26 Sep, 2014

4 commits

  • In PTE holes that contain VM_SOFTDIRTY VMAs, unmapped addresses before
    VM_SOFTDIRTY VMAs are reported as softdirty by /proc/pid/pagemap. This
    bug was introduced in commit 68b5a6524856 ("mm: softdirty: respect
    VM_SOFTDIRTY in PTE holes"). That commit made /proc/pid/pagemap look at
    VM_SOFTDIRTY in PTE holes but neglected to observe the start of VMAs
    returned by find_vma.

    Tested:
    Wrote a selftest that creates a PMD-sized VMA then unmaps the first
    page and asserts that the page is not softdirty. I'm going to send the
    pagemap selftest in a later commit.

    Signed-off-by: Peter Feiner
    Cc: Cyrill Gorcunov
    Cc: Pavel Emelyanov
    Cc: Hugh Dickins
    Cc: Naoya Horiguchi
    Cc: "Kirill A. Shutemov"
    Cc: Jamie Liu
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Peter Feiner
     
  • There is a deadlock case which reported by Guozhonghua:
    https://oss.oracle.com/pipermail/ocfs2-devel/2014-September/010079.html

    This case is caused by &res->spinlock and &dlm->master_lock
    misordering in different threads.

    It was introduced by commit 8d400b81cc83 ("ocfs2/dlm: Clean up refmap
    helpers"). Since lockres is new, it doesn't not require the
    &res->spinlock. So remove it.

    Fixes: 8d400b81cc83 ("ocfs2/dlm: Clean up refmap helpers")
    Signed-off-by: Joseph Qi
    Reviewed-by: joyce.xue
    Reported-by: Guozhonghua
    Cc: Joel Becker
    Cc: Mark Fasheh
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Joseph Qi
     
  • This bug leads to reproducible silent data loss, despite the use of
    msync(), sync() and a clean unmount of the file system. It is easily
    reproducible with the following script:

    ----------------[BEGIN SCRIPT]--------------------
    mkfs.nilfs2 -f /dev/sdb
    mount /dev/sdb /mnt

    dd if=/dev/zero bs=1M count=30 of=/mnt/testfile

    umount /mnt
    mount /dev/sdb /mnt
    CHECKSUM_BEFORE="$(md5sum /mnt/testfile)"

    /root/mmaptest/mmaptest /mnt/testfile 30 10 5

    sync
    CHECKSUM_AFTER="$(md5sum /mnt/testfile)"
    umount /mnt
    mount /dev/sdb /mnt
    CHECKSUM_AFTER_REMOUNT="$(md5sum /mnt/testfile)"
    umount /mnt

    echo "BEFORE MMAP:\t$CHECKSUM_BEFORE"
    echo "AFTER MMAP:\t$CHECKSUM_AFTER"
    echo "AFTER REMOUNT:\t$CHECKSUM_AFTER_REMOUNT"
    ----------------[END SCRIPT]--------------------

    The mmaptest tool looks something like this (very simplified, with
    error checking removed):

    ----------------[BEGIN mmaptest]--------------------
    data = mmap(NULL, file_size - file_offset, PROT_READ | PROT_WRITE,
    MAP_SHARED, fd, file_offset);

    for (i = 0; i < write_count; ++i) {
    memcpy(data + i * 4096, buf, sizeof(buf));
    msync(data, file_size - file_offset, MS_SYNC))
    }
    ----------------[END mmaptest]--------------------

    The output of the script looks something like this:

    BEFORE MMAP: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile
    AFTER MMAP: 6604a1c31f10780331a6850371b3a313 /mnt/testfile
    AFTER REMOUNT: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile

    So it is clear, that the changes done using mmap() do not survive a
    remount. This can be reproduced a 100% of the time. The problem was
    introduced in commit 136e8770cd5d ("nilfs2: fix issue of
    nilfs_set_page_dirty() for page at EOF boundary").

    If the page was read with mpage_readpage() or mpage_readpages() for
    example, then it has no buffers attached to it. In that case
    page_has_buffers(page) in nilfs_set_page_dirty() will be false.
    Therefore nilfs_set_file_dirty() is never called and the pages are never
    collected and never written to disk.

    This patch fixes the problem by also calling nilfs_set_file_dirty() if the
    page has no buffers attached to it.

