summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2012-11-23block: Don't access request after it might be freedRoland Dreier
After we've done __elv_add_request() and __blk_run_queue() in blk_execute_rq_nowait(), the request might finish and be freed immediately. Therefore checking if the type is REQ_TYPE_PM_RESUME isn't safe afterwards, because if it isn't, rq might be gone. Instead, check beforehand and stash the result in a temporary. This fixes crashes in blk_execute_rq_nowait() I get occasionally when running with lots of memory debugging options enabled -- I think this race is usually harmless because the window for rq to be reallocated is so small. Signed-off-by: Roland Dreier <roland@purestorage.com> Cc: stable@kernel.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-11-23mtip32xx: Fix padding issueSelvan Mani
Hi Jens, Another tiny patch. Removed __packed before the struct smart_attr and added __packed at end of the structure to fix padding issue. Signed-off-by: Selvan Mani <smani@micron.com> Signed-off-by: Asai Thambi S P <asamymuthupa@micron.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-11-23aoe: avoid running request handler on plugged queueEd Cashin
Calling the request handler directly on a plugged queue defeats the performance improvements provided by the plugging mechanism. Use the __blk_run_queue function instead of calling the request handler directly, so that we don't interfere with the block layer's ability to plug the queue. Signed-off-by: Ed Cashin <ecashin@coraid.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-11-23mtip32xx: fix potential NULL pointer dereference in mtip_timeout_function()Wei Yongjun
The dereference to port should be moved below the NULL test. dpatch engine is used to auto generate this patch. (https://github.com/weiyj/dpatch) Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-11-23mtip32xx: fix shift larger than type warningJens Axboe
If we're building a 32-bit kernel and CONFIG_LBADF isn't set, sector_t is 32-bits wide. The shifts by 32 and 40 are thus larger than we support. Cast the sector offset to a u64 to avoid these warnings. Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-11-23mtip32xx: Fix incorrect mask used for erase modeSelvan Mani
Previous commit use value 3 for erasemode mask. Changing the mask to correct value to 2 Signed-off-by: Selvan Mani <smani@micron.com> Signed-off-by: Asai Thambi S P <asamymuthupa@micron.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-11-23mtip32xx: Fix to make lba address correct in big-endian systemsSelvan Mani
Earlier lba address was assigned directly to lba_low and lba_low_ex, which would result in a different number (bytes reversed) in big-endian systems. Now assigning lba address byte-by-byte to fis. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Selvan Mani <smani@micron.com> Signed-off-by: Asai Thambi S P <asamymuthupa@micron.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-11-23mtip32xx: fix potential crash on SEC_ERASE_UNITSelvan Mani
The mtip driver lifted this code from elsewhere and then added a special handling check for SEC_ERASE_UNIT. If the caller tries to do a security erase but passes no output data for the command then outbuf is not allocated and the driver duly explodes. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Selvan Mani <smani@micron.com> Signed-off-by: Asai Thambi S P <asamymuthupa@micron.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-11-23dm: fix deadlock with request based dm and queue request_fn recursionJens Axboe
Request based dm attempts to re-run the request queue off the request completion path. If used with a driver that potentially does end_io from its request_fn, we could deadlock trying to recurse back into request dispatch. Fix this by punting the request queue run to kblockd. Tested to fix a quickly reproducible deadlock in such a scenario. Cc: stable@kernel.org Acked-by: Alasdair G Kergon <agk@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-11-23floppy: destroy floppy workqueue before cleaning up the queueJiri Kosina
