| Age | Commit message (Collapse) | Author |
|---|
|
The device model needs a release() function so it can free devices when
they become dereferenced. Do that for rtds.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
|
|
|
|
commit 739be96 "ASoC: Fix build dependency for SND_ATMEL_SOC_SSC"
introduces below build warnings:
drivers/misc/Kconfig:212:error: recursive dependency detected!
drivers/misc/Kconfig:212: symbol ATMEL_SSC is selected by SND_ATMEL_SOC_SSC
sound/soc/atmel/Kconfig:9: symbol SND_ATMEL_SOC_SSC is selected by SND_AT91_SOC_SAM9G20_WM8731
sound/soc/atmel/Kconfig:18: symbol SND_AT91_SOC_SAM9G20_WM8731 depends on ATMEL_SSC
SND_ATMEL_SOC_SSC needs ATMEL_SSC to pass compilation.
This patch remove the "select ATMEL_SSC" from SND_ATMEL_SOC_SSC to avoid above
warnings. And then ensures all the machine drivers that select SND_ATMEL_SOC_SSC
need to depend on ATMEL_SSC.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
|
|
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
|
MTD pull for 3.3
* tag 'for-linus-3.3' of git://git.infradead.org/mtd-2.6: (113 commits)
mtd: Fix dependency for MTD_DOC200x
mtd: do not use mtd->block_markbad directly
logfs: do not use 'mtd->block_isbad' directly
mtd: introduce mtd_can_have_bb helper
mtd: do not use mtd->suspend and mtd->resume directly
mtd: do not use mtd->lock, unlock and is_locked directly
mtd: do not use mtd->sync directly
mtd: harmonize mtd_writev usage
mtd: do not use mtd->lock_user_prot_reg directly
mtd: mtd->write_user_prot_reg directly
mtd: do not use mtd->read_*_prot_reg directly
mtd: do not use mtd->get_*_prot_info directly
mtd: do not use mtd->read_oob directly
mtd: mtdoops: do not use mtd->panic_write directly
romfs: do not use mtd->get_unmapped_area directly
mtd: do not use mtd->get_unmapped_area directly
mtd: do use mtd->point directly
mtd: introduce mtd_has_oob helper
mtd: mtdcore: export symbols cleanup
mtd: clean-up the default_mtd_writev function
...
Fix up trivial edit/remove conflict in drivers/staging/spectra/lld_mtd.c
|
|
We normally try to avoid reading from write-mostly devices, but when
we do we really have to check for bad blocks and be sure not to
try reading them.
With the current code, best_good_sectors might not get set and that
causes zero-length read requests to be send down which is very
confusing.
This bug was introduced in commit d2eb35acfdccbe2 and so the patch
is suitable for 3.1.x and 3.2.x
Reported-and-tested-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Reported-and-tested-by: Art -kwaak- van Breemen <ard@telegraafnet.nl>
Signed-off-by: NeilBrown <neilb@suse.de>
Cc: stable@vger.kernel.org
|
|
We currently only 'notify' changes to the 'degraded' attribute
when it decreases, not when it increases.
Notifying on failure is a little awkward as it happen in
interrupt context.
So instead, notify when we remove the failed device from the array,
which is very soon afterwards.
Reported-and-tested-by: Mikhail Balabin <mbalabin@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
|
|
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
|
|
QUEUE_FLAG_* are flags (other than QUEUE_FLAG_DEFAULT), so they cannot
be ORed together. Set the queue flags using queue_flag_set_unlocked().
Reported-by: Donald Wood <donald.e.wood@intel.com>
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
|
|
As reported by Toralf:
the build failed with :
CC [M] drivers/media/dvb/dvb-core/dvb_ca_en50221.o
In file included from arch/x86/include/asm/uaccess.h:573:0,
from include/linux/poll.h:14,
from drivers/media/dvb/dvb-core/dvbdev.h:27,
from drivers/media/dvb/dvb-core/dvb_ca_en50221.h:27,
from drivers/media/dvb/dvb-core/dvb_ca_en50221.c:41:
In function "copy_from_user", inlined from "dvb_ca_en50221_io_write" at drivers/media/dvb/dvb-core/dvb_ca_en50221.c:1314:26: arch/x86/include/asm/uaccess_32.h:211:26: error: call to "copy_from_user_overflow" declared with attribute error: copy_from_user() buffer size is not provably correct
Reported-by: Toralf Foerster <toralf.foerster@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
The commit "ath9k: Fix invalid noisefloor reading due to channel update"
preserves the current channel noisefloor readings before updating
channel type at the same channel index. It is also updating the curchan
pointer. As survey updation is also referring curchan pointer to fetch
the appropriate index, which might leads to invalid memory access. This
patch partially reverts the change and stores the noise floor history
buffer before updating channel type w/o updating curchan.
