Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1381489 > unrolled thread

[PATCH 3.4 00/92] 3.4.112-rc1 review

Back to article view | Back to linux.kernel

Contents

  [PATCH 3.4 00/92] 3.4.112-rc1 review lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 41/92] iwlwifi: dvm: fix D3 firmware PN programming lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 10/92] devres: fix devres_get() lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 19/92] SUNRPC: xs_reset_transport must mark the connection as disconnected lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 29/92] scsi_dh: fix randconfig build error lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 45/92] md/raid10: ensure device failure recorded before write request returns. lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 42/92] sched/core: Fix TASK_DEAD race in finish_task_switch() lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 16/92] DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 24/92] hpfs: update ctime and mtime on directory modification lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 31/92] powerpc/MSI: Fix race condition in tearing down MSI interrupts lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 26/92] fs: create and use seq_show_option for escaping lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 22/92] Add radeon suspend/resume quirk for HP Compaq dc5750. lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 46/92] md/raid10: don't clear bitmap bit when bad-block-list write fails. lizf@kernel.org - 2016-04-18 12:50 +0200
    [PATCH 3.4 73/92] tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 67/92] x86/process: Add proper bound checks in 64bit get_wchan() lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 51/92] spi: Fix documentation of spi_alloc_master() lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 64/92] x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when sanitizing map lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 69/92] mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 85/92] mm: make sendfile(2) killable lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 56/92] usb: Use the USB_SS_MULT() macro to get the burst multiplier. lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 71/92] USB: Add reset-resume quirk for two Plantronics usb headphones. lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 76/92] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing) lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 72/92] usb: Add device quirk for Logitech PTZ cameras lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 68/92] genirq: Fix race in register_irq_proc() lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 92/92] x86/iopl/64: Properly context-switch IOPL on Xen PV lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 91/92] splice: sendfile() at once fails for big files lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 82/92] ASoC: wm8904: Correct number of EQ registers lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 90/92] pipe: Fix buffer offset after partially failed read lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 89/92] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 80/92] xhci: Add spurious wakeup quirk for LynxPoint-LP controllers lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 88/92] raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 83/92] iommu/amd: Don't clear DTE flags when modifying it lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 78/92] iommu/vt-d: fix range computation when making room for large pages lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 58/92] usb: xhci: Clear XHCI_STATE_DYING on start lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 52/92] btrfs: skip waiting on ordered range for special files lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 77/92] crypto: ahash - ensure statesize is non-zero lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 87/92] mvsas: Fix NULL pointer dereference in mvs_slot_task_free lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 86/92] dm btree: fix leak of bufio-backed block in btree_split_beneath error path lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 74/92] drivers/tty: require read access for controlling terminal lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 60/92] cifs: use server timestamp for ntlmv2 authentication lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 75/92] ALSA: synth: Fix conflicting OSS device registration on AWE32 lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 81/92] crypto: api - Only abort operations on fatal signal lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 84/92] drm/nouveau/gem: return only valid domain when there's only one lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 61/92] ocfs2/dlm: fix deadlock when dispatch assert master lizf@kernel.org - 2016-04-18 13:00 +0200
      Re: [PATCH 3.4 61/92] ocfs2/dlm: fix deadlock when dispatch assert  master Joseph Qi <joseph.qi@huawei.com> - 2016-04-18 13:40 +0200
        Re: [PATCH 3.4 61/92] ocfs2/dlm: fix deadlock when dispatch assert  master Zefan Li <lizefan@huawei.com> - 2016-04-19 02:20 +0200
    [PATCH 3.4 79/92] xhci: handle no ping response error properly lizf@kernel.org - 2016-04-18 13:00 +0200
    [PATCH 3.4 57/92] xhci: give command abortion one more chance before killing xhci lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 50/92] spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 48/92] md/raid1: don't clear bitmap bit when bad-block-list write fails. lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 43/92] IB/cm: Fix rb-tree duplicate free and use-after-free lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 49/92] drm: crtc: integer overflow in drm_property_create_blob() lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 55/92] KVM: x86: trap AMD MSRs for the TSeg base and mask lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 63/92] m68k: Define asmlinkage_protect lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 54/92] regmap: debugfs: Don't bother actually printing when calculating max length lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 66/92] UBI: return ENOSPC if no enough space available lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 59/92] xhci: change xhci 1.0 only restrictions to support xhci 1.1 lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 53/92] regmap: debugfs: Ensure we don't underflow when printing access masks lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 65/92] UBI: Validate data_size lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 62/92] ath9k: declare required extra tx headroom lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 70/92] clocksource: Fix abs() usage w/ 64bit values lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 47/92] md/raid1: ensure device failure recorded before write request returns. lizf@kernel.org - 2016-04-18 13:10 +0200
    [PATCH 3.4 09/92] auxdisplay: ks0108: fix refcount lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 25/92] crypto: ghash-clmulni: specify context size for ghash async algorithm lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 20/92] IB/mlx4: Use correct SL on AH query under RoCE lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 21/92] IB/uverbs: Fix race between ib_uverbs_open and remove_one lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 30/92] ARM: 8429/1: disable GCC SRA optimization lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 33/92] ARM: 7880/1: Clear the IT state independent of the Thumb-2 mode lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 13/92] usb: host: ehci-sys: delete useless bus_to_hcd conversion lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 40/92] md/raid0: apply base queue limits *before* disk_stack_limits lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 15/92] eCryptfs: Invalidate dcache entries when lower i_nlink is zero lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 38/92] ASoC: fix broken pxa SoC support lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 06/92] powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 11/92] windfarm: decrement client count when unregistering lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 36/92] module: Fix locking in symbol_put_addr() lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 17/92] of/address: Don't loop forever in of_find_matching_node_by_address(). lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 14/92] USB: ftdi_sio: Added custom PID for CustomWare products lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 23/92] IB/uverbs: reject invalid or unknown opcodes lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 27/92] hfs,hfsplus: cache pages correctly between bnode_create and bnode_free lizf@kernel.org - 2016-04-18 13:20 +0200
    [PATCH 3.4 05/92] PCI: Add VPD function 0 quirk for Intel Ethernet devices lizf@kernel.org - 2016-04-18 13:30 +0200
    Re: [PATCH 3.4 00/92] 3.4.112-rc1 review Guenter Roeck <linux@roeck-us.net> - 2016-04-18 18:40 +0200
      Re: [PATCH 3.4 00/92] 3.4.112-rc1 review Zefan Li <lizefan@huawei.com> - 2016-04-19 02:30 +0200

Page 3 of 5 — ← Prev page 1 2 [3] 4 5  Next page →

#1381540 — [PATCH 3.4 75/92] ALSA: synth: Fix conflicting OSS device registration on AWE32

From: Takashi Iwai <tiwai@suse.de>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 225db5762dc1a35b26850477ffa06e5cd0097243 upstream.

