1. 30 Aug, 2013 5 commits
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 418a95bc
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Since we are getting to the pointy end, one i915 black screen on some
        machines, and one vmwgfx stop userspace ability to nuke the VM,
      
        There might be one or two ati or nouveau fixes trickle in before
        final, but I think this should pretty much be it"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/vmwgfx: Split GMR2_REMAP commands if they are to large
        drm/i915: ivb: fix edp voltage swing reg val
      418a95bc
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input · 155e3a35
      Linus Torvalds authored
      Pull input layer updates from Dmitry Torokhov:
       "Just a couple of new IDs in Wacom and xpad drivers, i8042 is now
        disabled on ARC, and data checks in Elantech driver that were overly
        relaxed by the previous patch are now tightened"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
        Input: i8042 - disable the driver on ARC platforms
        Input: xpad - add signature for Razer Onza Classic Edition
        Input: elantech - fix packet check for v3 and v4 hardware
        Input: wacom - add support for 0x300 and 0x301
      155e3a35
    • Linus Torvalds's avatar
      Merge branch 'for-3.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup · 41615e81
      Linus Torvalds authored
      Pull cgroup fix from Tejun Heo:
       "During the percpu reference counting update which was merged during
        v3.11-rc1, the cgroup destruction path was updated so that a cgroup in
        the process of dying may linger on the children list, which was
        necessary as the cgroup should still be included in child/descendant
        iteration while percpu ref is being killed.
      
        Unfortunately, I forgot to update cgroup destruction path accordingly
        and cgroup destruction may fail spuriously with -EBUSY due to
        lingering dying children even when there's no live child left - e.g.
        "rmdir parent/child parent" will usually fail.
      
        This can be easily fixed by iterating through the children list to
        verify that there's no live child left.  While this is very late in
        the release cycle, this bug is very visible to userland and I believe
        the fix is relatively safe.
      
        Thanks Hugh for spotting and providing fix for the issue"
      
      * 'for-3.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
        cgroup: fix rmdir EBUSY regression in 3.11
      41615e81
    • Linus Torvalds's avatar
      Merge branch 'for-3.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq · ff497452
      Linus Torvalds authored
      Pull workqueue fix from Tejun Heo:
       "This contains one fix which could lead to system-wide lockup on
        !PREEMPT kernels.  It's very late in the cycle but this definitely is
        a -stable material.
      
        The problem is that workqueue worker tasks may process unlimited
        number of work items back-to-back without every yielding inbetween.
        This usually isn't noticeable but a work item which re-queues itself
        waiting for someone else to do something can deadlock with
        stop_machine.  stop_machine will ensure nothing else happens on all
        other cpus and the requeueing work item will reqeueue itself
        indefinitely without ever yielding and thus preventing the CPU from
        entering stop_machine.
      
        Kudos to Jamie Liu for spotting and diagnosing the problem.  This can
        be trivially fixed by adding cond_resched() after processing each work
        item"
      
      * 'for-3.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
        workqueue: cond_resched() after processing each work item
      ff497452
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-3.11-5' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · 06a557f7
      Linus Torvalds authored
      Pull NFS client bugfix from Trond Myklebust:
       "Stable patch to fix a highmem-related data corruption issue on 32-bit
        ARM platforms"
      
      * tag 'nfs-for-3.11-5' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        SUNRPC: Fix memory corruption issue on 32-bit highmem systems
      06a557f7
  2. 29 Aug, 2013 15 commits
    • Jakob Bornecrantz's avatar
      drm/vmwgfx: Split GMR2_REMAP commands if they are to large · 6e4dcff3
      Jakob Bornecrantz authored
      This fixes the piglit test texturing/max-texture-size
      causing the VM to die due to a too large SVGA command.
      Signed-off-by: default avatarJakob Bornecrantz <jakob@vmware.com>
      Reviewed-by: default avatarBiran Paul <brianp@vmware.com>
      Reviewed-by: default avatarZack Rusin <zackr@vmware.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDave Airlie <airlied@gmail.com>
      6e4dcff3
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2013-08-30' of... · 1dcff832
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2013-08-30' of git://people.freedesktop.org/~danvet/drm-intel into drm-fixes
      
