1. 18 Apr, 2014 11 commits
  2. 17 Apr, 2014 17 commits
  3. 16 Apr, 2014 12 commits
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 6ca2a88a
      Linus Torvalds authored
      Pull x86 fixes from Ingo Molnar:
       "Various fixes:
      
         - reboot regression fix
         - build message spam fix
         - GPU quirk fix
         - 'make kvmconfig' fix
      
        plus the wire-up of the renameat2() system call on i386"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86: Remove the PCI reboot method from the default chain
        x86/build: Supress "Nothing to be done for ..." messages
        x86/gpu: Fix sign extension issue in Intel graphics stolen memory quirks
        x86/platform: Fix "make O=dir kvmconfig"
        i386: Wire up the renameat2() syscall
      6ca2a88a
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 2a83dc7e
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "Tooling fixes, plus a simple hardware-enablement patch for the Intel
        RAPL PMU (energy use measurement) on Haswell CPUs, which I hope is
        still fine at this stage"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf tools: Instead of redirecting flex output, use -o
        perf tools: Fix double free in perf test 21 (code-reading.c)
        perf stat: Initialize statistics correctly
        perf bench: Set more defaults in the 'numa' suite
        perf bench: Fix segfault at the end of an 'all' execution
        perf bench: Update manpage to mention numa and futex
        perf probe: Use dwarf_getcfi_elf() instead of dwarf_getcfi()
        perf probe: Fix to handle errors in line_range searching
        perf probe: Fix --line option behavior
        perf tools: Pick up libdw without explicit LIBDW_DIR
        MAINTAINERS: Change e-mail to kernel.org one
        perf callchains: Disable unwind libraries when libelf isn't found
        tools lib traceevent: Do not call warning() directly
        tools lib traceevent: Print event name when show warning if possible
        perf top: Fix documentation of invalid -s option
        perf/x86: Enable DRAM RAPL support on Intel Haswell
      2a83dc7e
    • Linus Torvalds's avatar
      Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 17cf7db2
      Linus Torvalds authored
      Pull irq fix from Ingo Molnar:
       "ARM VIC (Vectored Irq Controller) irqchip driver fix"
      
      * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        irqchip: vic: Properly chain the cascaded IRQs
      17cf7db2
    • Linus Torvalds's avatar
      Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · d99d5917
      Linus Torvalds authored
      Pull locking fixes from Ingo Molnar:
       "liblockdep fixes and mutex debugging fixes"
      
      * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        locking/mutex: Fix debug_mutexes
        tools/liblockdep: Add proper versioning to the shared obj
        tools/liblockdep: Ignore asmlinkage and visible
      d99d5917
    • Steven Rostedt (Red Hat)'s avatar
      tracing: Do not try to recreated toplevel set_ftrace_* files · 5d6c97c5
      Steven Rostedt (Red Hat) authored
      With the restructing of the function tracer working with instances, the
      "top level" buffer is a bit special, as the function tracing is mapped
      to the same set of filters. This is done by using a "global_ops" descriptor
      and having the "set_ftrace_filter" and "set_ftrace_notrace" map to it.
      
      When an instance is created, it creates the same files but its for the
      local instance and not the global_ops.
      
      The issues is that the local instance creation shares some code with
      the global instance one and we end up trying to create th top level
      "set_ftrace_*" files twice, and on boot up, we get an error like this:
      
       Could not create debugfs 'set_ftrace_filter' entry
       Could not create debugfs 'set_ftrace_notrace' entry
      
      The reason they failed to be created was because they were created
      twice, and the second time gives this error as you can not create the
      same file twice.
      Reported-by: default avatarBorislav Petkov <bp@alien8.de>
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      5d6c97c5
    • Linus Torvalds's avatar
      Merge tag 'fbdev-fixes-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux · 498f9620
      Linus Torvalds authored
      Pull fbdev fixes from Tomi Valkeinen:
       - fix build errors for bf54x-lq043fb and imxfb
       - fbcon fix for da8xx-fb
       - omapdss fixes for hdmi audio, irq handling and fclk calculation
      
