lab.nexedi.com will be down from Thursday, 20 March 2025, 07:30:00 UTC for a duration of approximately 2 hours

  1. 27 Apr, 2014 40 commits
    • Giacomo Comes's avatar
      Skip intel_crt_init for Dell XPS 8700 · 95849485
      Giacomo Comes authored
      commit 10b6ee4a upstream.
      
      The Dell XPS 8700 has a onboard Display port and HDMI port and no VGA port.
      The call intel_crt_init freeze the machine, so skip such call.
      
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=73559
      Signed-off-by: Giacomo Comes <comes at naic.edu>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      95849485
    • alex chen's avatar
      ocfs2: do not put bh when buffer_uptodate failed · 3654c5b7
      alex chen authored
      commit f7cf4f5b upstream.
      
      Do not put bh when buffer_uptodate failed in ocfs2_write_block and
      ocfs2_write_super_or_backup, because it will put bh in b_end_io.
      Otherwise it will hit a warning "VFS: brelse: Trying to free free
      buffer".
      Signed-off-by: default avatarAlex Chen <alex.chen@huawei.com>
      Reviewed-by: default avatarJoseph Qi <joseph.qi@huawei.com>
      Reviewed-by: default avatarSrinivas Eeda <srinivas.eeda@oracle.com>
      Cc: Mark Fasheh <mfasheh@suse.com>
      Acked-by: default avatarJoel Becker <jlbec@evilplan.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      3654c5b7
    • Junxiao Bi's avatar
      ocfs2: dlm: fix recovery hung · 743f9bbf
      Junxiao Bi authored
      commit ded2cf71 upstream.
      
      There is a race window in dlm_do_recovery() between dlm_remaster_locks()
      and dlm_reset_recovery() when the recovery master nearly finish the
      recovery process for a dead node.  After the master sends FINALIZE_RECO
      message in dlm_remaster_locks(), another node may become the recovery
      master for another dead node, and then send the BEGIN_RECO message to
      all the nodes included the old master, in the handler of this message
      dlm_begin_reco_handler() of old master, dlm->reco.dead_node and
      dlm->reco.new_master will be set to the second dead node and the new
      master, then in dlm_reset_recovery(), these two variables will be reset
      to default value.  This will cause new recovery master can not finish
      the recovery process and hung, at last the whole cluster will hung for
      recovery.
      
      old recovery master:                                 new recovery master:
      dlm_remaster_locks()
                                                        become recovery master for
                                                        another dead node.
                                                        dlm_send_begin_reco_message()
      dlm_begin_reco_handler()
      {
       if (dlm->reco.state & DLM_RECO_STATE_FINALIZE) {
        return -EAGAIN;
       }
       dlm_set_reco_master(dlm, br->node_idx);
       dlm_set_reco_dead_node(dlm, br->dead_node);
      }
      dlm_reset_recovery()
      {
       dlm_set_reco_dead_node(dlm, O2NM_INVALID_NODE_NUM);
       dlm_set_reco_master(dlm, O2NM_INVALID_NODE_NUM);
      }
                                                        will hang in dlm_remaster_locks() for
                                                        request dlm locks info
      
      Before send FINALIZE_RECO message, recovery master should set
      DLM_RECO_STATE_FINALIZE for itself and clear it after the recovery done,
      this can break the race windows as the BEGIN_RECO messages will not be
      handled before DLM_RECO_STATE_FINALIZE flag is cleared.
      
      A similar race may happen between new recovery master and normal node
      which is in dlm_finalize_reco_handler(), also fix it.
      Signed-off-by: default avatarJunxiao Bi <junxiao.bi@oracle.com>
      Reviewed-by: default avatarSrinivas Eeda <srinivas.eeda@oracle.com>
      Reviewed-by: default avatarWengang Wang <wen.gang.wang@oracle.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Mark Fasheh <mfasheh@suse.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      743f9bbf
    • Junxiao Bi's avatar
      ocfs2: dlm: fix lock migration crash · c3f379ff
      Junxiao Bi authored
      commit 34aa8dac upstream.
      
      This issue was introduced by commit 800deef3 ("ocfs2: use
      list_for_each_entry where benefical") in 2007 where it replaced
      list_for_each with list_for_each_entry.  The variable "lock" will point
      to invalid data if "tmpq" list is empty and a panic will be triggered
      due to this.  Sunil advised reverting it back, but the old version was
      also not right.  At the end of the outer for loop, that
      list_for_each_entry will also set "lock" to an invalid data, then in the
      next loop, if the "tmpq" list is empty, "lock" will be an stale invalid
      data and cause the panic.  So reverting the list_for_each back and reset
      "lock" to NULL to fix this issue.
      
      Another concern is that this seemes can not happen because the "tmpq"
      list should not be empty.  Let me describe how.
      
      old lock resource owner(node 1):                                  migratation target(node 2):
      image there's lockres with a EX lock from node 2 in
      granted list, a NR lock from node x with convert_type
      EX in converting list.
      dlm_empty_lockres() {
       dlm_pick_migration_target() {
         pick node 2 as target as its lock is the first one
         in granted list.
       }
       dlm_migrate_lockres() {
         dlm_mark_lockres_migrating() {
           res->state |= DLM_LOCK_RES_BLOCK_DIRTY;
           wait_event(dlm->ast_wq, !dlm_lockres_is_dirty(dlm, res));
      	 //after the above code, we can not dirty lockres any more,
           // so dlm_thread shuffle list will not run
                                                                         downconvert lock from EX to NR
                                                                         upconvert lock from NR to EX
      <<< migration may schedule out here, then
      <<< node 2 send down convert request to convert type from EX to
      <<< NR, then send up convert request to convert type from NR to
      <<< EX, at this time, lockres granted list is empty, and two locks
      <<< in the converting list, node x up convert lock followed by
      <<< node 2 up convert lock.
      
