29 Sep, 2014

1 commit


17 Sep, 2014

4 commits

  • MAXQUOTAS value defines maximum number of quota types VFS supports.
    This isn't necessarily the number of types ocfs2 supports and with
    addition of project quotas these two numbers stop matching. So make
    ocfs2 use its private definition.

    CC: Mark Fasheh
    CC: Joel Becker
    CC: ocfs2-devel@oss.oracle.com
    Signed-off-by: Jan Kara

    Jan Kara
     
  • MAXQUOTAS value defines maximum number of quota types VFS supports.
    This isn't necessarily the number of types reiserfs supports and with
    addition of project quotas these two numbers stop matching. So make
    reiserfs use its private definition.

    CC: reiserfs-devel@vger.kernel.org
    CC: Jeff Mahoney
    Signed-off-by: Jan Kara

    Jan Kara
     
  • MAXQUOTAS value defines maximum number of quota types VFS supports. This
    isn't necessarily the number of types ext3 supports and with addition of
    project quotas these two numbers stop matching. So make ext3 use its
    private definition.

    CC: linux-ext4@vger.kernel.org
    Signed-off-by: Jan Kara

    Jan Kara
     
  • Currently write(2) updating i_size and close(2) of the file can race in
    such a way that udf_truncate_tail_extent() called from
    udf_file_release() sees old i_size but already new extents added by the
    running write call. This results in complaints like:
    UDF-fs: warning (device vdb2): udf_truncate_tail_extent: Too long extent
    after EOF in inode 877: i_size: 0 lbcount: 1073739776 extent 0+1073739776
    UDF-fs: error (device vdb2): udf_truncate_tail_extent: Extent after EOF
    in inode 877

    Fix the problem by grabbing i_mutex in udf_file_release() to be sure
    i_size is consistent with current state of extent list. Also avoid
    truncating tail extent unnecessarily when the file is still open for
    writing.

    Signed-off-by: Jan Kara

    Jan Kara
     

05 Sep, 2014

6 commits

  • Signed-off-by: Al Viro
    Signed-off-by: Jan Kara

    Al Viro
     
  • Currently udf_iget() (triggered by NFS) can race with udf_new_inode()
    leading to two inode structures with the same inode number:

    nfsd: iget_locked() creates inode
    nfsd: try to read from disk, block on that.
    udf_new_inode(): allocate inode with that inumber
    udf_new_inode(): insert it into icache, set it up and dirty
    udf_write_inode(): write inode into buffer cache
    nfsd: get CPU again, look into buffer cache, see nice and sane on-disk
    inode, set the in-core inode from it

    Fix the problem by putting inode into icache in locked state (I_NEW set)
    and unlocking it only after it's fully set up.

    Signed-off-by: Al Viro
    Signed-off-by: Jan Kara

    Al Viro
     
  • boilerplate code in udf_{create,mknod,symlink} taken to new helper

    symlink case converted to unique id calculated by udf_new_inode() - no
    point finding a new one.

    Signed-off-by: Al Viro
    Signed-off-by: Jan Kara

    Al Viro
     
  • Currently UDF doesn't initialize i_generation in any way and thus NFS
    can easily get reallocated inodes from stale file handles. Luckily UDF
    already has a unique object identifier associated with each inode -
    i_unique. Use that for initialization of i_generation.

    Signed-off-by: Jan Kara

    Jan Kara
     
  • NFS can easily ask for inodes that are already deleted. Currently UDF
    happily returns such inodes which is a bug. Return -ESTALE if
    udf_read_inode() is asked to read deleted inode.

    Signed-off-by: Jan Kara

    Jan Kara
     
  • Currently __udf_read_inode() wasn't returning anything and we found out
    whether we succeeded reading inode by checking whether inode is bad or
    not. udf_iget() returned NULL on failure and inode pointer otherwise.
    Make these two functions properly propagate errors up the call stack and
    use the return value in callers.

    Signed-off-by: Jan Kara

    Jan Kara
     

04 Sep, 2014

8 commits

  • We did not implement any bound on number of indirect ICBs we follow when
    loading inode. Thus corrupted medium could cause kernel to go into an
    infinite loop, possibly causing a stack overflow.

    Fix the possible stack overflow by removing recursion from
    __udf_read_inode() and limit number of indirect ICBs we follow to avoid
    infinite loops.

    Signed-off-by: Jan Kara

    Jan Kara
     
  • There's no good reason to separate these since udf_fill_inode() is
    called only from __udf_read_inode() and both do part of the same thing.