    [akpm@linux-foundation.org: s/PAGE_SHIFT/PAGE_CACHE_SHIFT/]
    Signed-off-by: Andreas Rohner
    Tested-by: Andreas Rohner
    Signed-off-by: Ryusuke Konishi
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andreas Rohner
     
  • osb->vol_label is malloced in ocfs2_initialize_super but not freed if
    error occurs or during umount, thus causing a memory leak.

    Signed-off-by: Joseph Qi
    Reviewed-by: joyce.xue
    Cc: Mark Fasheh
    Cc: Joel Becker
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Joseph Qi
     

25 Sep, 2014

19 commits

  • Pull drm fixes from Dave Airlie:
    "Some final radeon and i915 fixes, black screens mostly"

    * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
    drm/radeon/cik: use a separate counter for CP init timeout
    drm/i915/hdmi: fix hdmi audio state readout
    drm/i915: Don't leak command parser tables on suspend/resume
    drm/radeon: add PX quirk for asus K53TK
    drm/radeon: add a backlight quirk for Amilo Xi 2550
    drm/radeon: add a module parameter for backlight control (v2)
    drm/radeon: Update IH_RB_RPTR register after each processed interrupt
    drm/radeon: Make IH ring overflow debugging output more useful
    drm/radeon: Clear RB_OVERFLOW bit earlier

    Linus Torvalds
     
  • - fix a backlight regression resulting in dark screen
    - add a PX quirk to avoid a hang with runtime pm
    - fix an init issue on the CIK compute rings
    - fix IH ring buffer overflows gracefully

    * 'drm-fixes-3.17' of git://people.freedesktop.org/~agd5f/linux:
    drm/radeon/cik: use a separate counter for CP init timeout
    drm/radeon: add PX quirk for asus K53TK
    drm/radeon: add a backlight quirk for Amilo Xi 2550
    drm/radeon: add a module parameter for backlight control (v2)
    drm/radeon: Update IH_RB_RPTR register after each processed interrupt
    drm/radeon: Make IH ring overflow debugging output more useful
    drm/radeon: Clear RB_OVERFLOW bit earlier

    Dave Airlie
     
  • a couple of small fixes for 3.17 still.

    * tag 'drm-intel-fixes-2014-09-24' of git://anongit.freedesktop.org/drm-intel:
    drm/i915/hdmi: fix hdmi audio state readout
    drm/i915: Don't leak command parser tables on suspend/resume

    Dave Airlie
     
  • Pull networking fixes from David Miller:
    "Here is a quick pull request primarily meant to address the deconfig
    fallout from changing SCSI_NETLINK from being used via 'select' to
    being used via 'depends'.

    I applied a set of 5 patches written by Michal Marek, and then I
    carefully audited all of the remaining config files, basically:

    1) I scanned every arch config file, and if it mentioned CONFIG_INET
    or CONFIG_UNIX, I made sure it had CONFIG_NET=y

    2) After that, I scanned every arch config file, and if it did not
    have CONFIG_NET=y I made sure it did not reference any networking
    config options.

    Finally, we have some late breaking wireless fixes in here from John
    Linville and co"

    [ And there's a sparc bpf fix snuck in too ]

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
    sparc: bpf_jit: fix loads from negative offsets
    parisc: Update defconfigs which were missing CONFIG_NET.
    powerpc: Update defconfigs which were missing CONFIG_NET.
    s390: Update defconfigs which were missing CONFIG_NET.
    mips: Update some more defconfigs which were missing CONFIG_NET.
    sparc: Set CONFIG_NET=y in defconfigs
    sh: Set CONFIG_NET=y in defconfigs
    powerpc: Set CONFIG_NET=y in defconfigs
    parisc: Set CONFIG_NET=y in defconfigs
    mips: Set CONFIG_NET=y in defconfigs
    brcmfmac: Fix off by one bug in brcmf_count_20mhz_channels()
    ath9k: Fix NULL pointer dereference on early irq
    net: rfkill: gpio: Fix clock status
    NFC: st21nfca: Fix potential depmod dependency cycle
    NFC: st21nfcb: Fix depmod dependency cycle
    NFC: microread: Potential overflows in microread_target_discovered()

    Linus Torvalds
     
  • - fix BPF_LD|ABS|IND from negative offsets:
    make sure to sign extend lower 32 bits in 64-bit register
    before calling C helpers from JITed code, otherwise 'int k'
    argument of bpf_internal_load_pointer_neg_helper() function
    will be added as large unsigned integer, causing packet size
    check to trigger and abort the program.