Cc: stable@kernel.org
Cc: Gary Morain <gmorain@google.com>
Cc: Paul Stewart <pstew@google.com>
Reported-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
|
|
If the memory allocation 'nvram_ularray = kmalloc(varsize,
GFP_ATOMIC);' fails we'll leak the memory allocated to 'vbuffer' when
we return -ENOMEM from the function.
This patch resolves the leak by kfree()'ing the allocated memory
before the return.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
|
|
also remove an unused macro and a function declaration
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
|
|
When downloading firmware into the device, the driver fails to check the
return when allocating an skb. When the allocation fails, a BUG can be
generated, as seen in https://bugzilla.redhat.com/show_bug.cgi?id=771656.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-next
|
|
By using the iod->nents field (the same way other I/O paths do), we can
avoid recalculating the number of sg entries at unmap time, and make
nvme_unmap_user_pages() easier to call.
Also, use the 'write' parameter instead of assuming DMA_FROM_DEVICE.
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
|
|
For user I/O and admin commands, we were forgetting to mark the end of
the SG list.
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
|
|
We were always mapping as DMA_FROM_DEVICE then unmapping with
DMA_TO_DEVICE which was clearly not correct. Follow the same pattern as
nvme_submit_io() and key off the bottom bit of the opcode to determine
whether this is a read or a write.
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
|
|
IO_TIMEOUT is a little too generic and might be used by other parts of
the kernel in the future.
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
|
|
The new merged data structure is called nvme_iod. This improves performance
for mid-sized I/Os (in the 16k range) since we save a memory allocation.
It is also a slightly simpler interface to use.
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
|
|
The queue is only needed for some rare occasions, and it's more consistent
to pass the device around.
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
|
|
Upcoming patches require calling get_nvmeq when we don't have a namespace.
Some callers already have the device in a local variable anyway.
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
|
|
Instead of encoding the handler type in the bottom two bits of the
per-completion context pointer, store the handler function as well
as the context pointer. This gives us more flexibility and the code
is clearer. It comes at the cost of an extra 8k of memory per queue,
but this feels like a reasonable price to pay.
Signed-off-by: Matthew Wilcox <matthew.r.wilcox@intel.com>
|
|
For caches with debugging enabled, "slub: Switch per cpu partial page
support off for debugging" changes cpu_partial to 0. It shouldn't be
tunable from userspace for such caches, otherwise the same accounting
issues arise during validation.
This patch disallows tuning /sys/kernel/slab/cache/cpu_partial to be non-
zero for caches with debugging enabled.
Acked-by: Christoph Lameter <cl@linux.com>
Signed-off-by: David Rientjes <rientjes@google.com>
Signed-off-by: Pekka Enberg <penberg@kernel.org>
|
|
* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (53 commits)
iommu/amd: Set IOTLB invalidation timeout
iommu/amd: Init stats for iommu=pt
iommu/amd: Remove unnecessary cache flushes in amd_iommu_resume
iommu/amd: Add invalidate-context call-back
iommu/amd: Add amd_iommu_device_info() function
iommu/amd: Adapt IOMMU driver to PCI register name changes
iommu/amd: Add invalid_ppr callback
iommu/amd: Implement notifiers for IOMMUv2
iommu/amd: Implement IO page-fault handler
iommu/amd: Add routines to bind/unbind a pasid
iommu/amd: Implement device aquisition code for IOMMUv2
iommu/amd: Add driver stub for AMD IOMMUv2 support
iommu/amd: Add stat counter for IOMMUv2 events
iommu/amd: Add device errata handling
iommu/amd: Add function to get IOMMUv2 domain for pdev
iommu/amd: Implement function to send PPR completions
iommu/amd: Implement functions to manage GCR3 table
iommu/amd: Implement IOMMUv2 TLB flushing routines
iommu/amd: Add support for IOMMUv2 domain mode
iommu/amd: Add amd_iommu_domain_direct_map function
...
