1. 13 May, 2015 2 commits
    • Jeff Layton's avatar
      nfs: take extra reference to fl->fl_file when running a setlk · feaff8e5
      Jeff Layton authored
      We had a report of a crash while stress testing the NFS client:
      
          BUG: unable to handle kernel NULL pointer dereference at 0000000000000150
          IP: [<ffffffff8127b698>] locks_get_lock_context+0x8/0x90
          PGD 0
          Oops: 0000 [#1] SMP
          Modules linked in: rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ebtable_filter ebtable_broute bridge stp llc ebtables ip6table_security ip6table_mangle ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_raw ip6table_filter ip6_tables iptable_security iptable_mangle iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_raw coretemp crct10dif_pclmul ppdev crc32_pclmul crc32c_intel ghash_clmulni_intel vmw_balloon serio_raw vmw_vmci i2c_piix4 shpchp parport_pc acpi_cpufreq parport nfsd auth_rpcgss nfs_acl lockd grace sunrpc vmwgfx drm_kms_helper ttm drm mptspi scsi_transport_spi mptscsih mptbase e1000 ata_generic pata_acpi
          CPU: 1 PID: 399 Comm: kworker/1:1H Not tainted 4.1.0-0.rc1.git0.1.fc23.x86_64 #1
          Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/30/2013
          Workqueue: rpciod rpc_async_schedule [sunrpc]
          task: ffff880036aea7c0 ti: ffff8800791f4000 task.ti: ffff8800791f4000
          RIP: 0010:[<ffffffff8127b698>]  [<ffffffff8127b698>] locks_get_lock_context+0x8/0x90
          RSP: 0018:ffff8800791f7c00  EFLAGS: 00010293
          RAX: ffff8800791f7c40 RBX: ffff88001f2ad8c0 RCX: ffffe8ffffc80305
          RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
          RBP: ffff8800791f7c88 R08: ffff88007fc971d8 R09: 279656d600000000
          R10: 0000034a01000000 R11: 279656d600000000 R12: ffff88001f2ad918
          R13: ffff88001f2ad8c0 R14: 0000000000000000 R15: 0000000100e73040
          FS:  0000000000000000(0000) GS:ffff88007fc80000(0000) knlGS:0000000000000000
          CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
          CR2: 0000000000000150 CR3: 0000000001c0b000 CR4: 00000000000407e0
          Stack:
           ffffffff8127c5b0 ffff8800791f7c18 ffffffffa0171e29 ffff8800791f7c58
           ffffffffa0171ef8 ffff8800791f7c78 0000000000000246 ffff88001ea0ba00
           ffff8800791f7c40 ffff8800791f7c40 00000000ff5d86a3 ffff8800791f7ca8
          Call Trace:
           [<ffffffff8127c5b0>] ? __posix_lock_file+0x40/0x760
           [<ffffffffa0171e29>] ? rpc_make_runnable+0x99/0xa0 [sunrpc]
           [<ffffffffa0171ef8>] ? rpc_wake_up_task_queue_locked.part.35+0xc8/0x250 [sunrpc]
           [<ffffffff8127cd3a>] posix_lock_file_wait+0x4a/0x120
           [<ffffffffa03e4f12>] ? nfs41_wake_and_assign_slot+0x32/0x40 [nfsv4]
           [<ffffffffa03bf108>] ? nfs41_sequence_done+0xd8/0x2d0 [nfsv4]
           [<ffffffffa03c116d>] do_vfs_lock+0x2d/0x30 [nfsv4]
           [<ffffffffa03c251d>] nfs4_lock_done+0x1ad/0x210 [nfsv4]
           [<ffffffffa0171a30>] ? __rpc_sleep_on_priority+0x390/0x390 [sunrpc]
           [<ffffffffa0171a30>] ? __rpc_sleep_on_priority+0x390/0x390 [sunrpc]
           [<ffffffffa0171a5c>] rpc_exit_task+0x2c/0xa0 [sunrpc]
           [<ffffffffa0167450>] ? call_refreshresult+0x150/0x150 [sunrpc]
           [<ffffffffa0172640>] __rpc_execute+0x90/0x460 [sunrpc]
           [<ffffffffa0172a25>] rpc_async_schedule+0x15/0x20 [sunrpc]
           [<ffffffff810baa1b>] process_one_work+0x1bb/0x410
           [<ffffffff810bacc3>] worker_thread+0x53/0x480
           [<ffffffff810bac70>] ? process_one_work+0x410/0x410
           [<ffffffff810bac70>] ? process_one_work+0x410/0x410
           [<ffffffff810c0b38>] kthread+0xd8/0xf0
           [<ffffffff810c0a60>] ? kthread_worker_fn+0x180/0x180
           [<ffffffff817a1aa2>] ret_from_fork+0x42/0x70
           [<ffffffff810c0a60>] ? kthread_worker_fn+0x180/0x180
      
