21 Mar, 2012

4 commits

  • Pull scheduler changes for v3.4 from Ingo Molnar

    * 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (27 commits)
    printk: Make it compile with !CONFIG_PRINTK
    sched/x86: Fix overflow in cyc2ns_offset
    sched: Fix nohz load accounting -- again!
    sched: Update yield() docs
    printk/sched: Introduce special printk_sched() for those awkward moments
    sched/nohz: Correctly initialize 'next_balance' in 'nohz' idle balancer
    sched: Cleanup cpu_active madness
    sched: Fix load-balance wreckage
    sched: Clean up parameter passing of proc_sched_autogroup_set_nice()
    sched: Ditch per cgroup task lists for load-balancing
    sched: Rename load-balancing fields
    sched: Move load-balancing arguments into helper struct
    sched/rt: Do not submit new work when PI-blocked
    sched/rt: Prevent idle task boosting
    sched/wait: Add __wake_up_all_locked() API
    sched/rt: Document scheduler related skip-resched-check sites
    sched/rt: Use schedule_preempt_disabled()
    sched/rt: Add schedule_preempt_disabled()
    sched/rt: Do not throttle when PI boosting
    sched/rt: Keep period timer ticking when rt throttling is active
    ...

    Linus Torvalds
     
  • Pull perf events changes for v3.4 from Ingo Molnar:

    - New "hardware based branch profiling" feature both on the kernel and
    the tooling side, on CPUs that support it. (modern x86 Intel CPUs
    with the 'LBR' hardware feature currently.)

    This new feature is basically a sophisticated 'magnifying glass' for
    branch execution - something that is pretty difficult to extract from
    regular, function histogram centric profiles.

    The simplest mode is activated via 'perf record -b', and the result
    looks like this in perf report:

    $ perf record -b any_call,u -e cycles:u branchy

    $ perf report -b --sort=symbol
    52.34% [.] main [.] f1
    24.04% [.] f1 [.] f3
    23.60% [.] f1 [.] f2
    0.01% [k] _IO_new_file_xsputn [k] _IO_file_overflow
    0.01% [k] _IO_vfprintf_internal [k] _IO_new_file_xsputn
    0.01% [k] _IO_vfprintf_internal [k] strchrnul
    0.01% [k] __printf [k] _IO_vfprintf_internal
    0.01% [k] main [k] __printf

    This output shows from/to branch columns and shows the highest
    percentage (from,to) jump combinations - i.e. the most likely taken
    branches in the system. "branches" can also include function calls
    and any other synchronous and asynchronous transitions of the
    instruction pointer that are not 'next instruction' - such as system
    calls, traps, interrupts, etc.

    This feature comes with (hopefully intuitive) flat ascii and TUI
    support in perf report.

    - Various 'perf annotate' visual improvements for us assembly junkies.
    It will now recognize function calls in the TUI and by hitting enter
    you can follow the call (recursively) and back, amongst other
    improvements.

    - Multiple threads/processes recording support in perf record, perf
    stat, perf top - which is activated via a comma-list of PIDs:

    perf top -p 21483,21485
    perf stat -p 21483,21485 -ddd
    perf record -p 21483,21485

    - Support for per UID views, via the --uid paramter to perf top, perf
    report, etc. For example 'perf top --uid mingo' will only show the
    tasks that I am running, excluding other users, root, etc.

    - Jump label restructurings and improvements - this includes the
    factoring out of the (hopefully much clearer) include/linux/static_key.h
    generic facility:

    struct static_key key = STATIC_KEY_INIT_FALSE;

    ...

    if (static_key_false(&key))
    do unlikely code
    else
    do likely code

    ...
    static_key_slow_inc();
    ...
    static_key_slow_inc();
    ...

    The static_key_false() branch will be generated into the code with as
    little impact to the likely code path as possible. the
    static_key_slow_*() APIs flip the branch via live kernel code patching.