|
|
* 'drm-core-next' of git://people.freedesktop.org/~airlied/linux: (307 commits)
drm/nouveau/pm: fix build with HWMON off
gma500: silence gcc warnings in mid_get_vbt_data()
drm/ttm: fix condition (and vs or)
drm/radeon: double lock typo in radeon_vm_bo_rmv()
drm/radeon: use after free in radeon_vm_bo_add()
drm/sis|via: don't return stack garbage from free_mem ioctl
drm/radeon/kms: remove pointless CS flags priority struct
drm/radeon/kms: check if vm is supported in VA ioctl
drm: introduce drm_can_sleep and use in intel/radeon drivers. (v2)
radeon: Fix disabling PCI bus mastering on big endian hosts.
ttm: fix agp since ttm tt rework
agp: Fix multi-line warning message whitespace
drm/ttm/dma: Fix accounting error when calling ttm_mem_global_free_page and don't try to free freed pages.
drm/ttm/dma: Only call set_pages_array_wb when the page is not in WB pool.
drm/radeon/kms: sync across multiple rings when doing bo moves v3
drm/radeon/kms: Add support for multi-ring sync in CS ioctl (v2)
drm/radeon: GPU virtual memory support v22
drm: make DRM_UNLOCKED ioctls with their own mutex
drm: no need to hold global mutex for static data
drm/radeon/benchmark: common modes sweep ignores 640x480@32
...
Fix up trivial conflicts in radeon/evergreen.c and vmwgfx/vmwgfx_kms.c
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (64 commits)
Input: tc3589x-keypad - add missing kerneldoc
Input: ucb1400-ts - switch to using dev_xxx() for diagnostic messages
Input: ucb1400_ts - convert to threaded IRQ
Input: ucb1400_ts - drop inline annotations
Input: usb1400_ts - add __devinit/__devexit section annotations
Input: ucb1400_ts - set driver owner
Input: ucb1400_ts - convert to use dev_pm_ops
Input: psmouse - make sure we do not use stale methods
Input: evdev - do not block waiting for an event if fd is nonblock
Input: evdev - if no events and non-block, return EAGAIN not 0
Input: evdev - only allow reading events if a full packet is present
Input: add driver for pixcir i2c touchscreens
Input: samsung-keypad - implement runtime power management support
Input: tegra-kbc - report wakeup key for some platforms
Input: tegra-kbc - add device tree bindings
Input: add driver for AUO In-Cell touchscreens using pixcir ICs
Input: mpu3050 - configure the sampling method
Input: mpu3050 - ensure we enable interrupts
Input: mpu3050 - add of_match table for device-tree probing
Input: sentelic - document the latest hardware
...
Fix up fairly trivial conflicts (device tree matching conflicting with
some independent cleanups) in drivers/input/keyboard/samsung-keypad.c
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (68 commits)
hid-input/battery: add FEATURE quirk
hid-input/battery: remove battery_val
hid-input/battery: power-supply type really *is* a battery
hid-input/battery: make the battery setup common for INPUTs and FEATUREs
hid-input/battery: deal with both FEATURE and INPUT report batteries
hid-input/battery: add quirks for battery
hid-input/battery: remove apparently redundant kmalloc
hid-input: add support for HID devices reporting Battery Strength
HID: hid-multitouch: add support 9 new Xiroku devices
HID: multitouch: add support for 3M 32"
HID: multitouch: add support of Atmel multitouch panels
HID: usbhid: defer LED setting to a workqueue
HID: usbhid: hid-core: submit queued urbs before suspend
HID: usbhid: remove LED_ON
HID: emsff: use symbolic name instead of hardcoded PID constant
HID: Enable HID_QUIRK_MULTI_INPUT for Trio Linker Plus II
HID: Kconfig: fix syntax
HID: introduce proper dependency of HID_BATTERY on POWER_SUPPLY
HID: multitouch: support PixArt optical touch screen
HID: make parser more verbose about parsing errors by default
...