    It's worth noting that JITed code for 'A = A op K' will affect
    upper 32 bits differently depending whether K is simm13 or not.
    Since small constants are sign extended, whereas large constants
    are stored in temp register and zero extended.
    That is ok and we don't have to pay a penalty of sign extension
    for every sethi, since all classic BPF instructions have 32-bit
    semantics and we only need to set correct upper bits when
    transitioning from JITed code into C.

    - though instructions 'A &= 0' and 'A *= 0' are odd, JIT compiler
    should not optimize them out

    Signed-off-by: Alexei Starovoitov
    Signed-off-by: David S. Miller

    Alexei Starovoitov
     
  • John W. Linville says:

    ====================
    pull request: wireless 2014-09-23

    Please consider pulling this one last batch of fixes intended for the 3.17 stream!

    For the NFC bits, Samuel says:

    "Hopefully not too late for a handful of NFC fixes:

    - 2 potential build failures for ST21NFCA and ST21NFCB, triggered by a
    depmod dependenyc cycle.
    - One potential buffer overflow in the microread driver."

    On top of that...

    Emil Goode provides a fix for a brcmfmac off-by-one regression which
    was introduced in the 3.17 cycle.

    Loic Poulain fixes a polarity mismatch for a variable assignment
    inside of rfkill-gpio.

    Wojciech Dubowik prevents a NULL pointer dereference in ath9k.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • Commit df568d8e ("scsi: Use 'depends' with LIBFC instead of
    'select'.") removed what happened to be the only instance of 'select
    NET'. Defconfigs that were relying on the select now lack networking
    support.

    Signed-off-by: David S. Miller

    David S. Miller
     
  • Commit df568d8e ("scsi: Use 'depends' with LIBFC instead of
    'select'.") removed what happened to be the only instance of 'select
    NET'. Defconfigs that were relying on the select now lack networking
    support.

    Signed-off-by: David S. Miller

    David S. Miller
     
  • Commit df568d8e ("scsi: Use 'depends' with LIBFC instead of
    'select'.") removed what happened to be the only instance of 'select
    NET'. Defconfigs that were relying on the select now lack networking
    support.

    Signed-off-by: David S. Miller

    David S. Miller
     
  • Commit df568d8e ("scsi: Use 'depends' with LIBFC instead of
    'select'.") removed what happened to be the only instance of 'select
    NET'. Defconfigs that were relying on the select now lack networking
    support.

    Signed-off-by: David S. Miller

    David S. Miller
     
  • Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
    instead of selecting NET") removed what happened to be the only instance
    of 'select NET'. Defconfigs that were relying on the select now lack
    networking support.

    Reported-by: Stephen Rothwell
    Cc: sparclinux@vger.kernel.org
    Signed-off-by: Michal Marek
    Signed-off-by: David S. Miller

    Michal Marek
     
  • Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
    instead of selecting NET") removed what happened to be the only instance
    of 'select NET'. Defconfigs that were relying on the select now lack
    networking support.

    Reported-by: Stephen Rothwell
    Cc: linux-sh@vger.kernel.org
    Signed-off-by: Michal Marek
    Signed-off-by: David S. Miller

    Michal Marek
     
  • Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
    instead of selecting NET") removed what happened to be the only instance
    of 'select NET'. Defconfigs that were relying on the select now lack
    networking support.

    Reported-by: Stephen Rothwell
    Cc: linuxppc-dev@lists.ozlabs.org
    Signed-off-by: Michal Marek
    Signed-off-by: David S. Miller

    Michal Marek
     
  • Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
    instead of selecting NET") removed what happened to be the only instance
    of 'select NET'. Defconfigs that were relying on the select now lack
    networking support.

    Reported-by: Stephen Rothwell
    Cc: linux-parisc@vger.kernel.org
    Signed-off-by: Michal Marek
    Signed-off-by: David S. Miller

    Michal Marek
     
  • Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
    instead of selecting NET") removed what happened to be the only instance
    of 'select NET'. Defconfigs that were relying on the select now lack
    networking support.