      Jean says:
      
      "Running locktests with a large number of iterations resulted in a
       client crash.  The test run took a while and hasn't finished after close
       to 2 hours. The crash happened right after I gave up and killed the test
       (after 107m) with Ctrl+C."
      
      The crash happened because a NULL inode pointer got passed into
      locks_get_lock_context. The call chain indicates that file_inode(filp)
      returned NULL, which means that f_inode was NULL. Since that's zeroed
      out in __fput, that suggests that this filp pointer outlived the last
      reference.
      
      Looking at the code, that seems possible. We copy the struct file_lock
      that's passed in, but if the task is signalled at an inopportune time we
      can end up trying to use that file_lock in rpciod context after the process
      that requested it has already returned (and possibly put its filp
      reference).
      
      Fix this by taking an extra reference to the filp when we allocate the
      lock info, and put it in nfs4_lock_release.
      Reported-by: default avatarJean Spector <jean@primarydata.com>
      Signed-off-by: default avatarJeff Layton <jeff.layton@primarydata.com>
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
      feaff8e5
    • Chuck Lever's avatar
      nfs: stat(2) fails during cthon04 basic test5 on NFSv4.0 · 6b196875
      Chuck Lever authored
      When running the Connectathon basic tests against a Solaris NFS
      server over NFSv4.0, test5 reports that stat(2) returns a file size
      of zero instead of 1MB.
      
      On success, nfs_commit_inode() can return a positive result; see
      other call sites such as nfs_file_fsync_commit() and
      nfs_commit_unstable_pages().
      
      The call site recently added in nfs_wb_all() does not prevent that
      positive return value from leaking to its callers. If it leaks
      through nfs_sync_inode() back to nfs_getattr(), that causes stat(2)
      to return a positive return value to user space while also not
      filling in the passed-in struct stat.
      
      Additional clean up: the new logic in nfs_wb_all() is rewritten in
      bfields-normal form.
      
      Fixes: 5bb89b47 ("NFSv4.1/pnfs: Separate out metadata . . .")
      Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
      Signed-off-by: default avatarTrond Myklebust <trond.myklebust@primarydata.com>
      6b196875
  2. 10 May, 2015 6 commits
    • Linus Torvalds's avatar
      Linux 4.1-rc3 · 030bbdbf
      Linus Torvalds authored
      030bbdbf
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 01d07351
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "I really need to get back to sending these on my Friday, instead of my
        Monday morning, but nothing too amazing in here: a few amdkfd fixes, a
        few radeon fixes, i915 fixes, one tegra fix and one core fix"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm: Zero out invalid vblank timestamp in drm_update_vblank_count.
        drm/tegra: Don't use vblank_disable_immediate on incapable driver.
        drm/radeon: stop trying to suspend UVD sessions
        drm/radeon: more strictly validate the UVD codec
        drm/radeon: make UVD handle checking more strict
        drm/radeon: make VCE handle check more strict
        drm/radeon: fix userptr lockup
        drm/radeon: fix userptr BO unpin bug v3
        drm/amdkfd: Initialize sdma vm when creating sdma queue
        drm/amdkfd: Don't report local memory size
        drm/amdkfd: allow unregister process with queues
        drm/i915: Drop PIPE-A quirk for 945GSE HP Mini
        drm/i915: Sink rate read should be saved in deca-kHz
        drm/i915/dp: there is no audio on port A
        drm/i915: Add missing MacBook Pro models with dual channel LVDS
        drm/i915: Assume dual channel LVDS if pixel clock necessitates it
        drm/radeon: don't setup audio on asics that don't support it
        drm/radeon: disable semaphores for UVD V1 (v2)
      01d07351
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2015-05-08' of git://anongit.freedesktop.org/drm-intel into drm-fixes · 332545b3
      Dave Airlie authored
      misc i915 fixes.
      
