13 Sep, 2012

2 commits

  • ed3e694d "move exit_task_work() past exit_files() et.al" destroyed
    the add/exit synchronization we had, the caller itself should ensure
    task_work_add() can't race with the exiting task.

    However, this is not convenient/simple, and the only user which tries
    to do this is buggy (see the next patch). Unless the task is current,
    there is simply no way to do this in general.

    Change exit_task_work()->task_work_run() to use the dummy "work_exited"
    entry to let task_work_add() know it should fail.

    Signed-off-by: Oleg Nesterov
    Signed-off-by: Peter Zijlstra
    Cc: Al Viro
    Cc: Linus Torvalds
    Cc: Andrew Morton
    Cc: Thomas Gleixner
    Link: http://lkml.kernel.org/r/20120826191211.GA4228@redhat.com
    Signed-off-by: Ingo Molnar

    Oleg Nesterov
     
  • Change task_work's to use llist-like code to avoid pi_lock
    in task_work_add(), this makes it useable under rq->lock.

    task_work_cancel() and task_work_run() still use pi_lock
    to synchronize with each other.

    (This is in preparation for a deadlock fix.)

    Suggested-by: Peter Zijlstra
    Signed-off-by: Oleg Nesterov
    Signed-off-by: Peter Zijlstra
    Cc: Al Viro
    Cc: Linus Torvalds
    Cc: Andrew Morton
    Cc: Thomas Gleixner
    Link: http://lkml.kernel.org/r/20120826191209.GA4221@redhat.com
    Signed-off-by: Ingo Molnar

    Oleg Nesterov
     

05 Sep, 2012

1 commit


03 Sep, 2012

2 commits

  • Pull CIFS fixes from Steve French.

    * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
    CIFS: Fix cifs_do_create error hadnling
    cifs: print error code if smb signature verification fails
    CIFS: Fix log messages in packet checking for SMB2
    CIFS: Protect i_nlink from being negative

    Linus Torvalds
     
  • Pull networking fixes from David Miller:

    1) NLA_PUT* --> nla_put_* conversion got one case wrong in
    nfnetlink_log, fix from Patrick McHardy.

    2) Missed error return check in ipw2100 driver, from Julia Lawall.

    3) PMTU updates in ipv4 were setting the expiry time incorrectly, fix
    from Eric Dumazet.

    4) SFC driver erroneously reversed src and dst when reporting filters
    via ethtool.

    5) Memory leak in CAN protocol and wrong setting of IRQF_SHARED in
    sja1000 can platform driver, from Alexey Khoroshilov and Sven
    Schmitt.

    6) Fix multicast traffic scaling regression in ipv4_dst_destroy, only
    take the lock when we really need to. From Eric Dumazet.

    7) Fix non-root process spoofing in netlink, from Pablo Neira Ayuso.

    8) CWND reduction in TCP is done incorrectly during non-SACK recovery,
    fix from Yuchung Cheng.

    9) Revert netpoll change, and fix what was actually a driver specific
    problem. From Amerigo Wang. This should cure bootup hangs with
    netconsole some people reported.

    10) Fix xen-netfront invoking __skb_fill_page_desc() with a NULL page
    pointer. From Ian Campbell.

    11) SIP NAT fix for expectiontation creation, from Pablo Neira Ayuso.

    12) __ip_rt_update_pmtu() needs RCU locking, from Eric Dumazet.

    13) Fix usbnet deadlock on resume, can't use GFP_KERNEL in this
    situation. From Oliver Neukum.