      * tag 'fbdev-fixes-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux:
        video: bf54x-lq043fb: fix build error
        OMAPDSS: Change struct reg_field to dispc_reg_field
        OMAPDSS: Take pixelclock unit change into account in hdmi_compute_acr()
        OMAPDSS: fix shared irq handlers
        video: imxfb: Select LCD_CLASS_DEVICE unconditionally
        OMAPDSS: fix rounding when calculating fclk rate
        video: da8xx-fb: Fix casting of info->pseudo_palette
      498f9620
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v3.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · 5f63517c
      Linus Torvalds authored
      Pull pincontrol fixes from Linus Walleij:
       "A first set of pin control fixes for the v3.15 series:
      
         - Fix a couple of barnsjukdomar on the Rockchip driver.
      
         - Remove an idiotic debug print I happened to leave behind in the
           Nomadik driver.
      
         - Fixup the Qualcomm MSM interrupt handling code for the TLMM v2.
      
         - Three patches renaming the Broadcom Capri driver to BCM28155.  This
           has been falling between the chairs for some time due to some
           cross-tree synchronization misunderstandings, now I'm fed up with
           this and just rename it in this -rc1 phase"
      
      * tag 'pinctrl-v3.15-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: fix typo in bindings documentation
        Update bcm_defconfig with new pinctrl CONFIG
        pinctrl: Rename Broadcom Capri pinctrl driver
        pinctrl: msm: Correct interrupt code for TLMM v2
        pinctrl: nomadik: delete stray debug print
        pinctrl: rockchip: handle first half of rk3188-bank0 correctly
        pinctrl: rockchip: add return value to rockchip_set_mux
        pinctrl: rockchip: fix offset of mux registers for rk3188
      5f63517c
    • Brian Foster's avatar
      xfs: fix tmpfile/selinux deadlock and initialize security · 330033d6
      Brian Foster authored
      xfstests generic/004 reproduces an ilock deadlock using the tmpfile
      interface when selinux is enabled. This occurs because
      xfs_create_tmpfile() takes the ilock and then calls d_tmpfile(). The
      latter eventually calls into xfs_xattr_get() which attempts to get the
      lock again. E.g.:
      
      xfs_io          D ffffffff81c134c0  4096  3561   3560 0x00000080
      ffff8801176a1a68 0000000000000046 ffff8800b401b540 ffff8801176a1fd8
      00000000001d5800 00000000001d5800 ffff8800b401b540 ffff8800b401b540
      ffff8800b73a6bd0 fffffffeffffffff ffff8800b73a6bd8 ffff8800b5ddb480
      Call Trace:
      [<ffffffff8177f969>] schedule+0x29/0x70
      [<ffffffff81783a65>] rwsem_down_read_failed+0xc5/0x120
      [<ffffffffa05aa97f>] ? xfs_ilock_attr_map_shared+0x1f/0x50 [xfs]
      [<ffffffff813b3434>] call_rwsem_down_read_failed+0x14/0x30
      [<ffffffff810ed179>] ? down_read_nested+0x89/0xa0
      [<ffffffffa05aa7f2>] ? xfs_ilock+0x122/0x250 [xfs]
      [<ffffffffa05aa7f2>] xfs_ilock+0x122/0x250 [xfs]
      [<ffffffffa05aa97f>] xfs_ilock_attr_map_shared+0x1f/0x50 [xfs]
      [<ffffffffa05701d0>] xfs_attr_get+0x90/0xe0 [xfs]
      [<ffffffffa0565e07>] xfs_xattr_get+0x37/0x50 [xfs]
      [<ffffffff8124842f>] generic_getxattr+0x4f/0x70
      [<ffffffff8133fd9e>] inode_doinit_with_dentry+0x1ae/0x650
      [<ffffffff81340e0c>] selinux_d_instantiate+0x1c/0x20
      [<ffffffff813351bb>] security_d_instantiate+0x1b/0x30
      [<ffffffff81237db0>] d_instantiate+0x50/0x70
      [<ffffffff81237e85>] d_tmpfile+0xb5/0xc0
      [<ffffffffa05add02>] xfs_create_tmpfile+0x362/0x410 [xfs]
      [<ffffffffa0559ac8>] xfs_vn_tmpfile+0x18/0x20 [xfs]
      [<ffffffff81230388>] path_openat+0x228/0x6a0
      [<ffffffff810230f9>] ? sched_clock+0x9/0x10
      [<ffffffff8105a427>] ? kvm_clock_read+0x27/0x40
      [<ffffffff8124054f>] ? __alloc_fd+0xaf/0x1f0
      [<ffffffff8123101a>] do_filp_open+0x3a/0x90
      [<ffffffff817845e7>] ? _raw_spin_unlock+0x27/0x40
      [<ffffffff8124054f>] ? __alloc_fd+0xaf/0x1f0
      [<ffffffff8121e3ce>] do_sys_open+0x12e/0x210
      [<ffffffff8121e4ce>] SyS_open+0x1e/0x20
      [<ffffffff8178eda9>] system_call_fastpath+0x16/0x1b
      