We need to first destroy the floppy_wq workqueue before cleaning up the queue. Otherwise we might race with still pending work with the workqueue, but all the block queue already gone. This might lead to various oopses, such as CPU 0 Pid: 6, comm: kworker/u:0 Not tainted 3.7.0-rc4 #1 Bochs Bochs RIP: 0010:[<ffffffff8134eef5>] [<ffffffff8134eef5>] blk_peek_request+0xd5/0x1c0 RSP: 0000:ffff88000dc7dd88 EFLAGS: 00010092 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88000f602688 RSI: ffffffff81fd95d8 RDI: 6b6b6b6b6b6b6b6b RBP: ffff88000dc7dd98 R08: ffffffff81fd95c8 R09: 0000000000000000 R10: ffffffff81fd9480 R11: 0000000000000001 R12: 6b6b6b6b6b6b6b6b R13: ffff88000dc7dfd8 R14: ffff88000dc7dfd8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffffff81e21000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000000 CR3: 0000000001e11000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process kworker/u:0 (pid: 6, threadinfo ffff88000dc7c000, task ffff88000dc5ecc0) Stack: 0000000000000000 0000000000000000 ffff88000dc7ddb8 ffffffff8134efee ffff88000dc7ddb8 0000000000000000 ffff88000dc7dde8 ffffffff814aef3c ffffffff81e75d80 ffff88000dc0c640 ffff88000fbfb000 ffffffff814aed90 Call Trace: [<ffffffff8134efee>] blk_fetch_request+0xe/0x30 [<ffffffff814aef3c>] redo_fd_request+0x1ac/0x400 [<ffffffff814aed90>] ? start_motor+0x130/0x130 [<ffffffff8106b526>] process_one_work+0x136/0x450 [<ffffffff8106af65>] ? manage_workers+0x205/0x2e0 [<ffffffff8106bb6d>] worker_thread+0x14d/0x420 [<ffffffff8106ba20>] ? rescuer_thread+0x1a0/0x1a0 [<ffffffff8107075a>] kthread+0xba/0xc0 [<ffffffff810706a0>] ? __kthread_parkme+0x80/0x80 [<ffffffff818b553a>] ret_from_fork+0x7a/0xb0 [<ffffffff810706a0>] ? __kthread_parkme+0x80/0x80 Code: 0f 84 c0 00 00 00 83 f8 01 0f 85 e2 00 00 00 81 4b 40 00 00 80 00 48 89 df e8 58 f8 ff ff be fb ff ff ff fe ff ff <49> 8b 1c 24 49 39 dc 0f 85 2e ff ff ff 41 0f b6 84 24 28 04 00 RIP [<ffffffff8134eef5>] blk_peek_request+0xd5/0x1c0 RSP <ffff88000dc7dd88> Reported-by: Fengguang Wu <fengguang.wu@intel.com> Tested-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-11-22Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "This fixes recent regression where /dev/input/mice got assigned wrong device node which messed up setups with static /dev, and a regression in ads7846 GPIO debounce setup." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: ARM - OMAP: ads7846: fix pendown debounce setting Input: ads7846 - enable pendown GPIO debounce time setting Input: mousedev - move /dev/input/mice to the correct minor Input: MT - document new 'flags' argument of input_mt_init_slots()
2012-11-22Merge branch 'v3.7-samsung-fixes-3' of ↵Olof Johansson
git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes From Kukjin Kim: Here is Samsung fixes for v3.7 and it is for fixing of mdma1 address for exynos4210 rev0 SoC. * 'v3.7-samsung-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung: ARM: EXYNOS: PL330 MDMA1 fix for revision 0 of Exynos4210 SOC Signed-off-by: Olof Johansson <olof@lixom.net>
2012-11-23powerpc/pseries: Fix oops with MSIs when missing EEH PEsAlexey Kardashevskiy
The new EEH code introduced a small regression, if the EEH PEs are missin (which happens currently in qemu for example), it will deref a NULL pointer in the MSI code. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
2012-11-22i2c: mxs: Handle i2c DMA failure properlyMarek Vasut
Properly terminate the DMA transfer in case the DMA PIO transfer or setup fails for any reason. Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
2012-11-22ipv4: do not cache looped multicastsJulian Anastasov
Starting from 3.6 we cache output routes for multicasts only when using route to 224/4. For local receivers we can set RTCF_LOCAL flag depending on the membership but in such case we use maddr and saddr which are not caching keys as before. Additionally, we can not use same place to cache routes that differ in RTCF_LOCAL flag value. Fix it by caching only RTCF_MULTICAST entries without RTCF_LOCAL (send-only, no loopback). As a side effect, we avoid unneeded lookup for fnhe when not caching because multicasts are not redirected and they do not learn PMTU. Thanks to Maxime Bizon for showing the caching problems in __mkroute_output for 3.6 kernels: different RTCF_LOCAL flag in cache can lead to wrong ip_mc_output or ip_output call and the visible problem is that traffic can not reach local receivers via loopback. Reported-by: Maxime Bizon <mbizon@freebox.fr> Tested-by: Maxime Bizon <mbizon@freebox.fr> Signed-off-by: Julian Anastasov <ja@ssi.bg> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-22drm/i915: do not default to 18 bpp for eDP if missing from VBTJani Nikula