Fix up rename/delete conflict in drivers/hid/hid-hyperv.c (removed in
staging, moved in this branch) and similarly for the rules for same file
in drivers/staging/hv/{Kconfig,Makefile}.
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6
SCSI updates for post 3.2 merge window
* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (67 commits)
[SCSI] lpfc 8.3.28: Update driver version to 8.3.28
[SCSI] lpfc 8.3.28: Add Loopback support for SLI4 adapters
[SCSI] lpfc 8.3.28: Critical Miscellaneous fixes
[SCSI] Lpfc 8.3.28: FC and SCSI Discovery Fixes
[SCSI] lpfc 8.3.28: Add support for ABTS failure handling
[SCSI] lpfc 8.3.28: SLI fixes and added SLI4 support
[SCSI] lpfc 8.3.28: Miscellaneous fixes in sysfs and mgmt interfaces
[SCSI] mpt2sas: Removed redundant calling of _scsih_probe_devices() from _scsih_probe
[SCSI] mac_scsi: Remove obsolete IRQ_FLG_* users
[SCSI] qla4xxx: Update driver version to 5.02.00-k10
[SCSI] qla4xxx: check for FW alive before calling chip_reset
[SCSI] qla4xxx: Fix qla4xxx_dump_buffer to dump buffer correctly
[SCSI] qla4xxx: Fix the IDC locking mechanism
[SCSI] qla4xxx: Wait for disable_acb before doing set_acb
[SCSI] qla4xxx: Don't recover adapter if device state is FAILED
[SCSI] qla4xxx: fix call trace on rmmod with ql4xdontresethba=1
[SCSI] qla4xxx: Fix CPU lockups when ql4xdontresethba set
[SCSI] qla4xxx: Perform context resets in case of context failures.
[SCSI] iscsi class: export pid of process that created
[SCSI] mpt2sas: Remove unused duplicate diag_buffer_enable param
...
|
|
* git://www.linux-watchdog.org/linux-watchdog:
watchdog: omap_wdt.c: fix the WDIOC_GETBOOTSTATUS ioctl if not implemented.
watchdog: new driver for VIA chipsets
watchdog: ath79_wdt: flush register writes
drivers/watchdog/lantiq_wdt.c: drop iounmap for devm_ allocated data
watchdog: documentation: describe nowayout in coversion-guide
watchdog: documentation: update index file
watchdog: Convert wm831x driver to devm_kzalloc()
watchdog: add nowayout helpers to Watchdog Timer Driver Kernel API
watchdog: convert drivers/watchdog/* to use module_platform_driver()
watchdog: Use DEFINE_SPINLOCK() for static spinlocks
watchdog: Convert Wolfson drivers to module_platform_driver
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (40 commits)
regulator: set constraints.apply_uV to 0 in of_get_fixed_voltage_config
regulator: max8925: fix enabled/disabled judgement mistake
regulator: add regulator_bulk_force_disable function
regulator: pass regulator_register of_node in fixed voltage driver
regulator: add regulator_force_disable() definition for !CONFIG_REGULATOR
regulator: Enable supply regulator if child rail is enabled.