      Just a one-line patch to fix a black screen issue on rare ivb machines,
      cc: stable. Normally I'd just shovel this into the -next pull request this
      late in the -rc cycle, but Linus was making noises about not getting real
      fixes which are cc: stable. So here we go ;-)
      
      * tag 'drm-intel-fixes-2013-08-30' of git://people.freedesktop.org/~danvet/drm-intel:
        drm/i915: ivb: fix edp voltage swing reg val
      1dcff832
    • Imre Deak's avatar
      drm/i915: ivb: fix edp voltage swing reg val · 77fa4cbd
      Imre Deak authored
      Fix the typo introduced in
      
      commit 1a2eb460
      Author: Keith Packard <keithp@keithp.com>
      Date:   Wed Nov 16 16:26:07 2011 -0800
      
          drm/i915: Hook up Ivybridge eDP
      
      This fixes eDP link-training failures and cases where all voltage swing
      /pre-emphasis levels were tried and failed during clock recovery and -
      as a fallback - we go on to do channel equalization with the last voltage
      swing/pre-emphasis level which will succeed. Both issues can lead to a
      blank screen.
      
      v2:
      - improve commit message
      
      CC: stable@vger.kernel.org
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=64880Tested-by: default avatarJeremy Moles <cubicool@gmail.com>
      Signed-off-by: default avatarImre Deak <imre.deak@intel.com>
      Reviewed-by: default avatarPaulo Zanoni <paulo.r.zanoni@intel.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      77fa4cbd
    • Mischa Jonker's avatar
      Input: i8042 - disable the driver on ARC platforms · fa46c798
      Mischa Jonker authored
      It causes crashes when enabled, and we don't have such a peripheral
      anyway on ARC platforms.
      Signed-off-by: default avatarMischa Jonker <mjonker@synopsys.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      fa46c798
    • Hugh Dickins's avatar
      cgroup: fix rmdir EBUSY regression in 3.11 · bb78a92f
      Hugh Dickins authored
      On 3.11-rc we are seeing cgroup directories left behind when they should
      have been removed.  Here's a trivial reproducer:
      
      cd /sys/fs/cgroup/memory
      mkdir parent parent/child; rmdir parent/child parent
      rmdir: failed to remove `parent': Device or resource busy
      
      It's because cgroup_destroy_locked() (step 1 of destruction) leaves
      cgroup on parent's children list, letting cgroup_offline_fn() (step 2 of
      destruction) remove it; but step 2 is run by work queue, which may not
      yet have removed the children when parent destruction checks the list.
      
      Fix that by checking through a non-empty list of children: if every one
      of them has already been marked CGRP_DEAD, then it's safe to proceed:
      those children are invisible to userspace, and should not obstruct rmdir.
      
      (I didn't see any reason to keep the cgrp->children checks under the
      unrelated css_set_lock, so moved them out.)
      
      tj: Flattened nested ifs a bit and updated comment so that it's
          correct on both for-3.11-fixes and for-3.12.
      Signed-off-by: default avatarHugh Dickins <hughd@google.com>
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      bb78a92f
    • Tejun Heo's avatar
      workqueue: cond_resched() after processing each work item · b22ce278
      Tejun Heo authored
      If !PREEMPT, a kworker running work items back to back can hog CPU.
      This becomes dangerous when a self-requeueing work item which is
      waiting for something to happen races against stop_machine.  Such
      self-requeueing work item would requeue itself indefinitely hogging
      the kworker and CPU it's running on while stop_machine would wait for
      that CPU to enter stop_machine while preventing anything else from
      happening on all other CPUs.  The two would deadlock.
      
      Jamie Liu reports that this deadlock scenario exists around
      scsi_requeue_run_queue() and libata port multiplier support, where one
      port may exclude command processing from other ports.  With the right
      timing, scsi_requeue_run_queue() can end up requeueing itself trying
      to execute an IO which is asked to be retried while another device has
      an exclusive access, which in turn can't make forward progress due to
      stop_machine.
      