When OSS emulation is loaded on ISA SB AWE32 chip, we get now kernel
warnings like:
  WARNING: CPU: 0 PID: 2791 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x51/0x80()
  sysfs: cannot create duplicate filename '/devices/isa/sbawe.0/sound/card0/seq-oss-0-0'

It's because both emux synth and opl3 drivers try to register their
OSS device object with the same static index number 0.  This hasn't
been a big problem until the recent rewrite of device management code
(that exposes sysfs at the same time), but it's been an obvious bug.

This patch works around it just by using a different index number of
emux synth object.  There can be a more elegant way to fix, but it's
enough for now, as this code won't be touched so often, in anyway.

Reported-and-tested-by: Michael Shell <list1@michaelshell.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 sound/synth/emux/emux_oss.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
index daf61ab..646b667 100644
--- a/sound/synth/emux/emux_oss.c
+++ b/sound/synth/emux/emux_oss.c
@@ -69,7 +69,8 @@ snd_emux_init_seq_oss(struct snd_emux *emu)
 	struct snd_seq_oss_reg *arg;
 	struct snd_seq_device *dev;
 
-	if (snd_seq_device_new(emu->card, 0, SNDRV_SEQ_DEV_ID_OSS,
+	/* using device#1 here for avoiding conflicts with OPL3 */
+	if (snd_seq_device_new(emu->card, 1, SNDRV_SEQ_DEV_ID_OSS,
 			       sizeof(struct snd_seq_oss_reg), &dev) < 0)
 		return;
 
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381541 — [PATCH 3.4 81/92] crypto: api - Only abort operations on fatal signal

From: Herbert Xu <herbert@gondor.apana.org.au>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 3fc89adb9fa4beff31374a4bf50b3d099d88ae83 upstream.

Currently a number of Crypto API operations may fail when a signal
occurs.  This causes nasty problems as the caller of those operations
are often not in a good position to restart the operation.

In fact there is currently no need for those operations to be
interrupted by user signals at all.  All we need is for them to
be killable.

This patch replaces the relevant calls of signal_pending with
fatal_signal_pending, and wait_for_completion_interruptible with
wait_for_completion_killable, respectively.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 crypto/ablkcipher.c  | 2 +-
 crypto/algapi.c      | 2 +-
 crypto/api.c         | 6 +++---
 crypto/crypto_user.c | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
index 45fe410..4a9c499 100644
--- a/crypto/ablkcipher.c
+++ b/crypto/ablkcipher.c
@@ -700,7 +700,7 @@ struct crypto_ablkcipher *crypto_alloc_ablkcipher(const char *alg_name,
 err:
 		if (err != -EAGAIN)
 			break;
-		if (signal_pending(current)) {
+		if (fatal_signal_pending(current)) {
 			err = -EINTR;
 			break;
 		}
diff --git a/crypto/algapi.c b/crypto/algapi.c
index b4c046c..7bae610 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -342,7 +342,7 @@ static void crypto_wait_for_test(struct crypto_larval *larval)
 		crypto_alg_tested(larval->alg.cra_driver_name, 0);
 	}
 
-	err = wait_for_completion_interruptible(&larval->completion);
+	err = wait_for_completion_killable(&larval->completion);
 	WARN_ON(err);
 
 out:
diff --git a/crypto/api.c b/crypto/api.c
index 4f98dd5..c9c2f47 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -178,7 +178,7 @@ static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg)
 	struct crypto_larval *larval = (void *)alg;
 	long timeout;
 
-	timeout = wait_for_completion_interruptible_timeout(
+	timeout = wait_for_completion_killable_timeout(
 		&larval->completion, 60 * HZ);
 
 	alg = larval->adult;
@@ -441,7 +441,7 @@ struct crypto_tfm *crypto_alloc_base(const char *alg_name, u32 type, u32 mask)
 err:
 		if (err != -EAGAIN)
 			break;
-		if (signal_pending(current)) {
+		if (fatal_signal_pending(current)) {
 			err = -EINTR;
 			break;
 		}
@@ -558,7 +558,7 @@ void *crypto_alloc_tfm(const char *alg_name,
 err:
 		if (err != -EAGAIN)
 			break;
-		if (signal_pending(current)) {
+		if (fatal_signal_pending(current)) {
 			err = -EINTR;
 			break;
 		}
diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
index 910497b..0c19d03 100644
--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -350,7 +350,7 @@ static struct crypto_alg *crypto_user_aead_alg(const char *name, u32 type,
 		err = PTR_ERR(alg);
 		if (err != -EAGAIN)
 			break;
-		if (signal_pending(current)) {
+		if (fatal_signal_pending(current)) {
 			err = -EINTR;
 			break;
 		}
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381542 — [PATCH 3.4 84/92] drm/nouveau/gem: return only valid domain when there's only one

From: Ilia Mirkin <imirkin@alum.mit.edu>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 2a6c521bb41ce862e43db46f52e7681d33e8d771 upstream.

On nv50+, we restrict the valid domains to just the one where the buffer
was originally created. However after the buffer is evicted to system
memory, we might move it back to a different domain that was not
originally valid. When sharing the buffer and retrieving its GEM_INFO
data, we still want the domain that will be valid for this buffer in a
pushbuf, not the one where it currently happens to be.