commit 500a8cc466a24e2fbc4c86ef9c6467ae2ffdeb0c Author: Zhenyu Wang <zhenyuw@linux.intel.com> Date: Wed Jan 13 11:19:52 2010 +0800 drm/i915: parse eDP panel color depth from VBT block originally introduced parsing bpp for eDP from VBT, with a default of 18 bpp if the eDP BIOS data block is not present. Turns out that default seems to break the Macbook Pro with retina display, as noted in commit 4344b813f105a19f793f1fd93ad775b784648b95 Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Fri Aug 10 11:10:20 2012 +0200 drm/i915: ignore eDP bpc settings from vbt Since we can't ignore bpc settings from VBT completely after all, get rid of the default. Do not clamp eDP to 18 bpp by default if the eDP BDB is missing from VBT. Signed-off-by: Jani Nikula <jani.nikula@intel.com> Tested-by: Henrik Rydberg <rydberg@euromail.se> [danvet: paste in the updated commit message from irc.] Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2012-11-22Merge branch 'master' of git://1984.lsi.us.es/nfDavid S. Miller
Pablo Neira Ayuso says: ==================== The following patchset contains two Netfilter fixes: * Fix buffer overflow in the name of the timeout policy object in the cttimeout infrastructure, from Florian Westphal. * Fix a bug in the hash set in case that IP ranges are specified, from Jozsef Kadlecsik. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-22Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== This pull request is intended for 3.7 and contains a single patch to fix the IPsec gc threshold value for ipv4. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-22ALSA: snd-usb: properly initialize the sync endpointDaniel Mack
Jeffrey Barish reported an obvious bug in the pcm part of the usb-audio driver which causes the code to not initialize the sync endpoint from configure_endpoint(). Reported-by: Jeffrey Barish <jeff_barish@earthlink.net> Signed-off-by: Daniel Mack <zonque@gmail.com> Cc: stable@kernel.org [3.5+] Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-11-22Merge tag 'fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "A few more fixes for final 3.7. Two dealing with pinmux setup on OMAP, and one dealing with TV output on DaVinci. And one small MAINTAINER update." * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: davinci: dm644x: fix out range signal for ED ARM: OMAP4: TWL: mux sys_drm_msecure as output for PMIC ARM: OMAP3: igep0020: Set WIFI/BT GPIO pins in correct mux mode ARM: OMAP: Add maintainer entry for IGEP machines
2012-11-22Merge tag 'parisc-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/parisc-2.6 Pull PARISC fixes from James Bottomley: "This is two bug fixes: one fixes a loophole where rt_sigprocmask() with the wrong values panics the box (Denial of Service) and the other fixes an aliasing problem with get_shared_area() which could cause data corruption. Signed-off-by: James Bottomley <JBottomley@Parallels.com>" * tag 'parisc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/parisc-2.6: [PARISC] fix user-triggerable panic on parisc [PARISC] fix virtual aliasing issue in get_shared_area()
2012-11-22Merge tag 'scsi-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is a set of four bug fixes. The isci one is an obvious thinko (using request buffer instead of response buffer) which causes a command to fail. The three others are DIF/DIX updates which are required because they're part of a series of ten patches, the other seven of which went into the block layer during the merge window meaning our current DIF/DIX implementation is broken without these three. Signed-off-by: James Bottomley <JBottomley@Parallels.com>" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: [SCSI] sd: Implement support for WRITE SAME [SCSI] sd: Permit merged discard requests [SCSI] Add a report opcode helper [SCSI] isci: copy fis 0x34 response into proper buffer
2012-11-22Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds
Pull drm fixes from Dave Airlie. Small fixes for (mostly Nouveau, some radeon) regressions. * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/nouveau: use the correct fence implementation for nv50 drm/radeon: add new SI pci id radeon: add AGPMode 1 quirk for RV250 drm/radeon: properly track the crtc not_enabled case evergreen_mc_stop() drm/nouveau/bios: fix DCB v1.5 parsing drm/nouveau: add missing pll_calc calls drm/nouveau: fix crash with noaccel=1 drm/nv40: allocate ctxprog with kmalloc drm/nvc0/disp: fix thinko in vblank regression fix..