regulator: mc13892: Convert to devm_kzalloc()
regulator: mc13783: Convert to devm_kzalloc()
regulator: Fix checking return value of create_regulator
regulator: Fix the error handling if create_regulator fails
regulator: Export regulator_is_supported_voltage()
regulator: mc13892: add device tree probe support
regulator: mc13892: remove the unnecessary prefix from regulator name
regulator: Convert wm831x regulator drivers to devm_kzalloc()
regulator: da9052: Staticize non-exported symbols
regulator: Replace kzalloc with devm_kzalloc and if-else with a switch-case for da9052-regulator
regulator: Update da9052-regulator for DT changes
regulator: DA9052/53 Regulator support
regulator: pass device_node to of_get_regulator_init_data()
regulator: If a single voltage is set with device tree then set apply_uV
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (31 commits)
pinctrl: remove unnecessary max pin number
pinctrl: correct a offset while enumerating pins
pinctrl: some typo fixes
pinctrl: rename U300 and SIRF pin controllers
pinctrl: pass name instead of device to pin_config_*
pinctrl: add "struct seq_file;" to pinconf.h
pinctrl: conjure names for unnamed pins
pinctrl: add a group-specific hog macro
pinctrl: don't create a device for each pin controller
arm/u300: don't use PINMUX_MAP_PRIMARY*
pinctrl: implement PINMUX_MAP_SYS_HOG
pinctrl: add a pin config interface
pinctrl/coh901: driver to request its pins
pinctrl: u300-pinmux: register proper GPIO ranges
pinctrl: move the U300 GPIO driver to pinctrl
ARM: u300: localize GPIO assignments
pinctrl: make it possible to add multiple maps
pinctrl: make a copy of pinmux map
pinctrl: GPIO direction support for muxing
pinctrl: print pin range in GPIO range debugs
...
|
|
* 'upstream-linus' of git://github.com/jgarzik/libata-dev:
ahci: support the STA2X11 I/O Hub
pata_bf54x: fix BMIDE status register emulation
ata: add ata port hibernate callbacks
ata: update ata port's runtime status during system resume
[SCSI] runtime resume parent for child's system-resume
ahci: platform support for suspend/resume
libata-core: kill duplicate statement in ata_do_set_mode()
pata_of_platform: remove direct dependency on OF_IRQ
SATA/PATA: convert drivers/ata/* to use module_platform_driver()
pata_cs5536: forward port changes from cs5536
libata-sff: use ATAPI_{COD|IO}
ata: add ata port runtime PM callbacks
ata: add ata port system PM callbacks
[SCSI] sd: check runtime PM status in sd_shutdown
[SCSI] check runtime PM status in system PM
[SCSI] add flag to skip the runtime PM calls on the host
ata: make ata port as parent device of scsi host
ahci: start engine only during soft/hard resets
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen
* 'stable/for-linus-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: (37 commits)
xen/pciback: Expand the warning message to include domain id.
xen/pciback: Fix "device has been assigned to X domain!" warning
xen/pciback: Move the PCI_DEV_FLAGS_ASSIGNED ops to the "[un|]bind"
xen/xenbus: don't reimplement kvasprintf via a fixed size buffer
xenbus: maximum buffer size is XENSTORE_PAYLOAD_MAX
xen/xenbus: Reject replies with payload > XENSTORE_PAYLOAD_MAX.
Xen: consolidate and simplify struct xenbus_driver instantiation
xen-gntalloc: introduce missing kfree
xen/xenbus: Fix compile error - missing header for xen_initial_domain()
xen/netback: Enable netback on HVM guests
xen/grant-table: Support mappings required by blkback
xenbus: Use grant-table wrapper functions
xenbus: Support HVM backends
xen/xenbus-frontend: Fix compile error with randconfig
xen/xenbus-frontend: Make error message more clear
xen/privcmd: Remove unused support for arch specific privcmp mmap
xen: Add xenbus_backend device
xen: Add xenbus device driver
xen: Add privcmd device driver
xen/gntalloc: fix reference counts on multi-page mappings
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen
* 'stable/for-linus-fixes-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
xen/mmu: Fix compile errors introduced by x86/memblock mismerge.