This resolves fdo#92504 and several others. These are due to suspend
evicting all buffers, making it more likely that they temporarily end up
in the wrong place.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92504
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/gpu/drm/nouveau/nouveau_gem.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 2f46bbf..b242534 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -172,11 +172,12 @@ nouveau_gem_info(struct drm_file *file_priv, struct drm_gem_object *gem,
 	struct nouveau_bo *nvbo = nouveau_gem_object(gem);
 	struct nouveau_vma *vma;
 
-	if (nvbo->bo.mem.mem_type == TTM_PL_TT)
+	if (is_power_of_2(nvbo->valid_domains))
+		rep->domain = nvbo->valid_domains;
+	else if (nvbo->bo.mem.mem_type == TTM_PL_TT)
 		rep->domain = NOUVEAU_GEM_DOMAIN_GART;
 	else
 		rep->domain = NOUVEAU_GEM_DOMAIN_VRAM;
-
 	rep->offset = nvbo->bo.offset;
 	if (fpriv->vm) {
 		vma = nouveau_bo_vma_find(nvbo, fpriv->vm);
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381543 — [PATCH 3.4 61/92] ocfs2/dlm: fix deadlock when dispatch assert master

From: Joseph Qi <joseph.qi@huawei.com>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 012572d4fc2e4ddd5c8ec8614d51414ec6cae02a upstream.

The order of the following three spinlocks should be:
dlm_domain_lock < dlm_ctxt->spinlock < dlm_lock_resource->spinlock

But dlm_dispatch_assert_master() is called while holding
dlm_ctxt->spinlock and dlm_lock_resource->spinlock, and then it calls
dlm_grab() which will take dlm_domain_lock.

Once another thread (for example, dlm_query_join_handler) has already
taken dlm_domain_lock, and tries to take dlm_ctxt->spinlock deadlock
happens.

Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Cc: "Junxiao Bi" <junxiao.bi@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 fs/ocfs2/dlm/dlmmaster.c   | 4 +++-
 fs/ocfs2/dlm/dlmrecovery.c | 6 +++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 7ba6ac1..751efa8 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -1411,6 +1411,7 @@ int dlm_master_request_handler(struct o2net_msg *msg, u32 len, void *data,
 	int found, ret;
 	int set_maybe;
 	int dispatch_assert = 0;
+	int dispatched = 0;
 
 	if (!dlm_grab(dlm))
 		return DLM_MASTER_RESP_NO;
@@ -1617,6 +1618,8 @@ send_response:
 			mlog(ML_ERROR, "failed to dispatch assert master work\n");
 			response = DLM_MASTER_RESP_ERROR;
 			dlm_lockres_put(res);
+		} else {
+			dispatched = 1;
 		}
 	} else {
 		if (res)
@@ -2041,7 +2044,6 @@ int dlm_dispatch_assert_master(struct dlm_ctxt *dlm,
 
 
 	/* queue up work for dlm_assert_master_worker */
-	dlm_grab(dlm);  /* get an extra ref for the work item */
 	dlm_init_work_item(dlm, item, dlm_assert_master_worker, NULL);
 	item->u.am.lockres = res; /* already have a ref */
 	/* can optionally ignore node numbers higher than this node */
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index d15b071..0e5013e 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1689,6 +1689,7 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
 	unsigned int hash;
 	int master = DLM_LOCK_RES_OWNER_UNKNOWN;
 	u32 flags = DLM_ASSERT_MASTER_REQUERY;
+	int dispatched = 0;
 
 	if (!dlm_grab(dlm)) {
 		/* since the domain has gone away on this
@@ -1710,6 +1711,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
 				mlog_errno(-ENOMEM);
 				/* retry!? */
 				BUG();
+			} else {
+				dispatched = 1;
 			}
 		} else /* put.. incase we are not the master */
 			dlm_lockres_put(res);
@@ -1717,7 +1720,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
 	}
 	spin_unlock(&dlm->spinlock);
 
-	dlm_put(dlm);
+	if (!dispatched)
+		dlm_put(dlm);
 	return master;
 }
 
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381618 — Re: [PATCH 3.4 61/92] ocfs2/dlm: fix deadlock when dispatch assert master

Hi Zefan,
In dlm_master_request_handler, it has missed the following change :
-	dlm_put(dlm);
+	if (!dispatched)
+		dlm_put(dlm);