    Signed-off-by: Jan Kara

    Jan Kara
     
  • If we are writing back inode of unlinked directory, its link count ends
    up being (u16)-1. Although the inode is deleted, udf_iget() can load the
    inode when NFS uses stale file handle and get confused.

    Signed-off-by: Jan Kara

    Jan Kara
     
  • Pull input subsystem updates from Dmitry Torokhov:
    "A fix for MT breakage, enhancement to Elantech PS/2 driver and a
    couple of assorted fixes"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
    Input: elantech - add support for trackpoint found on some v3 models
    Input: elantech - reset the device when elantech probe fails
    Input: ALPS - suppress message about 'Unknown touchpad'
    Input: fix used slots detection breakage
    Input: sparc - i8042-sparcio.h: fix unused kbd_res warning
    Input: atmel_mxt_ts - improve description of gpio-keymap property

    Linus Torvalds
     
  • Pull regmap fixes from Mark Brown:
    "Several bug fixes for issues that have been lurking for a while:

    - Check that devices haven't set the flag saying they only support
    register at a time operation while we're doing cache syncs,
    otherwise we fail to restore caches

    - Ensure that we don't mark all registers on devices using
    format_write() as cacheable, avoiding adding a cache of things like
    reset registers which we don't want to rewrite during cache sync

    - Make sure we create the debugfs files in the correct directory"

    * tag 'regmap-v3.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
    regmap: Don't attempt block writes when syncing cache on single_rw devices
    regmap: Fix handling of volatile registers for format_write() chips
    regmap: Fix regcache debugfs initialization

    Linus Torvalds
     
  • Pull f2fs bug fixes from Jaegeuk Kim:
    "This series includes patches to:

    - fix recovery routines
    - fix bugs related to inline_data/xattr
    - fix when casting the dentry names
    - handle EIO or ENOMEM correctly
    - fix memory leak
    - fix lock coverage"

    * tag 'for-f2fs-3.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (28 commits)
    f2fs: reposition unlock_new_inode to prevent accessing invalid inode
    f2fs: fix wrong casting for dentry name
    f2fs: simplify by using a literal
    f2fs: truncate stale block for inline_data
    f2fs: use macro for code readability
    f2fs: introduce need_do_checkpoint for readability
    f2fs: fix incorrect calculation with total/free inode num
    f2fs: remove rename and use rename2
    f2fs: skip if inline_data was converted already
    f2fs: remove rewrite_node_page
    f2fs: avoid double lock in truncate_blocks
    f2fs: prevent checkpoint during roll-forward
    f2fs: add WARN_ON in f2fs_bug_on
    f2fs: handle EIO not to break fs consistency
    f2fs: check s_dirty under cp_mutex
    f2fs: unlock_page when node page is redirtied out
    f2fs: introduce f2fs_cp_error for readability
    f2fs: give a chance to mount again when encountering errors
    f2fs: trigger release_dirty_inode in f2fs_put_super
    f2fs: don't skip checkpoint if there is no dirty node pages
    ...

    Linus Torvalds
     
  • Pull key subsystem fixes from James Morris:
    "Fixes for the keys subsystem, one of which addresses a use-after-free
    bug"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
    PEFILE: Relax the check on the length of the PKCS#7 cert
    KEYS: Fix use-after-free in assoc_array_gc()
    KEYS: Fix public_key asymmetric key subtype name
    KEYS: Increase root_maxkeys and root_maxbytes sizes

    Linus Torvalds
     
  • Structure name and variable name were erroneously interchanged

    Signed-off-by: Noam Camus
    Acked-by: Vineet Gupta
    [ Also removed pointless cast from "void *". - Linus ]
    Signed-off-by: Linus Torvalds

    Noam Camus
     

03 Sep, 2014

8 commits

  • Pull more arm64 fixes from Will Deacon:
    "Another handful of arm64 fixes here. They address some issues found
    by running smatch on the arch code (ignoring the false positives) and
    also stop 32-bit Android from losing track of its stack.

    There's one additional irq migration fix in the pipeline, but it came
    in after I'd tagged and tested this set.

    - a few fixes for real issues found by smatch (after Dan's talk at KS)

    - revert the /proc/cpuinfo changes merged during the merge window.
    We've opened a can of worms here, so we need to find out where we
    stand before we change this interface.

    - implement KSTK_ESP for compat tasks, otherwise 32-bit Android gets
    confused wondering where its [stack] has gone

    - misc fixes (fpsimd context handling, crypto, ...)"

    * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
    Revert "arm64: cpuinfo: print info for all CPUs"
    arm64: fix bug for reloading FPSIMD state after cpu power off
    arm64: report correct stack pointer in KSTK_ESP for compat tasks
    arm64: Add brackets around user_stack_pointer()
    arm64: perf: don't rely on layout of pt_regs when grabbing sp or pc
    arm64: ptrace: fix compat reg getter/setter return values
    arm64: ptrace: fix compat hardware watchpoint reporting
    arm64: Remove unused variable in head.S
    arm64/crypto: remove redundant update of data

    Linus Torvalds
     
  • Pull PCI fix from Bjorn Helgaas:
    "This fixes an ARM allmodconfig build problem:

    Remove module option for ST Microelectronics SPEAr13xx"

    * tag 'pci-v3.17-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
    PCI: spear: Remove module option

    Linus Torvalds
     
  • …git/cooloney/linux-leds

    Pull LED fix from Bryan Wu:
    "Hugh, Jiri and many other people found a kernel oops due to a LED
    change merged recently. Now the right fix might just revert it and
    avoid the kernel oops"

    * 'leds-fixes-for-3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds:
    Revert "leds: convert blink timer to workqueue"

    Linus Torvalds
     
  • Relax the check on the length of the PKCS#7 cert as it appears that the PE
    file wrapper size gets rounded up to the nearest 8.

    The debugging output looks like this:

    PEFILE: ==> verify_pefile_signature()
    PEFILE: ==> pefile_parse_binary()
    PEFILE: checksum @ 110
    PEFILE: header size = 200
    PEFILE: cert = 968 @547be0 [68 09 00 00 00 02 02 00 30 82 09 56 ]
    PEFILE: sig wrapper = { 968, 200, 2 }
    PEFILE: Signature data not PKCS#7

    The wrapper is the first 8 bytes of the hex dump inside []. This indicates a
    length of 0x968 bytes, including the wrapper header - so 0x960 bytes of
    payload.

    The ASN.1 wrapper begins [ ... 30 82 09 56 ]. That indicates an object of size
    0x956 - a four byte discrepency, presumably just padding for alignment
    purposes.

    So we just check that the ASN.1 container is no bigger than the payload and
    reduce the recorded size appropriately.

    Whilst we're at it, allow shorter PKCS#7 objects that manage to squeeze within
    127 or 255 bytes. It's just about conceivable if no X.509 certs are included
    in the PKCS#7 message.

    Reported-by: Vivek Goyal
    Signed-off-by: David Howells
    Acked-by: Vivek Goyal
    Acked-by: Peter Jones
    Signed-off-by: James Morris

    David Howells
     
  • An edit script should be considered inaccessible by a function once it has
    called assoc_array_apply_edit() or assoc_array_cancel_edit().

    However, assoc_array_gc() is accessing the edit script just after the
    gc_complete: label.

    Reported-by: Andreea-Cristina Bernat
    Signed-off-by: David Howells
    Reviewed-by: Andreea-Cristina Bernat
    cc: shemming@brocade.com
    cc: paulmck@linux.vnet.ibm.com
    Cc: stable@vger.kernel.org
    Signed-off-by: James Morris

    David Howells
     
  • The length of the name of an asymmetric key subtype must be stored in struct
    asymmetric_key_subtype::name_len so that it can be matched by a search for
    ":". Fix the public_key subtype to have
    name_len set.

    Signed-off-by: David Howells
    Signed-off-by: James Morris

    David Howells
     
  • Now that NFS client uses the kernel key ring facility to store the NFSv4
    id/gid mappings, the defaults for root_maxkeys and root_maxbytes need to be
    substantially increased.

    These values have been soak tested:

    https://bugzilla.redhat.com/show_bug.cgi?id=1033708#c73

    Signed-off-by: Steve Dickson
    Signed-off-by: David Howells
    Signed-off-by: James Morris

    Steve Dickson
     
  • This reverts commit 8b37e1bef5a6b60e949e28a4db3006e4b00bd758.

    It's broken as it changes led_blink_set() in a way that it can now sleep
    (while synchronously waiting for workqueue to be cancelled). That's a
    problem, because it's possible that this function gets called from atomic
    context (tpt_trig_timer() takes a readlock and thus disables preemption).

    This has been brought up 3 weeks ago already [1] but no proper fix has
    materialized, and I keep seeing the problem since 3.17-rc1.

