1. 04 Jun, 2014 1 commit
  2. 02 Jun, 2014 5 commits
  3. 30 May, 2014 6 commits
  4. 27 May, 2014 4 commits
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2014-05-27' of git://anongit.freedesktop.org/drm-intel into drm-fixes · efb27e73
      Dave Airlie authored
      Fixes from Chris, all cc: stable.
      
      * tag 'drm-intel-fixes-2014-05-27' of git://anongit.freedesktop.org/drm-intel:
        drm/i915: Prevent negative relocation deltas from wrapping
        drm/i915: Only copy back the modified fields to userspace from execbuffer
        drm/i915: Fix dynamic allocation of physical handles
      efb27e73
    • Chris Wilson's avatar
      drm/i915: Prevent negative relocation deltas from wrapping · d23db88c
      Chris Wilson authored
      This is pure evil. Userspace, I'm looking at you SNA, repacks batch
      buffers on the fly after generation as they are being passed to the
      kernel for execution. These batches also contain self-referenced
      relocations as a single buffer encompasses the state commands, kernels,
      vertices and sampler. During generation the buffers are placed at known
      offsets within the full batch, and then the relocation deltas (as passed
      to the kernel) are tweaked as the batch is repacked into a smaller buffer.
      This means that userspace is passing negative relocations deltas, which
      subsequently wrap to large values if the batch is at a low address. The
      GPU hangs when it then tries to use the large value as a base for its
      address offsets, rather than wrapping back to the real value (as one
      would hope). As the GPU uses positive offsets from the base, we can
      treat the relocation address as the minimum address read by the GPU.
      For the upper bound, we trust that userspace will not read beyond the
      end of the buffer.
      
      So, how do we fix negative relocations from wrapping? We can either
      check that every relocation looks valid when we write it, and then
      position each object such that we prevent the offset wraparound, or we
      just special-case the self-referential behaviour of SNA and force all
      batches to be above 256k. Daniel prefers the latter approach.
      
      This fixes a GPU hang when it tries to use an address (relocation +
      offset) greater than the GTT size. The issue would occur quite easily
      with full-ppgtt as each fd gets its own VM space, so low offsets would
      often be handed out. However, with the rearrangement of the low GTT due
      to capturing the BIOS framebuffer, it is already affecting kernels 3.15
      onwards. I think only IVB+ is susceptible to this bug, but the workaround
      should only kick in rarely, so it seems sensible to always apply it.
      
      v3: Use a bias for batch buffers to prevent small negative delta relocations
      from wrapping.
      
      v4 from Daniel:
      - s/BIAS/BATCH_OFFSET_BIAS/
      - Extract eb_vma_misplaced/i915_vma_misplaced since the conditions
        were growing rather cumbersome.
      - Add a comment to eb_get_batch explaining why we do this.
      - Apply the batch offset bias everywhere but mention that we've only
        observed it on gen7 gpus.
      - Drop PIN_OFFSET_FIX for now, that slipped in from a feature patch.
      
      v5: Add static to eb_get_batch, spotted by 0-day tester.
      
      Testcase: igt/gem_bad_reloc
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=78533
      Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> (v3)
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      d23db88c
    • Chris Wilson's avatar
      drm/i915: Only copy back the modified fields to userspace from execbuffer · 9aab8bff
      Chris Wilson authored
      We only want to modifiy a single field in the userspace view of the
      execbuffer command buffer, so explicitly change that rather than copy
      everything back again.
      
      This serves two purposes:
      
      1. The single fields are much cheaper to copy (constant size so the
      copy uses special case code) and much smaller than the whole array.
      
      2. We modify the array for internal use that need to be masked from
      the user.
      
      Note: We need this backported since without it the next bugfix will
      blow up when userspace recycles batchbuffers and relocations.
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      9aab8bff
    • Chris Wilson's avatar
      drm/i915: Fix dynamic allocation of physical handles · 00731155
      Chris Wilson authored
      A single object may be referenced by multiple registers fundamentally
      breaking the static allotment of ids in the current design. When the
      object is used the second time, the physical address of the first
      assignment is relinquished and a second one granted. However, the
      hardware is still reading (and possibly writing) to the old physical
      address now returned to the system. Eventually hilarity will ensue, but
      in the short term, it just means that cursors are broken when using more
      than one pipe.
      