Thanks,
Joseph

On 2016/4/18 18:46, lizf@kernel.org wrote:
> From: Joseph Qi <joseph.qi@huawei.com>
> 
> 3.4.112-rc1 review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> 
> commit 012572d4fc2e4ddd5c8ec8614d51414ec6cae02a upstream.
> 
> The order of the following three spinlocks should be:
> dlm_domain_lock < dlm_ctxt->spinlock < dlm_lock_resource->spinlock
> 
> But dlm_dispatch_assert_master() is called while holding
> dlm_ctxt->spinlock and dlm_lock_resource->spinlock, and then it calls
> dlm_grab() which will take dlm_domain_lock.
> 
> Once another thread (for example, dlm_query_join_handler) has already
> taken dlm_domain_lock, and tries to take dlm_ctxt->spinlock deadlock
> happens.
> 
> Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
> Cc: Joel Becker <jlbec@evilplan.org>
> Cc: Mark Fasheh <mfasheh@suse.com>
> Cc: "Junxiao Bi" <junxiao.bi@oracle.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> [lizf: Backported to 3.4: adjust context]
> Signed-off-by: Zefan Li <lizefan@huawei.com>
> ---
>  fs/ocfs2/dlm/dlmmaster.c   | 4 +++-
>  fs/ocfs2/dlm/dlmrecovery.c | 6 +++++-
>  2 files changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
> index 7ba6ac1..751efa8 100644
> --- a/fs/ocfs2/dlm/dlmmaster.c
> +++ b/fs/ocfs2/dlm/dlmmaster.c
> @@ -1411,6 +1411,7 @@ int dlm_master_request_handler(struct o2net_msg *msg, u32 len, void *data,
>  	int found, ret;
>  	int set_maybe;
>  	int dispatch_assert = 0;
> +	int dispatched = 0;
>  
>  	if (!dlm_grab(dlm))
>  		return DLM_MASTER_RESP_NO;
> @@ -1617,6 +1618,8 @@ send_response:
>  			mlog(ML_ERROR, "failed to dispatch assert master work\n");
>  			response = DLM_MASTER_RESP_ERROR;
>  			dlm_lockres_put(res);
> +		} else {
> +			dispatched = 1;
>  		}
>  	} else {
>  		if (res)
> @@ -2041,7 +2044,6 @@ int dlm_dispatch_assert_master(struct dlm_ctxt *dlm,
>  
>  
>  	/* queue up work for dlm_assert_master_worker */
> -	dlm_grab(dlm);  /* get an extra ref for the work item */
>  	dlm_init_work_item(dlm, item, dlm_assert_master_worker, NULL);
>  	item->u.am.lockres = res; /* already have a ref */
>  	/* can optionally ignore node numbers higher than this node */
> diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
> index d15b071..0e5013e 100644
> --- a/fs/ocfs2/dlm/dlmrecovery.c
> +++ b/fs/ocfs2/dlm/dlmrecovery.c
> @@ -1689,6 +1689,7 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
>  	unsigned int hash;
>  	int master = DLM_LOCK_RES_OWNER_UNKNOWN;
>  	u32 flags = DLM_ASSERT_MASTER_REQUERY;
> +	int dispatched = 0;
>  
>  	if (!dlm_grab(dlm)) {
>  		/* since the domain has gone away on this
> @@ -1710,6 +1711,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
>  				mlog_errno(-ENOMEM);
>  				/* retry!? */
>  				BUG();
> +			} else {
> +				dispatched = 1;
>  			}
>  		} else /* put.. incase we are not the master */
>  			dlm_lockres_put(res);
> @@ -1717,7 +1720,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
>  	}
>  	spin_unlock(&dlm->spinlock);
>  
> -	dlm_put(dlm);
> +	if (!dispatched)
> +		dlm_put(dlm);
>  	return master;
>  }
>  
> 

[toc] | [prev] | [next] | [standalone]

#1382111 — Re: [PATCH 3.4 61/92] ocfs2/dlm: fix deadlock when dispatch assert master

On 2016/4/18 19:29, Joseph Qi wrote:
> Hi Zefan,
> In dlm_master_request_handler, it has missed the following change :
> -	dlm_put(dlm);
> +	if (!dispatched)
> +		dlm_put(dlm);

Oops..I guess I forgot to refresh the patch after adjusting the context.

Thanks for the review!

> 
> Thanks,
> Joseph
> 
> On 2016/4/18 18:46, lizf@kernel.org wrote:
>> From: Joseph Qi <joseph.qi@huawei.com>
>>
>> 3.4.112-rc1 review patch.  If anyone has any objections, please let me know.
>>
>> ------------------
>>
>>
>> commit 012572d4fc2e4ddd5c8ec8614d51414ec6cae02a upstream.
>>
>> The order of the following three spinlocks should be:
>> dlm_domain_lock < dlm_ctxt->spinlock < dlm_lock_resource->spinlock
>>
>> But dlm_dispatch_assert_master() is called while holding
>> dlm_ctxt->spinlock and dlm_lock_resource->spinlock, and then it calls
>> dlm_grab() which will take dlm_domain_lock.
>>
>> Once another thread (for example, dlm_query_join_handler) has already
>> taken dlm_domain_lock, and tries to take dlm_ctxt->spinlock deadlock
>> happens.
>>
>> Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
>> Cc: Joel Becker <jlbec@evilplan.org>
>> Cc: Mark Fasheh <mfasheh@suse.com>
>> Cc: "Junxiao Bi" <junxiao.bi@oracle.com>
>> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
>> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
>> [lizf: Backported to 3.4: adjust context]
>> Signed-off-by: Zefan Li <lizefan@huawei.com>
>> ---
>>  fs/ocfs2/dlm/dlmmaster.c   | 4 +++-
>>  fs/ocfs2/dlm/dlmrecovery.c | 6 +++++-
>>  2 files changed, 8 insertions(+), 2 deletions(-)
>>
>> diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
>> index 7ba6ac1..751efa8 100644
>> --- a/fs/ocfs2/dlm/dlmmaster.c
>> +++ b/fs/ocfs2/dlm/dlmmaster.c
>> @@ -1411,6 +1411,7 @@ int dlm_master_request_handler(struct o2net_msg *msg, u32 len, void *data,
>>  	int found, ret;
>>  	int set_maybe;
>>  	int dispatch_assert = 0;
>> +	int dispatched = 0;
>>  
>>  	if (!dlm_grab(dlm))
>>  		return DLM_MASTER_RESP_NO;
>> @@ -1617,6 +1618,8 @@ send_response:
>>  			mlog(ML_ERROR, "failed to dispatch assert master work\n");
>>  			response = DLM_MASTER_RESP_ERROR;
>>  			dlm_lockres_put(res);
>> +		} else {
>> +			dispatched = 1;
>>  		}
>>  	} else {
>>  		if (res)
>> @@ -2041,7 +2044,6 @@ int dlm_dispatch_assert_master(struct dlm_ctxt *dlm,
>>  
>>  
>>  	/* queue up work for dlm_assert_master_worker */
>> -	dlm_grab(dlm);  /* get an extra ref for the work item */
>>  	dlm_init_work_item(dlm, item, dlm_assert_master_worker, NULL);
>>  	item->u.am.lockres = res; /* already have a ref */
>>  	/* can optionally ignore node numbers higher than this node */
>> diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
>> index d15b071..0e5013e 100644
>> --- a/fs/ocfs2/dlm/dlmrecovery.c
>> +++ b/fs/ocfs2/dlm/dlmrecovery.c
>> @@ -1689,6 +1689,7 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
>>  	unsigned int hash;
>>  	int master = DLM_LOCK_RES_OWNER_UNKNOWN;
>>  	u32 flags = DLM_ASSERT_MASTER_REQUERY;
>> +	int dispatched = 0;
>>  
>>  	if (!dlm_grab(dlm)) {
>>  		/* since the domain has gone away on this
>> @@ -1710,6 +1711,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
>>  				mlog_errno(-ENOMEM);
>>  				/* retry!? */
>>  				BUG();
>> +			} else {
>> +				dispatched = 1;
>>  			}
>>  		} else /* put.. incase we are not the master */
>>  			dlm_lockres_put(res);
>> @@ -1717,7 +1720,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
>>  	}
>>  	spin_unlock(&dlm->spinlock);
>>  
>> -	dlm_put(dlm);
>> +	if (!dispatched)
>> +		dlm_put(dlm);
>>  	return master;
>>  }
>>  
>>
> 
> 
> .
> 