    14) The davinci ethernet driver triggers an OOPS on removal because it
    frees an MDIO object before unregistering it. Fix from Bin Liu.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (41 commits)
    net: qmi_wwan: add several new Gobi devices
    fddi: 64 bit bug in smt_add_para()
    net: ethernet: fix kernel OOPS when remove davinci_mdio module
    net/xfrm/xfrm_state.c: fix error return code
    net: ipv6: fix error return code
    net: qmi_wwan: new device: Foxconn/Novatel E396
    usbnet: fix deadlock in resume
    cs89x0 : packet reception not working
    netfilter: nf_conntrack: fix racy timer handling with reliable events
    bnx2x: Correct the ndo_poll_controller call
    bnx2x: Move netif_napi_add to the open call
    ipv4: must use rcu protection while calling fib_lookup
    bnx2x: fix 57840_MF pci id
    net: ipv4: ipmr_expire_timer causes crash when removing net namespace
    e1000e: DoS while TSO enabled caused by link partner with small MSS
    l2tp: avoid to use synchronize_rcu in tunnel free function
    gianfar: fix default tx vlan offload feature flag
    netfilter: nf_nat_sip: fix incorrect handling of EBUSY for RTCP expectation
    xen-netfront: use __pskb_pull_tail to ensure linear area is big enough on RX
    netfilter: nfnetlink_log: fix error return code in init path
    ...

    Linus Torvalds
     

02 Sep, 2012

4 commits

  • Gobi devices are composite, needing both the qcserial and
    qmi_wwan drivers to support all functions. Re-syncing the
    list of supported devices with qcserial.

    Cc: Aleksander Morgado
    Cc: Thomas Tuttle
    Signed-off-by: Bjørn Mork
    Signed-off-by: David S. Miller

    Bjørn Mork
     
  • The intent was to set 4 bytes of data so that's why the sp_len is set
    to 4 on the next line. The cast to u_long pointer clears 8 bytes
    on 64 bit arches.

    Signed-off-by: Dan Carpenter
    Signed-off-by: David S. Miller

    Dan Carpenter
     
  • Linus Torvalds
     
  • Andreas Bombe reported that the added ktime_t overflow checking added to
    timespec_valid in commit 4e8b14526ca7 ("time: Improve sanity checking of
    timekeeping inputs") was causing problems with X.org because it caused
    timeouts larger then KTIME_T to be invalid.

    Previously, these large timeouts would be clamped to KTIME_MAX and would
    never expire, which is valid.

    This patch splits the ktime_t overflow checking into a new
    timespec_valid_strict function, and converts the timekeeping codes
    internal checking to use this more strict function.

    Reported-and-tested-by: Andreas Bombe
    Cc: Zhouping Liu
    Cc: Ingo Molnar
    Cc: Prarit Bhargava
    Cc: Thomas Gleixner
    Cc: stable@vger.kernel.org
    Signed-off-by: John Stultz
    Signed-off-by: Linus Torvalds

    John Stultz
     

01 Sep, 2012

10 commits


31 Aug, 2012

12 commits

  • Existing code assumes that del_timer returns true for alive conntrack
    entries. However, this is not true if reliable events are enabled.
    In that case, del_timer may return true for entries that were
    just inserted in the dying list. Note that packets / ctnetlink may
    hold references to conntrack entries that were just inserted to such
    list.

    This patch fixes the issue by adding an independent timer for
    event delivery. This increases the size of the ecache extension.
    Still we can revisit this later and use variable size extensions
    to allocate this area on demand.

    Tested-by: Oliver Smith
    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • This patch correct poll_bnx2x (ndo_poll_controller call) which was not
    functioning well with MSI-X.

    Signed-off-by: Merav Sicron
    Signed-off-by: Dmitry Kravkov
    Signed-off-by: Eilon Greenstein
    Signed-off-by: David S. Miller

    Merav Sicron
     
  • Move netif_napi_add for all queues from the probe call to the open call, to
    avoid the case that napi objects are added for queues that may eventually not
    be initialized and activated. With the former behavior, the driver could crash
    when netpoll was calling ndo_poll_controller.

    Signed-off-by: Merav Sicron
    Signed-off-by: Dmitry Kravkov
    Signed-off-by: Eilon Greenstein
    Signed-off-by: David S. Miller

    Merav Sicron
     
  • Following lockdep splat was reported by Pavel Roskin :