|
|
Kmemleak reports the following warning in bdev_cache_init()
[ 0.003738] kmemleak: Object 0xffff880153035200 (size 256):
[ 0.003823] kmemleak: comm "swapper/0", pid 0, jiffies 4294667299
[ 0.003909] kmemleak: min_count = 1
[ 0.003988] kmemleak: count = 0
[ 0.004066] kmemleak: flags = 0x1
[ 0.004144] kmemleak: checksum = 0
[ 0.004224] kmemleak: backtrace:
[ 0.004303] [<ffffffff814755ac>] kmemleak_alloc+0x21/0x3e
[ 0.004446] [<ffffffff811100ba>] kmem_cache_alloc+0xca/0x1dc
[ 0.004592] [<ffffffff811371b1>] alloc_vfsmnt+0x1f/0x198
[ 0.004736] [<ffffffff811375c5>] vfs_kern_mount+0x36/0xd2
[ 0.004879] [<ffffffff8113929a>] kern_mount_data+0x18/0x32
[ 0.005025] [<ffffffff81ab9075>] bdev_cache_init+0x51/0x81
[ 0.005169] [<ffffffff81ab8abf>] vfs_caches_init+0x101/0x10d
[ 0.005313] [<ffffffff81a9bae3>] start_kernel+0x344/0x383
[ 0.005456] [<ffffffff81a9b2a7>] x86_64_start_reservations+0xae/0xb2
[ 0.005602] [<ffffffff81a9b3ad>] x86_64_start_kernel+0x102/0x111
[ 0.005747] [<ffffffffffffffff>] 0xffffffffffffffff
[ 0.008653] kmemleak: Trying to color unknown object at 0xffff880153035220 as Grey
[ 0.008754] Pid: 0, comm: swapper/0 Not tainted 3.3.0-rc0-dbg-04200-g8180888-dirty #888
[ 0.008856] Call Trace:
[ 0.008934] [<ffffffff81118704>] ? find_and_get_object+0x44/0x118
[ 0.009023] [<ffffffff81118fe6>] paint_ptr+0x57/0x8f
[ 0.009109] [<ffffffff81475935>] kmemleak_not_leak+0x23/0x42
[ 0.009195] [<ffffffff81ab9096>] bdev_cache_init+0x72/0x81
[ 0.009282] [<ffffffff81ab8abf>] vfs_caches_init+0x101/0x10d
[ 0.009368] [<ffffffff81a9bae3>] start_kernel+0x344/0x383
[ 0.009466] [<ffffffff81a9b2a7>] x86_64_start_reservations+0xae/0xb2
[ 0.009555] [<ffffffff81a9b140>] ? early_idt_handlers+0x140/0x140
[ 0.009643] [<ffffffff81a9b3ad>] x86_64_start_kernel+0x102/0x111
due to attempt to mark pointer to `struct vfsmount' as a gray object, which
is embedded into `struct mount' returned from alloc_vfsmnt().
Make `bd_mnt' static, avoiding need to tell kmemleak to mark it gray, as
suggested by Al Viro.
Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
|
Two (or more) concurrent calls of shrink_dcache_parent() on the same dentry may
cause shrink_dcache_parent() to loop forever.
Here's what appears to happen:
1 - CPU0: select_parent(P) finds C and puts it on dispose list, returns 1
2 - CPU1: select_parent(P) locks P->d_lock
3 - CPU0: shrink_dentry_list() locks C->d_lock
dentry_kill(C) tries to lock P->d_lock but fails, unlocks C->d_lock
4 - CPU1: select_parent(P) locks C->d_lock,
moves C from dispose list being processed on CPU0 to the new
dispose list, returns 1
5 - CPU0: shrink_dentry_list() finds dispose list empty, returns
6 - Goto 2 with CPU0 and CPU1 switched
Basically select_parent() steals the dentry from shrink_dentry_list() and thinks
it found a new one, causing shrink_dentry_list() to think it's making progress
and loop over and over.
One way to trigger this is to make udev calls stat() on the sysfs file while it
is going away.
Having a file in /lib/udev/rules.d/ with only this one rule seems to the trick:
ATTR{vendor}=="0x8086", ATTR{device}=="0x10ca", ENV{PCI_SLOT_NAME}="%k", ENV{MATCHADDR}="$attr{address}", RUN+="/bin/true"
Then execute the following loop:
while true; do
echo -bond0 > /sys/class/net/bonding_masters
echo +bond0 > /sys/class/net/bonding_masters
echo -bond1 > /sys/class/net/bonding_masters
echo +bond1 > /sys/class/net/bonding_masters
done
One fix would be to check all callers and prevent concurrent calls to
shrink_dcache_parent(). But I think a better solution is to stop the
stealing behavior.
This patch adds a new dentry flag that is set when the dentry is added to the
dispose list. The flag is cleared in dentry_lru_del() in case the dentry gets a
new reference just before being pruned.