      Fix it by invoking cond_resched() after executing each work item.
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Reported-by: default avatarJamie Liu <jamieliu@google.com>
      References: http://thread.gmane.org/gmane.linux.kernel/1552567
      Cc: stable@vger.kernel.org
      --
       kernel/workqueue.c |    9 +++++++++
       1 file changed, 9 insertions(+)
      b22ce278
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew Morton) · c95389b4
      Linus Torvalds authored
      Merge fixes from Andrew Morton:
       "Five fixes.
      
        err, make that six.  let me try again"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        fs/ocfs2/super.c: Use bigger nodestr to accomodate 32-bit node numbers
        memcg: check that kmem_cache has memcg_params before accessing it
        drivers/base/memory.c: fix show_mem_removable() to handle missing sections
        IPC: bugfix for msgrcv with msgtyp < 0
        Omnikey Cardman 4000: pull in ioctl.h in user header
        timer_list: correct the iterator for timer_list
      c95389b4
    • Goldwyn Rodrigues's avatar
      fs/ocfs2/super.c: Use bigger nodestr to accomodate 32-bit node numbers · 49fa8140
      Goldwyn Rodrigues authored
      While using pacemaker/corosync, the node numbers are generated using IP
      address as opposed to serial node number generation.  This may not fit
      in a 8-byte string.  Use a bigger string to print the complete node
      number.
      Signed-off-by: default avatarGoldwyn Rodrigues <rgoldwyn@suse.com>
      Cc: Mark Fasheh <mfasheh@suse.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      49fa8140
    • Andrey Vagin's avatar
      memcg: check that kmem_cache has memcg_params before accessing it · 6f6b8951
      Andrey Vagin authored
      If the system had a few memory groups and all of them were destroyed,
      memcg_limited_groups_array_size has non-zero value, but all new caches
      are created without memcg_params, because memcg_kmem_enabled() returns
      false.
      
      We try to enumirate child caches in a few places and all of them are
      potentially dangerous.
      
      For example my kernel is compiled with CONFIG_SLAB and it crashed when I
      tryed to mount a NFS share after a few experiments with kmemcg.
      
        BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
        IP: [<ffffffff8118166a>] do_tune_cpucache+0x8a/0xd0
        PGD b942a067 PUD b999f067 PMD 0
        Oops: 0000 [#1] SMP
        Modules linked in: fscache(+) ip6table_filter ip6_tables iptable_filter ip_tables i2c_piix4 pcspkr virtio_net virtio_balloon i2c_core floppy
        CPU: 0 PID: 357 Comm: modprobe Not tainted 3.11.0-rc7+ #59
        Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
        task: ffff8800b9f98240 ti: ffff8800ba32e000 task.ti: ffff8800ba32e000
        RIP: 0010:[<ffffffff8118166a>]  [<ffffffff8118166a>] do_tune_cpucache+0x8a/0xd0
        RSP: 0018:ffff8800ba32fb70  EFLAGS: 00010246
        RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000006
        RDX: 0000000000000000 RSI: ffff8800b9f98910 RDI: 0000000000000246
        RBP: ffff8800ba32fba0 R08: 0000000000000002 R09: 0000000000000004
        R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000010
        R13: 0000000000000008 R14: 00000000000000d0 R15: ffff8800375d0200
        FS:  00007f55f1378740(0000) GS:ffff8800bfa00000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
        CR2: 00007f24feba57a0 CR3: 0000000037b51000 CR4: 00000000000006f0
        Call Trace:
          enable_cpucache+0x49/0x100
          setup_cpu_cache+0x215/0x280
          __kmem_cache_create+0x2fa/0x450
          kmem_cache_create_memcg+0x214/0x350
          kmem_cache_create+0x2b/0x30
          fscache_init+0x19b/0x230 [fscache]
          do_one_initcall+0xfa/0x1b0
          load_module+0x1c41/0x26d0
          SyS_finit_module+0x86/0xb0
          system_call_fastpath+0x16/0x1b
      Signed-off-by: default avatarAndrey Vagin <avagin@openvz.org>
      Cc: Pekka Enberg <penberg@kernel.org>
      Cc: Christoph Lameter <cl@linux.com>
      Cc: Glauber Costa <glommer@openvz.org>
      Cc: Joonsoo Kim <js1304@gmail.com>
      Cc: Michal Hocko <mhocko@suse.cz>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6f6b8951
    • Russ Anderson's avatar
      drivers/base/memory.c: fix show_mem_removable() to handle missing sections · 21ea9f5a
      Russ Anderson authored
      "cat /sys/devices/system/memory/memory*/removable" crashed the system.
      
