Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1573997 > unrolled thread

[PATCH 3.10 100/319] fix fault_in_multipages_...() on architectures with no-op access_ok()

Back to article view | Back to linux.kernel

Contents

  [PATCH 3.10 100/319] fix fault_in_multipages_...() on architectures with no-op access_ok() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 155/319] ext4: sanity check the block and cluster size at mount time Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 116/319] usb: gadget: fsl_qe_udc: signedness bug in qe_get_frame() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 304/319] staging: iio: ad5933: avoid uninitialized variable in error case Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 125/319] ALSA: timer: fix NULL pointer dereference in read()/ioctl() race Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 206/319] IB/cm: Mark stale CM id's whenever the mad agent was unregistered Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 156/319] reiserfs: fix "new_insert_key may be used uninitialized ..." Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 181/319] drm/radeon: Ensure vblank interrupt is enabled on DPMS transition to on Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 303/319] hv: do not lose pending heartbeat vmbus packets Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 261/319] dccp: do not send reset to already closed sockets Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 123/319] Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 262/319] dccp: fix out of bound access in dccp_v4_err() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 249/319] firewire: net: guard against rx buffer overflows Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 315/319] ASoC: omap-mcpdm: Fix irq resource handling Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 201/319] IB/core: Fix use after free in send_leave function Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 193/319] iio: accel: kxsd9: Fix raw read return Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 179/319] drm/radeon: fix radeon_move_blit on 32bit systems Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 211/319] perf: Tighten (and fix) the grouping condition Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 241/319] ipvs: count pre-established TCP states as active Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 276/319] arch: Introduce smp_load_acquire(), smp_store_release() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
      Re: [PATCH 3.10 276/319] arch: Introduce smp_load_acquire(),  smp_store_release() Willy Tarreau <w@1wt.eu> - 2017-02-06 10:20 +0100
    [PATCH 3.10 202/319] IB/ipoib: Don't allow MC joins during light MC flush Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 127/319] ALSA: timer: fix NULL pointer dereference on memory allocation failure Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 184/319] Input: i8042 - set up shared ps2_cmd_mutex for AUX ports Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 191/319] i2c: core: fix NULL pointer dereference under race condition Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 205/319] IB/uverbs: Fix leak of XRC target QPs Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 290/319] PM / sleep: fix device reference leak in test_suspend Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 318/319] fbdev/efifb: Fix 16 color palette entry calculation Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 103/319] Fix potential infoleak in older kernels Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 234/319] tcp: fix wrong checksum calculation on MTU probing Willy Tarreau <w@1wt.eu> - 2017-02-05 20:30 +0100
    [PATCH 3.10 254/319] net: avoid sk_forward_alloc overflows Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 251/319] netfilter: fix namespace handling in nf_log_proc_dostring Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 228/319] ip6_tunnel: Clear IP6CB in ip6tunnel_xmit() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 131/319] zfcp: fix ELS/GS request&response length for hardware data router Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 274/319] kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 170/319] NFSD: Using free_conn free connection Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 265/319] ipv4: use new_gw for redirect neigh lookup Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 121/319] usb: gadget: u_ether: remove interrupt throttling Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 309/319] dm flakey: fix reads to be issued if drop_writes configured Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 216/319] drivers/vfio: Rework offsetofend() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 246/319] brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 258/319] sctp: validate chunk len before actually using it Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 292/319] mmc: block: don't use CMD23 with very old MMC cards Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 215/319] vt: clear selection before resizing Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 153/319] ext4: reinforce check of i_dtime when clearing high fields of uid and gid Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 159/319] libxfs: clean up _calc_dquots_per_chunk Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 182/319] qxl: check for kmap failures Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 252/319] can: bcm: fix warning in bcm_connect/proc_register Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 163/319] ubifs: Fix assertion in layout_in_gaps() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 291/319] mmc: mxs: Initialize the spinlock prior to using it Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 306/319] ACPI / APEI: Fix incorrect return value of ghes_proc() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 250/319] firewire: net: fix fragmented datagram_size off-by-one Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 152/319] ext4: use __GFP_NOFAIL in ext4_free_blocks() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 277/319] kernel: Provide READ_ONCE and ASSIGN_ONCE Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
      Re: [PATCH 3.10 277/319] kernel: Provide READ_ONCE and ASSIGN_ONCE Willy Tarreau <w@1wt.eu> - 2017-02-06 09:10 +0100
    [PATCH 3.10 281/319] compiler: Allow 1- and 2-byte smp_load_acquire() and smp_store_release() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
      Re: [PATCH 3.10 281/319] compiler: Allow 1- and 2-byte  smp_load_acquire() and smp_store_release() Willy Tarreau <w@1wt.eu> - 2017-02-06 09:10 +0100
    [PATCH 3.10 203/319] IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 102/319] arc: don't leak bits of kernel stack into coredump Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 200/319] IB/ipoib: Fix memory corruption in ipoib cm mode connect flow Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 275/319] ipc: remove use of seq_printf return value Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
      Re: [PATCH 3.10 275/319] ipc: remove use of seq_printf return value Joe Perches <joe@perches.com> - 2017-02-05 20:50 +0100
        Re: [PATCH 3.10 275/319] ipc: remove use of seq_printf return value Willy Tarreau <w@1wt.eu> - 2017-02-05 21:40 +0100
      Re: [PATCH 3.10 275/319] ipc: remove use of seq_printf return value Willy Tarreau <w@1wt.eu> - 2017-02-06 09:10 +0100
    [PATCH 3.10 307/319] PCI: Handle read-only BARs on AMD CS553x devices Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 147/319] scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 284/319] drbd: Fix kernel_sendmsg() usage - potential NULL deref Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 245/319] brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 242/319] iwlwifi: pcie: fix access to scratch buffer Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
    [PATCH 3.10 280/319] locking: Remove atomicy checks from {READ,WRITE}_ONCE Willy Tarreau <w@1wt.eu> - 2017-02-05 20:40 +0100
      Re: [PATCH 3.10 280/319] locking: Remove atomicy checks from  {READ,WRITE}_ONCE Willy Tarreau <w@1wt.eu> - 2017-02-06 09:10 +0100
    [PATCH 3.10 256/319] packet: call fanout_release, while UNREGISTERING a netdev Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 286/319] tools/vm/slabinfo: fix an unintentional printf Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 199/319] IB/srpt: Simplify srpt_handle_tsk_mgmt() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
      Re: [PATCH 3.10 199/319] IB/srpt: Simplify srpt_handle_tsk_mgmt() Willy Tarreau <w@1wt.eu> - 2017-02-06 07:40 +0100
    [PATCH 3.10 317/319] dm: mark request_queue dead before destroying the DM device Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 233/319] tcp: fix overflow in __tcp_retransmit_skb() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 157/319] reiserfs: Unlock superblock before calling reiserfs_quota_on_mount() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 126/319] ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 231/319] tcp: fix use after free in tcp_xmit_retransmit_queue() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 226/319] ipv6: dccp: fix out of bound access in dccp_v6_err() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 119/319] usb: gadget: function: u_ether: don't starve tx request queue Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 149/319] scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 222/319] ipv6: addrconf: fix dev refcont leak when DAD failed Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 311/319] can: dev: fix deadlock reported after bus-off Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 177/319] driver core: Delete an unnecessary check before the function call "put_device" Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 269/319] mwifiex: printk() overflow with 32-byte SSIDs Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 270/319] ipv4: Set skb->protocol properly for local output Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 314/319] mfd: 88pm80x: Double shifting bug in suspend/resume Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 143/319] scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 218/319] stddef.h: move offsetofend inside #ifndef/#endif guard, neaten Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 195/319] thermal: hwmon: Properly report critical temperature in sysfs Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 111/319] USB: kobil_sct: fix non-atomic allocation in write path Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 158/319] xfs: fix superblock inprogress check Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 209/319] mtd: nand: davinci: Reinitialize the HW ECC engine in 4bit hwctl Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 114/319] usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 272/319] kaweth: fix firmware download Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 105/319] coredump: fix unfreezable coredumping task Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 282/319] ipc/sem.c: fix complex_count vs. simple op race Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
      Re: [PATCH 3.10 282/319] ipc/sem.c: fix complex_count vs. simple op  race Willy Tarreau <w@1wt.eu> - 2017-02-06 09:10 +0100
    [PATCH 3.10 295/319] pstore/ram: Use memcpy_fromio() to save old buffer Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 310/319] mm,ksm: fix endless looping in allocating memory when ksm enable Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 210/319] perf symbols: Fixup symbol sizes before picking best ones Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 224/319] ip6_gre: fix flowi6_proto value in ip6gre_xmit_other() Willy Tarreau <w@1wt.eu> - 2017-02-05 20:50 +0100
    [PATCH 3.10 296/319] mb86a20s: fix the locking logic Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 279/319] kernel: make READ_ONCE() valid on const arguments Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
      Re: [PATCH 3.10 279/319] kernel: make READ_ONCE() valid on const  arguments Willy Tarreau <w@1wt.eu> - 2017-02-06 09:10 +0100
    [PATCH 3.10 174/319] fs/super.c: fix race between freeze_super() and thaw_super() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 129/319] ALSA: pcm : Call kill_fasync() in stream lock Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 238/319] mISDN: Support DR6 indication in mISDNipac driver Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 293/319] pstore/core: drop cmpxchg based updates Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 141/319] scsi: mpt3sas: Fix secure erase premature termination Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
      RE: [PATCH 3.10 141/319] scsi: mpt3sas: Fix secure erase premature termination Sathya Prakash Veerichetty <sathya.prakash@broadcom.com> - 2017-02-06 17:30 +0100
        Re: [PATCH 3.10 141/319] scsi: mpt3sas: Fix secure erase premature  termination Willy Tarreau <w@1wt.eu> - 2017-02-06 23:30 +0100
          Re: [PATCH 3.10 141/319] scsi: mpt3sas: Fix secure erase premature  termination James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-02-07 07:40 +0100
            Re: [PATCH 3.10 141/319] scsi: mpt3sas: Fix secure erase premature  termination Willy Tarreau <w@1wt.eu> - 2017-02-07 08:10 +0100
              Re: [PATCH 3.10 141/319] scsi: mpt3sas: Fix secure erase premature  termination James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-02-07 18:10 +0100
                Re: [PATCH 3.10 141/319] scsi: mpt3sas: Fix secure erase premature  termination Willy Tarreau <w@1wt.eu> - 2017-02-07 18:20 +0100
                  Re: [PATCH 3.10 141/319] scsi: mpt3sas: Fix secure erase premature  termination Willy Tarreau <w@1wt.eu> - 2017-02-08 08:00 +0100
    [PATCH 3.10 268/319] cfg80211: limit scan results cache size Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 247/319] pstore: Fix buffer overflow while write offset equal to buffer size Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 130/319] zfcp: fix fc_host port_type with NPIV Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 219/319] ipv6: don't call fib6_run_gc() until routing is ready Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 104/319] swapfile: fix memory corruption via malformed swapfile Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 223/319] ipv6: fix rtnl locking in setsockopt for anycast and multicast Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 240/319] net: disable fragment reassembly if high_thresh is set to zero Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 204/319] IB/mlx4: Fix create CQ error flow Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 294/319] pstore/ram: Use memcpy_toio instead of memcpy Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 285/319] lib/genalloc.c: start search from start of chunk Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 257/319] net: sctp, forbid negative length Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 230/319] net/irda: handle iriap_register_lsap() allocation failure Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 313/319] mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 168/319] UBI: fastmap: scrub PEB when bitflips are detected in a free PEB EC header Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 162/319] ocfs2: fix start offset to ocfs2_zero_range_for_truncate() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 225/319] ipv6: correctly add local routes when lo goes up Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 180/319] drm: Reject page_flip for !DRIVER_MODESET Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 194/319] iio: accel: kxsd9: Fix scaling bug Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 217/319] include/stddef.h: Move offsetofend() from vfio.h to a generic kernel header Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 196/319] cdc-acm: fix wrong pipe type on rx interrupt xfers Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 192/319] i2c: at91: fix write transfers by clearing pending interrupt first Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 312/319] hwmon: (adt7411) set bit 3 in CFG1 register Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 271/319] net: sky2: Fix shutdown crash Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 169/319] NFSv4.x: Fix a refcount leak in nfs_callback_up_net Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 264/319] neigh: check error pointer instead of NULL for ipv4_neigh_lookup() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 283/319] cfq: fix starvation of asynchronous writes Willy Tarreau <w@1wt.eu> - 2017-02-05 21:00 +0100
    [PATCH 3.10 287/319] rcu: Fix soft lockup for rcu_nocb_kthread Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 301/319] uio: fix dmem_region_start computation Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 255/319] ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 213/319] tty: limit terminal size to 4M chars Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 239/319] mISDN: Fixing missing validation in base_sock_bind() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 166/319] ubifs: Abort readdir upon error Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 188/319] hwrng: omap - Only fail if pm_runtime_get_sync returns < 0 Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 229/319] ip6_tunnel: disable caching when the traffic class is inherited Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 148/319] scsi: scsi_debug: Fix memory leak if LBP enabled and module is unloaded Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 302/319] KEYS: Fix short sprintf buffer in /proc/keys show function Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 259/319] net: clear sk_err_soft in sk_clone_lock() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 164/319] ubifs: Fix xattr_names length in exit paths Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 175/319] isofs: Do not return EACCES for unknown filesystems Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 263/319] sctp: assign assoc_id earlier in __sctp_connect Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 117/319] USB: serial: cp210x: fix hardware flow-control disable Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 273/319] tracing: Move mutex to protect against resetting of seq data Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 136/319] zfcp: restore tracing of handle for port and LUN with HBA records Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 214/319] tty: vt, fix bogus division in csi_J Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 122/319] usb: chipidea: move the lock initialization to core file Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 308/319] tile: avoid using clocksource_cyc2ns with absolute cycle count Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 289/319] mfd: core: Fix device reference leak in mfd_clone_cell Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 300/319] gpio: mpc8xxx: Correct irq handler function Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 172/319] NFSv4: Open state recovery must account for file permission changes Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 227/319] ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 221/319] ipv6: move DAD and addrconf_verify processing to workqueue Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 183/319] Input: i8042 - break load dependency between atkbd/psmouse and i8042 Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 319/319] metag: Only define atomic_dec_if_positive conditionally Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 108/319] USB: fix typo in wMaxPacketSize validation Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 161/319] ocfs2/dlm: fix race between convert and migration Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 266/319] mac80211: fix purging multicast PS buffer queue Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 134/319] zfcp: restore: Dont use 0 to indicate invalid LUN in rec trace Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 212/319] tty: Prevent ldisc drivers from re-using stale tty fields Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 244/319] brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill Willy Tarreau <w@1wt.eu> - 2017-02-05 21:10 +0100
    [PATCH 3.10 142/319] mpt2sas: Fix secure erase premature termination Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 171/319] NFS: Don't drop CB requests with invalid principals Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 197/319] timers: Use proper base migration in add_timer_on() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 253/319] net: fix sk_mem_reclaim_partial() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 186/319] hwrng: exynos - Disable runtime PM on probe failure Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 232/319] tcp: properly scale window in tcp_v[46]_reqsk_send_ack() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 151/319] ext4: avoid modifying checksum fields directly during checksum verification Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 176/319] hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 145/319] scsi: ibmvfc: Fix I/O hang when port is not mapped Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 160/319] btrfs: ensure that file descriptor used with subvol ioctls is a dir Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 243/319] svc: Avoid garbage replies when pc_func() returns rpc_drop_reply Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 140/319] scsi: zfcp: spin_lock_irqsave() is not nestable Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 124/319] ALSA: rawmidi: Fix possible deadlock with virmidi registration Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 115/319] USB: change bInterval default to 10 ms Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 112/319] USB: serial: mos7720: fix non-atomic allocation in write path Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 165/319] UBIFS: Fix possible memory leak in ubifs_readdir() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 189/319] i2c-eg20t: fix race between i2c init and interrupt enable Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 267/319] mac80211: discard multicast and 4-addr A-MSDUs Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 237/319] net: ratelimit warnings about dst entry refcount underflow or overflow Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 248/319] net/mlx4_core: Allow resetting VF admin mac to zero Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 198/319] EDAC: Increment correct counter in edac_inc_ue_error() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 236/319] bonding: Fix bonding crash Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 220/319] ipv6: split duplicate address detection and router solicitation timer Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 146/319] scsi: Fix use-after-free Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 135/319] zfcp: trace on request for open and close of WKA port Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 207/319] mtd: blkdevs: fix potential deadlock + lockdep warnings Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 150/319] ext4: validate that metadata blocks do not overlap superblock Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 208/319] mtd: pmcmsp-flash: Allocating too much in init_msp_flash() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 107/319] USB: validate wMaxPacketValue entries in endpoint descriptors Willy Tarreau <w@1wt.eu> - 2017-02-05 21:20 +0100
    [PATCH 3.10 109/319] usb: xhci: Fix panic if disconnect Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
    [PATCH 3.10 110/319] USB: serial: fix memleak in driver-registration error path Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
    [PATCH 3.10 139/319] zfcp: trace full payload of all SAN records (req,resp,iels) Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
    [PATCH 3.10 167/319] ubifs: Fix regression in ubifs_readdir() Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
    [PATCH 3.10 154/319] ext4: allow DAX writeback for hole punch Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
    [PATCH 3.10 132/319] zfcp: close window with unblocked rport during rport gone Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
    [PATCH 3.10 144/319] scsi: megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100
    [PATCH 3.10 128/319] ALSA: ali5451: Fix out-of-bound position reporting Willy Tarreau <w@1wt.eu> - 2017-02-05 21:30 +0100