    Reported-by: Stephen Rothwell
    Cc: linux-mips@linux-mips.org
    Signed-off-by: Michal Marek
    Signed-off-by: David S. Miller

    Michal Marek
     
  • Pull one last block fix from Jens Axboe:
    "We've had an issue with scsi-mq where probing takes forever. This was
    bisected down to the percpu changes for blk_mq_queue_enter(), and the
    fact we now suffer an RCU grace period when killing a queue. SCSI
    creates and destroys tons of queues, so this let to 10s of seconds of
    stalls at boot for some.

    Tejun has a real fix for this, but it's too involved for 3.17. So
    this is a temporary workaround to expedite the queue killing until we
    can fold in the real fix for 3.18 when that merge window opens"

    * 'for-linus' of git://git.kernel.dk/linux-block:
    blk-mq, percpu_ref: implement a kludge for SCSI blk-mq stall during probe

    Linus Torvalds
     
  • Pull PCI fixes from Bjorn Helgaas:
    "Here are a few fixes that should be in v3.17.

    - Reverting "Don't scan random busses" covers up a CardBus regression
    having to do with allocating CardBus bus numbers.

    - Reverting "Make sure bus numbers stay within parents bounds" covers
    up an ACPI _CRS bug that makes us reconfigure a bridge, causing a
    broken device behind it to stop responding.

    - The pciehp timeout change fixes some code we added in v3.17.
    Without the fix, we can send a new hotplug command too early,
    before the timeout has expired.

    I hope for better fixes for the reverts, but those will have to come
    after v3.17"

    * tag 'pci-v3.17-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
    PCI: pciehp: Fix pcie_wait_cmd() timeout
    Revert "PCI: Make sure bus number resources stay within their parents bounds"
    Revert "PCI: Don't scan random busses in pci_scan_bridge()"

    Linus Torvalds
     
  • Pull crypto fixes from Herbert Xu:
    "This fixes three issues:

    - if ccp is loaded on a machine without ccp, it will incorrectly
    activate causing all requests to fail. Fixed by preventing ccp
    from loading if hardware isn't available.

    - not all IRQs were enabled for the qat driver, leading to potential
    stalls when it is used

    - disabled buggy AVX CTR implementation in aesni"

    * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
    crypto: aesni - disable "by8" AVX CTR optimization
    crypto: ccp - Check for CCP before registering crypto algs
    crypto: qat - Enable all 32 IRQs

    Linus Torvalds
     
  • Pull media fixes from Mauro Carvalho Chehab:
    "For some last time fixes:
    - a regression detected on Kernel 3.16 related to VBI Teletext
    application breakage on drivers using videobuf2 (see
    https://bugzilla.kernel.org/show_bug.cgi?id=84401). The bug was
    noticed on saa7134 (migrated to VB2 on 3.16), but also affects
    em28xx (migrated on 3.9 to VB2);
    - two additional sanity checks at videobuf2;
    - two fixups to restore proper VBI support at the em28xx driver;
    - two Kernel oops fixups (at cx24123 and cx2341x drivers);
    - a bug at adv7604 where an if was doing just the opposite as it
    would be expected;
    - some documentation fixups to match the behavior defined at the
    Kernel"

    * tag 'media/v3.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
    [media] em28xx-v4l: get rid of field "users" in struct em28xx_v4l2"
    [media] em28xx: fix VBI handling logic
    [media] DocBook media: improve the poll() documentation
    [media] DocBook media: fix the poll() 'no QBUF' documentation
    [media] vb2: fix VBI/poll regression
    [media] cx2341x: fix kernel oops
    [media] cx24123: fix kernel oops due to missing parent pointer
    [media] adv7604: fix inverted condition
    [media] media/radio: fix radio-miropcm20.c build with io.h header file
    [media] vb2: fix plane index sanity check in vb2_plane_cookie()
    [media] DocBook media: update version number and V4L2 changes
    [media] DocBook media: fix fieldname in struct v4l2_subdev_selection
    [media] vb2: fix vb2 state check when start_streaming fails
    [media] videobuf2-core.h: fix comment
    [media] videobuf2-core: add comments before the WARN_ON
    [media] videobuf2-dma-sg: fix for wrong GFP mask to sg_alloc_table_from_pages

    Linus Torvalds
     

24 Sep, 2014

14 commits

  • Pull bugfixes for md/raid1 from Neil Brown:
    "It is amazing how much easier it is to find bugs when you know one is
    there. Two bug reports resulted in finding 7 bugs!