      	 // will set lockres RES_MIGRATING flag, the following
      	 // lock/unlock can not run
           dlm_lockres_release_ast(dlm, res);
         }
      
         dlm_send_one_lockres()
                                                                       dlm_process_recovery_data()
                                                                         for (i=0; i<mres->num_locks; i++)
                                                                           if (ml->node == dlm->node_num)
                                                                             for (j = DLM_GRANTED_LIST; j <= DLM_BLOCKED_LIST; j++) {
                                                                              list_for_each_entry(lock, tmpq, list)
                                                                              if (lock) break; <<< lock is invalid as grant list is empty.
                                                                             }
                                                                             if (lock->ml.node != ml->node)
                                                                               BUG() >>> crash here
       }
      
      I see the above locks status from a vmcore of our internal bug.
      Signed-off-by: default avatarJunxiao Bi <junxiao.bi@oracle.com>
      Reviewed-by: default avatarWengang Wang <wen.gang.wang@oracle.com>
      Cc: Sunil Mushran <sunil.mushran@gmail.com>
      Reviewed-by: default avatarSrinivas Eeda <srinivas.eeda@oracle.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Mark Fasheh <mfasheh@suse.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      c3f379ff
    • Matt Fleming's avatar
      sh: fix format string bug in stack tracer · 73cf02b9
      Matt Fleming authored
      commit a0c32761 upstream.
      
      Kees reported the following error:
      
         arch/sh/kernel/dumpstack.c: In function 'print_trace_address':
         arch/sh/kernel/dumpstack.c:118:2: error: format not a string literal and no format arguments [-Werror=format-security]
      
      Use the "%s" format so that it's impossible to interpret 'data' as a
      format string.
      Signed-off-by: default avatarMatt Fleming <matt.fleming@intel.com>
      Reported-by: default avatarKees Cook <keescook@chromium.org>
      Acked-by: default avatarKees Cook <keescook@chromium.org>
      Cc: Paul Mundt <lethal@linux-sh.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      73cf02b9
    • Alex Deucher's avatar
      drm/radeon: call drm_edid_to_eld when we update the edid · 7752811a
      Alex Deucher authored
      commit 16086279 upstream.
      
      This needs to be done to update some of the fields in
      the connector structure used by the audio code.
      
      Noticed by several users on irc.
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      7752811a
    • Christopher Friedt's avatar
      drm/vmwgfx: correct fb_fix_screeninfo.line_length · c53fb5de
      Christopher Friedt authored
      commit aa6de142 upstream.
      
      Previously, the vmwgfx_fb driver would allow users to call FBIOSET_VINFO, but it would not adjust
      the FINFO properly, resulting in distorted screen rendering. The patch corrects that behaviour.
      
      See https://bugs.gentoo.org/show_bug.cgi?id=494794 for examples.
      Signed-off-by: default avatarChristopher Friedt <chrisfriedt@gmail.com>
      Reviewed-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      c53fb5de
    • Oleg Nesterov's avatar
      pid_namespace: pidns_get() should check task_active_pid_ns() != NULL · a399c659
      Oleg Nesterov authored
      commit d2308225 upstream.
      
      pidns_get()->get_pid_ns() can hit ns == NULL. This task_struct can't
      go away, but task_active_pid_ns(task) is NULL if release_task(task)
      was already called. Alternatively we could change get_pid_ns(ns) to
      check ns != NULL, but it seems that other callers are fine.
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Cc: Eric W. Biederman ebiederm@xmission.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      a399c659
    • Jeff Mahoney's avatar
      reiserfs: fix race in readdir · 1e57813f
      Jeff Mahoney authored
      commit 01d88857 upstream.
      
      jdm-20004 reiserfs_delete_xattrs: Couldn't delete all xattrs (-2)
      
      The -ENOENT is due to readdir calling dir_emit on the same entry twice.
      
      If the dir_emit callback sleeps and the tree is changed underneath us,
      we won't be able to trust deh_offset(deh) anymore. We need to save
      next_pos before we might sleep so we can find the next entry.
      Signed-off-by: default avatarJeff Mahoney <jeffm@suse.com>
      Signed-off-by: default avatarJan Kara <jack@suse.cz>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      1e57813f
    • Al Viro's avatar
      don't bother with {get,put}_write_access() on non-regular files · 352086ce
      Al Viro authored
      commit d23142c6 upstream.
      
      it's pointless and actually leads to wrong behaviour in at least one
      moderately convoluted case (pipe(), close one end, try to get to
      another via /proc/*/fd and run into ETXTBUSY).
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      352086ce
    • Yann Droneaud's avatar
      IB/ehca: Returns an error on ib_copy_to_udata() failure · 28c78767
      Yann Droneaud authored
      commit 5bdb0f02 upstream.
      
      In case of error when writing to userspace, function ehca_create_cq()
      does not set an error code before following its error path.
      
      This patch sets the error code to -EFAULT when ib_copy_to_udata()
      fails.
      
      This was caught when using spatch (aka. coccinelle)
      to rewrite call to ib_copy_{from,to}_udata().
      
      Link: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci
      Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.comSigned-off-by: default avatarYann Droneaud <ydroneaud@opteya.com>
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      28c78767
    • Yann Droneaud's avatar
      IB/mthca: Return an error on ib_copy_to_udata() failure · dce65503
      Yann Droneaud authored
      commit 08e74c4b upstream.
      
      In case of error when writing to userspace, the function mthca_create_cq()
      does not set an error code before following its error path.
      
      This patch sets the error code to -EFAULT when ib_copy_to_udata() fails.
      
      This was caught when using spatch (aka. coccinelle)
      to rewrite call to ib_copy_{from,to}_udata().
      
      Link: https://www.gitorious.org/opteya/coccib/source/75ebf2c1033c64c1d81df13e4ae44ee99c989eba:ib_copy_udata.cocci
      Link: http://marc.info/?i=cover.1394485254.git.ydroneaud@opteya.comSigned-off-by: default avatarYann Droneaud <ydroneaud@opteya.com>
      Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      dce65503
    • Stanislav Kinsbursky's avatar
      nfsd: check passed socket's net matches NFSd superblock's one · 980d9b4a
      Stanislav Kinsbursky authored
      commit 30646394 upstream.
      