2012-11-22OMAPDSS: do not fail if dpll4_m4_ck is missingAaro Koskinen
Do not fail if dpll4_m4_ck is missing. The clock is not there on omap24xx, so this should not be a hard error. The patch retains the functionality before the commit 185bae10 (OMAPDSS: DSS: Cleanup cpu_is_xxxx checks). Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
2012-11-22[PARISC] fix user-triggerable panic on pariscAl Viro
int sys32_rt_sigprocmask(int how, compat_sigset_t __user *set, compat_sigset_t __user *oset, unsigned int sigsetsize) { sigset_t old_set, new_set; int ret; if (set && get_sigset32(set, &new_set, sigsetsize)) ... static int get_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz) { compat_sigset_t s; int r; if (sz != sizeof *set) panic("put_sigset32()"); In other words, rt_sigprocmask(69, (void *)69, 69) done by 32bit process will promptly panic the box. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Cc: <stable@vger.kernel.org> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
2012-11-22drm/exynos: Fix potential NULL pointer dereference in exynos_drm_encoder.cSachin Kamat
Check overlay_ops is not NULL as checked in the previous 'if' condition. Fixes the following smatch error: drivers/gpu/drm/exynos/exynos_drm_encoder.c:509 exynos_drm_encoder_plane_disable() error: we previously assumed 'overlay_ops' could be null (see line 499) Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Signed-off-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
2012-11-22drm/exynos: Make exynos4/5_fimd_driver_data staticSachin Kamat
Fixes the following sparse warnings: drivers/gpu/drm/exynos/exynos_drm_fimd.c:65:25: warning: symbol 'exynos4_fimd_driver_data' was not declared. Should it be static? drivers/gpu/drm/exynos/exynos_drm_fimd.c:69:25: warning: symbol 'exynos5_fimd_driver_data' was not declared. Should it be static? Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Signed-off-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
2012-11-22drm/exynos: fix overlay updating issueInki Dae
Chagelog v2: Move encoder's dpms updating into exynos_drm_encoder_commit function because when crtc's dpms is updated, encoder's dpms is updated also. This would induce the issue that encoder isn't disabled after crtc is disabled. Changelog v1: This patch fixes a issue that overlay data aren't applied to real hardware when dpms off goes to on after setcrtc was requested like below, dpms off -> setcrtc -> dpms off -> dpms on For this, it makes encoder's dpms to be updated when setcrtc is requested. Signed-off-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
2012-11-22drm/exynos: remove unnecessary code.Inki Dae
plane->fb will be set to new fb after update_plane callback is called by drm_mode_set_plane() Signed-off-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
2012-11-22drm/exynos: fix linux framebuffer address setting.Inki Dae
With iommu, buffer->dma_addr has device addres so this patch fixes for physical address to be set to fix.smem_start always. Signed-off-by: Inki Dae <inki.dae@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
2012-11-22md/raid10: decrement correct pending counter when writing to replacement.NeilBrown
When a write to a replacement device completes, we carefully and correctly found the rdev that the write actually went to and the blithely called rdev_dec_pending on the primary rdev, even if this write was to the replacement. This means that any writes to an array while a replacement was ongoing would cause the nr_pending count for the primary device to go negative, so it could never be removed. This bug has been present since replacement was introduced in 3.3, so it is suitable for any -stable kernel since then. Reported-by: "George Spelvin" <linux@horizon.com> Cc: stable@vger.kernel.org Signed-off-by: NeilBrown <neilb@suse.de>
2012-11-22md/raid10: close race that lose writes lost when replacement completes.NeilBrown