      v2: Fix up leak of pci handle when handling an error during attachment,
      and avoid a double kmap/kunmap. (Ville)
      Rebase against -fixes.
      
      v3: And fix the error handling added in v2 (Ville)
      
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=77351Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
      Cc: Jani Nikula <jani.nikula@linux.intel.com>
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      00731155
  5. 25 May, 2014 13 commits
  6. 23 May, 2014 11 commits
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fixes-3.15-rc5' of... · 03743007
      Linus Torvalds authored
      Merge tag 'dmaengine-fixes-3.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/dmaengine
      
      Pull dmaengine fixes from Dan Williams:
       "Two fixes for -stable:
      
         - async_mult() sometimes maps less buffers than initially requested.
            We end up freeing dmaengine_unmap_data on an invalid pool.
      
         - mv_xor: register write ordering fix"
      
      * tag 'dmaengine-fixes-3.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/dmaengine:
        dmaengine: fix dmaengine_unmap failure
        dma: mv_xor: Flush descriptors before activating a channel
      03743007
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · 1ee1ceaf
      Linus Torvalds authored
      Pull sparc fixes from David Miller:
       "A small bunch of bug fixes, in particular:
      
         1) On older cpus we need a different chunk of virtual address space
            to map the huge page TSB.
      
         2) Missing memory barrier in Niagara2 memcpy.
      
         3) trinity showed some places where fault validation was
            unnecessarily loud on sparc64
      
         4) Some sysfs printf's need a type adjustment, from Toralf Förster"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc64: fix format string mismatch in arch/sparc/kernel/sysfs.c
        sparc64: Add membar to Niagara2 memcpy code.
        sparc64: Fix huge TSB mapping on pre-UltraSPARC-III cpus.
        sparc64: Don't bark so loudly about 32-bit tasks generating 64-bit fault addresses.
      1ee1ceaf
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 5fa6a683
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "It looks like a sizeble collection but this is nearly 3 weeks of bug
        fixing while you were away.
      
         1) Fix crashes over IPSEC tunnels with NAT, the latter can reroute
            the packet through a non-IPSEC protected path and the code has to
            be able to handle SKBs attached to routes lacking an attached xfrm
            state.  From Steffen Klassert.
      
         2) Fix OOPSs in ipv4 and ipv6 ipsec layers for unsupported
            sub-protocols, also from Steffen Klassert.
      
         3) Set local_df on fragmented netfilter skbs otherwise we won't be
            able to forward successfully, from Florian Westphal.
      
         4) cdc_mbim ipv6 neighbour code does __vlan_find_dev_deep without
            holding RCU lock, from Bjorn Mork.
      
         5) local_df test in ip_may_fragment is inverted, from Florian
            Westphal.
      
         6) jme driver doesn't check for DMA mapping failures, from Neil
            Horman.
      
         7) qlogic driver doesn't calculate number of TX queues properly, from
            Shahed Shaikh.
      
         8) fib_info_cnt can drift irreversibly positive if we fail to
            allocate the fi->fib_metrics array, from Sergey Popovich.
      
         9) Fix use after free in ip6_route_me_harder(), also from Sergey
            Popovich.
      
        10) When SYSCTL is disabled, we don't handle local_port_range and
            ping_group_range defaults properly at all, from Cong Wang.
      
        11) Unaccelerated VLAN tagged frames improperly handled by cdc_mbim
            driver, fix from Bjorn Mork.
      
        12) cassini driver needs nested lock annotations for TX locking, from
            Emil Goode.
      
        13) On init error ipv6 VTI driver can unregister pernet ops twice,
            oops.  Fix from Mahtias Krause.
      
        14) If macvlan device is down, don't propagate IFF_ALLMULTI changes,
            from Peter Christensen.
      
        15) Missing NULL pointer check while parsing netlink config options in
            ip6_tnl_validate().  From Susant Sahani.
      
        16) Fix handling of neighbour entries during ipv6 router reachability
            probing, from Duan Jiong.
      
        17) x86 and s390 JIT address randomization has some address
            calculation bugs leading to crashes, from Alexei Starovoitov and
            Heiko Carstens.
      
        18) Clear up those uglies with nop patching and net_get_random_once(),
            from Hannes Frederic Sowa.
      
        19) Option length miscalculated in ip6_append_data(), fix also from
            Hannes Frederic Sowa.
      