[toc] | [prev] | [next] | [standalone]

#1381544 — [PATCH 3.4 79/92] xhci: handle no ping response error properly

From: Mathias Nyman <mathias.nyman@linux.intel.com>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 3b4739b8951d650becbcd855d7d6f18ac98a9a85 upstream.

If a host fails to wake up a isochronous SuperSpeed device from U1/U2
in time for a isoch transfer it will generate a "No ping response error"
Host will then move to the next transfer descriptor.

Handle this case in the same way as missed service errors, tag the
current TD as skipped and handle it on the next transfer event.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/usb/host/xhci-ring.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 02c6dc8..f389328 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2340,6 +2340,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 	u32 trb_comp_code;
 	int ret = 0;
 	int td_num = 0;
+	bool handling_skipped_tds = false;
 
 	slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));
 	xdev = xhci->devs[slot_id];
@@ -2473,6 +2474,10 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 		ep->skip = true;
 		xhci_dbg(xhci, "Miss service interval error, set skip flag\n");
 		goto cleanup;
+	case COMP_PING_ERR:
+		ep->skip = true;
+		xhci_dbg(xhci, "No Ping response error, Skip one Isoc TD\n");
+		goto cleanup;
 	default:
 		if (xhci_is_vendor_info_code(xhci, trb_comp_code)) {
 			status = 0;
@@ -2604,13 +2609,18 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 						 ep, &status);
 
 cleanup:
+
+
+		handling_skipped_tds = ep->skip &&
+			trb_comp_code != COMP_MISSED_INT &&
+			trb_comp_code != COMP_PING_ERR;
+
 		/*
-		 * Do not update event ring dequeue pointer if ep->skip is set.
-		 * Will roll back to continue process missed tds.
+		 * Do not update event ring dequeue pointer if we're in a loop
+		 * processing missed tds.
 		 */
-		if (trb_comp_code == COMP_MISSED_INT || !ep->skip) {
+		if (!handling_skipped_tds)
 			inc_deq(xhci, xhci->event_ring);
-		}
 
 		if (ret) {
 			urb = td->urb;
@@ -2645,7 +2655,7 @@ cleanup:
 	 * Process them as short transfer until reach the td pointed by
 	 * the event.
 	 */
-	} while (ep->skip && trb_comp_code != COMP_MISSED_INT);
+	} while (handling_skipped_tds);
 
 	return 0;
 }
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381546 — [PATCH 3.4 57/92] xhci: give command abortion one more chance before killing xhci

From: Mathias Nyman <mathias.nyman@linux.intel.com>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit a6809ffd1687b3a8c192960e69add559b9d32649 upstream.

We want to give the command abortion an additional try to stop
the command ring before we completely hose xhci.

Tested-by: Vincent Pelletier <plr.vincent@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[lizf: Backported to 3.4: call handshake() instead of xhci_handshake()]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/usb/host/xhci-ring.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 5623785..3cfe7e3 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -331,6 +331,15 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
 	ret = handshake(xhci, &xhci->op_regs->cmd_ring,
 			CMD_RING_RUNNING, 0, 5 * 1000 * 1000);
 	if (ret < 0) {
+		/* we are about to kill xhci, give it one more chance */
+		xhci_write_64(xhci, temp_64 | CMD_RING_ABORT,
+			      &xhci->op_regs->cmd_ring);
+		udelay(1000);
+		ret = handshake(xhci, &xhci->op_regs->cmd_ring,
+				CMD_RING_RUNNING, 0, 3 * 1000 * 1000);
+		if (ret == 0)
+			return 0;
+
 		xhci_err(xhci, "Stopped the command ring failed, "
 				"maybe the host is dead\n");
 		xhci->xhc_state |= XHCI_STATE_DYING;
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381547 — [PATCH 3.4 50/92] spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled

From: "Tan, Jui Nee" <jui.nee.tan@intel.com>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 02bc933ebb59208f42c2e6305b2c17fd306f695d upstream.

On Intel Baytrail, there is case when interrupt handler get called, no SPI
message is captured. The RX FIFO is indeed empty when RX timeout pending
interrupt (SSSR_TINT) happens.

Use the BIOS version where both HSUART and SPI are on the same IRQ. Both
drivers are using IRQF_SHARED when calling the request_irq function. When
running two separate and independent SPI and HSUART application that
generate data traffic on both components, user will see messages like
below on the console:

  pxa2xx-spi pxa2xx-spi.0: bad message state in interrupt handler

This commit will fix this by first checking Receiver Time-out Interrupt,
if it is disabled, ignore the request and return without servicing.

Signed-off-by: Tan, Jui Nee <jui.nee.tan@intel.com>
Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/spi/spi-pxa2xx.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index dc25bee..2ecc2d6 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -799,6 +799,10 @@ static irqreturn_t ssp_int(int irq, void *dev_id)
 	if (!(sccr1_reg & SSCR1_TIE))
 		mask &= ~SSSR_TFS;
 
+	/* Ignore RX timeout interrupt if it is disabled */
+	if (!(sccr1_reg & SSCR1_TINTE))
+		mask &= ~SSSR_TINT;
+
 	if (!(status & mask))
 		return IRQ_NONE;
 
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381548 — [PATCH 3.4 48/92] md/raid1: don't clear bitmap bit when bad-block-list write fails.