If the dentry has this flag, select_parent() will skip it and let
shrink_dentry_list() retry pruning it. With select_parent() skipping those
dentries there will not be the appearance of progress (new dentries found) when
there is none, hence shrink_dcache_parent() will not loop forever.
Set the flag is also set in prune_dcache_sb() for consistency as suggested by
Linus.
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
|
* 'kvm-updates/3.3' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (74 commits)
KVM: PPC: Whitespace fix for kvm.h
KVM: Fix whitespace in kvm_para.h
KVM: PPC: annotate kvm_rma_init as __init
KVM: x86 emulator: implement RDPMC (0F 33)
KVM: x86 emulator: fix RDPMC privilege check
KVM: Expose the architectural performance monitoring CPUID leaf
KVM: VMX: Intercept RDPMC
KVM: SVM: Intercept RDPMC
KVM: Add generic RDPMC support
KVM: Expose a version 2 architectural PMU to a guests
KVM: Expose kvm_lapic_local_deliver()
KVM: x86 emulator: Use opcode::execute for Group 9 instruction
KVM: x86 emulator: Use opcode::execute for Group 4/5 instructions
KVM: x86 emulator: Use opcode::execute for Group 1A instruction
KVM: ensure that debugfs entries have been created
KVM: drop bsp_vcpu pointer from kvm struct
KVM: x86: Consolidate PIT legacy test
KVM: x86: Do not rely on implicit inclusions
KVM: Make KVM_INTEL depend on CPU_SUP_INTEL
KVM: Use memdup_user instead of kmalloc/copy_from_user
...
|
|
Signed-off-by: Sage Weil <sage@newdream.net>
|
|
ceph_mdsc_put_request() can call iput(), which can sleep. Don't do that.
Fixes: #1812
Signed-off-by: Sage Weil <sage@newdream.net>
|
|
Nothing we do here sleeps, so just do it under d_lock and avoid the dget/
dput entirely.
Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Sage Weil <sage@newdream.net>
|
|
moved dereference after BUG_ON
Signed-off-by: Yehuda Sadeh <yehuda@hq.newdream.net>
|
|
Signed-off-by: Sage Weil <sage@newdream.net>
|
|
We now set d_fsdata unconditionally on all dentries prior to setting up
the d_ops, so all of these checks are unnecessary.
Signed-off-by: Sage Weil <sage@newdream.net>
|
|
Use kmemdup rather than duplicating its implementation
The semantic patch that makes this change is available
in scripts/coccinelle/api/memdup.cocci.
Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
Signed-off-by: Sage Weil <sage@newdream.net>
|
|
|
|
Conflicts:
fs/ext4/ioctl.c
|
|
Commit 503358ae01b70ce6909d19dd01287093f6b6271c ("ext4: avoid divide by
zero when trying to mount a corrupted file system") fixes CVE-2009-4307
by performing a sanity check on s_log_groups_per_flex, since it can be
set to a bogus value by an attacker.
sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
groups_per_flex = 1 << sbi->s_log_groups_per_flex;
if (groups_per_flex < 2) { ... }
This patch fixes two potential issues in the previous commit.
1) The sanity check might only work on architectures like PowerPC.
On x86, 5 bits are used for the shifting amount. That means, given a
large s_log_groups_per_flex value like 36, groups_per_flex = 1 << 36
is essentially 1 << 4 = 16, rather than 0. This will bypass the check,
leaving s_log_groups_per_flex and groups_per_flex inconsistent.
2) The sanity check relies on undefined behavior, i.e., oversized shift.
A standard-confirming C compiler could rewrite the check in unexpected
ways. Consider the following equivalent form, assuming groups_per_flex
is unsigned for simplicity.
groups_per_flex = 1 << sbi->s_log_groups_per_flex;
if (groups_per_flex == 0 || groups_per_flex == 1) {
We compile the code snippet using Clang 3.0 and GCC 4.6. Clang will
completely optimize away the check groups_per_flex == 0, leaving the
patched code as vulnerable as the original. GCC keeps the check, but
there is no guarantee that future versions will do the same.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org
|
|
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
|
lookup should fail with ENOMEM, not silently make dentry negative.
Switched to saner calling conventions, while we are at it.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