    [ 1570.586223] ===============================
    [ 1570.586225] [ INFO: suspicious RCU usage. ]
    [ 1570.586228] 3.6.0-rc3-wl-main #98 Not tainted
    [ 1570.586229] -------------------------------
    [ 1570.586231] /home/proski/src/linux/net/ipv4/route.c:645 suspicious rcu_dereference_check() usage!
    [ 1570.586233]
    [ 1570.586233] other info that might help us debug this:
    [ 1570.586233]
    [ 1570.586236]
    [ 1570.586236] rcu_scheduler_active = 1, debug_locks = 0
    [ 1570.586238] 2 locks held by Chrome_IOThread/4467:
    [ 1570.586240] #0: (slock-AF_INET){+.-...}, at: [] release_sock+0x2c/0xa0
    [ 1570.586253] #1: (fnhe_lock){+.-...}, at: [] update_or_create_fnhe+0x2c/0x270
    [ 1570.586260]
    [ 1570.586260] stack backtrace:
    [ 1570.586263] Pid: 4467, comm: Chrome_IOThread Not tainted 3.6.0-rc3-wl-main #98
    [ 1570.586265] Call Trace:
    [ 1570.586271] [] lockdep_rcu_suspicious+0xfd/0x130
    [ 1570.586275] [] update_or_create_fnhe+0x15c/0x270
    [ 1570.586278] [] __ip_rt_update_pmtu+0x73/0xb0
    [ 1570.586282] [] ip_rt_update_pmtu+0x29/0x90
    [ 1570.586285] [] inet_csk_update_pmtu+0x2c/0x80
    [ 1570.586290] [] tcp_v4_mtu_reduced+0x2e/0xc0
    [ 1570.586293] [] tcp_release_cb+0xa4/0xb0
    [ 1570.586296] [] release_sock+0x55/0xa0
    [ 1570.586300] [] tcp_sendmsg+0x4af/0xf50
    [ 1570.586305] [] inet_sendmsg+0x120/0x230
    [ 1570.586308] [] ? inet_sk_rebuild_header+0x40/0x40
    [ 1570.586312] [] ? sock_update_classid+0xbd/0x3b0
    [ 1570.586315] [] ? sock_update_classid+0x130/0x3b0
    [ 1570.586320] [] do_sock_write+0xc5/0xe0
    [ 1570.586323] [] sock_aio_write+0x53/0x80
    [ 1570.586328] [] do_sync_write+0xa3/0xe0
    [ 1570.586332] [] vfs_write+0x165/0x180
    [ 1570.586335] [] sys_write+0x45/0x90
    [ 1570.586340] [] system_call_fastpath+0x16/0x1b

    Signed-off-by: Eric Dumazet
    Reported-by: Pavel Roskin
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • Commit c3def943c7117d42caaed3478731ea7c3c87190e have added support for
    new pci ids of the 57840 board, while failing to change the obsolete value
    in 'pci_ids.h'.
    This patch does so, allowing the probe of such devices.

    Signed-off-by: Yuval Mintz
    Signed-off-by: Eilon Greenstein
    Signed-off-by: David S. Miller

    Yuval Mintz
     
  • When tearing down a net namespace, ipv4 mr_table structures are freed
    without first deactivating their timers. This can result in a crash in
    run_timer_softirq.
    This patch mimics the corresponding behaviour in ipv6.
    Locking and synchronization seem to be adequate.
    We are about to kfree mrt, so existing code should already make sure that
    no other references to mrt are pending or can be created by incoming traffic.
    The functions invoked here do not cause new references to mrt or other
    race conditions to be created.
    Invoking del_timer_sync guarantees that ipmr_expire_timer is inactive.
    Both ipmr_expire_process (whose completion we may have to wait in
    del_timer_sync) and mroute_clean_tables internally use mfc_unres_lock
    or other synchronizations when needed, and they both only modify mrt.

    Tested in Linux 3.4.8.

    Signed-off-by: Francesco Ruggeri
    Signed-off-by: David S. Miller

    Francesco Ruggeri
     
  • With a low enough MSS on the link partner and TSO enabled locally, the
    networking stack can periodically send a very large (e.g. 64KB) TCP
    message for which the driver will attempt to use more Tx descriptors than
    are available by default in the Tx ring. This is due to a workaround in
    the code that imposes a limit of only 4 MSS-sized segments per descriptor
    which appears to be a carry-over from the older e1000 driver and may be
    applicable only to some older PCI or PCIx parts which are not supported in
    e1000e. When the driver gets a message that is too large to fit across the
    configured number of Tx descriptors, it stops the upper stack from queueing
    any more and gets stuck in this state. After a timeout, the upper stack
    assumes the adapter is hung and calls the driver to reset it.