        20) A while ago we fixed a race during device unregistry when a
            namespace went down, turns out there is a second place that needs
            similar protection.  From Cong Wang.
      
        21) In the new Altera TSE driver multicast filtering isn't working,
            disable it and just use promisc mode until the cause is found.
            From Vince Bridgers.
      
        22) When we disable router enabling in ipv6 we have to flush the
            cached routes explicitly, from Duan Jiong.
      
        23) NBMA tunnels should not cache routes on the tunnel object because
            the key is variable, from Timo Teräs.
      
        24) With stacked devices GRO information in skb->cb[] can be not setup
            properly, make sure it is in all code paths.  From Eric Dumazet.
      
        25) Really fix stacked vlan locking, multiple levels of nesting with
            intervening non-vlan devices are possible.  From Vlad Yasevich.
      
        26) Fallback ipip tunnel device's mtu is not setup properly, from
            Steffen Klassert.
      
        27) The packet scheduler's tcindex filter can crash because we
            structure copy objects with list_head's inside, oops.  From Cong
            Wang.
      
        28) Fix CHECKSUM_COMPLETE handling for ipv6 GRE tunnels, from Eric
            Dumazet.
      
        29) In some configurations 'itag' in __mkroute_input() can end up
            being used uninitialized because of how fib_validate_source()
            works.  Fix it by explitly initializing itag to zero like all the
            other fib_validate_source() callers do, from Li RongQing"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (116 commits)
        batman: fix a bogus warning from batadv_is_on_batman_iface()
        ipv4: initialise the itag variable in __mkroute_input
        bonding: Send ALB learning packets using the right source
        bonding: Don't assume 802.1Q when sending alb learning packets.
        net: doc: Update references to skb->rxhash
        stmmac: Remove unbalanced clk_disable call
        ipv6: gro: fix CHECKSUM_COMPLETE support
        net_sched: fix an oops in tcindex filter
        can: peak_pci: prevent use after free at netdev removal
        ip_tunnel: Initialize the fallback device properly
        vlan: Fix build error wth vlan_get_encap_level()
        can: c_can: remove obsolete STRICT_FRAME_ORDERING Kconfig option
        MAINTAINERS: Pravin Shelar is Open vSwitch maintainer.
        bnx2x: Convert return 0 to return rc
        bonding: Fix alb mode to only use first level vlans.
        bonding: Fix stacked device detection in arp monitoring
        macvlan: Fix lockdep warnings with stacked macvlan devices
        vlan: Fix lockdep warning with stacked vlan devices.
        net: Allow for more then a single subclass for netif_addr_lock
        net: Find the nesting level of a given device by type.
        ...
      5fa6a683
    • Linus Torvalds's avatar
      Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f02f79db
      Linus Torvalds authored
      Pull scheduler fixes from Ingo Molnar:
       "The biggest commit is an irqtime accounting loop latency fix, the rest
        are misc fixes all over the place: deadline scheduling, docs, numa,
        balancer and a bad to-idle latency fix"
      
      * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/numa: Initialize newidle balance stats in sd_numa_init()
        sched: Fix updating rq->max_idle_balance_cost and rq->next_balance in idle_balance()
        sched: Skip double execution of pick_next_task_fair()
        sched: Use CPUPRI_NR_PRIORITIES instead of MAX_RT_PRIO in cpupri check
        sched/deadline: Fix memory leak
        sched/deadline: Fix sched_yield() behavior
        sched: Sanitize irq accounting madness
        sched/docbook: Fix 'make htmldocs' warnings caused by missing description
      f02f79db
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · e6a32c3a
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "The biggest changes are fixes for races that kept triggering Trinity
        crashes, plus liblockdep build fixes and smaller misc fixes.
      
        The liblockdep bits in perf/urgent are a pull mistake - they should
        have been in locking/urgent - but by the time I noticed other commits
        were added and testing was done :-/ Sorry about that"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf: Fix a race between ring_buffer_detach() and ring_buffer_attach()
        perf: Prevent false warning in perf_swevent_add
        perf: Limit perf_event_attr::sample_period to 63 bits
        tools/liblockdep: Remove all build files when doing make clean
        tools/liblockdep: Build liblockdep from tools/Makefile
        perf/x86/intel: Fix Silvermont's event constraints
        perf: Fix perf_event_init_context()
        perf: Fix race in removing an event
      e6a32c3a
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 2b2d323a
      Linus Torvalds authored
      Pull drm radeon and nouveau fixes from Dave Airlie:
       "Fixes for the other big two.
      