    [1] https://lkml.org/lkml/2014/8/16/128

    BUG: sleeping function called from invalid context at kernel/workqueue.c:2650
    in_atomic(): 1, irqs_disabled(): 0, pid: 2335, name: wpa_supplicant
    5 locks held by wpa_supplicant/2335:
    #0: (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x12/0x20
    #1: (&wdev->mtx){+.+.+.}, at: [] cfg80211_mgd_wext_siwessid+0x5c/0x180 [cfg80211]
    #2: (&local->mtx){+.+.+.}, at: [] ieee80211_prep_connection+0x17a/0x9a0 [mac80211]
    #3: (&local->chanctx_mtx){+.+.+.}, at: [] ieee80211_vif_use_channel+0x5d/0x2a0 [mac80211]
    #4: (&trig->leddev_list_lock){.+.+..}, at: [] tpt_trig_timer+0xec/0x170 [mac80211]
    CPU: 0 PID: 2335 Comm: wpa_supplicant Not tainted 3.17.0-rc3 #1
    Hardware name: LENOVO 7470BN2/7470BN2, BIOS 6DET38WW (2.02 ) 12/19/2008
    ffff8800360b5a50 ffff8800751f76d8 ffffffff8159e97f ffff8800360b5a30
    ffff8800751f76e8 ffffffff810739a5 ffff8800751f77b0 ffffffff8106862f
    ffffffff810685d0 0aa2209200000000 ffff880000000004 ffff8800361c59d0
    Call Trace:
    [] dump_stack+0x4d/0x66
    [] __might_sleep+0xe5/0x120
    [] flush_work+0x5f/0x270
    [] ? mod_delayed_work_on+0x80/0x80
    [] ? mark_held_locks+0x6a/0x90
    [] ? __cancel_work_timer+0x6f/0x100
    [] ? trace_hardirqs_on_caller+0xfd/0x1c0
    [] __cancel_work_timer+0x7b/0x100
    [] cancel_delayed_work_sync+0xe/0x10
    [] led_blink_set+0x1b/0x40
    [] tpt_trig_timer+0x110/0x170 [mac80211]
    [] ieee80211_mod_tpt_led_trig+0x9d/0x160 [mac80211]
    [] __ieee80211_recalc_idle+0x98/0x140 [mac80211]
    [] ieee80211_idle_off+0xe/0x10 [mac80211]
    [] ieee80211_add_chanctx+0x3b/0x220 [mac80211]
    [] ieee80211_new_chanctx+0x44/0xf0 [mac80211]
    [] ieee80211_vif_use_channel+0x1fa/0x2a0 [mac80211]
    [] ieee80211_prep_connection+0x188/0x9a0 [mac80211]
    [] ieee80211_mgd_auth+0x256/0x2e0 [mac80211]
    [] ieee80211_auth+0x13/0x20 [mac80211]
    [] cfg80211_mlme_auth+0x106/0x270 [cfg80211]
    [] cfg80211_conn_do_work+0x155/0x3b0 [cfg80211]
    [] cfg80211_connect+0x3f0/0x540 [cfg80211]
    [] cfg80211_mgd_wext_connect+0x158/0x1f0 [cfg80211]
    [] cfg80211_mgd_wext_siwessid+0xde/0x180 [cfg80211]
    [] ? cfg80211_wext_giwessid+0x50/0x50 [cfg80211]
    [] cfg80211_wext_siwessid+0x1d/0x40 [cfg80211]
    [] ioctl_standard_iw_point+0x14c/0x3e0
    [] ? trace_hardirqs_on_caller+0xfd/0x1c0
    [] ioctl_standard_call+0x8a/0xd0
    [] ? ioctl_standard_iw_point+0x3e0/0x3e0
    [] wireless_process_ioctl.constprop.10+0xb6/0x100
    [] wext_handle_ioctl+0x5d/0xb0
    [] dev_ioctl+0x329/0x620
    [] ? trace_hardirqs_on_caller+0xfd/0x1c0
    [] sock_ioctl+0x142/0x2e0
    [] do_vfs_ioctl+0x300/0x520
    [] ? sysret_check+0x1b/0x56
    [] ? trace_hardirqs_on_caller+0xfd/0x1c0
    [] SyS_ioctl+0x81/0xa0
    [] system_call_fastpath+0x1a/0x1f
    wlan0: send auth to 00:0b:6b:3c:8c:e4 (try 1/3)
    wlan0: authenticated
    wlan0: associate with 00:0b:6b:3c:8c:e4 (try 1/3)
    wlan0: RX AssocResp from 00:0b:6b:3c:8c:e4 (capab=0x431 status=0 aid=2)
    wlan0: associated
    IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
    cfg80211: Calling CRDA for country: NA
    wlan0: Limiting TX power to 27 (27 - 0) dBm as advertised by 00:0b:6b:3c:8c:e4