    Remove the unnecessary limitation of using up to only 4 MSS-sized segments
    per Tx descriptor, and put in a hard failure test to catch when attempting
    to check for message sizes larger than would fit in the whole Tx ring.
    Refactor the remaining logic that limits the size of data per Tx descriptor
    from a seemingly arbitrary 8KB to a limit based on the dynamic size of the
    Tx packet buffer as described in the hardware specification.

    Also, fix the logic in the check for space in the Tx ring for the next
    largest possible packet after the current one has been successfully queued
    for transmit, and use the appropriate defines for default ring sizes in
    e1000_probe instead of magic values.

    This issue goes back to the introduction of e1000e in 2.6.24 when it was
    split off from e1000.

    Reported-by: Ben Hutchings
    Signed-off-by: Bruce Allan
    Cc: Stable [2.6.24+]
    Tested-by: Aaron Brown
    Signed-off-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Bruce Allan
     
  • Avoid to use synchronize_rcu in l2tp_tunnel_free because context may be
    atomic.

    Signed-off-by: Dmitry Kozlov
    Signed-off-by: David S. Miller

    xeb@mail.ru
     
  • Commit -
    "b852b72 gianfar: fix bug caused by
    87c288c6e9aa31720b72e2bc2d665e24e1653c3e"
    disables by default (on mac init) the hw vlan tag insertion.
    The "features" flags were not updated to reflect this, and
    "ethtool -K" shows tx-vlan-offload to be "on" by default.

    Cc: Sebastian Poehn
    Signed-off-by: Claudiu Manoil
    Signed-off-by: David S. Miller

    Claudiu Manoil
     
  • We're hitting bug while trying to reinsert an already existing
    expectation:

    kernel BUG at kernel/timer.c:895!
    invalid opcode: 0000 [#1] SMP
    [...]
    Call Trace:

    [] nf_ct_expect_related_report+0x4a0/0x57a [nf_conntrack]
    [] ? in4_pton+0x72/0x131
    [] ip_nat_sdp_media+0xeb/0x185 [nf_nat_sip]
    [] set_expected_rtp_rtcp+0x32d/0x39b [nf_conntrack_sip]
    [] process_sdp+0x30c/0x3ec [nf_conntrack_sip]
    [] ? irq_exit+0x9a/0x9c
    [] ? ip_nat_sdp_media+0x185/0x185 [nf_nat_sip]

    We have to remove the RTP expectation if the RTCP expectation hits EBUSY
    since we keep trying with other ports until we succeed.

    Reported-by: Rafal Fitt
    Signed-off-by: Pablo Neira Ayuso

    Pablo Neira Ayuso
     
  • I'm slightly concerned by the "only in exceptional circumstances"
    comment on __pskb_pull_tail but the structure of an skb just created
    by netfront shouldn't hit any of the especially slow cases.

    This approach still does slightly more work than the old way, since if
    we pull up the entire first frag we now have to shuffle everything
    down where before we just received into the right place in the first
    place.

    Signed-off-by: Ian Campbell
    Cc: Konrad Rzeszutek Wilk
    Cc: Jeremy Fitzhardinge
    Cc: Mel Gorman
    Cc: xen-devel@lists.xensource.com
    Cc: netdev@vger.kernel.org
    Cc: linux-kernel@vger.kernel.org
    Tested-by: Konrad Rzeszutek Wilk
    Acked-by: Konrad Rzeszutek Wilk
    Signed-off-by: David S. Miller

    Ian Campbell
     
  • Pull drm fixes from Dave Airlie:
    "A bunch of scattered fixes ati/intel/nouveau, couple of core ones,
    nothing too shocking or different."

    * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
    drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S
    gma500: Consider CRTC initially active.
    drm/radeon: fix dig encoder selection on DCE61
    drm/radeon: fix double free in radeon_gpu_reset
    drm/radeon: force dma32 to fix regression rs4xx,rs6xx,rs740
    drm/radeon: rework panel mode setup
    drm/radeon/atom: powergating fixes for DCE6
    drm/radeon/atom: rework DIG modesetting on DCE3+
    drm/radeon: don't disable plls that are in use by other crtcs
    drm/radeon: add proper checking of RESOLVE_BOX command for r600-r700
    drm/radeon: initialize tracked CS state
    drm/radeon: fix reading CB_COLORn_MASK from the CS
    drm/nvc0/copy: check PUNITS to determine which copy engines are disabled
    i915: Quirk no_lvds on Gigabyte GA-D525TUD ITX motherboard
    drm/i915: Use the correct size of the GTT for placing the per-process entries
    drm: Check for invalid cursor flags
    drm: Initialize object type when using DRM_MODE() macro
    drm/i915: fix color order for BGR formats on IVB
    drm/i915: fix wrong order of parameters in port checking functions

    Linus Torvalds
     

30 Aug, 2012

9 commits

  • In native 32 bit mode the personality flags were not correctly inherited.
    This is the s390 version of 59e4c3a2 "powerpc/32: Don't clobber personality
    flags on exec".

    Reported-by: Mike Frysinger
    Signed-off-by: Heiko Carstens
    Signed-off-by: Martin Schwidefsky

    Heiko Carstens
     
  • Connecting an ASUS VW222S [1] over VGA a garbled screen is shown with
    vertical stripes in the top half.

    In commit bc42aabc [2]

    commit bc42aabc6a01b92b0f961d65671564e0e1cd7592
    Author: Adam Jackson
    Date: Wed May 23 16:26:54 2012 -0400

    drm/edid/quirks: ViewSonic VA2026w

    Adam Jackson added the quirk `EDID_QUIRK_FORCE_REDUCED_BLANKING` which
    is also needed for this ASUS monitor.

    All log files and output from `xrandr` is included in the referenced
    Bugzilla report #17629.

    Please note that this monitor only has a VGA (D-Sub) connector [1].

    [1] http://www.asus.com/Display/LCD_Monitors/VW222S/
    [2] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commit;h=bc42aabc6a01b92b0f961d65671564e0e1cd7592

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=17629
    Signed-off-by: Paul Menzel
    Cc:
    Cc: Adam Jackson
    Cc: Ian Pilcher
    Cc:
    Signed-off-by: Dave Airlie

    Paul Menzel
     
  • Initialize return variable before exiting on an error path.

    A simplified version of the semantic match that finds this problem is as
    follows: (http://coccinelle.lip6.fr/)

    //
    (
    if@p1 (\(ret < 0\|ret != 0\))
    { ... return ret; }
    |
    ret@p1 = 0
    )
    ... when != ret = e1
    when != &ret
    *if(...)
    {
    ... when != ret = e2
    when forall
    return ret;
    }

    //

    Signed-off-by: Julia Lawall
    Signed-off-by: Pablo Neira Ayuso

    Julia Lawall
     
  • Initialize return variable before exiting on an error path.

    A simplified version of the semantic match that finds this problem is as
    follows: (http://coccinelle.lip6.fr/)

    //
    (
    if@p1 (\(ret < 0\|ret != 0\))
    { ... return ret; }
    |
    ret@p1 = 0
    )
    ... when != ret = e1
    when != &ret
    *if(...)
    {
    ... when != ret = e2
    when forall
    return ret;
    }

    //

    Signed-off-by: Julia Lawall
    Signed-off-by: Pablo Neira Ayuso

    Julia Lawall
     
  • Initialize return variable before exiting on an error path.

    A simplified version of the semantic match that finds this problem is as
    follows: (http://coccinelle.lip6.fr/)

    //
    (
    if@p1 (\(ret < 0\|ret != 0\))
    { ... return ret; }
    |
    ret@p1 = 0
    )
    ... when != ret = e1
    when != &ret
    *if(...)
    {
    ... when != ret = e2
    when forall
    return ret;
    }

    //

    Signed-off-by: Julia Lawall
    Acked-by: Simon Horman
    Signed-off-by: Pablo Neira Ayuso

    Julia Lawall
     
  • Alex writes:

    Highlights:
    - fix a gart regression on older IGP chips
    - more MSAA fixes
    - fix a double free in gpu reset code
    - modesetting fixes
    - trinity dig encoder fix.