        The radeon VCE one is large but it fixes some userspace triggerable
        issues, otherwise its blackscreens and oopses.
      
        Nouveau fixes a bleeding laptop panel issue when displayport is used
        sometimes"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/radeon/pm: don't allow debugfs/sysfs access when PX card is off (v2)
        drm/radeon: avoid segfault on device open when accel is not working.
        drm/radeon: fix typo in finding PLL params
        drm/radeon: fix register typo on si
        drm/radeon: fix buffer placement under memory pressure v2
        drm/radeon: fix page directory update size estimation
        drm/radeon: handle non-VGA class pci devices with ATRM
        drm/radeon: fix DCE83 check for mullins
        drm/radeon: check VCE relocation buffer range v3
        drm/radeon: also try GART for CPU accessed buffers
        drm/gf119-/disp: fix nasty bug which can clobber SOR0's clock setup
        drm/nvd9/therm: handle another kind of PWM fan
      2b2d323a
    • Linus Torvalds's avatar
      Merge branch 'akpm' (incoming from Andrew) · fc3ac5c7
      Linus Torvalds authored
      Merge misc fixes from Andrew Morton:
       "9 fixes"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        MAINTAINERS: add closing angle bracket to Vince Bridgers' email address
        Documentation: fix DOCBOOKS=... building
        ocfs2: fix double kmem_cache_destroy in dlm_init
        mm/memory-failure.c: fix memory leak by race between poison and unpoison
        wait: swap EXIT_ZOMBIE(Z) and EXIT_DEAD(X) chars in TASK_STATE_TO_CHAR_STR
        memcg: fix swapcache charge from kernel thread context
        mm: madvise: fix MADV_WILLNEED on shmem swapouts
        mm/filemap.c: avoid always dirtying mapping->flags on O_DIRECT
        hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage
      fc3ac5c7
    • Tobias Klauser's avatar
      MAINTAINERS: add closing angle bracket to Vince Bridgers' email address · 0d9327ab
      Tobias Klauser authored
      Signed-off-by: default avatarTobias Klauser <tklauser@distanz.ch>
      Cc: Vince Bridgers <vbridgers2013@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0d9327ab
    • Johannes Berg's avatar
      Documentation: fix DOCBOOKS=... building · e60cbeed
      Johannes Berg authored
      Prior to commit 42661299 ("[media] DocBook: Move all media docbook
      stuff into its own directory") it was possible to build only a single
      (or more) book(s) by calling, for example
      
          make htmldocs DOCBOOKS=80211.xml
      
      This now fails:
      
          cp: target `.../Documentation/DocBook//media_api' is not a directory
      
      Ignore errors from that copy to make this possible again.
      
      Fixes: 42661299 ("[media] DocBook: Move all media docbook stuff into its own directory")
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Acked-by: default avatarRandy Dunlap <rdunlap@xenotime.net>
      Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e60cbeed
    • Joseph Qi's avatar
      ocfs2: fix double kmem_cache_destroy in dlm_init · 66db6cfd
      Joseph Qi authored
      In dlm_init, if create dlm_lockname_cache failed in
      dlm_init_master_caches, it will destroy dlm_lockres_cache which created
      before twice.  And this will cause system die when loading modules.
      Signed-off-by: default avatarJoseph Qi <joseph.qi@huawei.com>
      Cc: Mark Fasheh <mfasheh@suse.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      66db6cfd
    • Naoya Horiguchi's avatar
      mm/memory-failure.c: fix memory leak by race between poison and unpoison · 3e030ecc
      Naoya Horiguchi authored
      When a memory error happens on an in-use page or (free and in-use)
      hugepage, the victim page is isolated with its refcount set to one.
      
      When you try to unpoison it later, unpoison_memory() calls put_page()
      for it twice in order to bring the page back to free page pool (buddy or
      free hugepage list).  However, if another memory error occurs on the
      page which we are unpoisoning, memory_failure() returns without
      releasing the refcount which was incremented in the same call at first,
      which results in memory leak and unconsistent num_poisoned_pages
      statistics.  This patch fixes it.
      Signed-off-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Cc: Andi Kleen <andi@firstfloor.org>
      Cc: <stable@vger.kernel.org>    [2.6.32+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      3e030ecc