    =================================
    [ INFO: inconsistent lock state ]
    3.17.0-rc3 #1 Not tainted
    ---------------------------------
    inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
    swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
    ((&(&led_cdev->blink_work)->work)){+.?...}, at: [] flush_work+0x0/0x270
    {SOFTIRQ-ON-W} state was registered at:
    [] __lock_acquire+0x30e/0x1a30
    [] lock_acquire+0x91/0x110
    [] flush_work+0x38/0x270
    [] __cancel_work_timer+0x7b/0x100
    [] cancel_delayed_work_sync+0xe/0x10
    [] led_blink_set+0x1b/0x40
    [] tpt_trig_timer+0x110/0x170 [mac80211]
    [] ieee80211_mod_tpt_led_trig+0x9d/0x160 [mac80211]
    [] __ieee80211_recalc_idle+0x98/0x140 [mac80211]
    [] ieee80211_idle_off+0xe/0x10 [mac80211]
    [] ieee80211_add_chanctx+0x3b/0x220 [mac80211]
    [] ieee80211_new_chanctx+0x44/0xf0 [mac80211]
    [] ieee80211_vif_use_channel+0x1fa/0x2a0 [mac80211]
    [] ieee80211_prep_connection+0x188/0x9a0 [mac80211]
    [] ieee80211_mgd_auth+0x256/0x2e0 [mac80211]
    [] ieee80211_auth+0x13/0x20 [mac80211]
    [] cfg80211_mlme_auth+0x106/0x270 [cfg80211]
    [] cfg80211_conn_do_work+0x155/0x3b0 [cfg80211]
    [] cfg80211_connect+0x3f0/0x540 [cfg80211]
    [] cfg80211_mgd_wext_connect+0x158/0x1f0 [cfg80211]
    [] cfg80211_mgd_wext_siwessid+0xde/0x180 [cfg80211]
    [] cfg80211_wext_siwessid+0x1d/0x40 [cfg80211]
    [] ioctl_standard_iw_point+0x14c/0x3e0
    [] ioctl_standard_call+0x8a/0xd0
    [] wireless_process_ioctl.constprop.10+0xb6/0x100
    [] wext_handle_ioctl+0x5d/0xb0
    [] dev_ioctl+0x329/0x620
    [] sock_ioctl+0x142/0x2e0
    [] do_vfs_ioctl+0x300/0x520
    [] SyS_ioctl+0x81/0xa0
    [] system_call_fastpath+0x1a/0x1f
    irq event stamp: 493416
    hardirqs last enabled at (493416): [] __cancel_work_timer+0x6f/0x100
    hardirqs last disabled at (493415): [] try_to_grab_pending+0x1f/0x160
    softirqs last enabled at (493408): [] _local_bh_enable+0x1d/0x50
    softirqs last disabled at (493409): [] irq_exit+0xa5/0xb0

    other info that might help us debug this:
    Possible unsafe locking scenario:

    CPU0
    ----
    lock((&(&led_cdev->blink_work)->work));

    lock((&(&led_cdev->blink_work)->work));

    *** DEADLOCK ***

    2 locks held by swapper/0/0:
    #0: (((&tpt_trig->timer))){+.-...}, at: [] call_timer_fn+0x0/0x180
    #1: (&trig->leddev_list_lock){.+.?..}, at: [] tpt_trig_timer+0xec/0x170 [mac80211]