      There could be a case, when NFSd file system is mounted in network, different
      to socket's one, like below:
      
      "ip netns exec" creates new network and mount namespace, which duplicates NFSd
      mount point, created in init_net context. And thus NFS server stop in nested
      network context leads to RPCBIND client destruction in init_net.
      Then, on NFSd start in nested network context, rpc.nfsd process creates socket
      in nested net and passes it into "write_ports", which leads to RPCBIND sockets
      creation in init_net context because of the same reason (NFSd monut point was
      created in init_net context). An attempt to register passed socket in nested
      net leads to panic, because no RPCBIND client present in nexted network
      namespace.
      
      This patch add check that passed socket's net matches NFSd superblock's one.
      And returns -EINVAL error to user psace otherwise.
      
      v2: Put socket on exit.
      Reported-by: default avatarWeng Meiling <wengmeiling.weng@huawei.com>
      Signed-off-by: default avatarStanislav Kinsbursky <skinsbursky@parallels.com>
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      980d9b4a
    • Neil Horman's avatar
      x86: Adjust irq remapping quirk for older revisions of 5500/5520 chipsets · 1ace4c73
      Neil Horman authored
      commit 6f8a1b33 upstream.
      
      Commit 03bbcb2e (iommu/vt-d: add quirk for broken interrupt
      remapping on 55XX chipsets) properly disables irq remapping on the
      5500/5520 chipsets that don't correctly perform that feature.
      
      However, when I wrote it, I followed the errata sheet linked in that
      commit too closely, and explicitly tied the activation of the quirk to
      revision 0x13 of the chip, under the assumption that earlier revisions
      were not in the field.  Recently a system was reported to be suffering
      from this remap bug and the quirk hadn't triggered, because the
      revision id register read at a lower value that 0x13, so the quirk
      test failed improperly.  Given this, it seems only prudent to adjust
      this quirk so that any revision less than 0x13 has the quirk asserted.
      
      [ tglx: Removed the 0x12 comparison of pci id 3405 as this is covered
          	by the <= 0x13 check already ]
      Signed-off-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: x86@kernel.org
      Link: http://lkml.kernel.org/r/1394649873-14913-1-git-send-email-nhorman@tuxdriver.comSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      1ace4c73
    • W. Trevor King's avatar
      ALSA: hda - Enable beep for ASUS 1015E · 8c4b4825
      W. Trevor King authored
      commit a4b7f21d upstream.
      
      The `lspci -nnvv` output contains (wrapped for line length):
      
        00:1b.0 Audio device [0403]:
          Intel Corporation 7 Series/C210 Series Chipset Family
          High Definition Audio Controller [8086:1e20] (rev 04)
              Subsystem: ASUSTeK Computer Inc. Device [1043:115d]
      Signed-off-by: default avatarW. Trevor King <wking@tremily.us>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      8c4b4825
    • Huacai Chen's avatar
      MIPS: Hibernate: Flush TLB entries in swsusp_arch_resume() · c2ad5e25
      Huacai Chen authored
      commit c14af233 upstream.
      
      The original MIPS hibernate code flushes cache and TLB entries in
      swsusp_arch_resume(). But they are removed in Commit 44eeab67
      (MIPS: Hibernation: Remove SMP TLB and cacheflushing code.). A cross-
      CPU flush is surely unnecessary because all but the local CPU have
      already been disabled. But a local flush (at least the TLB flush) is
      needed. When we do hibernation on Loongson-3 with an E1000E NIC, it is
      very easy to produce a kernel panic (kernel page fault, or unaligned
      access). The root cause is E1000E driver use vzalloc_node() to allocate
      pages, the stale TLB entries of the booting kernel will be misused by
      the resumed target kernel.
      Signed-off-by: default avatarHuacai Chen <chenhc@lemote.com>
      Cc: John Crispin <john@phrozen.org>
      Cc: Steven J. Hill <Steven.Hill@imgtec.com>
      Cc: Aurelien Jarno <aurelien@aurel32.net>
      Cc: linux-mips@linux-mips.org
      Cc: Fuxin Zhang <zhangfx@lemote.com>
      Cc: Zhangjin Wu <wuzhangjin@gmail.com>
      Patchwork: https://patchwork.linux-mips.org/patch/6643/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      c2ad5e25
    • J. Bruce Fields's avatar
      nfsd4: fix setclientid encode size · fef69a39
      J. Bruce Fields authored
      commit 480efaee upstream.
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      fef69a39
    • Trond Myklebust's avatar
      NFSv4: Fix a use-after-free problem in open() · 1ddef54b
      Trond Myklebust authored
      commit e911b815 upstream.
      
      If we interrupt the nfs4_wait_for_completion_rpc_task() call in
      nfs4_run_open_task(), then we don't prevent the RPC call from
      completing. So freeing up the opendata->f_attr.mdsthreshold
      in the error path in _nfs4_do_open() leads to a use-after-free
      when the XDR decoder tries to decode the mdsthreshold information
      from the server.
      
      Fixes: 82be417a (NFSv4.1 cache mdsthreshold values on OPEN)
      Tested-by: default avatarSteve Dickson <SteveD@redhat.com>
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
      [ kamal: backport to 3.8 (context) ]
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      1ddef54b
    • Mike Snitzer's avatar
      dm thin: fix dangling bio in process_deferred_bios error path · 6f9bad27
      Mike Snitzer authored
      commit fe76cd88 upstream.
      
      If unable to ensure_next_mapping() we must add the current bio, which
      was removed from the @bios list via bio_list_pop, back to the
      deferred_bios list before all the remaining @bios.
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Acked-by: default avatarJoe Thornber <ejt@redhat.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      6f9bad27
    • Jani Nikula's avatar
      drm/i915/tv: fix gen4 composite s-video tv-out · 1f2561bd
      Jani Nikula authored
      commit e1f23f3d upstream.
      
      This is *not* bisected, but the likely regression is
      
      commit c3561438
      Author: Zhao Yakui <yakui.zhao@intel.com>
      Date:   Tue Nov 24 09:48:48 2009 +0800
      
          drm/i915: Don't set up the TV port if it isn't in the BIOS table.
      