Page 9 of 11 — ← Prev page 1 … 7 8 [9] 10 11  Next page →

#1574176 — [PATCH 3.10 273/319] tracing: Move mutex to protect against resetting of seq data

From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>

commit 1245800c0f96eb6ebb368593e251d66c01e61022 upstream.

The iter->seq can be reset outside the protection of the mutex. So can
reading of user data. Move the mutex up to the beginning of the function.

Fixes: d7350c3f45694 ("tracing/core: make the read callbacks reentrants")
Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 kernel/trace/trace.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 4ff36f7..d6e7252 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4121,13 +4121,6 @@ tracing_read_pipe(struct file *filp, char __user *ubuf,
 	struct trace_array *tr = iter->tr;
 	ssize_t sret;
 
-	/* return any leftover data */
-	sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
-	if (sret != -EBUSY)
-		return sret;
-
-	trace_seq_init(&iter->seq);
-
 	/* copy the tracer to avoid using a global lock all around */
 	mutex_lock(&trace_types_lock);
 	if (unlikely(iter->trace->name != tr->current_trace->name))
@@ -4140,6 +4133,14 @@ tracing_read_pipe(struct file *filp, char __user *ubuf,
 	 * is protected.
 	 */
 	mutex_lock(&iter->mutex);
+
+	/* return any leftover data */
+	sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
+	if (sret != -EBUSY)
+		goto out;
+
+	trace_seq_init(&iter->seq);
+
 	if (iter->trace->read) {
 		sret = iter->trace->read(iter, filp, ubuf, cnt, ppos);
 		if (sret)
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574178 — [PATCH 3.10 136/319] zfcp: restore tracing of handle for port and LUN with HBA records

From: Steffen Maier <maier@linux.vnet.ibm.com>

commit 7c964ffe586bc0c3d9febe9bf97a2e4b2866e5b7 upstream.

This information was lost with
commit a54ca0f62f953898b05549391ac2a8a4dad6482b
("[SCSI] zfcp: Redesign of the debug tracing for HBA records.")
but is required to debug e.g. invalid handle situations.

Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
Fixes: a54ca0f62f95 ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.")
Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/s390/scsi/zfcp_dbf.c | 2 ++
 drivers/s390/scsi/zfcp_dbf.h | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index e99b3d6..1abe57d 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -78,6 +78,8 @@ void zfcp_dbf_hba_fsf_res(char *tag, int level, struct zfcp_fsf_req *req)
 	rec->u.res.req_issued = req->issued;
 	rec->u.res.prot_status = q_pref->prot_status;
 	rec->u.res.fsf_status = q_head->fsf_status;
+	rec->u.res.port_handle = q_head->port_handle;
+	rec->u.res.lun_handle = q_head->lun_handle;
 
 	memcpy(rec->u.res.prot_status_qual, &q_pref->prot_status_qual,
 	       FSF_PROT_STATUS_QUAL_SIZE);
diff --git a/drivers/s390/scsi/zfcp_dbf.h b/drivers/s390/scsi/zfcp_dbf.h
index 97f46e6..ac7bce8 100644
--- a/drivers/s390/scsi/zfcp_dbf.h
+++ b/drivers/s390/scsi/zfcp_dbf.h
@@ -131,6 +131,8 @@ struct zfcp_dbf_hba_res {
 	u8  prot_status_qual[FSF_PROT_STATUS_QUAL_SIZE];
 	u32 fsf_status;
 	u8  fsf_status_qual[FSF_STATUS_QUALIFIER_SIZE];
+	u32 port_handle;
+	u32 lun_handle;
 } __packed;
 
 /**
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574179 — [PATCH 3.10 214/319] tty: vt, fix bogus division in csi_J

From: Jiri Slaby <jslaby@suse.cz>

commit 42acfc6615f47e465731c263bee0c799edb098f2 upstream.

In csi_J(3), the third parameter of scr_memsetw (vc_screenbuf_size) is
divided by 2 inappropriatelly. But scr_memsetw expects size, not
count, because it divides the size by 2 on its own before doing actual
memset-by-words.

So remove the bogus division.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Petr Písař <ppisar@redhat.com>
Fixes: f8df13e0a9 (tty: Clean console safely)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/tty/vt/vt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index ee51acd..5deddca 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1166,7 +1166,7 @@ static void csi_J(struct vc_data *vc, int vpar)
 			break;
 		case 3: /* erase scroll-back buffer (and whole display) */
 			scr_memsetw(vc->vc_screenbuf, vc->vc_video_erase_char,
-				    vc->vc_screenbuf_size >> 1);
+				    vc->vc_screenbuf_size);
 			set_origin(vc);
 			if (CON_IS_VISIBLE(vc))
 				update_screen(vc);
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574180 — [PATCH 3.10 122/319] usb: chipidea: move the lock initialization to core file

From: Peter Chen <peter.chen@nxp.com>

commit a5d906bb261cde5f881a949d3b0fbaa285dcc574 upstream.

This can fix below dump when the lock is accessed at host
mode due to it is not initialized.

[   46.119638] INFO: trying to register non-static key.
[   46.124643] the code is fine but needs lockdep annotation.
[   46.130144] turning off the locking correctness validator.
[   46.135659] CPU: 0 PID: 690 Comm: cat Not tainted 4.9.0-rc3-00079-g4b75f1d #1210
[   46.143075] Hardware name: Freescale i.MX6 SoloX (Device Tree)
[   46.148923] Backtrace:
[   46.151448] [<c010c460>] (dump_backtrace) from [<c010c658>] (show_stack+0x18/0x1c)
[   46.159038]  r7:edf52000
[   46.161412]  r6:60000193
[   46.163967]  r5:00000000
[   46.165035]  r4:c0e25c2c

[   46.169109] [<c010c640>] (show_stack) from [<c03f58a4>] (dump_stack+0xb4/0xe8)
[   46.176362] [<c03f57f0>] (dump_stack) from [<c016d690>] (register_lock_class+0x4fc/0x56c)
[   46.184554]  r10:c0e25d24
[   46.187014]  r9:edf53e70
[   46.189569]  r8:c1642444
[   46.190637]  r7:ee9da024
[   46.193191]  r6:00000000
[   46.194258]  r5:00000000
[   46.196812]  r4:00000000
[   46.199185]  r3:00000001

[   46.203259] [<c016d194>] (register_lock_class) from [<c0171294>] (__lock_acquire+0x80/0x10f0)
[   46.211797]  r10:c0e25d24
[   46.214257]  r9:edf53e70
[   46.216813]  r8:ee9da024
[   46.217880]  r7:c1642444
[   46.220435]  r6:edcd1800
[   46.221502]  r5:60000193
[   46.224057]  r4:00000000

[   46.227953] [<c0171214>] (__lock_acquire) from [<c01726c0>] (lock_acquire+0x74/0x94)
[   46.235710]  r10:00000001
[   46.238169]  r9:edf53e70
[   46.240723]  r8:edf53f80
[   46.241790]  r7:00000001
[   46.244344]  r6:00000001
[   46.245412]  r5:60000193
[   46.247966]  r4:00000000

[   46.251866] [<c017264c>] (lock_acquire) from [<c096c8fc>] (_raw_spin_lock_irqsave+0x40/0x54)
[   46.260319]  r7:ee1c6a00
[   46.262691]  r6:c062a570
[   46.265247]  r5:20000113
[   46.266314]  r4:ee9da014

[   46.270393] [<c096c8bc>] (_raw_spin_lock_irqsave) from [<c062a570>] (ci_port_test_show+0x2c/0x70)
[   46.279280]  r6:eebd2000
[   46.281652]  r5:ee9da010
[   46.284207]  r4:ee9da014

[   46.286810] [<c062a544>] (ci_port_test_show) from [<c0248d04>] (seq_read+0x1ac/0x4f8)
[   46.294655]  r9:edf53e70
[   46.297028]  r8:edf53f80
[   46.299583]  r7:ee1c6a00
[   46.300650]  r6:00000001
[   46.303205]  r5:00000000
[   46.304273]  r4:eebd2000
[   46.306850] [<c0248b58>] (seq_read) from [<c039e864>] (full_proxy_read+0x54/0x6c)
[   46.314348]  r10:00000000
[   46.316808]  r9:c0a6ad30
[   46.319363]  r8:edf53f80
[   46.320430]  r7:00020000
[   46.322986]  r6:b6de3000
[   46.324053]  r5:ee1c6a00
[   46.326607]  r4:c0248b58

[   46.330505] [<c039e810>] (full_proxy_read) from [<c021ec98>] (__vfs_read+0x34/0x118)
[   46.338262]  r9:edf52000
[   46.340635]  r8:c0107fc4
[   46.343190]  r7:00020000
[   46.344257]  r6:edf53f80
[   46.346812]  r5:c039e810
[   46.347879]  r4:ee1c6a00
[   46.350447] [<c021ec64>] (__vfs_read) from [<c021fbd0>] (vfs_read+0x8c/0x11c)
[   46.357597]  r9:edf52000
[   46.359969]  r8:c0107fc4
[   46.362524]  r7:edf53f80
[   46.363592]  r6:b6de3000
[   46.366147]  r5:ee1c6a00
[   46.367214]  r4:00020000
[   46.369782] [<c021fb44>] (vfs_read) from [<c0220a4c>] (SyS_read+0x4c/0xa8)
[   46.376672]  r8:c0107fc4
[   46.379045]  r7:00020000
[   46.381600]  r6:b6de3000
[   46.382667]  r5:ee1c6a00
[   46.385222]  r4:ee1c6a00

[   46.387817] [<c0220a00>] (SyS_read) from [<c0107e20>] (ret_fast_syscall+0x0/0x1c)
[   46.395314]  r7:00000003
[   46.397687]  r6:b6de3000
[   46.400243]  r5:00020000
[   46.401310]  r4:00020000

Fixes: 26c696c678c4 ("USB: Chipidea: rename struct ci13xxx variables from udc to ci")
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/usb/chipidea/core.c | 1 +
 drivers/usb/chipidea/udc.c  | 2 --
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 475c9c1..b77badb 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -381,6 +381,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
 		return -ENOMEM;
 	}
 
+	spin_lock_init(&ci->lock);
 	ci->dev = dev;
 	ci->platdata = dev->platform_data;
 	if (ci->platdata->phy)
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index f1cab42..45c8ffa 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1647,8 +1647,6 @@ static int udc_start(struct ci13xxx *ci)
 	struct device *dev = ci->dev;
 	int retval = 0;
 
-	spin_lock_init(&ci->lock);
-
 	ci->gadget.ops          = &usb_gadget_ops;
 	ci->gadget.speed        = USB_SPEED_UNKNOWN;
 	ci->gadget.max_speed    = USB_SPEED_HIGH;
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574181 — [PATCH 3.10 308/319] tile: avoid using clocksource_cyc2ns with absolute cycle count

From: Chris Metcalf <cmetcalf@mellanox.com>

commit e658a6f14d7c0243205f035979d0ecf6c12a036f upstream.

For large values of "mult" and long uptimes, the intermediate
result of "cycles * mult" can overflow 64 bits.  For example,
the tile platform calls clocksource_cyc2ns with a 1.2 GHz clock;
we have mult = 853, and after 208.5 days, we overflow 64 bits.

Since clocksource_cyc2ns() is intended to be used for relative
cycle counts, not absolute cycle counts, performance is more
importance than accepting a wider range of cycle values.  So,
just use mult_frac() directly in tile's sched_clock().

Commit 4cecf6d401a0 ("sched, x86: Avoid unnecessary overflow
in sched_clock") by Salman Qazi results in essentially the same
generated code for x86 as this change does for tile.  In fact,
a follow-on change by Salman introduced mult_frac() and switched
to using it, so the C code was largely identical at that point too.

Peter Zijlstra then added mul_u64_u32_shr() and switched x86
to use it.  This is, in principle, better; by optimizing the
64x64->64 multiplies to be 32x32->64 multiplies we can potentially
save some time.  However, the compiler piplines the 64x64->64
multiplies pretty well, and the conditional branch in the generic
mul_u64_u32_shr() causes some bubbles in execution, with the
result that it's pretty much a wash.  If tilegx provided its own
implementation of mul_u64_u32_shr() without the conditional branch,
we could potentially save 3 cycles, but that seems like small gain
for a fair amount of additional build scaffolding; no other platform
currently provides a mul_u64_u32_shr() override, and tile doesn't
currently have an <asm/div64.h> header to put the override in.

Additionally, gcc currently has an optimization bug that prevents
it from recognizing the opportunity to use a 32x32->64 multiply,
and so the result would be no better than the existing mult_frac()
until such time as the compiler is fixed.