    This facility can now be used more widely within the kernel to
    micro-optimize hot branches whose likelihood matches the static-key
    usage and fast/slow cost patterns.

    - SW function tracer improvements: perf support and filtering support.

    - Various hardenings of the perf.data ABI, to make older perf.data's
    smoother on newer tool versions, to make new features integrate more
    smoothly, to support cross-endian recording/analyzing workflows
    better, etc.

    - Restructuring of the kprobes code, the splitting out of 'optprobes',
    and a corner case bugfix.

    - Allow the tracing of kernel console output (printk).

    - Improvements/fixes to user-space RDPMC support, allowing user-space
    self-profiling code to extract PMU counts without performing any
    system calls, while playing nice with the kernel side.

    - 'perf bench' improvements

    - ... and lots of internal restructurings, cleanups and fixes that made
    these features possible. And, as usual this list is incomplete as
    there were also lots of other improvements

    * 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (120 commits)
    perf report: Fix annotate double quit issue in branch view mode
    perf report: Remove duplicate annotate choice in branch view mode
    perf/x86: Prettify pmu config literals
    perf report: Enable TUI in branch view mode
    perf report: Auto-detect branch stack sampling mode
    perf record: Add HEADER_BRANCH_STACK tag
    perf record: Provide default branch stack sampling mode option
    perf tools: Make perf able to read files from older ABIs
    perf tools: Fix ABI compatibility bug in print_event_desc()
    perf tools: Enable reading of perf.data files from different ABI rev
    perf: Add ABI reference sizes
    perf report: Add support for taken branch sampling
    perf record: Add support for sampling taken branch
    perf tools: Add code to support PERF_SAMPLE_BRANCH_STACK
    x86/kprobes: Split out optprobe related code to kprobes-opt.c
    x86/kprobes: Fix a bug which can modify kernel code permanently
    x86/kprobes: Fix instruction recovery on optimized path
    perf: Add callback to flush branch_stack on context switch
    perf: Disable PERF_SAMPLE_BRANCH_* when not supported
    perf/x86: Add LBR software filter support for Intel CPUs
    ...

    Linus Torvalds
     
  • Pull irq/core changes for v3.4 from Ingo Molnar

    * 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    genirq: Remove paranoid warnons and bogus fixups
    genirq: Flush the irq thread on synchronization
    genirq: Get rid of unnecessary IRQTF_DIED flag
    genirq: No need to check IRQTF_DIED before stopping a thread handler
    genirq: Get rid of unnecessary irqaction field in task_struct
    genirq: Fix incorrect check for forced IRQ thread handler
    softirq: Reduce invoke_softirq() code duplication
    genirq: Fix long-term regression in genirq irq_set_irq_type() handling
    x86-32/irq: Don't switch to irq stack for a user-mode irq

    Linus Torvalds
     
  • Pull RCU changes for v3.4 from Ingo Molnar. The major features of this
    series are:

    - making RCU more aggressive about entering dyntick-idle mode in order
    to improve energy efficiency

    - converting a few more call_rcu()s to kfree_rcu()s

    - applying a number of rcutree fixes and cleanups to rcutiny

    - removing CONFIG_SMP #ifdefs from treercu

    - allowing RCU CPU stall times to be set via sysfs

    - adding CPU-stall capability to rcutorture

    - adding more RCU-abuse diagnostics

    - updating documentation

    - fixing yet more issues located by the still-ongoing top-to-bottom
    inspection of RCU, this time with a special focus on the CPU-hotplug
    code path.