      The problem is that show_mem_removable() is passing a
      bad pfn to is_mem_section_removable(), which causes
      
          if (!node_online(page_to_nid(page)))
      
      to blow up.  Why is it passing in a bad pfn?
      
      The reason is that show_mem_removable() will loop sections_per_block
      times.  sections_per_block is 16, but mem->section_count is 8,
      indicating holes in this memory block.  Checking that the memory section
      is present before checking to see if the memory section is removable
      fixes the problem.
      
         harp5-sys:~ # cat /sys/devices/system/memory/memory*/removable
         0
         1
         1
         1
         1
         1
         1
         1
         1
         1
         1
         1
         1
         1
         BUG: unable to handle kernel paging request at ffffea00c3200000
         IP: [<ffffffff81117ed1>] is_pageblock_removable_nolock+0x1/0x90
         PGD 83ffd4067 PUD 37bdfce067 PMD 0
         Oops: 0000 [#1] SMP
         Modules linked in: autofs4 binfmt_misc rdma_ucm rdma_cm iw_cm ib_addr ib_srp scsi_transport_srp scsi_tgt ib_ipoib ib_cm ib_uverbs ib_umad iw_cxgb3 cxgb3 mdio mlx4_en mlx4_ib ib_sa mlx4_core ib_mthca ib_mad ib_core fuse nls_iso8859_1 nls_cp437 vfat fat joydev loop hid_generic usbhid hid hwperf(O) numatools(O) dm_mod iTCO_wdt ipv6 iTCO_vendor_support igb i2c_i801 ioatdma i2c_algo_bit ehci_pci pcspkr lpc_ich i2c_core ehci_hcd ptp sg mfd_core dca rtc_cmos pps_core mperf button xhci_hcd sd_mod crc_t10dif usbcore usb_common scsi_dh_emc scsi_dh_hp_sw scsi_dh_alua scsi_dh_rdac scsi_dh gru(O) xvma(O) xfs crc32c libcrc32c thermal sata_nv processor piix mptsas mptscsih scsi_transport_sas mptbase megaraid_sas fan thermal_sys hwmon ext3 jbd ata_piix ahci libahci libata scsi_mod
         CPU: 4 PID: 5991 Comm: cat Tainted: G           O 3.11.0-rc5-rja-uv+ #10
         Hardware name: SGI UV2000/ROMLEY, BIOS SGI UV 2000/3000 series BIOS 01/15/2013
         task: ffff88081f034580 ti: ffff880820022000 task.ti: ffff880820022000
         RIP: 0010:[<ffffffff81117ed1>]  [<ffffffff81117ed1>] is_pageblock_removable_nolock+0x1/0x90
         RSP: 0018:ffff880820023df8  EFLAGS: 00010287
         RAX: 0000000000040000 RBX: ffffea00c3200000 RCX: 0000000000000004
         RDX: ffffea00c30b0000 RSI: 00000000001c0000 RDI: ffffea00c3200000
         RBP: ffff880820023e38 R08: 0000000000000000 R09: 0000000000000001
         R10: 0000000000000000 R11: 0000000000000001 R12: ffffea00c33c0000
         R13: 0000160000000000 R14: 6db6db6db6db6db7 R15: 0000000000000001
         FS:  00007ffff7fb2700(0000) GS:ffff88083fc80000(0000) knlGS:0000000000000000
         CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
         CR2: ffffea00c3200000 CR3: 000000081b954000 CR4: 00000000000407e0
         Call Trace:
           show_mem_removable+0x41/0x70
           dev_attr_show+0x2a/0x60
           sysfs_read_file+0xf7/0x1c0
           vfs_read+0xc8/0x130
           SyS_read+0x5d/0xa0
           system_call_fastpath+0x16/0x1b
      Signed-off-by: default avatarRuss Anderson <rja@sgi.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
      Cc: Yinghai Lu <yinghai@kernel.org>
      Reviewed-by: default avatarYasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      21ea9f5a
    • Svenning Sørensen's avatar
      IPC: bugfix for msgrcv with msgtyp < 0 · 368ae537
      Svenning Sørensen authored
      According to 'man msgrcv': "If msgtyp is less than 0, the first message of
      the lowest type that is less than or equal to the absolute value of msgtyp
      shall be received."
      