When a replacement operation completes there is a small window when the original device is marked 'faulty' and the replacement still looks like a replacement. The faulty should be removed and the replacement moved in place very quickly, bit it isn't instant. So the code write out to the array must handle the possibility that the only working device for some slot in the replacement - but it doesn't. If the primary device is faulty it just gives up. This can lead to corruption. So make the code more robust: if either the primary or the replacement is present and working, write to them. Only when neither are present do we give up. This bug has been present since replacement was introduced in 3.3, so it is suitable for any -stable kernel since then. Reported-by: "George Spelvin" <linux@horizon.com> Cc: stable@vger.kernel.org Signed-off-by: NeilBrown <neilb@suse.de>
2012-11-22Merge branch 'drm-fixes-3.7' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie
into drm-fixes Alex writes: A couple more small fixes for 3.7: - another evergreen_mc fix - add an AGP quirk for an old RV250 - new pci id. * 'drm-fixes-3.7' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: add new SI pci id radeon: add AGPMode 1 quirk for RV250 drm/radeon: properly track the crtc not_enabled case evergreen_mc_stop()
2012-11-22Merge branch 'drm-nouveau-fixes' of ↵Dave Airlie
git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes nouveau: one more regression fix. * 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6: drm/nouveau: use the correct fence implementation for nv50
2012-11-22Merge branch 'drm-nouveau-fixes' of ↵Dave Airlie
git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes Some more misc fallout from nouveau rework. * 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6: drm/nouveau/bios: fix DCB v1.5 parsing drm/nouveau: add missing pll_calc calls drm/nouveau: fix crash with noaccel=1 drm/nv40: allocate ctxprog with kmalloc drm/nvc0/disp: fix thinko in vblank regression fix..
2012-11-22drm/nouveau: use the correct fence implementation for nv50Maarten Lankhorst
Only compile time tested, noticed nv50_fence_create was never used, so fix this. This will probably fix vblank on nv50 cards. Hopefully this is still in time for 3.7 final release. Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2012-11-21drm/radeon: add new SI pci idAlex Deucher
Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2012-11-21netfilter: cttimeout: fix buffer overflowFlorian Westphal
Chen Gang reports: the length of nla_data(cda[CTA_TIMEOUT_NAME]) is not limited in server side. And indeed, its used to strcpy to a fixed-sized buffer. Fortunately, nfnetlink users need CAP_NET_ADMIN. Reported-by: Chen Gang <gang.chen@asianux.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-11-21netfilter: ipset: Fix range bug in hash:ip,port,netJozsef Kadlecsik
Due to the missing ininitalization at adding/deleting entries, when a plain_ip,port,net element was the object, multiple elements were added/deleted instead. The bug came from the missing dangling default initialization. The error-prone default initialization is corrected in all hash:* types. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-11-21fix incorrect NR_FREE_PAGES accounting (appears like memory leak)Dave Hansen