For now, just using mult_frac() seems like the right answer.

Signed-off-by: Chris Metcalf <cmetcalf@mellanox.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 arch/tile/kernel/time.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/tile/kernel/time.c b/arch/tile/kernel/time.c
index 5ac397e..9df6d0d 100644
--- a/arch/tile/kernel/time.c
+++ b/arch/tile/kernel/time.c
@@ -215,8 +215,8 @@ void do_timer_interrupt(struct pt_regs *regs, int fault_num)
  */
 unsigned long long sched_clock(void)
 {
-	return clocksource_cyc2ns(get_cycles(),
-				  sched_clock_mult, SCHED_CLOCK_SHIFT);
+	return mult_frac(get_cycles(),
+			 sched_clock_mult, 1ULL << SCHED_CLOCK_SHIFT);
 }
 
 int setup_profiling_timer(unsigned int multiplier)
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574182 — [PATCH 3.10 289/319] mfd: core: Fix device reference leak in mfd_clone_cell

From: Johan Hovold <johan@kernel.org>

commit 722f191080de641f023feaa7d5648caf377844f5 upstream.

Make sure to drop the reference taken by bus_find_device_by_name()
before returning from mfd_clone_cell().

Fixes: a9bbba996302 ("mfd: add platform_device sharing support for mfd")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/mfd/mfd-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 7604f4e..af6a245 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -263,6 +263,8 @@ int mfd_clone_cell(const char *cell, const char **clones, size_t n_clones)
 					clones[i]);
 	}
 
+	put_device(dev);
+
 	return 0;
 }
 EXPORT_SYMBOL(mfd_clone_cell);
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574183 — [PATCH 3.10 300/319] gpio: mpc8xxx: Correct irq handler function

From: Liu Gang <Gang.Liu@nxp.com>

commit d71cf15b865bdd45925f7b094d169aaabd705145 upstream.

From the beginning of the gpio-mpc8xxx.c, the "handle_level_irq"
has being used to handle GPIO interrupts in the PowerPC/Layerscape
platforms. But actually, almost all PowerPC/Layerscape platforms
assert an interrupt request upon either a high-to-low change or
any change on the state of the signal.

So the "handle_level_irq" is not reasonable for PowerPC/Layerscape
GPIO interrupt, it should be "handle_edge_irq". Otherwise the system
may lost some interrupts from the PIN's state changes.

Signed-off-by: Liu Gang <Gang.Liu@nxp.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/gpio/gpio-mpc8xxx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
index 2aa3ca2..d5376aa 100644
--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
@@ -295,7 +295,7 @@ static int mpc8xxx_gpio_irq_map(struct irq_domain *h, unsigned int virq,
 		mpc8xxx_irq_chip.irq_set_type = mpc8xxx_gc->of_dev_id_data;
 
 	irq_set_chip_data(virq, h->host_data);
-	irq_set_chip_and_handler(virq, &mpc8xxx_irq_chip, handle_level_irq);
+	irq_set_chip_and_handler(virq, &mpc8xxx_irq_chip, handle_edge_irq);
 
 	return 0;
 }
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574184 — [PATCH 3.10 172/319] NFSv4: Open state recovery must account for file permission changes

From: Trond Myklebust <trond.myklebust@primarydata.com>

commit 304020fe48c6c7fff8b5a38f382b54404f0f79d3 upstream.

If the file permissions change on the server, then we may not be able to
recover open state. If so, we need to ensure that we mark the file
descriptor appropriately.

Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Tested-by: Oleg Drokin <green@linuxhacker.ru>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 fs/nfs/nfs4state.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 2bdaf57..7d45b38 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1464,6 +1464,9 @@ restart:
 					"Zeroing state\n", __func__, status);
 			case -ENOENT:
 			case -ENOMEM:
+			case -EACCES:
+			case -EROFS:
+			case -EIO:
 			case -ESTALE:
 				/*
 				 * Open state on this file cannot be recovered
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574185 — [PATCH 3.10 227/319] ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped

From: Eric Dumazet <edumazet@google.com>

commit 990ff4d84408fc55942ca6644f67e361737b3d8e upstream.

While fuzzing kernel with syzkaller, Andrey reported a nasty crash
in inet6_bind() caused by DCCP lacking a required method.

Fixes: ab1e0a13d7029 ("[SOCK] proto: Add hashinfo member to struct proto")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 net/dccp/ipv6.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index fb72107..94f8224 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -1014,6 +1014,7 @@ static const struct inet_connection_sock_af_ops dccp_ipv6_mapped = {
 	.getsockopt	   = ipv6_getsockopt,
 	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
 	.sockaddr_len	   = sizeof(struct sockaddr_in6),
+	.bind_conflict	   = inet6_csk_bind_conflict,
 #ifdef CONFIG_COMPAT
 	.compat_setsockopt = compat_ipv6_setsockopt,
 	.compat_getsockopt = compat_ipv6_getsockopt,
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574186 — [PATCH 3.10 221/319] ipv6: move DAD and addrconf_verify processing to workqueue

From: Hannes Frederic Sowa <hannes@stressinduktion.org>

commit c15b1ccadb323ea50023e8f1cca2954129a62b51 upstream.

addrconf_join_solict and addrconf_join_anycast may cause actions which
need rtnl locked, especially on first address creation.

A new DAD state is introduced which defers processing of the initial
DAD processing into a workqueue.

To get rtnl lock we need to push the code paths which depend on those
calls up to workqueues, specifically addrconf_verify and the DAD
processing.

(v2)
addrconf_dad_failure needs to be queued up to the workqueue, too. This
patch introduces a new DAD state and stop the DAD processing in the
workqueue (this is because of the possible ipv6_del_addr processing
which removes the solicited multicast address from the device).

addrconf_verify_lock is removed, too. After the transition it is not
needed any more.

As we are not processing in bottom half anymore we need to be a bit more
careful about disabling bottom half out when we lock spin_locks which are also
used in bh.

Relevant backtrace:
[  541.030090] RTNL: assertion failed at net/core/dev.c (4496)
[  541.031143] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O 3.10.33-1-amd64-vyatta #1
[  541.031145] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[  541.031146]  ffffffff8148a9f0 000000000000002f ffffffff813c98c1 ffff88007c4451f8
[  541.031148]  0000000000000000 0000000000000000 ffffffff813d3540 ffff88007fc03d18
[  541.031150]  0000880000000006 ffff88007c445000 ffffffffa0194160 0000000000000000
[  541.031152] Call Trace:
[  541.031153]  <IRQ>  [<ffffffff8148a9f0>] ? dump_stack+0xd/0x17
[  541.031180]  [<ffffffff813c98c1>] ? __dev_set_promiscuity+0x101/0x180
[  541.031183]  [<ffffffff813d3540>] ? __hw_addr_create_ex+0x60/0xc0
[  541.031185]  [<ffffffff813cfe1a>] ? __dev_set_rx_mode+0xaa/0xc0
[  541.031189]  [<ffffffff813d3a81>] ? __dev_mc_add+0x61/0x90
[  541.031198]  [<ffffffffa01dcf9c>] ? igmp6_group_added+0xfc/0x1a0 [ipv6]
[  541.031208]  [<ffffffff8111237b>] ? kmem_cache_alloc+0xcb/0xd0
[  541.031212]  [<ffffffffa01ddcd7>] ? ipv6_dev_mc_inc+0x267/0x300 [ipv6]
[  541.031216]  [<ffffffffa01c2fae>] ? addrconf_join_solict+0x2e/0x40 [ipv6]
[  541.031219]  [<ffffffffa01ba2e9>] ? ipv6_dev_ac_inc+0x159/0x1f0 [ipv6]
[  541.031223]  [<ffffffffa01c0772>] ? addrconf_join_anycast+0x92/0xa0 [ipv6]
[  541.031226]  [<ffffffffa01c311e>] ? __ipv6_ifa_notify+0x11e/0x1e0 [ipv6]
[  541.031229]  [<ffffffffa01c3213>] ? ipv6_ifa_notify+0x33/0x50 [ipv6]
[  541.031233]  [<ffffffffa01c36c8>] ? addrconf_dad_completed+0x28/0x100 [ipv6]
[  541.031241]  [<ffffffff81075c1d>] ? task_cputime+0x2d/0x50
[  541.031244]  [<ffffffffa01c38d6>] ? addrconf_dad_timer+0x136/0x150 [ipv6]
[  541.031247]  [<ffffffffa01c37a0>] ? addrconf_dad_completed+0x100/0x100 [ipv6]
[  541.031255]  [<ffffffff8105313a>] ? call_timer_fn.isra.22+0x2a/0x90
[  541.031258]  [<ffffffffa01c37a0>] ? addrconf_dad_completed+0x100/0x100 [ipv6]

Hunks and backtrace stolen from a patch by Stephen Hemminger.