From: NeilBrown <neilb@suse.com>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit bd8688a199b864944bf62eebed0ca13b46249453 upstream.

When a write fails and a bad-block-list is present, we can
update the bad-block-list instead of writing the data.  If
this succeeds then it is OK clear the relevant bitmap-bit as
no further 'sync' of the block is needed.

However if writing the bad-block-list fails then we need to
treat the write as failed and particularly must not clear
the bitmap bit.  Otherwise the device can be re-added (after
any hardware connection issues are resolved) and because the
relevant bit in the bitmap is clear, that block will not be
resynced.  This leads to data corruption.

We already delay the final bio_endio() on the write until
the bad-block-list is written so that when the write
returns: either that data is safe, the bad-block record is
safe, or the fact that the device is faulty is safe.
However we *don't* delay the clearing of the bitmap, so the
bitmap bit can be recorded as cleared before we know if the
bad-block-list was written safely.

So: delay that until the write really is safe.
i.e. move the call to close_write() until just before
calling bio_endio(), and recheck the 'is array degraded'
status before making that call.

This bug goes back to v3.1 when bad-block-lists were
introduced, though it only affects arrays created with
mdadm-3.3 or later as only those have bad-block lists.

Backports will require at least
Commit: 55ce74d4bfe1 ("md/raid1: ensure device failure recorded before write request returns.")
as well.  I'll send that to 'stable' separately.

Note that of the two tests of R1BIO_WriteError that this
patch adds, the first is certain to fail and the second is
certain to succeed.  However doing it this way makes the
patch more obviously correct.  I will tidy the code up in a
future merge window.

Reported-and-tested-by: Nate Dailey <nate.dailey@stratus.com>
Cc: Jes Sorensen <Jes.Sorensen@redhat.com>
Fixes: cd5ff9a16f08 ("md/raid1:  Handle write errors by updating badblock log.")
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/md/raid1.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 64d2351c..32d1f1a 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -2085,15 +2085,16 @@ static void handle_write_finished(struct r1conf *conf, struct r1bio *r1_bio)
 			rdev_dec_pending(conf->mirrors[m].rdev,
 					 conf->mddev);
 		}
-	if (test_bit(R1BIO_WriteError, &r1_bio->state))
-		close_write(r1_bio);
 	if (fail) {
 		spin_lock_irq(&conf->device_lock);
 		list_add(&r1_bio->retry_list, &conf->bio_end_io_list);
 		spin_unlock_irq(&conf->device_lock);
 		md_wakeup_thread(conf->mddev->thread);
-	} else
+	} else {
+		if (test_bit(R1BIO_WriteError, &r1_bio->state))
+			close_write(r1_bio);
 		raid_end_bio_io(r1_bio);
+	}
 }
 
 static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio)
@@ -2209,6 +2210,10 @@ static void raid1d(struct mddev *mddev)
 			r1_bio = list_first_entry(&conf->bio_end_io_list,
 						  struct r1bio, retry_list);
 			list_del(&r1_bio->retry_list);
+			if (mddev->degraded)
+				set_bit(R1BIO_Degraded, &r1_bio->state);
+			if (test_bit(R1BIO_WriteError, &r1_bio->state))
+				close_write(r1_bio);
 			raid_end_bio_io(r1_bio);
 		}
 	}
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381550 — [PATCH 3.4 43/92] IB/cm: Fix rb-tree duplicate free and use-after-free

From: Doron Tsur <doront@mellanox.com>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 0ca81a2840f77855bbad1b9f172c545c4dc9e6a4 upstream.

ib_send_cm_sidr_rep could sometimes erase the node from the sidr
(depending on errors in the process). Since ib_send_cm_sidr_rep is
called both from cm_sidr_req_handler and cm_destroy_id, cm_id_priv
could be either erased from the rb_tree twice or not erased at all.
Fixing that by making sure it's erased only once before freeing
cm_id_priv.

Fixes: a977049dacde ('[PATCH] IB: Add the kernel CM implementation')
Signed-off-by: Doron Tsur <doront@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/infiniband/core/cm.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index c889aae..90104c6 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -856,6 +856,11 @@ retest:
 	case IB_CM_SIDR_REQ_RCVD:
 		spin_unlock_irq(&cm_id_priv->lock);
 		cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);
+		spin_lock_irq(&cm.lock);
+		if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node))
+			rb_erase(&cm_id_priv->sidr_id_node,
+				 &cm.remote_sidr_table);
+		spin_unlock_irq(&cm.lock);
 		break;
 	case IB_CM_REQ_SENT:
 		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
@@ -3092,7 +3097,10 @@ int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 
 	spin_lock_irqsave(&cm.lock, flags);
-	rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+	if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) {
+		rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+		RB_CLEAR_NODE(&cm_id_priv->sidr_id_node);
+	}
 	spin_unlock_irqrestore(&cm.lock, flags);
 	return 0;
 
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381552 — [PATCH 3.4 49/92] drm: crtc: integer overflow in drm_property_create_blob()

From: Dan Carpenter <dan.carpenter@oracle.com>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 9ac0934bbe52290e4e4c2a58ec41cab9b6ca8c96 upstream.

The size here comes from the user via the ioctl, it is a number between
1-u32max so the addition here could overflow on 32 bit systems.

Fixes: f453ba046074 ('DRM: add mode setting support')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Daniel Stone <daniels@collabora.com>
Signed-off-by: Dave Airlie <airlied@gmail.com>
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/gpu/drm/drm_crtc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index ed4b748..93c5b2f 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2945,7 +2945,7 @@ static struct drm_property_blob *drm_property_create_blob(struct drm_device *dev
 	struct drm_property_blob *blob;
 	int ret;
 
-	if (!length || !data)
+	if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob) || !data)
 		return NULL;
 
 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381553 — [PATCH 3.4 55/92] KVM: x86: trap AMD MSRs for the TSeg base and mask

From: Paolo Bonzini <pbonzini@redhat.com>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 3afb1121800128aae9f5722e50097fcf1a9d4d88 upstream.