There have been some 3.7-rc reports of vm issues, including some kswapd bugs and, more importantly, some memory "leaks": http://www.spinics.net/lists/linux-mm/msg46187.html https://bugzilla.kernel.org/show_bug.cgi?id=50181 Commit 1fb3f8ca0e92 ("mm: compaction: capture a suitable high-order page immediately when it is made available") took split_free_page() and reused it for the compaction code. It does something curious with capture_free_page() (previously known as split_free_page()): int capture_free_page(struct page *page, int alloc_order, ... __mod_zone_page_state(zone, NR_FREE_PAGES, -(1UL << order)); - /* Split into individual pages */ - set_page_refcounted(page); - split_page(page, order); + if (alloc_order != order) + expand(zone, page, alloc_order, order, + &zone->free_area[order], migratetype); Note that expand() puts the pages _back_ in the allocator, but it does not bump NR_FREE_PAGES. We "return" 'alloc_order' worth of pages, but we accounted for removing 'order' in the __mod_zone_page_state() call. For the old split_page()-style use (order==alloc_order) the bug will not trigger. But, when called from the compaction code where we occasionally get a larger page out of the buddy allocator than we need, we will run in to this. This patch simply changes the NR_FREE_PAGES manipulation to the correct 'alloc_order' instead of 'order'. I've been able to repeatedly trigger this in my testing environment. The amount "leaked" very closely tracks the imbalance I see in buddy pages vs. NR_FREE_PAGES. I have confirmed that this patch fixes the imbalance Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com> Acked-by: Mel Gorman <mgorman@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-11-21Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds
Pull networking updates from David Miller: 1) inet6_csk_update_pmtu() must return NULL or non-NULL, so translate ERR_PTR to NULL, as needed. Fix from Eric Dumazet. 2) Fix copy&paste error in IRDA sir_dev ->set_speed method invocation, it was testing the NULL'ness of a different method to guard the call. Fix from Alexander Shiyan. 3) Fix build regression of xilinx driver, from Jeff Mahoney. 4) Make XEN netfront (like XEN netback) handle compound pages in SKBs properly. From Ian Campbell. 5) Fix inverted logic of team_dev_queue_xmit() return value checks, from Jiri Pirko and Dan Carpenter. 6) dma_poll_create() no longer allows a NULL device argument, breaking both ixp4xx drivers. Fix from Xi Wang. 7) ne2000 driver doesn't hook up the parent device properly, breaking udev matching. Fix from Alan Cox. 8) Locking and memory leak fixes in Near Field Communications layer. From Thierry Escande, Szymon Janc, and Waldemar Rymarkiewicz. 9) sis900 resume regression, sis900_set_mode() is being called with the iomem pointer instead of the expected device private. Fix from Francois Romieu. 10) Fix IBSS regression caused by uninitializing the ibss-internals before performing an emptyness check, from Simon WUnderlich. 11) Fix SNIFFER mode regression in iwlwifi driver, from Johannes Berg. 12) Fix task wedges in mwifiex_cmd_timeout_func(), from Bing Zhao. 13) Add back wireless sysfs directory, too much stuff depends upon it being there (actually I'd say it never should have been removed to begin with). From Johannes Berg. 14) Fix hang introduced by suspend/resume changes in ath9k. Fix from Sujith Manoharan. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (24 commits) team: bcast: convert return value of team_dev_queue_xmit() to bool correctly bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices. xen/netfront: handle compound page fragments on transmit net: fix build failure in xilinx irda: sir_dev: Fix copy/paste typo ipv6: fix inet6_csk_update_pmtu() return value ixp4xx_hss: avoid calling dma_pool_create() with NULL dev ixp4xx_eth: avoid calling dma_pool_create() with NULL dev ne2000: add the right platform device of/net/mdio-gpio: Fix pdev->id issue when using devicetrees. NFC: Fix pn533 target mode memory leak NFC: pn533: Fix mem leak in pn533_in_dep_link_up NFC: pn533: Fix use after free NFC: pn533: Fix missing lock while operating on commands list NFC: Fix nfc_llcp_local chained list insertion ath9k_hw: Fix regression in device reset sis900: fix sis900_set_mode call parameters. iwlwifi: don't WARN when a non empty queue is disabled wireless: add back sysfs directory mwifiex: report error to MMC core if we cannot suspend ...