      * tag 'drm-intel-fixes-2015-05-08' of git://anongit.freedesktop.org/drm-intel:
        drm/i915: Drop PIPE-A quirk for 945GSE HP Mini
        drm/i915: Sink rate read should be saved in deca-kHz
        drm/i915/dp: there is no audio on port A
        drm/i915: Add missing MacBook Pro models with dual channel LVDS
        drm/i915: Assume dual channel LVDS if pixel clock necessitates it
      332545b3
    • Mario Kleiner's avatar
      drm: Zero out invalid vblank timestamp in drm_update_vblank_count. · fdb68e09
      Mario Kleiner authored
      Since commit 844b03f2 we make
      sure that after vblank irq off, we return the last valid
      (vblank count, vblank timestamp) pair to clients, e.g., during
      modesets, which is good.
      
      An overlooked side effect of that commit for kms drivers without
      support for precise vblank timestamping is that at vblank irq
      enable, when we update the vblank counter from the hw counter, we
      can't update the corresponding vblank timestamp, so now we have a
      totally mismatched timestamp for the new count to confuse clients.
      
      Restore old client visible behaviour from before Linux 3.17, but
      zero out the timestamp at vblank counter update (instead of disable
      as in original implementation) if we can't generate a meaningful
      timestamp immediately for the new vblank counter. This will fix
      this regression, so callers know they need to retry again later
      if they need a valid timestamp, but at the same time preserves
      the improvements made in the commit mentioned above.
      Signed-off-by: default avatarMario Kleiner <mario.kleiner.de@gmail.com>
      Cc: <stable@vger.kernel.org> #v3.17+
      
      Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
      Cc: Daniel Vetter <daniel@ffwll.ch>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      fdb68e09
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm · 41f2a93c
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "A set of ARM fixes:
      
         - fix an off-by-one error in the iommu DMA ops, which caused errors
           with a 4GiB size.
      
         - remove comments mentioning the non-existent CONFIG_CPU_ARM1020_CPU_IDLE
           macro.
      
         - remove useless CONFIG_CPU_ICACHE_STREAMING_DISABLE blocks, where
           this symbol never appeared in any Kconfig.
      
         - fix Feroceon code to cope with a previous change correctly (it
           incorrectly left an additional word in an assembly structure
           definition)
      
         - avoid a misleading IRQ affinity warning in the ARM PMU code for
           IRQs which are already affine to their CPUs.
      
         - fix the node name printed in the IRQ affinity warning"
      
      * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
        ARM: 8352/1: perf: Fix the pmu node name in warning message
        ARM: 8351/1: perf: don't warn about missing interrupt-affinity property for PPIs
        ARM: 8350/1: proc-feroceon: Fix feroceon_proc_info macro
        ARM: 8349/1: arch/arm/mm/proc-arm925.S: remove dead #ifdef block
        ARM: 8348/1: remove comments on CPU_ARM1020_CPU_IDLE
        ARM: 8347/1: dma-mapping: fix off-by-one check in arm_setup_iommu_dma_ops
      41f2a93c
    • Linus Torvalds's avatar
      Merge tag 'samsung-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung · 8425ac7a
      Linus Torvalds authored
      Pull samsung fixes from Kukjin Kim:
       "Here is Samsung fixes for v4.1.  Since I've missed to send this via
        arm-soc tree before v4.1-rc3, so I'm sending this to you directly
      
         - fix commit ea08de16 ("ARM: dts: Add DISP1 power domain for
           exynos5420") which causes 'unhandled fault: imprecise external
           abort' error when PD turned off.  ("make DP a consumer of DISP1
           power domain")
      
         - fix 's3c-rtc' probe failure on Odriod-X2/U2/U3 boards ("add
           'rtc_src' clock to rtc node for source clock of rtc")
      
         - fix typo for 'cpu-crit-0' trip point on exynos5420/5440
      
         - fix S2R failure on exynos5250-snow due to card power of Marvell
           WiFi driver (suspend/resume) ("add keep-power-in-susped to WiFi
           SDIO node")"
      
      * tag 'samsung-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
        ARM: dts: Add keep-power-in-suspend to WiFi SDIO node for exynos5250-snow
        ARM: dts: Fix typo in trip point temperature for exynos5420/5440
        ARM: dts: add 'rtc_src' clock to rtc node for exynos4412-odroid boards
        ARM: dts: Make DP a consumer of DISP1 power domain on Exynos5420
      8425ac7a
  3. 09 May, 2015 15 commits
  4. 08 May, 2015 11 commits
  5. 07 May, 2015 6 commits