    All are tagged for -stable. Those that can't cause (rare) data
    corruption, cause lockups.

    Particularly, but not only, fixing new "resync" code"

    * tag 'md/3.17-more-fixes' of git://git.neil.brown.name/md:
    md/raid1: fix_read_error should act on all non-faulty devices.
    md/raid1: count resync requests in nr_pending.
    md/raid1: update next_resync under resync_lock.
    md/raid1: Don't use next_resync to determine how far resync has progressed
    md/raid1: make sure resync waits for conflicting writes to complete.
    md/raid1: clean up request counts properly in close_sync()
    md/raid1: be more cautious where we read-balance during resync.
    md/raid1: intialise start_next_window for READ case to avoid hang

    Linus Torvalds
     
  • blk-mq uses percpu_ref for its usage counter which tracks the number
    of in-flight commands and used to synchronously drain the queue on
    freeze. percpu_ref shutdown takes measureable wallclock time as it
    involves a sched RCU grace period. This means that draining a blk-mq
    takes measureable wallclock time. One would think that this shouldn't
    matter as queue shutdown should be a rare event which takes place
    asynchronously w.r.t. userland.

    Unfortunately, SCSI probing involves synchronously setting up and then
    tearing down a lot of request_queues back-to-back for non-existent
    LUNs. This means that SCSI probing may take more than ten seconds
    when scsi-mq is used.

    This will be properly fixed by implementing a mechanism to keep
    q->mq_usage_counter in atomic mode till genhd registration; however,
    that involves rather big updates to percpu_ref which is difficult to
    apply late in the devel cycle (v3.17-rc6 at the moment). As a
    stop-gap measure till the proper fix can be implemented in the next
    cycle, this patch introduces __percpu_ref_kill_expedited() and makes
    blk_mq_freeze_queue() use it. This is heavy-handed but should work
    for testing the experimental SCSI blk-mq implementation.

    Signed-off-by: Tejun Heo
    Reported-by: Christoph Hellwig
    Link: http://lkml.kernel.org/g/20140919113815.GA10791@lst.de
    Fixes: add703fda981 ("blk-mq: use percpu_ref for mq usage count")
    Cc: Kent Overstreet
    Cc: Jens Axboe
    Tested-by: Christoph Hellwig
    Signed-off-by: Jens Axboe

    Tejun Heo
     
  • The "by8" implementation introduced in commit 22cddcc7df8f ("crypto: aes
    - AES CTR x86_64 "by8" AVX optimization") is failing crypto tests as it
    handles counter block overflows differently. It only accounts the right
    most 32 bit as a counter -- not the whole block as all other
    implementations do. This makes it fail the cryptomgr test #4 that
    specifically tests this corner case.

    As we're quite late in the release cycle, just disable the "by8" variant
    for now.

    Reported-by: Romain Francoise
    Signed-off-by: Mathias Krause
    Cc: Chandramouli Narayanan
    Signed-off-by: Herbert Xu

    Mathias Krause
     
  • If the ccp is built as a built-in module, then ccp-crypto (whether
    built as a module or a built-in module) will be able to load and
    it will register its crypto algorithms. If the system does not have
    a CCP this will result in -ENODEV being returned whenever a command
    is attempted to be queued by the registered crypto algorithms.

    Add an API, ccp_present(), that checks for the presence of a CCP
    on the system. The ccp-crypto module can use this to determine if it
    should register it's crypto alogorithms.