    stack backtrace:
    CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.17.0-rc3 #1
    Hardware name: LENOVO 7470BN2/7470BN2, BIOS 6DET38WW (2.02 ) 12/19/2008
    ffffffff8246eb30 ffff88007c203b00 ffffffff8159e97f ffffffff81a194c0
    ffff88007c203b50 ffffffff81599c29 0000000000000001 ffffffff00000001
    ffff880000000000 0000000000000006 ffffffff81a194c0 ffffffff81093ad0
    Call Trace:
    [] dump_stack+0x4d/0x66
    [] print_usage_bug+0x1f4/0x205
    [] ? check_usage_backwards+0x140/0x140
    [] mark_lock+0x223/0x2b0
    [] __lock_acquire+0x2b0/0x1a30
    [] lock_acquire+0x91/0x110
    [] ? mod_delayed_work_on+0x80/0x80
    [] ? __ieee80211_get_rx_led_name+0x10/0x10 [mac80211]
    [] flush_work+0x38/0x270
    [] ? mod_delayed_work_on+0x80/0x80
    [] ? mark_held_locks+0x6a/0x90
    [] ? __cancel_work_timer+0x6f/0x100
    [] ? __ieee80211_get_rx_led_name+0x10/0x10 [mac80211]
    [] ? trace_hardirqs_on_caller+0xad/0x1c0
    [] ? __ieee80211_get_rx_led_name+0x10/0x10 [mac80211]
    [] __cancel_work_timer+0x7b/0x100
    [] cancel_delayed_work_sync+0xe/0x10
    [] led_blink_set+0x1b/0x40
    [] tpt_trig_timer+0x110/0x170 [mac80211]
    [] call_timer_fn+0x75/0x180
    [] ? process_timeout+0x10/0x10
    [] ? __ieee80211_get_rx_led_name+0x10/0x10 [mac80211]
    [] run_timer_softirq+0x1fc/0x2f0
    [] __do_softirq+0x115/0x2e0
    [] irq_exit+0xa5/0xb0
    [] do_IRQ+0x53/0xf0
    [] common_interrupt+0x6f/0x6f
    [] ? cpuidle_enter_state+0x6e/0x180
    [] cpuidle_enter+0x12/0x20
    [] cpu_startup_entry+0x330/0x360
    [] rest_init+0xc1/0xd0
    [] ? csum_partial_copy_generic+0x170/0x170
    [] start_kernel+0x44f/0x45a
    [] ? set_init_arg+0x53/0x53
    [] x86_64_start_reservations+0x2a/0x2c
    [] x86_64_start_kernel+0xf1/0xf4

    Cc: Vincent Donnefort
    Cc: Hugh Dickins
    Cc: Tejun Heo
    Signed-off-by: Jiri Kosina
    Signed-off-by: Bryan Wu

    Jiri Kosina
     

02 Sep, 2014

2 commits

  • As the race condition on the inode cache, following scenario can appear:
    [Thread a] [Thread b]
    ->f2fs_mkdir
    ->f2fs_add_link
    ->__f2fs_add_link
    ->init_inode_metadata failed here
    ->gc_thread_func
    ->f2fs_gc
    ->do_garbage_collect
    ->gc_data_segment
    ->f2fs_iget
    ->iget_locked
    ->wait_on_inode
    ->unlock_new_inode
    ->move_data_page
    ->make_bad_inode
    ->iput

    When we fail in create/symlink/mkdir/mknod/tmpfile, the new allocated inode
    should be set as bad to avoid being accessed by other thread. But in above
    scenario, it allows f2fs to access the invalid inode before this inode was set
    as bad.
    This patch fix the potential problem, and this issue was found by code review.

    change log from v1:
    o Add condition judgment in gc_data_segment() suggested by Changman Lee.
    o use iget_failed to simplify code.

    Signed-off-by: Chao Yu
    Signed-off-by: Jaegeuk Kim

    Chao Yu
     
  • Pull irq handling fixlet from Thomas Gleixner:
    "Just an export for an interrupt flow handler which is now used in gpio
    modules"

    * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    irq: Export handle_fasteoi_irq

    Linus Torvalds
     

01 Sep, 2014

10 commits

  • It turns out that vendors are relying on the format of /proc/cpuinfo,
    and we've even spotted out-of-tree hacks attempting to make it look
    identical to the format used by arch/arm/. That means we can't afford to
    churn this interface in mainline, so revert the recent reformatting of
    the file for arm64 pending discussions on the list to find out what
    people actually want.

    This reverts commit d7a49086f263164a2c4c178eb76412d48cd671d7.

    Acked-by: Mark Rutland
    Signed-off-by: Will Deacon

    Will Deacon
     
  • Now arm64 defers reloading FPSIMD state, but this optimization also
    introduces the bug after cpu resume back from low power mode.

    The reason is after the cpu has been powered off, s/w need set the
    cpu's fpsimd_last_state to NULL so that it will force to reload
    FPSIMD state for the thread, otherwise there has the chance to meet
    the condition for both the task's fpsimd_state.cpu field contains the
    id of the current cpu, and the cpu's fpsimd_last_state per-cpu variable
    points to the task's fpsimd_state, so finally kernel will skip to reload
    the context during it return back to userland.

    Acked-by: Ard Biesheuvel
    Reviewed-by: Catalin Marinas
    Signed-off-by: Leo Yan
    Signed-off-by: Will Deacon

    Leo Yan
     
  • Linus Torvalds
     
  • Pull Xtensa updates from Chris Zankel:
    "Xtensa improvements for 3.17:
    - support highmem on cores with aliasing data cache. Enable highmem
    on kc705 by default
    - simplify addition of new core variants (no need to modify Kconfig /
    Makefiles)
    - improve robustness of unaligned access handler and its interaction
    with window overflow/underflow exception handlers
    - deprecate atomic and spill registers syscalls
    - clean up Kconfig: remove orphan MATH_EMULATION, sort 'select'
    statements
    - wire up renameat2 syscall.