    * 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (48 commits)
    rcu: Stop spurious warnings from synchronize_sched_expedited
    rcu: Hold off RCU_FAST_NO_HZ after timer posted
    rcu: Eliminate softirq-mediated RCU_FAST_NO_HZ idle-entry loop
    rcu: Add RCU_NONIDLE() for idle-loop RCU read-side critical sections
    rcu: Allow nesting of rcu_idle_enter() and rcu_idle_exit()
    rcu: Remove redundant check for rcu_head misalignment
    PTR_ERR should be called before its argument is cleared.
    rcu: Convert WARN_ON_ONCE() in rcu_lock_acquire() to lockdep
    rcu: Trace only after NULL-pointer check
    rcu: Call out dangers of expedited RCU primitives
    rcu: Rework detection of use of RCU by offline CPUs
    lockdep: Add CPU-idle/offline warning to lockdep-RCU splat
    rcu: No interrupt disabling for rcu_prepare_for_idle()
    rcu: Move synchronize_sched_expedited() to rcutree.c
    rcu: Check for illegal use of RCU from offlined CPUs
    rcu: Update stall-warning documentation
    rcu: Add CPU-stall capability to rcutorture
    rcu: Make documentation give more realistic rcutorture duration
    rcutorture: Permit holding off CPU-hotplug operations during boot
    rcu: Print scheduling-clock information on RCU CPU stall-warning messages
    ...

    Linus Torvalds
     

20 Mar, 2012

4 commits

  • Pull core/locking changes for v3.4 from Ingo Molnar

    * 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    futex: Simplify return logic
    futex: Cover all PI opcodes with cmpxchg enabled check

    Linus Torvalds
     
  • Pull core/iommu changes for v3.4 from Ingo Molnar

    * 'core-iommu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86/iommu/intel: Increase the number of iommus supported to MAX_IO_APICS
    x86/iommu/intel: Fix identity mapping for sandy bridge

    Linus Torvalds
     
  • * branch 'dcache-word-accesses':
    vfs: use 'unsigned long' accesses for dcache name comparison and hashing

    This does the name hashing and lookup using word-sized accesses when
    that is efficient, namely on x86 (although any little-endian machine
    with good unaligned accesses would do).

    It does very much depend on little-endian logic, but it's a very hot
    couple of functions under some real loads, and this patch improves the
    performance of __d_lookup_rcu() and link_path_walk() by up to about 30%.
    Giving a 10% improvement on some very pathname-heavy benchmarks.

    Because we do make unaligned accesses past the filename, the
    optimization is disabled when CONFIG_DEBUG_PAGEALLOC is active, and we
    effectively depend on the fact that on x86 we don't really ever have the
    last page of usable RAM followed immediately by any IO memory (due to
    ACPI tables, BIOS buffer areas etc).

    Some of the bit operations we do are a bit "subtle". It's commented,
    but you do need to really think about the code. Or just consider it
    black magic.

    Thanks to people on G+ for some of the optimized bit tricks.

    Linus Torvalds
     
  • For some odd historical reason, the final mixing round for the dentry
    cache hash table lookup had an insane "xor with big constant" logic. In
    two places.

    The big constant that is being xor'ed is GOLDEN_RATIO_PRIME, which is a
    fairly random-looking number that is designed to be *multiplied* with so
    that the bits get spread out over a whole long-word.

    But xor'ing with it is insane. It doesn't really even change the hash -
    it really only shifts the hash around in the hash table. To make
    matters worse, the insane big constant is different on 32-bit and 64-bit
    builds, even though the name hash bits we use are always 32-bit (and the
    bits from the pointer we mix in effectively are too).

    It's all total voodoo programming, in other words.

    Now, some testing and analysis of the hash chains shows that the rest of
    the hash function seems to be fairly good. It does pick the right bits
    of the parent dentry pointer, for example, and while it's generally a
    bad idea to use an xor to mix down the upper bits (because if there is a
    repeating pattern, the xor can cause "destructive interference"), it
    seems to not have been a disaster.

    For example, replacing the hash with the normal "hash_long()" code (that
    uses the GOLDEN_RATIO_PRIME constant correctly, btw) actually just makes
    the hash worse. The hand-picked hash knew which bits of the pointer had
    the highest entropy, and hash_long() ends up mixing bits less optimally
    at least in some trivial tests.