      The commit does not check for all TV device types that might be present
      in the VBT, disabling TV out for the missing ones. Add composite
      S-video.
      Reported-and-tested-by: default avatarMatthew Khouzam <matthew.khouzam@gmail.com>
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=73362Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      [ kamal: backport to 3.8 (no "old" structure) ]
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      1f2561bd
    • Jeff Layton's avatar
      lockd: ensure we tear down any live sockets when socket creation fails during lockd_up · 8f481b17
      Jeff Layton authored
      commit 679b033d upstream.
      
      We had a Fedora ABRT report with a stack trace like this:
      
      kernel BUG at net/sunrpc/svc.c:550!
      invalid opcode: 0000 [#1] SMP
      [...]
      CPU: 2 PID: 913 Comm: rpc.nfsd Not tainted 3.13.6-200.fc20.x86_64 #1
      Hardware name: Hewlett-Packard HP ProBook 4740s/1846, BIOS 68IRR Ver. F.40 01/29/2013
      task: ffff880146b00000 ti: ffff88003f9b8000 task.ti: ffff88003f9b8000
      RIP: 0010:[<ffffffffa0305fa8>]  [<ffffffffa0305fa8>] svc_destroy+0x128/0x130 [sunrpc]
      RSP: 0018:ffff88003f9b9de0  EFLAGS: 00010206
      RAX: ffff88003f829628 RBX: ffff88003f829600 RCX: 00000000000041ee
      RDX: 0000000000000000 RSI: 0000000000000286 RDI: 0000000000000286
      RBP: ffff88003f9b9de8 R08: 0000000000017360 R09: ffff88014fa97360
      R10: ffffffff8114ce57 R11: ffffea00051c9c00 R12: ffff88003f829600
      R13: 00000000ffffff9e R14: ffffffff81cc7cc0 R15: 0000000000000000
      FS:  00007f4fde284840(0000) GS:ffff88014fa80000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f4fdf5192f8 CR3: 00000000a569a000 CR4: 00000000001407e0
      Stack:
       ffff88003f792300 ffff88003f9b9e18 ffffffffa02de02a 0000000000000000
       ffffffff81cc7cc0 ffff88003f9cb000 0000000000000008 ffff88003f9b9e60
       ffffffffa033bb35 ffffffff8131c86c ffff88003f9cb000 ffff8800a5715008
      Call Trace:
       [<ffffffffa02de02a>] lockd_up+0xaa/0x330 [lockd]
       [<ffffffffa033bb35>] nfsd_svc+0x1b5/0x2f0 [nfsd]
       [<ffffffff8131c86c>] ? simple_strtoull+0x2c/0x50
       [<ffffffffa033c630>] ? write_pool_threads+0x280/0x280 [nfsd]
       [<ffffffffa033c6bb>] write_threads+0x8b/0xf0 [nfsd]
       [<ffffffff8114efa4>] ? __get_free_pages+0x14/0x50
       [<ffffffff8114eff6>] ? get_zeroed_page+0x16/0x20
       [<ffffffff811dec51>] ? simple_transaction_get+0xb1/0xd0
       [<ffffffffa033c098>] nfsctl_transaction_write+0x48/0x80 [nfsd]
       [<ffffffff811b8b34>] vfs_write+0xb4/0x1f0
       [<ffffffff811c3f99>] ? putname+0x29/0x40
       [<ffffffff811b9569>] SyS_write+0x49/0xa0
       [<ffffffff810fc2a6>] ? __audit_syscall_exit+0x1f6/0x2a0
       [<ffffffff816962e9>] system_call_fastpath+0x16/0x1b
      Code: 31 c0 e8 82 db 37 e1 e9 2a ff ff ff 48 8b 07 8b 57 14 48 c7 c7 d5 c6 31 a0 48 8b 70 20 31 c0 e8 65 db 37 e1 e9 f4 fe ff ff 0f 0b <0f> 0b 66 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 55
      RIP  [<ffffffffa0305fa8>] svc_destroy+0x128/0x130 [sunrpc]
       RSP <ffff88003f9b9de0>
      
      Evidently, we created some lockd sockets and then failed to create
      others. make_socks then returned an error and we tried to tear down the
      svc, but svc->sv_permsocks was not empty so we ended up tripping over
      the BUG() in svc_destroy().
      
      Fix this by ensuring that we tear down any live sockets we created when
      socket creation is going to return an error.
      
      Fixes: 786185b5 (SUNRPC: move per-net operations from...)
      Reported-by: default avatarRaphos <raphoszap@laposte.net>
      Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
      Reviewed-by: default avatarStanislav Kinsbursky <skinsbursky@parallels.com>
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      8f481b17
    • Kinglong Mee's avatar
      NFSD: Traverse unconfirmed client through hash-table · 7bd960be
      Kinglong Mee authored
      commit 2b905635 upstream.
      
      When stopping nfsd, I got BUG messages, and soft lockup messages,
      The problem is cuased by double rb_erase() in nfs4_state_destroy_net()
      and destroy_client().
      
      This patch just let nfsd traversing unconfirmed client through
      hash-table instead of rbtree.
      