    Various fixes:
    - fix address checks in dma_{alloc,free}_coherent (runtime BUG)
    - fix access to THREAD_RA/THREAD_SP/THREAD_DS (debug build breakage)
    - fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
    (runtime unrecoverable exception)
    - fix a6 and a7 handling in fast_syscall_xtensa (runtime userspace
    register clobbering)
    - fix kernel/user jump out of fast_unaligned (potential runtime
    unrecoverabl exception)
    - replace termios IOCTL code definitions with constants (userspace
    build breakage)"

    * tag 'xtensa-20140830' of git://github.com/czankel/xtensa-linux: (25 commits)
    xtensa: deprecate fast_xtensa and fast_spill_registers syscalls
    xtensa: don't allow overflow/underflow on unaligned stack
    xtensa: fix a6 and a7 handling in fast_syscall_xtensa
    xtensa: allow single-stepping through unaligned load/store
    xtensa: move invalid unaligned instruction handler closer to its users
    xtensa: make fast_unaligned store restartable
    xtensa: add double exception fixup handler for fast_unaligned
    xtensa: fix kernel/user jump out of fast_unaligned
    xtensa: configure kc705 for highmem
    xtensa: support highmem in aliasing cache flushing code
    xtensa: support aliasing cache in kmap
    xtensa: support aliasing cache in k[un]map_atomic
    xtensa: implement clear_user_highpage and copy_user_highpage
    xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
    xtensa: allow fixmap and kmap span more than one page table
    xtensa: make fixmap region addressing grow with index
    xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS
    xtensa: add renameat2 syscall
    xtensa: fix address checks in dma_{alloc,free}_coherent
    xtensa: replace IOCTL code definitions with constants
    ...

    Linus Torvalds
     
  • unicore32 builds fail with

    arch/unicore32/kernel/signal.c: In function ‘setup_frame’:
    arch/unicore32/kernel/signal.c:257: error: ‘usig’ undeclared (first use in this function)
    arch/unicore32/kernel/signal.c:279: error: ‘usig’ undeclared (first use in this function)
    arch/unicore32/kernel/signal.c: In function ‘handle_signal’:
    arch/unicore32/kernel/signal.c:306: warning: unused variable ‘tsk’
    arch/unicore32/kernel/signal.c: In function ‘do_signal’:
    arch/unicore32/kernel/signal.c:376: error: implicit declaration of function ‘get_signsl’
    make[1]: *** [arch/unicore32/kernel/signal.o] Error 1
    make: *** [arch/unicore32/kernel/signal.o] Error 2

    Bisect points to commit 649671c90eaf ("unicore32: Use get_signal()
    signal_setup_done()").

    This code never even compiled. Reverting the patch does not work, since
    previously used functions no longer exist, so try to fix it up. Compile
    tested only.

    Fixes: 649671c90eaf ("unicore32: Use get_signal() signal_setup_done()")
    Cc: Richard Weinberger
    Signed-off-by: Guenter Roeck
    Signed-off-by: Linus Torvalds

    Guenter Roeck
     
  • Pull ARM fixes from Russell King:
    "Various assorted fixes:

    - a couple of patches from Mark Rutland to resolve an errata with
    Cortex-A15 CPUs.
    - fix cpuidle for the CPU part ID changes in the last merge window
    - add support for a relocation which ARM binutils is generating in
    some circumstances"

    * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
    ARM: 8130/1: cpuidle/cpuidle-big_little: fix reading cpu id part number
    ARM: 8129/1: errata: work around Cortex-A15 erratum 830321 using dummy strex
    ARM: 8128/1: abort: don't clear the exclusive monitors
    ARM: 8127/1: module: add support for R_ARM_TARGET1 relocations

    Linus Torvalds
     
  • Pull ARM SoC fixes from Olof Johansson:
    "Here's the weekly batch of fixes from arm-soc.

    The delta is a largeish negative delta, due to revert of SMP support
    for Broadcom's STB SoC -- it was accidentally merged before some
    issues had been addressed, so they will make a new attempt for 3.18.
    I didn't see a need for a full revert of the whole platform due to
    this, we're keeping the rest enabled.