      Bug: The kernel only returns a message if its type is 1; other messages
      with type < abs(msgtype) will never get returned.
      
      Fix: After having traversed the list to find the first message with the
      lowest type, we need to actually return that message.
      
      This regression was introduced by commit daaf74cf ("ipc: refactor
      msg list search into separate function")
      Signed-off-by: default avatarSvenning Soerensen <sss@secomea.dk>
      Reviewed-by: default avatarPeter Hurley <peter@hurleysoftware.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      368ae537
    • Mike Frysinger's avatar
      Omnikey Cardman 4000: pull in ioctl.h in user header · aaaafb7f
      Mike Frysinger authored
      This file uses the ioctl helpers (_IOR/_IOW/etc...), so include ioctl.h
      for the definitions.
      Signed-off-by: default avatarMike Frysinger <vapier@gentoo.org>
      Cc: Harald Welte <laforge@gnumonks.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      aaaafb7f
    • Nathan Zimmer's avatar
      timer_list: correct the iterator for timer_list · 84a78a65
      Nathan Zimmer authored
      Correct an issue with /proc/timer_list reported by Holger.
      
      When reading from the proc file with a sufficiently small buffer, 2k so
      not really that small, there was one could get hung trying to read the
      file a chunk at a time.
      
      The timer_list_start function failed to account for the possibility that
      the offset was adjusted outside the timer_list_next.
      Signed-off-by: default avatarNathan Zimmer <nzimmer@sgi.com>
      Reported-by: default avatarHolger Hans Peter Freyther <holger@freyther.de>
      Cc: John Stultz <john.stultz@linaro.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Berke Durak <berke.durak@xiphos.com>
      Cc: Jeff Layton <jlayton@redhat.com>
      Tested-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Cc: <stable@vger.kernel.org> # 3.10.x
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      84a78a65
    • Waiman Long's avatar
      vfs: make the dentry cache use the lockref infrastructure · 98474236
      Waiman Long authored
      This just replaces the dentry count/lock combination with the lockref
      structure that contains both a count and a spinlock, and does the
      mechanical conversion to use the lockref infrastructure.
      
      There are no semantic changes here, it's purely syntactic.  The
      reference lockref implementation uses the spinlock exactly the same way
      that the old dcache code did, and the bulk of this patch is just
      expanding the internal "d_count" use in the dcache code to use
      "d_lockref.count" instead.
      
      This is purely preparation for the real change to make the reference
      count updates be lockless during the 3.12 merge window.
      
      [ As with the previous commit, this is a rewritten version of a concept
        originally from Waiman, so credit goes to him, blame for any errors
        goes to me.
      
        Waiman's patch had some semantic differences for taking advantage of
        the lockless update in dget_parent(), while this patch is
        intentionally a pure search-and-replace change with no semantic
        changes.     - Linus ]
      Signed-off-by: default avatarWaiman Long <Waiman.Long@hp.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      98474236
    • Waiman Long's avatar
      Add new lockref infrastructure reference implementation · 0f8f2aaa
      Waiman Long authored
      This introduces a new "lockref" structure that supports the concept of
      lockless updates of reference counts that still honor an attached
      spinlock.
      
      NOTE! This reference implementation is not the optimized lockless
      version, rather it is the fallback implementation using standard
      spinlocks.  The actual optimized versions will be merged into 3.12, but
      I wanted to get the infrastructure in place and document the new
      interfaces.
      
      [ Also note that this particular commit is drastically cut-down minimal
        version of the original patch by Waiman.  In order to properly credit
        the original author I'm marking Waiman as the author here, but in the
        end this patch bears little resemblance to the patch by Waiman.  So
        blame any errors on me editing things down to the point where I can
        introduce the infrastructure before the merge window for 3.12 actually
        opens.     - Linus ]
      Signed-off-by: default avatarWaiman Long <Waiman.Long@hp.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0f8f2aaa
  3. 28 Aug, 2013 2 commits
    • Trond Myklebust's avatar
      SUNRPC: Fix memory corruption issue on 32-bit highmem systems · 347e2233
      Trond Myklebust authored
      Some architectures, such as ARM-32 do not return the same base address
      when you call kmap_atomic() twice on the same page.
      This causes problems for the memmove() call in the XDR helper routine
      "_shift_data_right_pages()", since it defeats the detection of
      overlapping memory ranges, and has been seen to corrupt memory.
      