      [ 2325.021995] BUG: unable to handle kernel NULL pointer dereference at
                (null)
      [ 2325.022809] IP: [<ffffffff8133c18c>] rb_erase+0x14c/0x390
      [ 2325.022982] PGD 7a91b067 PUD 7a33d067 PMD 0
      [ 2325.022982] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
      [ 2325.022982] Modules linked in: nfsd(OF) cfg80211 rfkill bridge stp
      llc snd_intel8x0 snd_ac97_codec ac97_bus auth_rpcgss nfs_acl serio_raw
      e1000 i2c_piix4 ppdev snd_pcm snd_timer lockd pcspkr joydev parport_pc
      snd parport i2c_core soundcore microcode sunrpc ata_generic pata_acpi
      [last unloaded: nfsd]
      [ 2325.022982] CPU: 1 PID: 2123 Comm: nfsd Tainted: GF          O
      3.14.0-rc8+ #2
      [ 2325.022982] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
      VirtualBox 12/01/2006
      [ 2325.022982] task: ffff88007b384800 ti: ffff8800797f6000 task.ti:
      ffff8800797f6000
      [ 2325.022982] RIP: 0010:[<ffffffff8133c18c>]  [<ffffffff8133c18c>]
      rb_erase+0x14c/0x390
      [ 2325.022982] RSP: 0018:ffff8800797f7d98  EFLAGS: 00010246
      [ 2325.022982] RAX: ffff880079c1f010 RBX: ffff880079f4c828 RCX:
      0000000000000000
      [ 2325.022982] RDX: 0000000000000000 RSI: ffff880079bcb070 RDI:
      ffff880079f4c810
      [ 2325.022982] RBP: ffff8800797f7d98 R08: 0000000000000000 R09:
      ffff88007964fc70
      [ 2325.022982] R10: 0000000000000000 R11: 0000000000000400 R12:
      ffff880079f4c800
      [ 2325.022982] R13: ffff880079bcb000 R14: ffff8800797f7da8 R15:
      ffff880079f4c860
      [ 2325.022982] FS:  0000000000000000(0000) GS:ffff88007f900000(0000)
      knlGS:0000000000000000
      [ 2325.022982] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      [ 2325.022982] CR2: 0000000000000000 CR3: 000000007a3ef000 CR4:
      00000000000006e0
      [ 2325.022982] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
      0000000000000000
      [ 2325.022982] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
      0000000000000400
      [ 2325.022982] Stack:
      [ 2325.022982]  ffff8800797f7de0 ffffffffa0191c6e ffff8800797f7da8
      ffff8800797f7da8
      [ 2325.022982]  ffff880079f4c810 ffff880079bcb000 ffffffff81cc26c0
      ffff880079c1f010
      [ 2325.022982]  ffff880079bcb070 ffff8800797f7e28 ffffffffa01977f2
      ffff8800797f7df0
      [ 2325.022982] Call Trace:
      [ 2325.022982]  [<ffffffffa0191c6e>] destroy_client+0x32e/0x3b0 [nfsd]
      [ 2325.022982]  [<ffffffffa01977f2>] nfs4_state_shutdown_net+0x1a2/0x220
      [nfsd]
      [ 2325.022982]  [<ffffffffa01700b8>] nfsd_shutdown_net+0x38/0x70 [nfsd]
      [ 2325.022982]  [<ffffffffa017013e>] nfsd_last_thread+0x4e/0x80 [nfsd]
      [ 2325.022982]  [<ffffffffa001f1eb>] svc_shutdown_net+0x2b/0x30 [sunrpc]
      [ 2325.022982]  [<ffffffffa017064b>] nfsd_destroy+0x5b/0x80 [nfsd]
      [ 2325.022982]  [<ffffffffa0170773>] nfsd+0x103/0x130 [nfsd]
      [ 2325.022982]  [<ffffffffa0170670>] ? nfsd_destroy+0x80/0x80 [nfsd]
      [ 2325.022982]  [<ffffffff810a8232>] kthread+0xd2/0xf0
      [ 2325.022982]  [<ffffffff810a8160>] ? insert_kthread_work+0x40/0x40
      [ 2325.022982]  [<ffffffff816c493c>] ret_from_fork+0x7c/0xb0
      [ 2325.022982]  [<ffffffff810a8160>] ? insert_kthread_work+0x40/0x40
      [ 2325.022982] Code: 48 83 e1 fc 48 89 10 0f 84 02 01 00 00 48 3b 41 10
      0f 84 08 01 00 00 48 89 51 08 48 89 fa e9 74 ff ff ff 0f 1f 40 00 48 8b
      50 10 <f6> 02 01 0f 84 93 00 00 00 48 8b 7a 10 48 85 ff 74 05 f6 07 01
      [ 2325.022982] RIP  [<ffffffff8133c18c>] rb_erase+0x14c/0x390
      [ 2325.022982]  RSP <ffff8800797f7d98>
      [ 2325.022982] CR2: 0000000000000000
      [ 2325.022982] ---[ end trace 28c27ed011655e57 ]---
      
      [  228.064071] BUG: soft lockup - CPU#0 stuck for 22s! [nfsd:558]
      [  228.064428] Modules linked in: ip6t_rpfilter ip6t_REJECT cfg80211
      xt_conntrack rfkill ebtable_nat ebtable_broute bridge stp llc
      ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6
      nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw
      ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4
      nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security
      iptable_raw nfsd(OF) auth_rpcgss nfs_acl lockd snd_intel8x0
      snd_ac97_codec ac97_bus joydev snd_pcm snd_timer e1000 sunrpc snd ppdev
      parport_pc serio_raw pcspkr i2c_piix4 microcode parport soundcore
      i2c_core ata_generic pata_acpi
      [  228.064539] CPU: 0 PID: 558 Comm: nfsd Tainted: GF          O
      3.14.0-rc8+ #2
      [  228.064539] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS
      VirtualBox 12/01/2006
      [  228.064539] task: ffff880076adec00 ti: ffff880074616000 task.ti:
      ffff880074616000
      [  228.064539] RIP: 0010:[<ffffffff8133ba17>]  [<ffffffff8133ba17>]
      rb_next+0x27/0x50
      [  228.064539] RSP: 0018:ffff880074617de0  EFLAGS: 00000282
      [  228.064539] RAX: ffff880074478010 RBX: ffff88007446f860 RCX:
      0000000000000014
      [  228.064539] RDX: ffff880074478010 RSI: 0000000000000000 RDI:
      ffff880074478010
      [  228.064539] RBP: ffff880074617de0 R08: 0000000000000000 R09:
      0000000000000012
      [  228.064539] R10: 0000000000000001 R11: ffffffffffffffec R12:
      ffffea0001d11a00
      [  228.064539] R13: ffff88007f401400 R14: ffff88007446f800 R15:
      ffff880074617d50
      [  228.064539] FS:  0000000000000000(0000) GS:ffff88007f800000(0000)
      knlGS:0000000000000000
      [  228.064539] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      [  228.064539] CR2: 00007fe9ac6ec000 CR3: 000000007a5d6000 CR4:
      00000000000006f0
      [  228.064539] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
      0000000000000000
      [  228.064539] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
      0000000000000400
      [  228.064539] Stack:
      [  228.064539]  ffff880074617e28 ffffffffa01ab7db ffff880074617df0
      ffff880074617df0
      [  228.064539]  ffff880079273000 ffffffff81cc26c0 ffffffff81cc26c0
      0000000000000000
      [  228.064539]  0000000000000000 ffff880074617e48 ffffffffa01840b8
      ffffffff81cc26c0
      [  228.064539] Call Trace:
      [  228.064539]  [<ffffffffa01ab7db>] nfs4_state_shutdown_net+0x18b/0x220
      [nfsd]
      [  228.064539]  [<ffffffffa01840b8>] nfsd_shutdown_net+0x38/0x70 [nfsd]
      [  228.064539]  [<ffffffffa018413e>] nfsd_last_thread+0x4e/0x80 [nfsd]
      [  228.064539]  [<ffffffffa00aa1eb>] svc_shutdown_net+0x2b/0x30 [sunrpc]
      [  228.064539]  [<ffffffffa018464b>] nfsd_destroy+0x5b/0x80 [nfsd]
      [  228.064539]  [<ffffffffa0184773>] nfsd+0x103/0x130 [nfsd]
      [  228.064539]  [<ffffffffa0184670>] ? nfsd_destroy+0x80/0x80 [nfsd]
      [  228.064539]  [<ffffffff810a8232>] kthread+0xd2/0xf0
      [  228.064539]  [<ffffffff810a8160>] ? insert_kthread_work+0x40/0x40
      [  228.064539]  [<ffffffff816c493c>] ret_from_fork+0x7c/0xb0
      [  228.064539]  [<ffffffff810a8160>] ? insert_kthread_work+0x40/0x40
      [  228.064539] Code: 1f 44 00 00 55 48 8b 17 48 89 e5 48 39 d7 74 3b 48
      8b 47 08 48 85 c0 75 0e eb 25 66 0f 1f 84 00 00 00 00 00 48 89 d0 48 8b
      50 10 <48> 85 d2 75 f4 5d c3 66 90 48 3b 78 08 75 f6 48 8b 10 48 89 c7
      