2012-11-22md/raid5: Make sure we clear R5_Discard when discard is finished.NeilBrown
commit 9e44476851e91c86c98eb92b9bc27fb801f89072 MD: raid5 avoid unnecessary zero page for trim change raid5 to clear R5_Discard when the complete request is handled rather than when submitting the per-device discard request. However it did not clear R5_Discard for the parity device. This means that if the stripe_head was reused before it expired from the cache, the setting would be wrong and a hang would result. Also if the R5_Uptodate bit happens to be set, R5_Discard again won't be cleared. But R5_Uptodate really should be clear at this point. So make sure R5_Discard is cleared in all cases, and clear R5_Uptodate when a 'discard' completes. Signed-off-by: NeilBrown <neilb@suse.de>
2012-11-22md/raid5: move resolving of reconstruct_state earlier inNeilBrown
stripe_handle. The chunk of code in stripe_handle which responds to a *_result value in reconstruct_state is really the completion of some processing that happened outside of handle_stripe (possibly asynchronously) and so should be one of the first things done in handle_stripe(). After the next patch it will be important that it happens before handle_stripe_clean_event(), as that will clear some dev->flags bit that this code tests. Signed-off-by: NeilBrown <neilb@suse.de>
2012-11-21Merge tag 'omap-for-v3.7-rc5/fixes-signed' of ↵Olof Johansson
git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes From Tony Lindgren: Few more regression fixes related to u-boot only muxing essential pins. * tag 'omap-for-v3.7-rc5/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: OMAP4: TWL: mux sys_drm_msecure as output for PMIC ARM: OMAP3: igep0020: Set WIFI/BT GPIO pins in correct mux mode ARM: OMAP: Add maintainer entry for IGEP machines
2012-11-21ARM - OMAP: ads7846: fix pendown debounce settingIgor Grinberg
Commit 97ee9f01 (ARM: OMAP: fix the ads7846 init code) have enabled the pendown GPIO debounce time setting by the below sequence: gpio_request_one() gpio_set_debounce() gpio_free() It also revealed a bug in the OMAP GPIO handling code which prevented the GPIO debounce clock to be disabled and CORE transition to low power states. Commit c9c55d9 (gpio/omap: fix off-mode bug: clear debounce settings on free/reset) fixes the OMAP GPIO handling code by making sure that the GPIO debounce clock gets disabled if no GPIO is requested from current bank. While fixing the OMAP GPIO handling code (in the right way), the above commit makes the gpio_request->set_debounce->free sequence invalid as after freeing the GPIO, the debounce settings are lost. Fix the debounce settings by moving the debounce initialization to the actual GPIO requesting code - the ads7846 driver. Signed-off-by: Igor Grinberg <grinberg@compulab.co.il> Acked-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2012-11-21Input: ads7846 - enable pendown GPIO debounce time settingIgor Grinberg
Some platforms need the pendown GPIO debounce time setting programmed. Since the pendown GPIO is handled by the driver, the debounce time should also be handled along with the pendown GPIO request. Signed-off-by: Igor Grinberg <grinberg@compulab.co.il> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2012-11-21team: bcast: convert return value of team_dev_queue_xmit() to bool correctlyJiri Pirko
The thing is that team_dev_queue_xmit() returns NET_XMIT_* or -E*. bc_trasmit() should return true in case all went well. So use ! to get correct retval from team_dev_queue_xmit() result. This bug caused iface statistics to be badly computed. This bug was introduced by: team: add broadcast mode (5fc889911a99043a97da1daa0d010ad72cbc3042) Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Jiri Pirko <jiri@resnulli.us> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-21Merge tag 'pinctrl-for-v3.7-late' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pinctrl fix from Linus Walleij: "A simple pinctrl Kconfig oneliner arriving late. Final (hopefully) oneliner for the pinctrl subsystem targeted at v3.7" * tag 'pinctrl-for-v3.7-late' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl/samsung: don't allow enabling pinctrl-samsung standalone
2012-11-21Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull selinux RCU fixlet from James Morris. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: selinux: fix sel_netnode_insert() suspicious rcu dereference
2012-11-21sign-file: fix the perl warning message when extracting ASN.1Chun-Yi Lee
There have the following warning message when running modules install for sign ko files: # make modules_install ... INSTALL drivers/input/touchscreen/pcap_ts.ko Found = in conditional, should be == at scripts/sign-file line 164. Found = in conditional, should be == at scripts/sign-file line 161. Found = in conditional, should be == at scripts/sign-file line 159. This patch change replace '=' by '==' in elsif conditions for avoid the above warning messages. Signed-off-by: Chun-Yi Lee <jlee@suse.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>