      The fix is to distinguish between the case where we're doing an
      inter-page copy or not. In the former case of we know that the memory
      ranges cannot possibly overlap, so we can additionally micro-optimise
      by replacing memmove() with memcpy().
      Reported-by: default avatarMark Young <MYoung@nvidia.com>
      Reported-by: default avatarMatt Craighead <mcraighead@nvidia.com>
      Cc: Bruce Fields <bfields@fieldses.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
      Tested-by: default avatarMatt Craighead <mcraighead@nvidia.com>
      347e2233
    • Linus Torvalds's avatar
      Revert "fs: Allow unprivileged linkat(..., AT_EMPTY_PATH) aka flink" · f0cc6ffb
      Linus Torvalds authored
      This reverts commit bb2314b4.
      
      It wasn't necessarily wrong per se, but we're still busily discussing
      the exact details of this all, so I'm going to revert it for now.
      
      It's true that you can already do flink() through /proc and that flink()
      isn't new.  But as Brad Spengler points out, some secure environments do
      not mount proc, and flink adds a new interface that can avoid path
      lookup of the source for those kinds of environments.
      
      We may re-do this (and even mark it for stable backporting back in 3.11
      and possibly earlier) once the whole discussion about the interface is done.
      
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Brad Spengler <spender@grsecurity.net>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f0cc6ffb
  4. 27 Aug, 2013 8 commits
    • Linus Torvalds's avatar
      Merge tag 'regmap-v3.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap · fa8218de
      Linus Torvalds authored
      Pull regmap fixes from Mark Brown:
       "Two changes here:
      
         - Fix a bug in the rbtree code which could cause it to create two
           different cache entries for the same register by adding a single
           register at a time to the cache.  This isn't awesome for
           performance but it's non-invasive which we need for this late in
           the release cycle and the I/O costs we're trying to avoid are high.
      
         - Add another header used in the !CONFIG_REGMAP stubs where we had
           been relying on implicit inclusion"
      
      * tag 'regmap-v3.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
        regmap: rbtree: Fix overlapping rbnodes.
        regmap: Add another missing header for !CONFIG_REGMAP stubs
      fa8218de
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc · 0c6b5c5b
      Linus Torvalds authored
      Pull powerpc fixes from Ben Herrenschmidt:
       "Here are 3 bug fixes that should probably go into 3.11 since I'm also
        tagging them for stable.
      
        Once fixes our old /proc/powerpc/lparcfg file which provides partition
        informations when running under our hypervisor and also acts as a
        user-triggerable Oops when hot :-(
      
        The other two respectively are a one liner to fix a HVSI protocol
        handshake problem causing the console to fail to show up on a bunch of
        machines until we reach userspace, which I deem annoying enough to
        warrant going to stable, and a nasty gcc miscompile causing us to pass
        virtual instead of physical addresses to the firmware under some
        circumstances"
      
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
        powerpc/hvsi: Increase handshake timeout from 200ms to 400ms.
        powerpc: Work around gcc miscompilation of __pa() on 64-bit
        powerpc: Don't Oops when accessing /proc/powerpc/lparcfg without hypervisor
      0c6b5c5b
    • Cyrill Gorcunov's avatar
      mm: move_ptes -- Set soft dirty bit depending on pte type · 6dec97dc
      Cyrill Gorcunov authored
      Dave reported corrupted swap entries
      
       | [ 4588.541886] swap_free: Unused swap offset entry 00002d15
       | [ 4588.541952] BUG: Bad page map in process trinity-kid12  pte:005a2a80 pmd:22c01f067
      
      and Hugh pointed that in move_ptes _PAGE_SOFT_DIRTY bit set regardless
      the type of entry pte consists of.  The trick here is that when we carry
      soft dirty status in swap entries we are to use _PAGE_SWP_SOFT_DIRTY
      instead, because this is the only place in pte which can be used for own
      needs without intersecting with bits owned by swap entry type/offset.
      Reported-and-tested-by: default avatarDave Jones <davej@redhat.com>
      Signed-off-by: default avatarCyrill Gorcunov <gorcunov@openvz.org>
      Cc: Pavel Emelyanov <xemul@parallels.com>
      Analyzed-by: default avatarHugh Dickins <hughd@google.com>
      Cc: Hillf Danton <dhillf@gmail.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6dec97dc
    • Eugene Surovegin's avatar
      powerpc/hvsi: Increase handshake timeout from 200ms to 400ms. · d220980b
      Eugene Surovegin authored
      This solves a problem observed in kexec'ed kernel where 200ms timeout is
      too short and bootconsole fails to initialize. Console did eventually
      become workable but much later into the boot process.
      