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: <stable@vger.kernel.org> 
Cc: <stable@vger.kernel.org> 
[Mike Manning <mmanning@brocade.com>: resolved minor conflicts in addrconf.c]
Signed-off-by: Mike Manning <mmanning@brocade.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 include/net/if_inet6.h |   4 +-
 net/ipv6/addrconf.c    | 186 ++++++++++++++++++++++++++++++++++++-------------
 2 files changed, 141 insertions(+), 49 deletions(-)

diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 3b558c6..a49b650 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -31,8 +31,10 @@
 #define IF_PREFIX_AUTOCONF	0x02
 
 enum {
+	INET6_IFADDR_STATE_PREDAD,
 	INET6_IFADDR_STATE_DAD,
 	INET6_IFADDR_STATE_POSTDAD,
+	INET6_IFADDR_STATE_ERRDAD,
 	INET6_IFADDR_STATE_UP,
 	INET6_IFADDR_STATE_DEAD,
 };
@@ -58,7 +60,7 @@ struct inet6_ifaddr {
 	unsigned long		cstamp;	/* created timestamp */
 	unsigned long		tstamp; /* updated timestamp */
 
-	struct timer_list	dad_timer;
+	struct delayed_work	dad_work;
 
 	struct inet6_dev	*idev;
 	struct rt6_info		*rt;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 4ff6a9c..98dd353 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -139,10 +139,12 @@ static int ipv6_count_addresses(struct inet6_dev *idev);
 static struct hlist_head inet6_addr_lst[IN6_ADDR_HSIZE];
 static DEFINE_SPINLOCK(addrconf_hash_lock);
 
-static void addrconf_verify(unsigned long);
+static void addrconf_verify(void);
+static void addrconf_verify_rtnl(void);
+static void addrconf_verify_work(struct work_struct *);
 
-static DEFINE_TIMER(addr_chk_timer, addrconf_verify, 0, 0);
-static DEFINE_SPINLOCK(addrconf_verify_lock);
+static struct workqueue_struct *addrconf_wq;
+static DECLARE_DELAYED_WORK(addr_chk_work, addrconf_verify_work);
 
 static void addrconf_join_anycast(struct inet6_ifaddr *ifp);
 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp);
@@ -157,7 +159,7 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
 						  u32 flags, u32 noflags);
 
 static void addrconf_dad_start(struct inet6_ifaddr *ifp);
-static void addrconf_dad_timer(unsigned long data);
+static void addrconf_dad_work(struct work_struct *w);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
 static void addrconf_dad_run(struct inet6_dev *idev);
 static void addrconf_rs_timer(unsigned long data);
@@ -259,9 +261,9 @@ static void addrconf_del_rs_timer(struct inet6_dev *idev)
 		__in6_dev_put(idev);
 }
 
-static void addrconf_del_dad_timer(struct inet6_ifaddr *ifp)
+static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
 {
-	if (del_timer(&ifp->dad_timer))
+	if (cancel_delayed_work(&ifp->dad_work))
 		__in6_ifa_put(ifp);
 }
 
@@ -273,12 +275,12 @@ static void addrconf_mod_rs_timer(struct inet6_dev *idev,
 	mod_timer(&idev->rs_timer, jiffies + when);
 }
 
-static void addrconf_mod_dad_timer(struct inet6_ifaddr *ifp,
-				   unsigned long when)
+static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
+				   unsigned long delay)
 {
-	if (!timer_pending(&ifp->dad_timer))
+	if (!delayed_work_pending(&ifp->dad_work))
 		in6_ifa_hold(ifp);
-	mod_timer(&ifp->dad_timer, jiffies + when);
+	mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
 }
 
 static int snmp6_alloc_dev(struct inet6_dev *idev)
@@ -773,8 +775,9 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
 
 	in6_dev_put(ifp->idev);
 
-	if (del_timer(&ifp->dad_timer))
-		pr_notice("Timer is still running, when freeing ifa=%p\n", ifp);
+	if (cancel_delayed_work(&ifp->dad_work))
+		pr_notice("delayed DAD work was pending while freeing ifa=%p\n",
+			  ifp);
 
 	if (ifp->state != INET6_IFADDR_STATE_DEAD) {
 		pr_warn("Freeing alive inet6 address %p\n", ifp);
@@ -866,8 +869,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
 
 	spin_lock_init(&ifa->lock);
 	spin_lock_init(&ifa->state_lock);
-	setup_timer(&ifa->dad_timer, addrconf_dad_timer,
-		    (unsigned long)ifa);
+	INIT_DELAYED_WORK(&ifa->dad_work, addrconf_dad_work);
 	INIT_HLIST_NODE(&ifa->addr_lst);
 	ifa->scope = scope;
 	ifa->prefix_len = pfxlen;
@@ -927,6 +929,8 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
 	int deleted = 0, onlink = 0;
 	unsigned long expires = jiffies;
 
+	ASSERT_RTNL();
+
 	spin_lock_bh(&ifp->state_lock);
 	state = ifp->state;
 	ifp->state = INET6_IFADDR_STATE_DEAD;
@@ -991,7 +995,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
 	}
 	write_unlock_bh(&idev->lock);
 
-	addrconf_del_dad_timer(ifp);
+	addrconf_del_dad_work(ifp);
 
 	ipv6_ifa_notify(RTM_DELADDR, ifp);
 
@@ -1614,7 +1618,7 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
 {
 	if (ifp->flags&IFA_F_PERMANENT) {
 		spin_lock_bh(&ifp->lock);
-		addrconf_del_dad_timer(ifp);
+		addrconf_del_dad_work(ifp);
 		ifp->flags |= IFA_F_TENTATIVE;
 		if (dad_failed)
 			ifp->flags |= IFA_F_DADFAILED;
@@ -1637,20 +1641,21 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
 		}
 		ipv6_del_addr(ifp);
 #endif
-	} else
+	} else {
 		ipv6_del_addr(ifp);
+	}
 }
 
 static int addrconf_dad_end(struct inet6_ifaddr *ifp)
 {
 	int err = -ENOENT;
 
-	spin_lock(&ifp->state_lock);
+	spin_lock_bh(&ifp->state_lock);
 	if (ifp->state == INET6_IFADDR_STATE_DAD) {
 		ifp->state = INET6_IFADDR_STATE_POSTDAD;
 		err = 0;
 	}
-	spin_unlock(&ifp->state_lock);
+	spin_unlock_bh(&ifp->state_lock);
 
 	return err;
 }
@@ -1683,7 +1688,12 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
 		}
 	}
 
-	addrconf_dad_stop(ifp, 1);
+	spin_lock_bh(&ifp->state_lock);
+	/* transition from _POSTDAD to _ERRDAD */
+	ifp->state = INET6_IFADDR_STATE_ERRDAD;
+	spin_unlock_bh(&ifp->state_lock);
+
+	addrconf_mod_dad_work(ifp, 0);
 }
 
 /* Join to solicited addr multicast group. */
@@ -1692,6 +1702,8 @@ void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
 {
 	struct in6_addr maddr;
 
+	ASSERT_RTNL();
+
 	if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))
 		return;
 
@@ -1703,6 +1715,8 @@ void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
 {
 	struct in6_addr maddr;
 
+	ASSERT_RTNL();
+
 	if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP))
 		return;
 
@@ -1713,6 +1727,9 @@ void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
 static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
 {
 	struct in6_addr addr;
+
+	ASSERT_RTNL();
+
 	if (ifp->prefix_len == 127) /* RFC 6164 */
 		return;
 	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
@@ -1724,6 +1741,9 @@ static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
 {
 	struct in6_addr addr;
+
+	ASSERT_RTNL();
+
 	if (ifp->prefix_len == 127) /* RFC 6164 */
 		return;
 	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
@@ -2358,7 +2378,7 @@ ok:
 			}
 #endif
 			in6_ifa_put(ifp);
-			addrconf_verify(0);
+			addrconf_verify();
 		}
 	}
 	inet6_prefix_notify(RTM_NEWPREFIX, in6_dev, pinfo);
@@ -2501,7 +2521,7 @@ static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *p
 		 */
 		addrconf_dad_start(ifp);
 		in6_ifa_put(ifp);
-		addrconf_verify(0);
+		addrconf_verify_rtnl();
 		return 0;
 	}
 
@@ -3082,7 +3102,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 		hlist_for_each_entry_rcu(ifa, h, addr_lst) {
 			if (ifa->idev == idev) {
 				hlist_del_init_rcu(&ifa->addr_lst);
-				addrconf_del_dad_timer(ifa);
+				addrconf_del_dad_work(ifa);
 				goto restart;
 			}
 		}
@@ -3122,7 +3142,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 	while (!list_empty(&idev->addr_list)) {
 		ifa = list_first_entry(&idev->addr_list,
 				       struct inet6_ifaddr, if_list);
-		addrconf_del_dad_timer(ifa);
+		addrconf_del_dad_work(ifa);
 
 		list_del(&ifa->if_list);
 
@@ -3217,10 +3237,10 @@ static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
 		rand_num = net_random() % (idev->cnf.rtr_solicit_delay ? : 1);
 
 	ifp->dad_probes = idev->cnf.dad_transmits;
-	addrconf_mod_dad_timer(ifp, rand_num);
+	addrconf_mod_dad_work(ifp, rand_num);
 }
 
-static void addrconf_dad_start(struct inet6_ifaddr *ifp)
+static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
 {
 	struct inet6_dev *idev = ifp->idev;
 	struct net_device *dev = idev->dev;
@@ -3272,25 +3292,68 @@ out:
 	read_unlock_bh(&idev->lock);
 }
 
-static void addrconf_dad_timer(unsigned long data)
+static void addrconf_dad_start(struct inet6_ifaddr *ifp)
+{
+	bool begin_dad = false;
+
+	spin_lock_bh(&ifp->state_lock);
+	if (ifp->state != INET6_IFADDR_STATE_DEAD) {
+		ifp->state = INET6_IFADDR_STATE_PREDAD;
+		begin_dad = true;
+	}
+	spin_unlock_bh(&ifp->state_lock);
+
+	if (begin_dad)
+		addrconf_mod_dad_work(ifp, 0);
+}
+
+static void addrconf_dad_work(struct work_struct *w)
 {
-	struct inet6_ifaddr *ifp = (struct inet6_ifaddr *) data;
+	struct inet6_ifaddr *ifp = container_of(to_delayed_work(w),
+						struct inet6_ifaddr,
+						dad_work);
 	struct inet6_dev *idev = ifp->idev;
 	struct in6_addr mcaddr;
 
+	enum {
+		DAD_PROCESS,
+		DAD_BEGIN,
+		DAD_ABORT,
+	} action = DAD_PROCESS;
+
+	rtnl_lock();
+
+	spin_lock_bh(&ifp->state_lock);
+	if (ifp->state == INET6_IFADDR_STATE_PREDAD) {
+		action = DAD_BEGIN;
+		ifp->state = INET6_IFADDR_STATE_DAD;
+	} else if (ifp->state == INET6_IFADDR_STATE_ERRDAD) {
+		action = DAD_ABORT;
+		ifp->state = INET6_IFADDR_STATE_POSTDAD;
+	}
+	spin_unlock_bh(&ifp->state_lock);
+
+	if (action == DAD_BEGIN) {
+		addrconf_dad_begin(ifp);
+		goto out;
+	} else if (action == DAD_ABORT) {
+		addrconf_dad_stop(ifp, 1);
+		goto out;
+	}
+
 	if (!ifp->dad_probes && addrconf_dad_end(ifp))
 		goto out;
 
