong <sund_sky@126.com> Reviewed-by: Michal Hocko <mhocko@suse.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Hugh Dickins <hughd@google.com> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Cc: David Rientjes <rientjes@google.com> Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Zefan Li <lizefan@huawei.com> --- mm/hugetlb.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index bc36e28..e622aab 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -2504,6 +2504,14 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma, continue; /* + * Shared VMAs have their own reserves and do not affect + * MAP_PRIVATE accounting but it is possible that a shared + * VMA is using the same page so check and skip such VMAs. + */ + if (iter_vma->vm_flags & VM_MAYSHARE) + continue; + + /* * Unmap the page from other VMAs without their own reserves. * They get marked to be SIGKILLed if they fault in these * areas. This is because a future no-page fault on this VMA -- 1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 13:00 +0200 |
| Subject | [PATCH 3.4 85/92] mm: make sendfile(2) killable |
| Message-ID | <rpf4n-46M-27@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Jan Kara <jack@suse.com>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 296291cdd1629c308114504b850dc343eabc2782 upstream.
Currently a simple program below issues a sendfile(2) system call which
takes about 62 days to complete in my test KVM instance.
int fd;
off_t off = 0;
fd = open("file", O_RDWR | O_TRUNC | O_SYNC | O_CREAT, 0644);
ftruncate(fd, 2);
lseek(fd, 0, SEEK_END);
sendfile(fd, fd, &off, 0xfffffff);
Now you should not ask kernel to do a stupid stuff like copying 256MB in
2-byte chunks and call fsync(2) after each chunk but if you do, sysadmin
should have a way to stop you.
We actually do have a check for fatal_signal_pending() in
generic_perform_write() which triggers in this path however because we
always succeed in writing something before the check is done, we return
value > 0 from generic_perform_write() and thus the information about
signal gets lost.
Fix the problem by doing the signal check before writing anything. That
way generic_perform_write() returns -EINTR, the error gets propagated up
and the sendfile loop terminates early.
Signed-off-by: Jan Kara <jack@suse.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
mm/filemap.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/mm/filemap.c b/mm/filemap.c
index 79c4b2b..448f9ca 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2402,6 +2402,11 @@ again:
break;
}
+ if (fatal_signal_pending(current)) {
+ status = -EINTR;
+ break;
+ }
+
status = a_ops->write_begin(file, mapping, pos, bytes, flags,
&page, &fsdata);
if (unlikely(status))
@@ -2442,10 +2447,6 @@ again:
written += copied;
balance_dirty_pages_ratelimited(mapping);
- if (fatal_signal_pending(current)) {
- status = -EINTR;
- break;
- }
} while (iov_iter_count(i));
return written ? written : status;
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-04-18 13:00 +0200 |
| Subject | [PATCH 3.4 56/92] usb: Use the USB_SS_MULT() macro to get the burst multiplier. |
| Message-ID | <rpf4n-46M-33@gated-at.bofh.it> |
| In reply to | #1381489 |
From: Mathias Nyman <mathias.nyman@linux.intel.com>
3.4.112-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit ff30cbc8da425754e8ab96904db1d295bd034f27 upstream.
Bits 1:0 of the bmAttributes are used for the burst multiplier.
The rest of the bits used to be reserved (zero), but USB3.1 takes bit 7
into use.
Use the existing USB_SS_MULT() macro instead to make sure the mult value
and hence max packet calculations are correct for USB3.1 devices.
Note that burst multiplier in bmAttributes is zero based and that
the USB_SS_MULT() macro adds one.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/usb/core/config.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index cc1004a..6baa836 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -114,7 +114,7 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
cfgno, inum, asnum, ep->desc.bEndpointAddress);
ep->ss_ep_comp.bmAttributes = 16;
} else if (usb_endpoint_xfer_isoc(&ep->desc) &&
- desc->bmAttributes > 2) {
+ USB_SS_MULT(desc->bmAttributes) > 3) {
dev_warn(ddev, "Isoc endpoint has Mult of %d in "
"config %d interface %d altsetting %d ep %d: "
"setting to 3\n", desc->bmAttributes + 1,
@@ -123,7 +123,8 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
}
if (usb_endpoint_xfer_isoc(&ep->desc))
- max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) *
+ max_tx = (desc->bMaxBurst + 1) *
+ (USB_SS_MULT(desc->bmAttributes)) *
usb_endpoint_maxp(&ep->desc);
else if (usb_endpoint_xfer_int(&ep->desc))
max_tx = usb_endpoint_maxp(&ep->desc) *
--
1.9.1
[toc] | [prev] | [next] | [standalone]
Page 1 of 5 [1] 2 3 4 5 Next page →
Back to top | Article view | linux.kernel
csiph-web