    So the hash function overall seems fine, it just has that really odd
    "shift result around by a constant xor".

    So get rid of the silly xor, and replace the down-mixing of the bits
    with an add instead of an xor that tends to not have the same kind of
    destructive interference issues. Some stats on the resulting hash
    chains shows that they look statistically identical before and after,
    but the code is simpler and no longer makes you go "WTF?".

    Also, the incoming hash really is just "unsigned int", not a long, and
    there's no real point to worry about the high 26 bits of the dentry
    pointer for the 64-bit case, because they are all going to be identical
    anyway.

    So also change the hashing to be done in the more natural 'unsigned int'
    that is the real size of the actual hashed data anyway.

    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

19 Mar, 2012

2 commits

  • Linus Torvalds
     
  • Commit 28d82dc1c4ed ("epoll: limit paths") that I did to limit the
    number of possible wakeup paths in epoll is causing a few applications
    to longer work (dovecot for one).

    The original patch is really about limiting the amount of epoll nesting
    (since epoll fds can be attached to other fds). Thus, we probably can
    allow an unlimited number of paths of depth 1. My current patch limits
    it at 1000. And enforce the limits on paths that have a greater depth.

    This is captured in: https://bugzilla.redhat.com/show_bug.cgi?id=681578

    Signed-off-by: Jason Baron
    Cc: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jason Baron
     

18 Mar, 2012

2 commits

  • Pull networking changes from David Miller:
    "1) icmp6_dst_alloc() returns NULL instead of ERR_PTR() leading to
    crashes, particularly during shutdown. Reported by Dave Jones and
    fixed by Eric Dumazet.

    2) hyperv and wimax/i2400m return NETDEV_TX_BUSY when they have
    already freed the SKB, which causes crashes as to the caller this
    means requeue the packet. Fixes from Eric Dumazet.

    3) usbnet driver doesn't allocate the right amount of headroom on
    fresh RX SKBs, fix from Eric Dumazet.

    4) Fix regression in ip6_mc_find_dev_rcu(), as an RCU lookup it
    abolutely should not take a reference to 'dev', this leads to
    leaks. Fix from RonQing Li.

    5) Fix netfilter ctnetlink race between delete and timeout expiration.
    From Pablo Neira Ayuso.

    6) Revert SFQ change which causes regressions, specifically queueing
    to tail can lead to unavoidable flow starvation. From Eric
    Dumazet.

    7) Fix a memory leak and a crash on corrupt firmware files in bnx2x,
    from Michal Schmidt."

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
    netfilter: ctnetlink: fix race between delete and timeout expiration
    ipv6: Don't dev_hold(dev) in ip6_mc_find_dev_rcu.
    wimax/i2400m: fix erroneous NETDEV_TX_BUSY use
    net/hyperv: fix erroneous NETDEV_TX_BUSY use
    net/usbnet: reserve headroom on rx skbs
    bnx2x: fix memory leak in bnx2x_init_firmware()
    bnx2x: fix a crash on corrupt firmware file
    sch_sfq: revert dont put new flow at the end of flows
    ipv6: fix icmp6_dst_alloc()

    Linus Torvalds
     
  • Pull perf fixes from Ingo Molnar.

    * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    perf tools, x86: Build perf on older user-space as well
    perf tools: Use scnprintf where applicable
    perf tools: Incorrect use of snprintf results in SEGV

    Linus Torvalds
     

17 Mar, 2012

9 commits

  • Kerin Millar reported hardlockups while running `conntrackd -c'
    in a busy firewall. That system (with several processors) was
    acting as backup in a primary-backup setup.

    After several tries, I found a race condition between the deletion
    operation of ctnetlink and timeout expiration. This patch fixes
    this problem.

    Tested-by: Kerin Millar
    Reported-by: Kerin Millar
    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: David S. Miller

    Pablo Neira Ayuso
     
  • ip6_mc_find_dev_rcu() is called with rcu_read_lock(), so don't
    need to dev_hold().
    With dev_hold(), not corresponding dev_put(), will lead to leak.