      Fixes: ac55fdc4 (nfsd: move the confirmed and unconfirmed hlists...)
      Signed-off-by: default avatarKinglong Mee <kinglongmee@gmail.com>
      Reviewed-by: default avatarJeff Layton <jlayton@redhat.com>
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      7bd960be
    • Joe Thornber's avatar
      dm: take care to copy the space map roots before locking the superblock · 72a28653
      Joe Thornber authored
      commit 5a32083d upstream.
      
      In theory copying the space map root can fail, but in practice it never
      does because we're careful to check what size buffer is needed.
      
      But make certain we're able to copy the space map roots before
      locking the superblock.
      Signed-off-by: default avatarJoe Thornber <ejt@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      [ kamal: backport to 3.8 (no dm-cache-metadata.c, dm-era-target.c) ]
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      72a28653
    • Joe Thornber's avatar
      dm transaction manager: fix corruption due to non-atomic transaction commit · 2d4dfde8
      Joe Thornber authored
      commit a9d45396 upstream.
      
      The persistent-data library used by dm-thin, dm-cache, etc is
      transactional.  If anything goes wrong, such as an io error when writing
      new metadata or a power failure, then we roll back to the last
      transaction.
      
      Atomicity when committing a transaction is achieved by:
      
      a) Never overwriting data from the previous transaction.
      b) Writing the superblock last, after all other metadata has hit the
         disk.
      
      This commit and the following commit ("dm: take care to copy the space
      map roots before locking the superblock") fix a bug associated with (b).
      When committing it was possible for the superblock to still be written
      in spite of an io error occurring during the preceeding metadata flush.
      With these commits we're careful not to take the write lock out on the
      superblock until after the metadata flush has completed.
      
      Change the transaction manager's semantics for dm_tm_commit() to assume
      all data has been flushed _before_ the single superblock that is passed
      in.
      
      As a prerequisite, split the block manager's block unlocking and
      flushing by simplifying dm_bm_flush_and_unlock() to dm_bm_flush().  Now
      the unlocking must be done separately.
      
      This issue was discovered by forcing io errors at the crucial time
      using dm-flakey.
      Signed-off-by: default avatarJoe Thornber <ejt@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      [ kamal: backport to 3.8 (no dm-cache-metadata.c) ]
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      2d4dfde8
    • J. Bruce Fields's avatar
      nfsd: notify_change needs elevated write count · b1c2fc5d
      J. Bruce Fields authored
      commit 9f67f189 upstream.
      
      Looks like this bug has been here since these write counts were
      introduced, not sure why it was just noticed now.
      
      Thanks also to Jan Kara for pointing out the problem.
      Reported-by: default avatarMatthew Rahtz <mrahtz@rapitasystems.com>
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      b1c2fc5d
    • J. Bruce Fields's avatar
      nfsd4: fix test_stateid error reply encoding · d5175c16
      J. Bruce Fields authored
      commit a11fcce1 upstream.
      
      If the entire operation fails then there's nothing to encode.
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      d5175c16
    • J. Bruce Fields's avatar
      nfsd4: leave reply buffer space for failed setattr · 65e71813
      J. Bruce Fields authored
      commit 04819bf6 upstream.
      
      This fixes an ommission from 18032ca0
      "NFSD: Server implementation of MAC Labeling", which increased the size
      of the setattr error reply without increasing COMPOUND_ERR_SLACK_SPACE.
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      65e71813
    • J. Bruce Fields's avatar
      0e47e4ff
    • J. Bruce Fields's avatar
      nfsd4: buffer-length check for SUPPATTR_EXCLCREAT · 5a73809b
      J. Bruce Fields authored
      commit de3997a7 upstream.
      
      This was an omission from 8c18f205
      "nfsd41: SUPPATTR_EXCLCREAT attribute".
      
      Cc: Benny Halevy <bhalevy@primarydata.com>
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      5a73809b
    • Jason Wang's avatar
      x86, hyperv: Bypass the timer_irq_works() check · 5d2285cb
      Jason Wang authored
      commit ca3ba2a2 upstream.
      
      This patch bypass the timer_irq_works() check for hyperv guest since:
      
      - It was guaranteed to work.
      - timer_irq_works() may fail sometime due to the lpj calibration were inaccurate
        in a hyperv guest or a buggy host.
      