    Cc: stable@vger.kernel.org
    Reported-by: Scot Doyle
    Signed-off-by: Tom Lendacky
    Tested-by: Scot Doyle
    Signed-off-by: Herbert Xu

    Tom Lendacky
     
  • Pull infiniband/rdma fixes from Roland Dreier:
    "Last late set of InfiniBand/RDMA fixes for 3.17:

    - fixes for the new memory region re-registration support
    - iSER initiator error path fixes
    - grab bag of small fixes for the qib and ocrdma hardware drivers
    - larger set of fixes for mlx4, especially in RoCE mode"

    * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: (26 commits)
    IB/mlx4: Fix VF mac handling in RoCE
    IB/mlx4: Do not allow APM under RoCE
    IB/mlx4: Don't update QP1 in native mode
    IB/mlx4: Avoid accessing netdevice when building RoCE qp1 header
    mlx4: Fix mlx4 reg/unreg mac to work properly with 0-mac addresses
    IB/core: When marshaling uverbs path, clear unused fields
    IB/mlx4: Avoid executing gid task when device is being removed
    IB/mlx4: Fix lockdep splat for the iboe lock
    IB/mlx4: Get upper dev addresses as RoCE GIDs when port comes up
    IB/mlx4: Reorder steps in RoCE GID table initialization
    IB/mlx4: Don't duplicate the default RoCE GID
    IB/mlx4: Avoid null pointer dereference in mlx4_ib_scan_netdevs()
    IB/iser: Bump version to 1.4.1
    IB/iser: Allow bind only when connection state is UP
    IB/iser: Fix RX/TX CQ resource leak on error flow
    RDMA/ocrdma: Use right macro in query AH
    RDMA/ocrdma: Resolve L2 address when creating user AH
    mlx4: Correct error flows in rereg_mr
    IB/qib: Correct reference counting in debugfs qp_stats
    IPoIB: Remove unnecessary port query
    ...

    Linus Torvalds
     
  • Pull sound fixes from Takashi Iwai:
    "One fix is about a buggy computation in PCM API function Clemens
    spotted out, but the impact must be really small as no one really uses
    it in user-space side.

    The rest are a trivial fix for a HD-audio model and a USB-audio
    device-specific regression fix, so all look fairly safe to apply"

    * tag 'sound-3.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
    ALSA: snd-usb-caiaq: Fix LED commands for Kore controller
    ALSA: pcm: fix fifo_size frame calculation
    ALSA: hda - Add fixup model name lookup for Lemote A1205

    Linus Torvalds
     
  • Pull final block fixes from Jens Axboe:
    "This week and last we've been fixing some corner cases related to
    blk-mq, mostly. I ended up pulling most of that out of for-linus
    yesterday, which is why the branch looks fresh. The rest were
    postponed for 3.18.

    This pull request contains:

    - Fix from Christoph, avoiding a stack overflow when FUA insertion
    would recursive infinitely.

    - Fix from David Hildenbrand on races between the timeout handler and
    uninitialized requests. Fixes a real issue that virtio_blk has run
    into.

    - A few fixes from me:

    - Ensure that request deadline/timeout is ordered before the
    request is marked as started.

    - A potential oops on out-of-memory, when we scale the queue
    depth of the device and retry.

    - A hang fix on requeue from SCSI, where the hardware queue
    would be stopped when we attempt to re-run it (and hence
    nothing would happen, stalling progress).

    - A fix for commit 2da78092, where the cleanup path was moved
    to RCU, but a debug might_sleep() was inadvertently left in
    the code. This causes warnings for people"

    * 'for-linus' of git://git.kernel.dk/linux-block:
    genhd: fix leftover might_sleep() in blk_free_devt()
    blk-mq: use blk_mq_start_hw_queues() when running requeue work
    blk-mq: fix potential oops on out-of-memory in __blk_mq_alloc_rq_maps()
    blk-mq: avoid infinite recursion with the FUA flag
    blk-mq: Avoid race condition with uninitialized requests
    blk-mq: request deadline must be visible before marking rq as started

    Linus Torvalds
     
  • Pull parisc fixes from Helge Deller:
    "We avoid using -mfast-indirect-calls for 64bit kernel builds to
    prevent building an unbootable kernel due to latest gcc changes.

    In the pdc_stable/firmware-access driver we fix a few possible stack
    overflows and we now call secure_computing_strict() instead of
    secure_computing() which fixes upcoming SECCOMP patches in the
    for-next trees"

    * 'parisc-3.17-7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
    parisc: Only use -mfast-indirect-calls option for 32-bit kernel builds
    parisc: pdc_stable.c: Avoid potential stack overflows
    parisc: pdc_stable.c: Cleaning up unnecessary use of memset in conjunction with strncpy
    parisc: ptrace: use secure_computing_strict()

    Linus Torvalds
     
  • In spite of what the GCC manual says, the -mfast-indirect-calls has
    never been supported in the 64-bit parisc compiler. Indirect calls have
    always been done using function descriptors irrespective of the
    -mfast-indirect-calls option.