    [ bug introduced in 96b52e61be1 (ipv6: mcast: RCU conversions) ]

    Signed-off-by: RongQing.Li
    Acked-by: Eric Dumazet
    Signed-off-by: David S. Miller

    RongQing.Li
     
  • Merge some more email patches from Andrew Morton:
    "A couple of nilfs fixes"

    * emailed from Andrew Morton :
    nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
    nilfs2: clamp ns_r_segments_percentage to [1, 99]

    Linus Torvalds
     
  • According to the report from Slicky Devil, nilfs caused kernel oops at
    nilfs_load_super_block function during mount after he shrank the
    partition without resizing the filesystem:

    BUG: unable to handle kernel NULL pointer dereference at 00000048
    IP: [] nilfs_load_super_block+0x17e/0x280 [nilfs2]
    *pde = 00000000
    Oops: 0000 [#1] PREEMPT SMP
    ...
    Call Trace:
    [] init_nilfs+0x4b/0x2e0 [nilfs2]
    [] nilfs_mount+0x447/0x5b0 [nilfs2]
    [] mount_fs+0x36/0x180
    [] vfs_kern_mount+0x51/0xa0
    [] do_kern_mount+0x3e/0xe0
    [] do_mount+0x169/0x700
    [] sys_mount+0x6b/0xa0
    [] sysenter_do_call+0x12/0x28
    Code: 53 18 8b 43 20 89 4b 18 8b 4b 24 89 53 1c 89 43 24 89 4b 20 8b 43
    20 c7 43 2c 00 00 00 00 23 75 e8 8b 50 68 89 53 28 8b 54 b3 20 72
    48 8b 7a 4c 8b 55 08 89 b3 84 00 00 00 89 bb 88 00 00 00
    EIP: [] nilfs_load_super_block+0x17e/0x280 [nilfs2] SS:ESP 0068:ca9bbdcc
    CR2: 0000000000000048

    This turned out due to a defect in an error path which runs if the
    calculated location of the secondary super block was invalid.

    This patch fixes it and eliminates the reported oops.

    Reported-by: Slicky Devil
    Signed-off-by: Ryusuke Konishi
    Tested-by: Slicky Devil
    Cc: [2.6.30+]
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Ryusuke Konishi
     
  • ns_r_segments_percentage is read from the disk. Bogus or malicious
    value could cause integer overflow and malfunction due to meaningless
    disk usage calculation. This patch reports error when mounting such
    bogus volumes.

    Signed-off-by: Haogang Chen
    Signed-off-by: Ryusuke Konishi
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Haogang Chen
     
  • Pull maintainer update from James Morris:
    "Please pull this patch which adds Serge as maintainer of the
    capabilities code, as discussed on lwn and the lsm list.

    New capabilities must be signed off by the maintainer, and new uses of
    any capabilities should at be cc'd to the maintainer."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
    MAINTAINERS: Add Serge as maintainer of capabilities

    Linus Torvalds
     
  • Pull c6x bugfix from Mark Salter:
    "Remove dead code from entry.S which causes a build failure when using
    a newer assembler (v2.22 complains about it, v2.20 ignores it)."

    * tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
    C6X: remove dead code from entry.S

    Linus Torvalds
     
  • When writing files to afs I sometimes hit a BUG:

    kernel BUG at fs/afs/rxrpc.c:179!

    With a backtrace of:

    afs_free_call
    afs_make_call
    afs_fs_store_data
    afs_vnode_store_data
    afs_write_back_from_locked_page
    afs_writepages_region
    afs_writepages

    The cause is:

    ASSERT(skb_queue_empty(&call->rx_queue));

    Looking at a tcpdump of the session the abort happens because we
    are exceeding our disk quota:

    rx abort fs reply store-data error diskquota exceeded (32)

    So the abort error is valid. We hit the BUG because we haven't
    freed all the resources for the call.