      In the future, we should get the tsc frequency from hypervisor and use preset
      lpj instead.
      
      [ hpa: I would prefer to not defer things to "the future" in the future... ]
      
      Cc: K. Y. Srinivasan <kys@microsoft.com>
      Cc: Haiyang Zhang <haiyangz@microsoft.com>
      Acked-by: default avatarK. Y. Srinivasan <kys@microsoft.com>
      Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      Link: http://lkml.kernel.org/r/1393558229-14755-1-git-send-email-jasowang@redhat.comSigned-off-by: default avatarH. Peter Anvin <hpa@linux.intel.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      5d2285cb
    • Marek Vasut's avatar
      gpio: mxs: Allow for recursive enable_irq_wake() call · e49dde85
      Marek Vasut authored
      commit a585f87c upstream.
      
      The scenario here is that someone calls enable_irq_wake() from somewhere
      in the code. This will result in the lockdep producing a backtrace as can
      be seen below. In my case, this problem is triggered when using the wl1271
      (TI WlCore) driver found in drivers/net/wireless/ti/ .
      
      The problem cause is rather obvious from the backtrace, but let's outline
      the dependency. enable_irq_wake() grabs the IRQ buslock in irq_set_irq_wake(),
      which in turns calls mxs_gpio_set_wake_irq() . But mxs_gpio_set_wake_irq()
      calls enable_irq_wake() again on the one-level-higher IRQ , thus it tries to
      grab the IRQ buslock again in irq_set_irq_wake() . Because the spinlock in
      irq_set_irq_wake()->irq_get_desc_buslock()->__irq_get_desc_lock() is not
      marked as recursive, lockdep will spew the stuff below.
      
      We know we can safely re-enter the lock, so use IRQ_GC_INIT_NESTED_LOCK to
      fix the spew.
      
       =============================================
       [ INFO: possible recursive locking detected ]
       3.10.33-00012-gf06b763-dirty #61 Not tainted
       ---------------------------------------------
       kworker/0:1/18 is trying to acquire lock:
        (&irq_desc_lock_class){-.-...}, at: [<c00685f0>] __irq_get_desc_lock+0x48/0x88
      
       but task is already holding lock:
        (&irq_desc_lock_class){-.-...}, at: [<c00685f0>] __irq_get_desc_lock+0x48/0x88
      
       other info that might help us debug this:
        Possible unsafe locking scenario:
      
              CPU0
              ----
         lock(&irq_desc_lock_class);
         lock(&irq_desc_lock_class);
      
        *** DEADLOCK ***
      
        May be due to missing lock nesting notation
      
       3 locks held by kworker/0:1/18:
        #0:  (events){.+.+.+}, at: [<c0036308>] process_one_work+0x134/0x4a4
        #1:  ((&fw_work->work)){+.+.+.}, at: [<c0036308>] process_one_work+0x134/0x4a4
        #2:  (&irq_desc_lock_class){-.-...}, at: [<c00685f0>] __irq_get_desc_lock+0x48/0x88
      
       stack backtrace:
       CPU: 0 PID: 18 Comm: kworker/0:1 Not tainted 3.10.33-00012-gf06b763-dirty #61
       Workqueue: events request_firmware_work_func
       [<c0013eb4>] (unwind_backtrace+0x0/0xf0) from [<c0011c74>] (show_stack+0x10/0x14)
       [<c0011c74>] (show_stack+0x10/0x14) from [<c005bb08>] (__lock_acquire+0x140c/0x1a64)
       [<c005bb08>] (__lock_acquire+0x140c/0x1a64) from [<c005c6a8>] (lock_acquire+0x9c/0x104)
       [<c005c6a8>] (lock_acquire+0x9c/0x104) from [<c051d5a4>] (_raw_spin_lock_irqsave+0x44/0x58)
       [<c051d5a4>] (_raw_spin_lock_irqsave+0x44/0x58) from [<c00685f0>] (__irq_get_desc_lock+0x48/0x88)
       [<c00685f0>] (__irq_get_desc_lock+0x48/0x88) from [<c0068e78>] (irq_set_irq_wake+0x20/0xf4)
       [<c0068e78>] (irq_set_irq_wake+0x20/0xf4) from [<c027260c>] (mxs_gpio_set_wake_irq+0x1c/0x24)
       [<c027260c>] (mxs_gpio_set_wake_irq+0x1c/0x24) from [<c0068cf4>] (set_irq_wake_real+0x30/0x44)
       [<c0068cf4>] (set_irq_wake_real+0x30/0x44) from [<c0068ee4>] (irq_set_irq_wake+0x8c/0xf4)
       [<c0068ee4>] (irq_set_irq_wake+0x8c/0xf4) from [<c0310748>] (wlcore_nvs_cb+0x10c/0x97c)
       [<c0310748>] (wlcore_nvs_cb+0x10c/0x97c) from [<c02be5e8>] (request_firmware_work_func+0x38/0x58)
       [<c02be5e8>] (request_firmware_work_func+0x38/0x58) from [<c0036394>] (process_one_work+0x1c0/0x4a4)
       [<c0036394>] (process_one_work+0x1c0/0x4a4) from [<c0036a4c>] (worker_thread+0x138/0x394)
       [<c0036a4c>] (worker_thread+0x138/0x394) from [<c003cb74>] (kthread+0xa4/0xb0)
       [<c003cb74>] (kthread+0xa4/0xb0) from [<c000ee00>] (ret_from_fork+0x14/0x34)
       wlcore: loaded
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      Acked-by: default avatarShawn Guo <shawn.guo@linaro.org>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      e49dde85
    • Josef Bacik's avatar
      Btrfs: fix deadlock with nested trans handles · 470be450
      Josef Bacik authored
      commit 3bbb24b2 upstream.
      