    The rest is mostly:

    - a handful of DT fixes for i.MX (Hummingboard/Cubox-i in particular)
    - some MTD/NAND fixes for OMAP
    - minor DT fixes for shmobile
    - warning fix for UP builds on vexpress/spc

    There's also a couple of patches that wires up hwmod on TI's DRA7 SoC
    so it can boot. Drivers and the rest had landed for 3.17, and it's
    small and isolated so it made sense to pick up now even if it's not a
    bugfix"

    * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (23 commits)
    vexpress/spc: fix a build warning on array bounds
    ARM: DRA7: hwmod: Add dra74x and dra72x specific ocp interface lists
    ARM: DRA7: Add support for soc_is_dra74x() and soc_is_dra72x() variants
    MAINTAINERS: catch special Rockchip code locations
    ARM: dts: microsom-ar8035: MDIO pad must be set open drain
    ARM: dts: omap54xx-clocks: Fix the l3 and l4 clock rates
    ARM: brcmstb: revert SMP support
    ARM: OMAP2+: hwmod: Rearm wake-up interrupts for DT when MUSB is idled
    ARM: dts: Enable UART wake-up events for beagleboard
    ARM: dts: Remove twl6030 clk32g "regulator"
    ARM: OMAP2+: omap_device: remove warning that clk alias already exists
    ARM: OMAP: fix %d confusingly prefixed with 0x in format string
    ARM: dts: DRA7: fix interrupt-cells for GPIO
    mtd: nand: omap: Fix 1-bit Hamming code scheme, omap_calculate_ecc()
    ARM: dts: omap3430-sdp: Revert to using software ECC for NAND
    ARM: OMAP2+: GPMC: Support Software ECC scheme via DT
    mtd: nand: omap: Revert to using software ECC by default
    ARM: dts: hummingboard/cubox-i: change SPDIF output to be more descriptive
    ARM: dts: hummingboard/cubox-i: add USB OC pinctrl configuration
    ARM: shmobile: r8a7791: add missing 0x0100 for SDCKCR
    ...

    Linus Torvalds
     
  • With ARCH_VEXPRESS_SPC option, kernel build has the following
    warning:

    arch/arm/mach-vexpress/spc.c: In function ‘ve_spc_clk_init’:
    arch/arm/mach-vexpress/spc.c:431:38: warning: array subscript is below array bounds [-Warray-bounds]
    struct ve_spc_opp *opps = info->opps[cluster];
    ^
    since 'cluster' maybe '-1' in UP system. This patch does a active
    checking to fix this issue.

    Signed-off-by: Alex Shi
    Acked-by: Pawel Moll
    Acked-by: Sudeep Holla
    Signed-off-by: Olof Johansson

    Alex Shi
     
  • …scm/linux/kernel/git/pjw/omap-pending into fixes

    Pull "ARM: OMAP2+: DRA72x/DRA74x basic support" from Tony Lindgren:

    Add basic subarchitecture support for the DRA72x and DRA74x. These
    are OMAP2+ derivative SoCs. This should be low-risk to existing OMAP
    platforms.

    Basic build, boot, and PM test logs are available here:

    http://www.pwsan.com/omap/testlogs/hwmod-a-early-v3.17-rc/20140827194314/

    * tag 'for-v3.17-rc/omap-dra72x-d74x-support-a' of git://git.kernel.org/pub/scm/linux/kernel/git/pjw/omap-pending:
    ARM: DRA7: hwmod: Add dra74x and dra72x specific ocp interface lists
    ARM: DRA7: Add support for soc_is_dra74x() and soc_is_dra72x() variants

    Signed-off-by: Olof Johansson <olof@lixom.net>

    Olof Johansson
     
  • Pull spi bugfixes from Mark Brown:
    "A smattering of bug fixes for the SPI subsystem, all in driver code
    which has seen active work recently and none of them with any great
    global impact.

    There's also a new ACPI ID for the pxa2xx driver which required no
    code changes and the addition of kerneldoc for some structure fields
    that were missing it and generating warnings during documentation
    builds as a result"

    * tag 'spi-v3.17-rc3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
    spi: sh-msiof: Fix transmit-only DMA transfers
    spi/rockchip: Avoid accidentally turning off the clock
    spi: dw: fix kernel crash due to NULL pointer dereference
    spi: dw-pci: fix bug when regs left uninitialized
    spi: davinci: fix SPI_NO_CS functionality
    spi/rockchip: fixup incorrect dma direction setting
    spi/pxa2xx: Add ACPI ID for Intel Braswell
    spi: spi-au1550: fix build failure
    spi: rspi: Fix leaking of unused DMA descriptors
    spi: sh-msiof: Fix leaking of unused DMA descriptors
    spi: Add missing kerneldoc bits
    spi/omap-mcspi: Fix the spi task hangs waiting dma_rx

    Linus Torvalds
     

31 Aug, 2014

1 commit