    By freeing any skbs in call->rx_queue before calling afs_free_call
    we avoid hitting leaking memory and avoid hitting the BUG.

    Signed-off-by: Anton Blanchard
    Signed-off-by: David Howells
    Cc:
    Signed-off-by: Linus Torvalds

    Anton Blanchard
     
  • A read of a large file on an afs mount failed:

    # cat junk.file > /dev/null
    cat: junk.file: Bad message

    Looking at the trace, call->offset wrapped since it is only an
    unsigned short. In afs_extract_data:

    _enter("{%u},{%zu},%d,,%zu", call->offset, len, last, count);
    ...

    if (call->offset < count) {
    if (last) {
    _leave(" = -EBADMSG [%d < %zu]", call->offset, count);
    return -EBADMSG;
    }

    Which matches the trace:

    [cat ] ==> afs_extract_data({65132},{524},1,,65536)
    [cat ] < 65536]

    call->offset went from 65132 to 0. Fix this by making call->offset an
    unsigned int.

    Signed-off-by: Anton Blanchard
    Signed-off-by: David Howells
    Cc:
    Signed-off-by: Linus Torvalds

    Anton Blanchard
     

16 Mar, 2012

19 commits

  • The ENDPROC() on sys_fadvise64_c6x() in arch/c6x/kernel/entry.S is
    outside of the conditional block with the matching ENTRY() macro. This
    leads a newer (v2.22 vs. v2.20) assembler to complain:

    /tmp/ccGZBaPT.s: Assembler messages:
    /tmp/ccGZBaPT.s: Error: .size expression for sys_fadvise64_c6x does not evaluate to a constant

    The conditional block became dead code when c6x switched to generic
    unistd.h and should be removed along with the offending ENDPROC().

    Signed-off-by: Mark Salter
    Acked-by: David Howells

    Mark Salter
     
  • Alexander pointed out that the warnons in the regular exit path are
    bogus and the thread_mask one actually could be triggered when
    __setup_irq() hands out that thread_mask again after __free_irq()
    dropped irq_desc->lock.

    Thinking more about it, neither IRQTF_RUNTHREAD nor the bit in
    thread_mask can be set as this is the regular exit path. We come here
    due to:
    __free_irq()
    remove action from desc
    synchronize_irq()
    kthread_stop()

    So synchronize_irq() makes sure that the thread finished running and
    cleaned up both the thread_active count and thread_mask. After that
    point nothing can set IRQTF_RUNTHREAD on this action. So the warnons
    and the cleanups are pointless.

    Reported-by: Alexander Gordeev
    Cc: Ido Yariv
    Link: http://lkml.kernel.org/r/20120315190755.GA6732@dhcp-26-207.brq.redhat.com
    Signed-off-by: Thomas Gleixner

    Thomas Gleixner
     
  • A driver start_xmit() method cannot free skb and return NETDEV_TX_BUSY,
    since caller is going to reuse freed skb.

    In fact netif_tx_stop_queue() / netif_stop_queue() is needed before
    returning NETDEV_TX_BUSY or you can trigger a ksoftirqd fatal loop.

    In case of memory allocation error, only safe way is to drop the packet
    and return NETDEV_TX_OK

    Also increments tx_dropped counter

    Signed-off-by: Eric Dumazet
    Cc: Inaky Perez-Gonzalez
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • A driver start_xmit() method cannot free skb and return NETDEV_TX_BUSY,
    since caller is going to reuse freed skb.

    This is mostly a revert of commit bf769375c (staging: hv: fix the return
    status of netvsc_start_xmit())

    In fact netif_tx_stop_queue() / netif_stop_queue() is needed before
    returning NETDEV_TX_BUSY or you can trigger a ksoftirqd fatal loop.