      Zach found this deadlock that would happen like this
      
      btrfs_end_transaction <- reduce trans->use_count to 0
        btrfs_run_delayed_refs
          btrfs_cow_block
            find_free_extent
      	btrfs_start_transaction <- increase trans->use_count to 1
                allocate chunk
      	btrfs_end_transaction <- decrease trans->use_count to 0
      	  btrfs_run_delayed_refs
      	    lock tree block we are cowing above ^^
      
      We need to only decrease trans->use_count if it is above 1, otherwise leave it
      alone.  This will make nested trans be the only ones who decrease their added
      ref, and will let us get rid of the trans->use_count++ hack if we have to commit
      the transaction.  Thanks,
      Reported-by: default avatarZach Brown <zab@redhat.com>
      Signed-off-by: default avatarJosef Bacik <jbacik@fb.com>
      Tested-by: default avatarZach Brown <zab@redhat.com>
      Signed-off-by: default avatarChris Mason <clm@fb.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      470be450
    • Richard Guy Briggs's avatar
      audit: convert PPIDs to the inital PID namespace. · a1b1dd71
      Richard Guy Briggs authored
      commit c92cdeb4 upstream.
      
      sys_getppid() returns the parent pid of the current process in its own pid
      namespace.  Since audit filters are based in the init pid namespace, a process
      could avoid a filter or trigger an unintended one by being in an alternate pid
      namespace or log meaningless information.
      
      Switch to task_ppid_nr() for PPIDs to anchor all audit filters in the
      init_pid_ns.
      
      (informed by ebiederman's 6c621b7e)
      Cc: Eric W. Biederman <ebiederm@xmission.com>
      Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
      [ kamal: backport to 3.8 (context) ]
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      a1b1dd71
    • Richard Guy Briggs's avatar
      pid: get pid_t ppid of task in init_pid_ns · 5e7951dc
      Richard Guy Briggs authored
      commit ad36d282 upstream.
      
      Added the functions task_ppid_nr_ns() and task_ppid_nr() to abstract the lookup
      of the PPID (real_parent's pid_t) of a process, including rcu locking, in the
      arbitrary and init_pid_ns.
      This provides an alternative to sys_getppid(), which is relative to the child
      process' pid namespace.
      
      (informed by ebiederman's 6c621b7e)
      Cc: Eric W. Biederman <ebiederm@xmission.com>
      Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      5e7951dc
    • Brian Austin's avatar
      ASoC: cs42l51: Fix SOC_DOUBLE_R_SX_TLV shift values for ADC, PCM, and Analog kcontrols · 521bc3b0
      Brian Austin authored
      commit 7272e051 upstream.
      
      The shift values for the ADC,PCM, and Analog kcontrols were wrong causing wrong values for the SOC_DOUBLE_R_SX_TLV macros
      Fixed the TLV for aout_tlv to show -102dB correctly
      
      Fixes: 1d99f243 (ASoC: core: Rework SOC_DOUBLE_R_SX_TLV add SOC_SINGLE_SX_TLV)
      Reported-by: default avatarThomas Petazzoni <thomas.petazzoni@free-electrons.com>
      Signed-off-by: default avatarBrian Austin <brian.austin@cirrus.com>
      Signed-off-by: default avatarMark Brown <broonie@linaro.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      521bc3b0
    • Krzysztof Kozlowski's avatar
      mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail · 8eea675e
      Krzysztof Kozlowski authored
      commit 483e2dfd upstream.
      
      Fixes: 4aab3fad ("mfd: tps65910: Move interrupt implementation code to mfd file")
      
      tps65910_irq_init() sets 'tps65910->chip_irq' before calling
      regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in
      memory allocation of regmap_irq_chip_data members then:
      
      1. The 'tps65910->chip_irq' will still hold some value
      2. 'tps65910->irq_data' will be pointing to already freed memory
         (because regmap_add_irq_chip() will free it on error)
      
      This results in invalid memory access during driver remove because the
      tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero.
      Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      8eea675e
    • Krzysztof Kozlowski's avatar
      mfd: max77693: Fix possible NULL pointer dereference on i2c_new_dummy error · ec6ec767
      Krzysztof Kozlowski authored
      commit ad09dd6a upstream.
      
      During probe the driver allocates dummy I2C devices for MUIC and haptic
      with i2c_new_dummy() but it does not check the return value of this
      calls.
      
      In case of error (i2c_new_device(): memory allocation failure or I2C
      address cannot be used) this function returns NULL which is later used
      by devm_regmap_init_i2c() and i2c_unregister_device().
      
      If i2c_new_dummy() fails for MUIC or haptic devices, fail also the probe
      for main MFD driver.
      Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      ec6ec767
    • Krzysztof Kozlowski's avatar
      mfd: 88pm860x: Fix possible NULL pointer dereference on i2c_new_dummy error · 784ad8c3
      Krzysztof Kozlowski authored
      commit 159ce52a upstream.
      
      During probe the driver allocates dummy I2C device for companion chip
      with i2c_new_dummy() but it does not check the return value of this call.
      
      In case of error (i2c_new_device(): memory allocation failure or I2C
      address cannot be used) this function returns NULL which is later used
      by regmap_init_i2c().
      
      If i2c_new_dummy() fails for companion device, fail also the probe for
      main MFD driver.
      Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      784ad8c3
    • Krzysztof Kozlowski's avatar
      mfd: 88pm860x: Fix I2C device resource leak on regmap init fail · f724e057
      Krzysztof Kozlowski authored
      commit a7ab1c8b upstream.
      
      During probe the driver allocates dummy I2C device for companion chip
      and then allocates a regmap for it. If regmap_init_i2c() fails then the
      I2C driver (allocated with i2c_new_dummy()) is not freed and this
      resource leaks.
      Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      f724e057
    • Krzysztof Kozlowski's avatar
      mfd: max8925: Fix possible NULL pointer dereference on i2c_new_dummy error · f8228efc
      Krzysztof Kozlowski authored
      commit 96cf3ded upstream.
      
      During probe the driver allocates dummy I2C devices for RTC and ADC
      with i2c_new_dummy() but it does not check the return value of this
      calls.
      
      In case of error (i2c_new_device(): memory allocation failure or I2C
      address cannot be used) this function returns NULL which is later used
      by i2c_unregister_device().
      
      If i2c_new_dummy() fails for RTC or ADC devices, fail also the probe
      for main MFD driver.
      Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
      Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
      Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
      f8228efc