-	write_lock(&idev->lock);
+	write_lock_bh(&idev->lock);
 	if (idev->dead || !(idev->if_flags & IF_READY)) {
-		write_unlock(&idev->lock);
+		write_unlock_bh(&idev->lock);
 		goto out;
 	}
 
 	spin_lock(&ifp->lock);
 	if (ifp->state == INET6_IFADDR_STATE_DEAD) {
 		spin_unlock(&ifp->lock);
-		write_unlock(&idev->lock);
+		write_unlock_bh(&idev->lock);
 		goto out;
 	}
 
@@ -3301,7 +3364,7 @@ static void addrconf_dad_timer(unsigned long data)
 
 		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
 		spin_unlock(&ifp->lock);
-		write_unlock(&idev->lock);
+		write_unlock_bh(&idev->lock);
 
 		addrconf_dad_completed(ifp);
 
@@ -3309,15 +3372,16 @@ static void addrconf_dad_timer(unsigned long data)
 	}
 
 	ifp->dad_probes--;
-	addrconf_mod_dad_timer(ifp, ifp->idev->nd_parms->retrans_time);
+	addrconf_mod_dad_work(ifp, ifp->idev->nd_parms->retrans_time);
 	spin_unlock(&ifp->lock);
-	write_unlock(&idev->lock);
+	write_unlock_bh(&idev->lock);
 
 	/* send a neighbour solicitation for our addr */
 	addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
 	ndisc_send_ns(ifp->idev->dev, NULL, &ifp->addr, &mcaddr, &in6addr_any);
 out:
 	in6_ifa_put(ifp);
+	rtnl_unlock();
 }
 
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
@@ -3325,7 +3389,7 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
 	struct net_device *dev = ifp->idev->dev;
 	struct in6_addr lladdr;
 
-	addrconf_del_dad_timer(ifp);
+	addrconf_del_dad_work(ifp);
 
 	/*
 	 *	Configure the address for reception. Now it is valid.
@@ -3557,23 +3621,23 @@ int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
  *	Periodic address status verification
  */
 
-static void addrconf_verify(unsigned long foo)
+static void addrconf_verify_rtnl(void)
 {
 	unsigned long now, next, next_sec, next_sched;
 	struct inet6_ifaddr *ifp;
 	int i;
 
+	ASSERT_RTNL();
+
 	rcu_read_lock_bh();
-	spin_lock(&addrconf_verify_lock);
 	now = jiffies;
 	next = round_jiffies_up(now + ADDR_CHECK_FREQUENCY);
 
-	del_timer(&addr_chk_timer);
+	cancel_delayed_work(&addr_chk_work);
 
 	for (i = 0; i < IN6_ADDR_HSIZE; i++) {
 restart:
-		hlist_for_each_entry_rcu_bh(ifp,
-					 &inet6_addr_lst[i], addr_lst) {
+		hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[i], addr_lst) {
 			unsigned long age;
 
 			if (ifp->flags & IFA_F_PERMANENT)
@@ -3664,13 +3728,22 @@ restart:
 
 	ADBG((KERN_DEBUG "now = %lu, schedule = %lu, rounded schedule = %lu => %lu\n",
 	      now, next, next_sec, next_sched));
-
-	addr_chk_timer.expires = next_sched;
-	add_timer(&addr_chk_timer);
-	spin_unlock(&addrconf_verify_lock);
+	mod_delayed_work(addrconf_wq, &addr_chk_work, next_sched - now);
 	rcu_read_unlock_bh();
 }
 
+static void addrconf_verify_work(struct work_struct *w)
+{
+	rtnl_lock();
+	addrconf_verify_rtnl();
+	rtnl_unlock();
+}
+
+static void addrconf_verify(void)
+{
+	mod_delayed_work(addrconf_wq, &addr_chk_work, 0);
+}
+
 static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local)
 {
 	struct in6_addr *pfx = NULL;
@@ -3722,6 +3795,8 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
 	clock_t expires;
 	unsigned long timeout;
 
+	ASSERT_RTNL();
+
 	if (!valid_lft || (prefered_lft > valid_lft))
 		return -EINVAL;
 
@@ -3755,7 +3830,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
 
 	addrconf_prefix_route(&ifp->addr, ifp->prefix_len, ifp->idev->dev,
 			      expires, flags);
-	addrconf_verify(0);
+	addrconf_verify_rtnl();
 
 	return 0;
 }
@@ -4364,6 +4439,8 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
 	bool update_rs = false;
 	struct in6_addr ll_addr;
 
+	ASSERT_RTNL();
+
 	if (token == NULL)
 		return -EINVAL;
 	if (ipv6_addr_any(token))
@@ -4409,6 +4486,7 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
 	}
 
 	write_unlock_bh(&idev->lock);
+	addrconf_verify_rtnl();
 	return 0;
 }
 
@@ -4610,6 +4688,9 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 {
 	struct net *net = dev_net(ifp->idev->dev);
 
+	if (event)
+		ASSERT_RTNL();
+
 	inet6_ifa_notify(event ? : RTM_NEWADDR, ifp);
 
 	switch (event) {
@@ -5138,6 +5219,12 @@ int __init addrconf_init(void)
 	if (err < 0)
 		goto out_addrlabel;
 
+	addrconf_wq = create_workqueue("ipv6_addrconf");
+	if (!addrconf_wq) {
+		err = -ENOMEM;
+		goto out_nowq;
+	}
+
 	/* The addrconf netdev notifier requires that loopback_dev
 	 * has it's ipv6 private information allocated and setup
 	 * before it can bring up and give link-local addresses
@@ -5168,7 +5255,7 @@ int __init addrconf_init(void)
 
 	register_netdevice_notifier(&ipv6_dev_notf);
 
-	addrconf_verify(0);
+	addrconf_verify();
 
 	err = rtnl_af_register(&inet6_ops);
 	if (err < 0)
@@ -5199,6 +5286,8 @@ errout:
 errout_af:
 	unregister_netdevice_notifier(&ipv6_dev_notf);
 errlo:
+	destroy_workqueue(addrconf_wq);
+out_nowq:
 	unregister_pernet_subsys(&addrconf_ops);
 out_addrlabel:
 	ipv6_addr_label_cleanup();
@@ -5234,7 +5323,8 @@ void addrconf_cleanup(void)
 	for (i = 0; i < IN6_ADDR_HSIZE; i++)
 		WARN_ON(!hlist_empty(&inet6_addr_lst[i]));
 	spin_unlock_bh(&addrconf_hash_lock);
-
-	del_timer(&addr_chk_timer);
+	cancel_delayed_work(&addr_chk_work);
 	rtnl_unlock();
+
+	destroy_workqueue(addrconf_wq);
 }
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574187 — [PATCH 3.10 183/319] Input: i8042 - break load dependency between atkbd/psmouse and i8042

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit 4097461897df91041382ff6fcd2bfa7ee6b2448c upstream.

As explained in 1407814240-4275-1-git-send-email-decui@microsoft.com we
have a hard load dependency between i8042 and atkbd which prevents
keyboard from working on Gen2 Hyper-V VMs.

> hyperv_keyboard invokes serio_interrupt(), which needs a valid serio
> driver like atkbd.c.  atkbd.c depends on libps2.c because it invokes
> ps2_command().  libps2.c depends on i8042.c because it invokes
> i8042_check_port_owner().  As a result, hyperv_keyboard actually
> depends on i8042.c.
>
> For a Generation 2 Hyper-V VM (meaning no i8042 device emulated), if a
> Linux VM (like Arch Linux) happens to configure CONFIG_SERIO_I8042=m
> rather than =y, atkbd.ko can't load because i8042.ko can't load(due to
> no i8042 device emulated) and finally hyperv_keyboard can't work and
> the user can't input: https://bugs.archlinux.org/task/39820
> (Ubuntu/RHEL/SUSE aren't affected since they use CONFIG_SERIO_I8042=y)

To break the dependency we move away from using i8042_check_port_owner()
and instead allow serio port owner specify a mutex that clients should use
to serialize PS/2 command stream.

Reported-by: Mark Laws <mdl@60hz.org>
Tested-by: Mark Laws <mdl@60hz.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/input/serio/i8042.c  | 16 +---------------
 drivers/input/serio/libps2.c | 10 ++++------
 include/linux/i8042.h        |  6 ------
 include/linux/serio.h        | 24 +++++++++++++++++++-----
 4 files changed, 24 insertions(+), 32 deletions(-)

diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 9870c54..2513c8a 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -1223,6 +1223,7 @@ static int __init i8042_create_kbd_port(void)
 	serio->start		= i8042_start;
 	serio->stop		= i8042_stop;
 	serio->close		= i8042_port_close;
+	serio->ps2_cmd_mutex	= &i8042_mutex;
 	serio->port_data	= port;
 	serio->dev.parent	= &i8042_platform_device->dev;
 	strlcpy(serio->name, "i8042 KBD port", sizeof(serio->name));
@@ -1310,21 +1311,6 @@ static void i8042_unregister_ports(void)
 	}
 }
 
-/*
- * Checks whether port belongs to i8042 controller.
- */
-bool i8042_check_port_owner(const struct serio *port)
-{
-	int i;
-
-	for (i = 0; i < I8042_NUM_PORTS; i++)
-		if (i8042_ports[i].serio == port)
-			return true;
-
-	return false;
-}
-EXPORT_SYMBOL(i8042_check_port_owner);
-
 static void i8042_free_irqs(void)
 {
 	if (i8042_aux_irq_registered)
diff --git a/drivers/input/serio/libps2.c b/drivers/input/serio/libps2.c
index 07a8363..b5ec313 100644
--- a/drivers/input/serio/libps2.c
+++ b/drivers/input/serio/libps2.c
@@ -57,19 +57,17 @@ EXPORT_SYMBOL(ps2_sendbyte);
 
 void ps2_begin_command(struct ps2dev *ps2dev)
 {
-	mutex_lock(&ps2dev->cmd_mutex);
+	struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex;
 