    In case of memory allocation error, only safe way is to drop the packet
    and return NETDEV_TX_OK

    Signed-off-by: Eric Dumazet
    Cc: "K. Y. Srinivasan"
    Cc: Haiyang Zhang
    Cc: Greg Kroah-Hartman
    Reviewed-by: Haiyang Zhang
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • network drivers should reserve some headroom on incoming skbs so that we
    dont need expensive reallocations, eg forwarding packets in tunnels.

    This NET_SKB_PAD padding is done in various helpers, like
    __netdev_alloc_skb_ip_align() in this patch, combining NET_SKB_PAD and
    NET_IP_ALIGN magic.

    Signed-off-by: Eric Dumazet
    Cc: Oliver Neukum
    Cc: Greg Kroah-Hartman
    Acked-by: Oliver Neukum
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • When cycling the interface down and up, bnx2x_init_firmware() knows that
    the firmware is already loaded, but nevertheless it allocates certain
    arrays anew (init_data, init_ops, init_ops_offsets, iro_arr). The old
    arrays are leaked.

    Fix the leaks by returning early if the firmware was already loaded.
    Because if the firmware is loaded, so are the arrays.

    Signed-off-by: Michal Schmidt
    Acked-by: Eilon Greenstein
    Signed-off-by: David S. Miller

    Michal Schmidt
     
  • If the requested firmware is deemed corrupt and then released, reset the
    pointer to NULL in order to avoid double-freeing it in
    bnx2x_release_firmware() or dereferencing it in bnx2x_init_firmware().

    Signed-off-by: Michal Schmidt
    Acked-by: Eilon Greenstein
    Signed-off-by: David S. Miller

    Michal Schmidt
     
  • This reverts commit d47a0ac7b6 (sch_sfq: dont put new flow at the end of
    flows)

    As Jesper found out, patch sounded great but has bad side effects.

    In stress situation, pushing new flows in front of the queue can prevent
    old flows doing any progress. Packets can stay in SFQ queue for
    unlimited amount of time.

    It's possible to add heuristics to limit this problem, but this would
    add complexity outside of SFQ scope.

    A more sensible answer to Dave Taht concerns (who reported the issued I
    tried to solve in original commit) is probably to use a qdisc hierarchy
    so that high prio packets dont enter a potentially crowded SFQ qdisc.

    Reported-by: Jesper Dangaard Brouer
    Cc: Dave Taht
    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • commit 87a115783 ( ipv6: Move xfrm_lookup() call down into
    icmp6_dst_alloc().) forgot to convert one error path, leading
    to crashes in mld_sendpack()

    Many thanks to Dave Jones for providing a very complete bug report.

    Reported-by: Dave Jones
    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • Add Serge as maintainer of capabilities, per suggestion on LWN:
    http://lwn.net/Articles/486306/

    Signed-off-by: James Morris

    James Morris
     
  • Merge patches from Andrew Morton:
    "Nine patches - some bug fixes and some MAINTAINERS fiddling."

    * emailed from Andrew Morton :
    drivers/video/backlight/s6e63m0.c: fix corruption storing gamma mode
    MAINTAINERS: add entry for exynos mipi display drivers
    MAINTAINERS: fix link to Gustavo Padovans tree
    MAINTAINERS: add Johan to Bluetooth maintainers
    MAINTAINERS: Gustavo has moved
    prctl: use CAP_SYS_RESOURCE for PR_SET_MM option
    rapidio/tsi721: fix bug in register offset definitions
    MAINTAINERS: update ST's Mailing list for SPEAr
    memcg: free mem_cgroup by RCU to fix oops

    Linus Torvalds
     
  • Pull i2c subsystem fixes from Jean Delvare.

    * 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
    i2c-algo-bit: Fix spurious SCL timeouts under heavy load
    i2c-core: Comment says "transmitted" but means "received"

    Linus Torvalds
     
  • Pull hwmon fixes from Guenter Roeck.

    * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
    hwmon: (zl6100) Enable interval between chip accesses for all chips
    hwmon: (w83627ehf) Describe undocumented pwm attributes
    hwmon: (w83627ehf) Fix temp2 source for W83627UHG
    hwmon: (w83627ehf) Fix memory leak in probe function
    hwmon: (w83627ehf) Fix writing into fan_stop_time for NCT6775F/NCT6776F

    Linus Torvalds
     
  • Pull drm exynos/intel updates from Dave Airlie:
    "Two minor updates from Jesse for Intel SNB fixes, and a few fixes from
    Samsung for exynos. The pull req has Alan's commit in it since Intel
    based their tree on my tree at that time, but it all seems fine wrt
    merging."

    * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
    drm exynos: use drm_fb_helper_set_par directly
    drm/exynos: Fix fb_videomode drm_mode_modeinfo conversion
    drm/exynos: fix runtime_pm fimd device state on probe
    drm/exynos: use correct 'exynos-drm' name for platform device
    drm/i915: support 32 bit BGR formats in sprite planes
    drm/i915: fix color order for BGR formats on SNB
    drm/gma500: Fix Cedarview boot failures in 3.3-rc

    Linus Torvalds
     
  • Pull media fixes from Mauro Carvalho Chehab:
    "For 4 fixes for 3.3 (all trivial):
    - uvc video driver: fixes a division by zero;
    - davinci: add module.h to fix compilation;
    - smsusb: fix the delivery system setting;
    - smsdvb: the get_frontend implementation there is broken.

    The smsdvb patch has 127 lines, but it is trivial: instead of
    returning a cache of the set_frontend (with is wrong, as it doesn't
    have the updated values for the data, and the implementation there is
    buggy), it copies the information of the detected DVB parameters from
    the smsdvb private structures into the corresponding DVBv5 struct
    fields."

    * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
    [media] smsdvb: fix get_frontend
    [media] smsusb: fix the default delivery system setting
    [media] media: davinci: added module.h to resolve unresolved macros
    [media] [FOR,v3.3] uvcvideo: Avoid division by 0 in timestamp calculation

    Linus Torvalds
     
  • Pull target fixes from Nicholas Bellinger:
    "This series addresses two recently reported regression bugs related to
    legacy SCSI reservation usage in target core, and iscsi-target
    reservation conflict handling.

    The second patch in particular addresses possible data-corruption with
    SCSI reservations that is specific to iscsi-target fabric LUNs with
    multiple client writers. Both patches need to go into v3.2 stable
    ASAP, and the branch based on the last target-pending/3.3-rc-fixes
    HEAD.

    Again, thanks to Martin Svec for his help to identify and address this
    regression bug with iscsi-target."

    * '3.3-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
    iscsi-target: Fix reservation conflict -EBUSY response handling bug
    target: Fix compatible reservation handling (CRH=1) with legacy RESERVE/RELEASE

    Linus Torvalds
     
  • strict_strtoul() writes a long but ->gamma_mode only has space to store an
    int, so on 64 bit systems we end up scribbling over ->gamma_table_count as
    well. I've changed it to use kstrtouint() instead.

    Signed-off-by: Dan Carpenter
    Acked-by: Inki Dae
    Signed-off-by: Florian Tobias Schandinat
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dan Carpenter
     
  • I'd like to add Inki Dae, Donghwa Lee and Kyungmin Park as maintainers
    who developers for exynos mipi display drivers for
    video/driver/exynos/exynos_mipi* and include/video/exynos_mipi*.

    Signed-off-by: Donghwa Lee
    Signed-off-by: Inki Dae
    Signed-off-by: Kyungmin Park
    Cc: Florian Tobias Schandinat
    Cc: Richard Purdie
    Cc: Kukjin Kim
    Cc: Jingoo Han
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Donghwa Lee
     
  • Gustavo's tree is called just bluetooth.git and not bluetooth-2.6.git
    anymore.

    Signed-off-by: Johan Hedberg
    Cc: Marcel Holtmann
    Cc: "Gustavo F. Padovan"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Johan Hedberg