These have roughly the same purpose as the SMRR, which we do not need
to implement in KVM.  However, Linux accesses MSR_K8_TSEG_ADDR at
boot, which causes problems when running a Xen dom0 under KVM.
Just return 0, meaning that processor protection of SMRAM is not
in effect.

Reported-by: M A Young <m.a.young@durham.ac.uk>
Acked-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 arch/x86/include/asm/msr-index.h | 1 +
 arch/x86/kvm/x86.c               | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index e92e1e4..033b8a0 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -166,6 +166,7 @@
 /* C1E active bits in int pending message */
 #define K8_INTP_C1E_ACTIVE_MASK		0x18000000
 #define MSR_K8_TSEG_ADDR		0xc0010112
+#define MSR_K8_TSEG_MASK		0xc0010113
 #define K8_MTRRFIXRANGE_DRAM_ENABLE	0x00040000 /* MtrrFixDramEn bit    */
 #define K8_MTRRFIXRANGE_DRAM_MODIFY	0x00080000 /* MtrrFixDramModEn bit */
 #define K8_MTRR_RDMEM_WRMEM_MASK	0x18181818 /* Mask: RdMem|WrMem    */
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 9cc83e2..32a6521 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1914,6 +1914,8 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata)
 	case MSR_IA32_LASTINTFROMIP:
 	case MSR_IA32_LASTINTTOIP:
 	case MSR_K8_SYSCFG:
+	case MSR_K8_TSEG_ADDR:
+	case MSR_K8_TSEG_MASK:
 	case MSR_K7_HWCR:
 	case MSR_VM_HSAVE_PA:
 	case MSR_K7_EVNTSEL0:
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381554 — [PATCH 3.4 63/92] m68k: Define asmlinkage_protect

From: Andreas Schwab <schwab@linux-m68k.org>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 8474ba74193d302e8340dddd1e16c85cc4b98caf upstream.

Make sure the compiler does not modify arguments of syscall functions.
This can happen if the compiler generates a tailcall to another
function.  For example, without asmlinkage_protect sys_openat is compiled
into this function:

sys_openat:
	clr.l %d0
	move.w 18(%sp),%d0
	move.l %d0,16(%sp)
	jbra do_sys_open

Note how the fourth argument is modified in place, modifying the register
%d4 that gets restored from this stack slot when the function returns to
user-space.  The caller may expect the register to be unmodified across
system calls.

Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 arch/m68k/include/asm/linkage.h | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/arch/m68k/include/asm/linkage.h b/arch/m68k/include/asm/linkage.h
index 5a822bb..066e74f 100644
--- a/arch/m68k/include/asm/linkage.h
+++ b/arch/m68k/include/asm/linkage.h
@@ -4,4 +4,34 @@
 #define __ALIGN .align 4
 #define __ALIGN_STR ".align 4"
 
+/*
+ * Make sure the compiler doesn't do anything stupid with the
+ * arguments on the stack - they are owned by the *caller*, not
+ * the callee. This just fools gcc into not spilling into them,
+ * and keeps it from doing tailcall recursion and/or using the
+ * stack slots for temporaries, since they are live and "used"
+ * all the way to the end of the function.
+ */
+#define asmlinkage_protect(n, ret, args...) \
+	__asmlinkage_protect##n(ret, ##args)
+#define __asmlinkage_protect_n(ret, args...) \
+	__asm__ __volatile__ ("" : "=r" (ret) : "0" (ret), ##args)
+#define __asmlinkage_protect0(ret) \
+	__asmlinkage_protect_n(ret)
+#define __asmlinkage_protect1(ret, arg1) \
+	__asmlinkage_protect_n(ret, "m" (arg1))
+#define __asmlinkage_protect2(ret, arg1, arg2) \
+	__asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2))
+#define __asmlinkage_protect3(ret, arg1, arg2, arg3) \
+	__asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3))
+#define __asmlinkage_protect4(ret, arg1, arg2, arg3, arg4) \
+	__asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
+			      "m" (arg4))
+#define __asmlinkage_protect5(ret, arg1, arg2, arg3, arg4, arg5) \
+	__asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
+			      "m" (arg4), "m" (arg5))
+#define __asmlinkage_protect6(ret, arg1, arg2, arg3, arg4, arg5, arg6) \
+	__asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
+			      "m" (arg4), "m" (arg5), "m" (arg6))
+
 #endif
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381555 — [PATCH 3.4 54/92] regmap: debugfs: Don't bother actually printing when calculating max length

From: Mark Brown <broonie@kernel.org>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 176fc2d5770a0990eebff903ba680d2edd32e718 upstream.

The in kernel snprintf() will conveniently return the actual length of
the printed string even if not given an output beffer at all so just do
that rather than relying on the user to pass in a suitable buffer,
ensuring that we don't need to worry if the buffer was truncated due to
the size of the buffer passed in.

Reported-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/base/regmap/regmap-debugfs.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index d805eb5..023a9d7 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -23,8 +23,7 @@ static struct dentry *regmap_debugfs_root;
 /* Calculate the length of a fixed format  */
 static size_t regmap_calc_reg_len(int max_val, char *buf, size_t buf_size)
 {
-	snprintf(buf, buf_size, "%x", max_val);
-	return strlen(buf);
+	return snprintf(NULL, 0, "%x", max_val);
 }
 
 static ssize_t regmap_name_read_file(struct file *file,
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381557 — [PATCH 3.4 66/92] UBI: return ENOSPC if no enough space available

From: shengyong <shengyong1@huawei.com>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 7c7feb2ebfc9c0552c51f0c050db1d1a004faac5 upstream.

UBI: attaching mtd1 to ubi0
UBI: scanning is finished
UBI error: init_volumes: not enough PEBs, required 706, available 686
UBI error: ubi_wl_init: no enough physical eraseblocks (-20, need 1)
UBI error: ubi_attach_mtd_dev: failed to attach mtd1, error -12 <= NOT ENOMEM
UBI error: ubi_init: cannot attach mtd1

If available PEBs are not enough when initializing volumes, return -ENOSPC
directly. If available PEBs are not enough when initializing WL, return
-ENOSPC instead of -ENOMEM.