    * 'drm-fixes-3.6' of git://people.freedesktop.org/~agd5f/linux:
    drm/radeon: fix dig encoder selection on DCE61
    drm/radeon: fix double free in radeon_gpu_reset
    drm/radeon: force dma32 to fix regression rs4xx,rs6xx,rs740
    drm/radeon: rework panel mode setup
    drm/radeon/atom: powergating fixes for DCE6
    drm/radeon/atom: rework DIG modesetting on DCE3+
    drm/radeon: don't disable plls that are in use by other crtcs
    drm/radeon: add proper checking of RESOLVE_BOX command for r600-r700
    drm/radeon: initialize tracked CS state
    drm/radeon: fix reading CB_COLORn_MASK from the CS

    Dave Airlie
     
  • [this one ideally should make 3.6 - it fixes the very annoying mode setting bug]

    This causes the pipe to be forced off prior to initial mode set, which
    roughly mirrors the behavior of the i915 driver. It fixes initial mode
    setting on my Intel DN2800MT (Cedarview) board. Without it, mode
    setting triggers an out-of-range error from the monitor for most modes,
    but only on initial configuration (i.e. they can be configured
    successfully from userspace after that).

    Signed-off-by: Forest Bond
    Signed-off-by: Alan Cox
    Cc: stable
    Signed-off-by: Dave Airlie

    Forest Bond
     
  • Was using the DCE41 code which was wrong. Fixes
    blank displays on a number of Trinity systems.

    Signed-off-by: Alex Deucher
    Cc: stable@vger.kernel.org

    Alex Deucher
     
  • Against -net.

    In the patch "netpoll: re-enable irq in poll_napi()", I tried to
    fix the following warning:

    [100718.051041] ------------[ cut here ]------------
    [100718.051048] WARNING: at kernel/softirq.c:159 local_bh_enable_ip+0x7d/0xb0()
    (Not tainted)
    [100718.051049] Hardware name: ProLiant BL460c G7
    ...
    [100718.051068] Call Trace:
    [100718.051073] [] ? warn_slowpath_common+0x87/0xc0
    [100718.051075] [] ? warn_slowpath_null+0x1a/0x20
    [100718.051077] [] ? local_bh_enable_ip+0x7d/0xb0
    [100718.051080] [] ? _spin_unlock_bh+0x1b/0x20
    [100718.051085] [] ? be_process_mcc+0x74/0x230 [be2net]
    [100718.051088] [] ? be_poll_tx_mcc+0x16c/0x290 [be2net]
    [100718.051090] [] ? netpoll_poll_dev+0xd6/0x490
    [100718.051095] [] ? bond_poll_controller+0x75/0x80 [bonding]
    [100718.051097] [] ? netpoll_poll_dev+0x45/0x490
    [100718.051100] [] ? ksize+0x19/0x80
    [100718.051102] [] ? netpoll_send_skb_on_dev+0x157/0x240

    by reenabling IRQ before calling ->poll, but it seems more
    problems are introduced after that patch:

    http://ozlabs.org/~akpm/stuff/IMG_20120824_122054.jpg
    http://marc.info/?l=linux-netdev&m=134563282530588&w=2

    So it is safe to fix be2net driver code directly.

    This patch reverts the offending commit and fixes be_poll() by
    avoid disabling BH there, this is okay because be_poll()
    can be called either by poll_napi() which already disables
    IRQ, or by net_rx_action() which already disables BH.

    Reported-by: Andrew Morton
    Reported-by: Sylvain Munaut
    Cc: Sylvain Munaut
    Cc: Andrew Morton
    Cc: David Miller
    Cc: Sathya Perla
    Cc: Subbu Seetharaman
    Cc: Ajit Khaparde
    Signed-off-by: Cong Wang
    Tested-by: Sylvain Munaut
    Signed-off-by: David S. Miller

    Amerigo Wang