-	if (i8042_check_port_owner(ps2dev->serio))
-		i8042_lock_chip();
+	mutex_lock(m);
 }
 EXPORT_SYMBOL(ps2_begin_command);
 
 void ps2_end_command(struct ps2dev *ps2dev)
 {
-	if (i8042_check_port_owner(ps2dev->serio))
-		i8042_unlock_chip();
+	struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex;
 
-	mutex_unlock(&ps2dev->cmd_mutex);
+	mutex_unlock(m);
 }
 EXPORT_SYMBOL(ps2_end_command);
 
diff --git a/include/linux/i8042.h b/include/linux/i8042.h
index a986ff5..801c307 100644
--- a/include/linux/i8042.h
+++ b/include/linux/i8042.h
@@ -38,7 +38,6 @@ struct serio;
 void i8042_lock_chip(void);
 void i8042_unlock_chip(void);
 int i8042_command(unsigned char *param, int command);
-bool i8042_check_port_owner(const struct serio *);
 int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str,
 					struct serio *serio));
 int i8042_remove_filter(bool (*filter)(unsigned char data, unsigned char str,
@@ -59,11 +58,6 @@ static inline int i8042_command(unsigned char *param, int command)
 	return -ENODEV;
 }
 
-static inline bool i8042_check_port_owner(const struct serio *serio)
-{
-	return false;
-}
-
 static inline int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str,
 					struct serio *serio))
 {
diff --git a/include/linux/serio.h b/include/linux/serio.h
index 36aac73..deffa474 100644
--- a/include/linux/serio.h
+++ b/include/linux/serio.h
@@ -28,7 +28,8 @@ struct serio {
 
 	struct serio_device_id id;
 
-	spinlock_t lock;		/* protects critical sections from port's interrupt handler */
+	/* Protects critical sections from port's interrupt handler */
+	spinlock_t lock;
 
 	int (*write)(struct serio *, unsigned char);
 	int (*open)(struct serio *);
@@ -37,16 +38,29 @@ struct serio {
 	void (*stop)(struct serio *);
 
 	struct serio *parent;
-	struct list_head child_node;	/* Entry in parent->children list */
+	/* Entry in parent->children list */
+	struct list_head child_node;
 	struct list_head children;
-	unsigned int depth;		/* level of nesting in serio hierarchy */
+	/* Level of nesting in serio hierarchy */
+	unsigned int depth;
 
-	struct serio_driver *drv;	/* accessed from interrupt, must be protected by serio->lock and serio->sem */
-	struct mutex drv_mutex;		/* protects serio->drv so attributes can pin driver */
+	/*
+	 * serio->drv is accessed from interrupt handlers; when modifying
+	 * caller should acquire serio->drv_mutex and serio->lock.
+	 */
+	struct serio_driver *drv;
+	/* Protects serio->drv so attributes can pin current driver */
+	struct mutex drv_mutex;
 
 	struct device dev;
 
 	struct list_head node;
+
+	/*
+	 * For use by PS/2 layer when several ports share hardware and
+	 * may get indigestion when exposed to concurrent access (i8042).
+	 */
+	struct mutex *ps2_cmd_mutex;
 };
 #define to_serio_port(d)	container_of(d, struct serio, dev)
 
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574189 — [PATCH 3.10 319/319] metag: Only define atomic_dec_if_positive conditionally

From: Guenter Roeck <linux@roeck-us.net>

commit 35d04077ad96ed33ceea2501f5a4f1eacda77218 upstream.

The definition of atomic_dec_if_positive() assumes that
atomic_sub_if_positive() exists, which is only the case if
metag specific atomics are used. This results in the following
build error when trying to build metag1_defconfig.

kernel/ucount.c: In function 'dec_ucount':
kernel/ucount.c:211: error:
	implicit declaration of function 'atomic_sub_if_positive'

Moving the definition of atomic_dec_if_positive() into the metag
conditional code fixes the problem.

Fixes: 6006c0d8ce94 ("metag: Atomics, locks and bitops")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 arch/metag/include/asm/atomic.h | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/metag/include/asm/atomic.h b/arch/metag/include/asm/atomic.h
index 307ecd2..d7d6b9e 100644
--- a/arch/metag/include/asm/atomic.h
+++ b/arch/metag/include/asm/atomic.h
@@ -38,6 +38,7 @@
 #define atomic_dec(v) atomic_sub(1, (v))
 
 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
+#define atomic_dec_if_positive(v)       atomic_sub_if_positive(1, v)
 
 #define smp_mb__before_atomic_dec()	barrier()
 #define smp_mb__after_atomic_dec()	barrier()
@@ -46,8 +47,6 @@
 
 #endif
 
-#define atomic_dec_if_positive(v)       atomic_sub_if_positive(1, v)
-
 #include <asm-generic/atomic64.h>
 
 #endif /* __ASM_METAG_ATOMIC_H */
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574191 — [PATCH 3.10 108/319] USB: fix typo in wMaxPacketSize validation

From: Alan Stern <stern@rowland.harvard.edu>

commit 6c73358c83ce870c0cf32413e5cadb3b9a39c606 upstream.

The maximum value allowed for wMaxPacketSize of a high-speed interrupt
endpoint is 1024 bytes, not 1023.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: aed9d65ac327 ("USB: validate wMaxPacketValue entries in endpoint descriptors")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/usb/core/config.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index ecb2acb..b7ba1f9 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -160,7 +160,7 @@ static const unsigned short high_speed_maxpacket_maxes[4] = {
 	[USB_ENDPOINT_XFER_CONTROL] = 64,
 	[USB_ENDPOINT_XFER_ISOC] = 1024,
 	[USB_ENDPOINT_XFER_BULK] = 512,
-	[USB_ENDPOINT_XFER_INT] = 1023,
+	[USB_ENDPOINT_XFER_INT] = 1024,
 };
 static const unsigned short super_speed_maxpacket_maxes[4] = {
 	[USB_ENDPOINT_XFER_CONTROL] = 512,
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574192 — [PATCH 3.10 161/319] ocfs2/dlm: fix race between convert and migration

From: Joseph Qi <joseph.qi@huawei.com>

commit e6f0c6e6170fec175fe676495f29029aecdf486c upstream.

Commit ac7cf246dfdb ("ocfs2/dlm: fix race between convert and recovery")
checks if lockres master has changed to identify whether new master has
finished recovery or not.  This will introduce a race that right after
old master does umount ( means master will change), a new convert
request comes.

In this case, it will reset lockres state to DLM_RECOVERING and then
retry convert, and then fail with lockres->l_action being set to
OCFS2_AST_INVALID, which will cause inconsistent lock level between
ocfs2 and dlm, and then finally BUG.

Since dlm recovery will clear lock->convert_pending in
dlm_move_lockres_to_recovery_list, we can use it to correctly identify
the race case between convert and recovery.  So fix it.

Fixes: ac7cf246dfdb ("ocfs2/dlm: fix race between convert and recovery")
Link: http://lkml.kernel.org/r/57CE1569.8010704@huawei.com
Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Signed-off-by: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mfasheh@versity.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 fs/ocfs2/dlm/dlmconvert.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
index f65bdcf..6d97883 100644
--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -265,7 +265,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
 				  struct dlm_lock *lock, int flags, int type)
 {
 	enum dlm_status status;
-	u8 old_owner = res->owner;
 
 	mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type,
 	     lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS);
@@ -332,7 +331,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
 
 	spin_lock(&res->spinlock);
 	res->state &= ~DLM_LOCK_RES_IN_PROGRESS;
-	lock->convert_pending = 0;
 	/* if it failed, move it back to granted queue.
 	 * if master returns DLM_NORMAL and then down before sending ast,
 	 * it may have already been moved to granted queue, reset to
@@ -341,12 +339,14 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
 		if (status != DLM_NOTQUEUED)
 			dlm_error(status);
 		dlm_revert_pending_convert(res, lock);
-	} else if ((res->state & DLM_LOCK_RES_RECOVERING) ||
-			(old_owner != res->owner)) {
-		mlog(0, "res %.*s is in recovering or has been recovered.\n",
-				res->lockname.len, res->lockname.name);
+	} else if (!lock->convert_pending) {
+		mlog(0, "%s: res %.*s, owner died and lock has been moved back "
+				"to granted list, retry convert.\n",
+				dlm->name, res->lockname.len, res->lockname.name);
 		status = DLM_RECOVERING;
 	}
+
+	lock->convert_pending = 0;
 bail:
 	spin_unlock(&res->spinlock);
 
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574193 — [PATCH 3.10 266/319] mac80211: fix purging multicast PS buffer queue

From: Felix Fietkau <nbd@nbd.name>

commit 6b07d9ca9b5363dda959b9582a3fc9c0b89ef3b5 upstream.