      Observed timeout was around 260ms, but I decided to make it a little bigger
      for more reliability.
      
      This has been tested on Power7 machine with Petitboot as a primary
      bootloader and PowerNV firmware.
      
      CC: <stable@vger.kernel.org>
      Signed-off-by: default avatarEugene Surovegin <surovegin@google.com>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      d220980b
    • Paul Mackerras's avatar
      powerpc: Work around gcc miscompilation of __pa() on 64-bit · bdbc29c1
      Paul Mackerras authored
      On 64-bit, __pa(&static_var) gets miscompiled by recent versions of
      gcc as something like:
      
              addis 3,2,.LANCHOR1+4611686018427387904@toc@ha
              addi 3,3,.LANCHOR1+4611686018427387904@toc@l
      
      This ends up effectively ignoring the offset, since its bottom 32 bits
      are zero, and means that the result of __pa() still has 0xC in the top
      nibble.  This happens with gcc 4.8.1, at least.
      
      To work around this, for 64-bit we make __pa() use an AND operator,
      and for symmetry, we make __va() use an OR operator.  Using an AND
      operator rather than a subtraction ends up with slightly shorter code
      since it can be done with a single clrldi instruction, whereas it
      takes three instructions to form the constant (-PAGE_OFFSET) and add
      it on.  (Note that MEMORY_START is always 0 on 64-bit.)
      
      CC: <stable@vger.kernel.org>
      Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      bdbc29c1
    • Benjamin Herrenschmidt's avatar
      powerpc: Don't Oops when accessing /proc/powerpc/lparcfg without hypervisor · f5f6cbb6
      Benjamin Herrenschmidt authored
      /proc/powerpc/lparcfg is an ancient facility (though still actively used)
      which allows access to some informations relative to the partition when
      running underneath a PAPR compliant hypervisor.
      
      It makes no sense on non-pseries machines. However, currently, not only
      can it be created on these if the kernel has pseries support, but accessing
      it on such a machine will crash due to trying to do hypervisor calls.
      
      In fact, it should also not do HV calls on older pseries that didn't have
      an hypervisor either.
      
      Finally, it has the plumbing to be a module but is a "bool" Kconfig option.
      
      This fixes the whole lot by turning it into a machine_device_initcall
      that is only created on pseries, and adding the necessary hypervisor
      check before calling the H_GET_EM_PARMS hypercall
      
      CC: <stable@vger.kernel.org>
      Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      f5f6cbb6
    • Linus Torvalds's avatar
      Merge tag 'usb-3.11-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 9b506833
      Linus Torvalds authored
      Pull USB bugfix from Greg KH:
       "Here is a single bugfix that resolves the "can not build the OHCI
        driver with CONFIG_PM disabled" problem that lots of people have been
        reporting with 3.11-rc7.  Sorry about that one, it missed my build
        tests, and it seems, a number of others as well.
      
        Thank goodness for Guenter :)"
      
      * tag 'usb-3.11-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        USB: OHCI: fix build error related to ohci_suspend/resume
      9b506833
    • Linus Torvalds's avatar
      Merge tag 'jfs-3.11-rc8' of git://github.com/kleikamp/linux-shaggy · 83c425d2
      Linus Torvalds authored
      Pull jfs fix from Dave Kleikamp:
       "One JFS patch to fix an incompatibility with NFSv4 resulting in the
        nfs client reporting a readdir loop"
      
      * tag 'jfs-3.11-rc8' of git://github.com/kleikamp/linux-shaggy:
        jfs: fix readdir cookie incompatibility with NFSv4
      83c425d2
  5. 26 Aug, 2013 3 commits
  6. 25 Aug, 2013 6 commits
  7. 24 Aug, 2013 1 commit