Signed-off-by: Sheng Yong <shengyong1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: David Gstir <david@sigma-star.at>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/mtd/ubi/vtbl.c | 1 +
 drivers/mtd/ubi/wl.c   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
index c015fc0..4105a50 100644
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -656,6 +656,7 @@ static int init_volumes(struct ubi_device *ubi, const struct ubi_scan_info *si,
 		if (ubi->corr_peb_count)
 			ubi_err("%d PEBs are corrupted and not used",
 				ubi->corr_peb_count);
+		return -ENOSPC;
 	}
 	ubi->rsvd_pebs += reserved_pebs;
 	ubi->avail_pebs -= reserved_pebs;
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 284d144..3e42cd6 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -1513,6 +1513,7 @@ int ubi_wl_init_scan(struct ubi_device *ubi, struct ubi_scan_info *si)
 		if (ubi->corr_peb_count)
 			ubi_err("%d PEBs are corrupted and not used",
 				ubi->corr_peb_count);
+		err = -ENOSPC;
 		goto out_free;
 	}
 	ubi->avail_pebs -= WL_RESERVED_PEBS;
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381558 — [PATCH 3.4 59/92] xhci: change xhci 1.0 only restrictions to support xhci 1.1

From: Mathias Nyman <mathias.nyman@linux.intel.com>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit dca7794539eff04b786fb6907186989e5eaaa9c2 upstream.

Some changes between xhci 0.96 and xhci 1.0 specifications forced us to
check the hci version in code, some of these checks were implemented as
hci_version == 1.0, which will not work with new xhci 1.1 controllers.

xhci 1.1 behaves similar to xhci 1.0 in these cases, so change these
checks to hci_version >= 1.0

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/usb/host/xhci-mem.c  | 6 +++---
 drivers/usb/host/xhci-ring.c | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 048cc38..cad4a174 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1493,10 +1493,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
 	 * use Event Data TRBs, and we don't chain in a link TRB on short
 	 * transfers, we're basically dividing by 1.
 	 *
-	 * xHCI 1.0 specification indicates that the Average TRB Length should
-	 * be set to 8 for control endpoints.
+	 * xHCI 1.0 and 1.1 specification indicates that the Average TRB Length
+	 * should be set to 8 for control endpoints.
 	 */
-	if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version == 0x100)
+	if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version >= 0x100)
 		ep_ctx->tx_info |= cpu_to_le32(AVG_TRB_LENGTH_FOR_EP(8));
 	else
 		ep_ctx->tx_info |=
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 3cfe7e3..02c6dc8 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3496,8 +3496,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 	if (start_cycle == 0)
 		field |= 0x1;
 
-	/* xHCI 1.0 6.4.1.2.1: Transfer Type field */
-	if (xhci->hci_version == 0x100) {
+	/* xHCI 1.0/1.1 6.4.1.2.1: Transfer Type field */
+	if (xhci->hci_version >= 0x100) {
 		if (urb->transfer_buffer_length > 0) {
 			if (setup->bRequestType & USB_DIR_IN)
 				field |= TRB_TX_TYPE(TRB_DATA_IN);
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381560 — [PATCH 3.4 53/92] regmap: debugfs: Ensure we don't underflow when printing access masks

From: Mark Brown <broonie@kernel.org>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit b763ec17ac762470eec5be8ebcc43e4f8b2c2b82 upstream.

If a read is attempted which is smaller than the line length then we may
underflow the subtraction we're doing with the unsigned size_t type so
move some of the calculation to be additions on the right hand side
instead in order to avoid this.

Reported-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/base/regmap/regmap-debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index 1db1289..d805eb5 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -205,7 +205,7 @@ static ssize_t regmap_access_read_file(struct file *file,
 		/* If we're in the region the user is trying to read */
 		if (p >= *ppos) {
 			/* ...but not beyond it */
-			if (buf_pos >= count - 1 - tot_len)
+			if (buf_pos + tot_len + 1 >= count)
 				break;
 
 			/* Format the register */
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381562 — [PATCH 3.4 65/92] UBI: Validate data_size

From: Richard Weinberger <richard@nod.at>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 281fda27673f833a01d516658a64d22a32c8e072 upstream.

Make sure that data_size is less than LEB size.
Otherwise a handcrafted UBI image is able to trigger
an out of bounds memory access in ubi_compare_lebs().

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: David Gstir <david@sigma-star.at>
[lizf: Backported to 3.4: use dbg_err() instead of ubi_err()];
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/mtd/ubi/io.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
index 43f1a00..8f793ea 100644
--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -942,6 +942,11 @@ static int validate_vid_hdr(const struct ubi_device *ubi,
 		goto bad;
 	}
 
+	if (data_size > ubi->leb_size) {
+		dbg_err("bad data_size");
+		goto bad;
+	}
+
 	if (vol_type == UBI_VID_STATIC) {
 		/*
 		 * Although from high-level point of view static volumes may
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1381563 — [PATCH 3.4 62/92] ath9k: declare required extra tx headroom

From: Felix Fietkau <nbd@openwrt.org>

3.4.112-rc1 review patch.  If anyone has any objections, please let me know.

------------------


commit 029cd0370241641eb70235d205aa0b90c84dce44 upstream.

ath9k inserts padding between the 802.11 header and the data area (to
align it). Since it didn't declare this extra required headroom, this
led to some nasty issues like randomly dropped packets in some setups.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
 drivers/net/wireless/ath/ath9k/init.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index cac5b25..37534a0 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -683,6 +683,7 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
 	hw->max_rate_tries = 10;
 	hw->sta_data_size = sizeof(struct ath_node);
 	hw->vif_data_size = sizeof(struct ath_vif);
+	hw->extra_tx_headroom = 4;
 
 	hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1;
 	hw->wiphy->available_antennas_tx = BIT(ah->caps.max_txchains) - 1;
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

Page 3 of 5 — ← Prev page 1 2 [3] 4 5  Next page →

Back to top | Article view | linux.kernel

csiph-web