The code currently assumes that buffered multicast PS frames don't have
a pending ACK frame for tx status reporting.
However, hostapd sends a broadcast deauth frame on teardown for which tx
status is requested. This can lead to the "Have pending ack frames"
warning on module reload.
Fix this by using ieee80211_free_txskb/ieee80211_purge_tx_queue.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 net/mac80211/cfg.c | 2 +-
 net/mac80211/tx.c  | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index e922bf3..11a10d5 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1072,7 +1072,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 
 	/* free all potentially still buffered bcast frames */
 	local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
-	skb_queue_purge(&sdata->u.ap.ps.bc_buf);
+	ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf);
 
 	ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
 	ieee80211_vif_release_channel(sdata);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e960fbe..1299053 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -335,7 +335,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
 		skb = skb_dequeue(&ps->bc_buf);
 		if (skb) {
 			purged++;
-			dev_kfree_skb(skb);
+			ieee80211_free_txskb(&local->hw, skb);
 		}
 		total += skb_queue_len(&ps->bc_buf);
 	}
@@ -417,7 +417,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
 	if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
 		ps_dbg(tx->sdata,
 		       "BC TX buffer full - dropping the oldest frame\n");
-		dev_kfree_skb(skb_dequeue(&ps->bc_buf));
+		ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));
 	} else
 		tx->local->total_ps_buffered++;
 
@@ -2711,7 +2711,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
 			sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
 		if (!ieee80211_tx_prepare(sdata, &tx, skb))
 			break;
-		dev_kfree_skb_any(skb);
+		ieee80211_free_txskb(hw, skb);
 	}
 
 	info = IEEE80211_SKB_CB(skb);
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574194 — [PATCH 3.10 134/319] zfcp: restore: Dont use 0 to indicate invalid LUN in rec trace

From: Steffen Maier <maier@linux.vnet.ibm.com>

commit 0102a30a6ff60f4bb4c07358ca3b1f92254a6c25 upstream.

bring back
commit d21e9daa63e009ce5b87bbcaa6d11ce48e07bbbe
("[SCSI] zfcp: Dont use 0 to indicate invalid LUN in rec trace")
which was lost with
commit ae0904f60fab7cb20c48d32eefdd735e478b91fb
("[SCSI] zfcp: Redesign of the debug tracing for recovery actions.")

Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
Fixes: ae0904f60fab ("[SCSI] zfcp: Redesign of the debug tracing for recovery actions.")
Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/s390/scsi/zfcp_dbf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index 8f668c6..394d5d4 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -234,7 +234,8 @@ static void zfcp_dbf_set_common(struct zfcp_dbf_rec *rec,
 	if (sdev) {
 		rec->lun_status = atomic_read(&sdev_to_zfcp(sdev)->status);
 		rec->lun = zfcp_scsi_dev_lun(sdev);
-	}
+	} else
+		rec->lun = ZFCP_DBF_INVALID_LUN;
 }
 
 /**
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574195 — [PATCH 3.10 212/319] tty: Prevent ldisc drivers from re-using stale tty fields

From: Peter Hurley <peter@hurleysoftware.com>

commit dd42bf1197144ede075a9d4793123f7689e164bc upstream.

Line discipline drivers may mistakenly misuse ldisc-related fields
when initializing. For example, a failure to initialize tty->receive_room
in the N_GIGASET_M101 line discipline was recently found and fixed [1].
Now, the N_X25 line discipline has been discovered accessing the previous
line discipline's already-freed private data [2].

Harden the ldisc interface against misuse by initializing revelant
tty fields before instancing the new line discipline.

[1]
    commit fd98e9419d8d622a4de91f76b306af6aa627aa9c
    Author: Tilman Schmidt <tilman@imap.cc>
    Date:   Tue Jul 14 00:37:13 2015 +0200

    isdn/gigaset: reset tty->receive_room when attaching ser_gigaset

[2] Report from Sasha Levin <sasha.levin@oracle.com>
    [  634.336761] ==================================================================
    [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
    [  634.339558] Read of size 4 by task syzkaller_execu/8981
    [  634.340359] =============================================================================
    [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
    ...
    [  634.405018] Call Trace:
    [  634.405277] dump_stack (lib/dump_stack.c:52)
    [  634.405775] print_trailer (mm/slub.c:655)
    [  634.406361] object_err (mm/slub.c:662)
    [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
    [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
    [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
    [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
    [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
    [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
    [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
    [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
    [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)

Cc: Tilman Schmidt <tilman@imap.cc>
Cc: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[wt: adjust context]

Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/tty/tty_ldisc.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 1afe192..b5cbe12 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -400,6 +400,10 @@ EXPORT_SYMBOL_GPL(tty_ldisc_flush);
  *	they are not on hot paths so a little discipline won't do
  *	any harm.
  *
+ *	The line discipline-related tty_struct fields are reset to
+ *	prevent the ldisc driver from re-using stale information for
+ *	the new ldisc instance.
+ *
  *	Locking: takes termios_mutex
  */
 
@@ -408,6 +412,9 @@ static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
 	mutex_lock(&tty->termios_mutex);
 	tty->termios.c_line = num;
 	mutex_unlock(&tty->termios_mutex);
+
+	tty->disc_data = NULL;
+	tty->receive_room = 0;
 }
 
 /**
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574196 — [PATCH 3.10 244/319] brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill

From: Florian Fainelli <f.fainelli@gmail.com>

commit 5c5fa1f464ac954982df1d96b9f9a5103d21aedd upstream.

In case dma_mapping_error() returns an error in dma_rxfill, we would be
leaking a packet that we allocated with brcmu_pkt_buf_get_skb().

Reported-by: coverity (CID 1081819)
Fixes: 67d0cf50bd32 ("brcmsmac: Fix WARNING caused by lack of calls to dma_mapping_error()")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/net/wireless/brcm80211/brcmsmac/dma.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
index 4fb9635..7660b52 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
@@ -1079,8 +1079,10 @@ bool dma_rxfill(struct dma_pub *pub)
 
 		pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
 				    DMA_FROM_DEVICE);
-		if (dma_mapping_error(di->dmadev, pa))
+		if (dma_mapping_error(di->dmadev, pa)) {
+			brcmu_pkt_buf_free_skb(p);
 			return false;
+		}
 
 		/* save the free packet pointer */
 		di->rxp[rxout] = p;
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574198 — [PATCH 3.10 142/319] mpt2sas: Fix secure erase premature termination

From: Andrey Grodzovsky <andrey2805@gmail.com>

Problem:
This is a work around for a bug with LSI Fusion MPT SAS2 when
pefroming secure erase. Due to the very long time the operation
takes commands issued during the erase will time out and will trigger
execution of abort hook. Even though the abort hook is called for
the specific command which timed out this leads to entire device halt
(scsi_state terminated) and premature termination of the secured erase.

Fix:
Set device state to busy while erase in progress to reject any incoming
commands until the erase is done. The device is blocked any way during
this time and cannot execute any other command.
More data and logs can be found here -
https://drive.google.com/file/d/0B9ocOHYHbbS1Q3VMdkkzeWFkTjg/view

P.S
This is a backport from the same fix for mpt3sas driver intended
for pre-4.4 stable trees.

Signed-off-by: Andrey Grodzovsky <andrey2805@gmail.com>
Cc: Sreekanth Reddy <Sreekanth.Reddy@broadcom.com>
Cc: Hannes Reinecke <hare@suse.de>
Cc: PDL-MPT-FUSIONLINUX <MPT-FusionLinux.pdl@broadcom.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/scsi/mpt2sas/mpt2sas_scsih.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index fe76185..64caa5c 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -3926,6 +3926,11 @@ _scsih_setup_direct_io(struct MPT2SAS_ADAPTER *ioc, struct scsi_cmnd *scmd,
 	}
 }
 
+static inline bool ata_12_16_cmd(struct scsi_cmnd *scmd)
+{
+	return (scmd->cmnd[0] == ATA_12 || scmd->cmnd[0] == ATA_16);
+}
+
 /**
  * _scsih_qcmd - main scsi request entry point
  * @scmd: pointer to scsi command object
@@ -3948,6 +3953,13 @@ _scsih_qcmd_lck(struct scsi_cmnd *scmd, void (*done)(struct scsi_cmnd *))
 	u32 mpi_control;
 	u16 smid;
 
+	/**
+	* Lock the device for any subsequent command until
+	* command is done.
+	*/
+	if (ata_12_16_cmd(scmd))
+		scsi_internal_device_block(scmd->device);
+
 	scmd->scsi_done = done;
 	sas_device_priv_data = scmd->device->hostdata;
 	if (!sas_device_priv_data || !sas_device_priv_data->sas_target) {
@@ -4454,6 +4466,9 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
 	if (scmd == NULL)
 		return 1;
 
+	if (ata_12_16_cmd(scmd))
+		scsi_internal_device_unblock(scmd->device, SDEV_RUNNING);
+
 	mpi_request = mpt2sas_base_get_msg_frame(ioc, smid);
 
 	if (mpi_reply == NULL) {
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1574200 — [PATCH 3.10 171/319] NFS: Don't drop CB requests with invalid principals

From: Chuck Lever <chuck.lever@oracle.com>

commit a4e187d83d88eeaba6252aac0a2ffe5eaa73a818 upstream.

Before commit 778be232a207 ("NFS do not find client in NFSv4
pg_authenticate"), the Linux callback server replied with
RPC_AUTH_ERROR / RPC_AUTH_BADCRED, instead of dropping the CB
request. Let's restore that behavior so the server has a chance to
do something useful about it, and provide a warning that helps
admins correct the problem.

Fixes: 778be232a207 ("NFS do not find client in NFSv4 ...")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Tested-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 fs/nfs/callback_xdr.c | 6 +++++-
 net/sunrpc/svc.c      | 5 +++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index e98ecf8..7f7a89a 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -884,7 +884,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
 	if (hdr_arg.minorversion == 0) {
 		cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident);
 		if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
-			return rpc_drop_reply;
+			goto out_invalidcred;
 	}
 
 	hdr_res.taglen = hdr_arg.taglen;
@@ -911,6 +911,10 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
 	nfs_put_client(cps.clp);
 	dprintk("%s: done, status = %u\n", __func__, ntohl(status));
 	return rpc_success;
+
+out_invalidcred:
+	pr_warn_ratelimited("NFS: NFSv4 callback contains invalid cred\n");
+	return rpc_autherr_badcred;
 }
 
 /*
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 89a588b..6dee8fb 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1187,6 +1187,11 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
 				procp->pc_release(rqstp, NULL, rqstp->rq_resp);
 			goto dropit;
 		}
+		if (*statp == rpc_autherr_badcred) {
+			if (procp->pc_release)
+				procp->pc_release(rqstp, NULL, rqstp->rq_resp);
+			goto err_bad_auth;
+		}
 		if (*statp == rpc_success &&
 		    (xdr = procp->pc_encode) &&
 		    !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

Page 9 of 11 — ← Prev page 1 … 7 8 [9] 10 11  Next page →

Back to top | Article view | linux.kernel

csiph-web