    Recently, it was noticed that a function descriptor was always requested
    when the -mfast-indirect-calls option was specified. This caused
    problems when the option was used in application code and doesn't make
    any sense because the whole point of the option is to avoid using a
    function descriptor for indirect calls.

    Fixing this broke 64-bit kernel builds.

    I will fix GCC but for now we need the attached change. This results in
    the same kernel code as before.

    Signed-off-by: John David Anglin
    Cc: stable@vger.kernel.org # v3.0+
    Signed-off-by: Helge Deller

    John David Anglin
     
  • Pull ia64 defconfig update from Tony Luck:
    "Need to rebuild defconfig files to cope with removal of "select NET"
    in drivers/scsi/Kconfig"

    * tag 'please-pull-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux:
    [IA64] refresh arch/ia64/configs/* using "make savedefconfig"

    Linus Torvalds
     
  • Pull hwmon fixes from Guenter Roeck:
    - Fix a resource leak in tmp103 driver
    - Add support for two more processors to fam15h_power driver
    - Also fix a bug in the same driver to only report the power level on
    chips which actually support reporting it

    * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
    hwmon: (tmp103) Fix resource leak bug in tmp103 temperature sensor driver
    hwmon: (fam15h_power) Add support for two more processors
    hwmon: (fam15h_power) Make actual power reporting conditional

    Linus Torvalds
     
  • Prompted by a change to drivers/scsi/Kconfig which used to do a
    "select NET" but now does a "depends on NET". This meant that some
    configurations ended up without CONFIG_NET=y

    Signed-off-by Tony Luck

    Tony Luck
     
  • Pull another kvm fix from Paolo Bonzini:
    "Another fix for 3.17 arrived at just the wrong time, after I had sent
    yesterday's pull request. Normally I would have waited for some other
    patches to pile up, but since 3.17 might be short here it is"

    * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
    arm/arm64: KVM: Fix unaligned access bug on gicv2 access

    Linus Torvalds
     
  • Pull cgroup fix from Tejun Heo:
    "One late fix for cgroup.

    I was waiting for another set of fixes for a long-standing obscure
    cpuset bug but am not sure whether they'll be ready before v3.17
    release. This one is a simple fix for a mutex unlock balance bug in
    an allocation failure path in pidlist_array_load().

    The bug was introduced in v3.14 and the fix is tagged for -stable"

    * 'for-3.17-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
    cgroup: fix unbalanced locking

    Linus Torvalds
     

23 Sep, 2014

3 commits

  • In the brcmf_count_20mhz_channels function we are looping through a list
    of channels received from firmware. Since the index of the first channel
    is 0 the condition leads to an off by one bug. This is causing us to hit
    the WARN_ON_ONCE(1) calls in the brcmu_d11n_decchspec function, which is
    how I discovered the bug.

    Introduced by:
    commit b48d891676f756d48b4d0ee131e4a7a5d43ca417
    ("brcmfmac: rework wiphy structure setup")

    Acked-by: Arend van Spriel
    Signed-off-by: Emil Goode
    Signed-off-by: John W. Linville

    Emil Goode
     
  • Otherwise we may fail to init the second compute ring.

    Noticed-by: Christian König
    Signed-off-by: Alex Deucher
    Cc: stable@vger.kernel.org

    Alex Deucher
     
  • Check the correct bit for audio. Seems like a copy-paste error from the
    start:

    commit 9ed109a7b445e3f073d8ea72f888ec80c0532465
    Author: Daniel Vetter
    Date: Thu Apr 24 23:54:52 2014 +0200

    drm/i915: Track has_audio in the pipe config

    Reported-by: Martin Andersen
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82756
    Cc: stable@vger.kernel.org # 3.16+
    Cc: Daniel Vetter
    Reviewed-by: Daniel Vetter
    Signed-off-by: Jani Nikula

    Jani Nikula