      xfs_vn_tmpfile() also fails to initialize security on the newly created
      inode.
      
      Pull the d_tmpfile() call up into xfs_vn_tmpfile() after the transaction
      has been committed and the inode unlocked. Also, initialize security on
      the inode based on the parent directory provided via the tmpfile call.
      Signed-off-by: default avatarBrian Foster <bfoster@redhat.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarDave Chinner <david@fromorbit.com>
      330033d6
    • Eric Sandeen's avatar
      xfs: fix buffer use after free on IO error · 8d6c1210
      Eric Sandeen authored
      When testing exhaustion of dm snapshots, the following appeared
      with CONFIG_DEBUG_OBJECTS_FREE enabled:
      
      ODEBUG: free active (active state 0) object type: work_struct hint: xfs_buf_iodone_work+0x0/0x1d0 [xfs]
      
      indicating that we'd freed a buffer which still had a pending reference,
      down this path:
      
      [  190.867975]  [<ffffffff8133e6fb>] debug_check_no_obj_freed+0x22b/0x270
      [  190.880820]  [<ffffffff811da1d0>] kmem_cache_free+0xd0/0x370
      [  190.892615]  [<ffffffffa02c5924>] xfs_buf_free+0xe4/0x210 [xfs]
      [  190.905629]  [<ffffffffa02c6167>] xfs_buf_rele+0xe7/0x270 [xfs]
      [  190.911770]  [<ffffffffa034c826>] xfs_trans_read_buf_map+0x7b6/0xac0 [xfs]
      
      At issue is the fact that if IO fails in xfs_buf_iorequest,
      we'll queue completion unconditionally, and then call
      xfs_buf_rele; but if IO failed, there are no IOs remaining,
      and xfs_buf_rele will free the bp while work is still queued.
      
      Fix this by not scheduling completion if the buffer has
      an error on it; run it immediately.  The rest is only comment
      changes.
      
      Thanks to dchinner for spotting the root cause.
      Signed-off-by: default avatarEric Sandeen <sandeen@redhat.com>
      Reviewed-by: default avatarBrian Foster <bfoster@redhat.com>
      Signed-off-by: default avatarDave Chinner <david@fromorbit.com>
      8d6c1210
    • Dave Chinner's avatar
      xfs: wrong error sign conversion during failed DIO writes · 07d5035a
      Dave Chinner authored
      We negate the error value being returned from a generic function
      incorrectly. The code path that it is running in returned negative
      errors, so there is no need to negate it to get the correct error
      signs here.
      
      This was uncovered by generic/019.
      Signed-off-by: default avatarDave Chinner <dchinner@redhat.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarDave Chinner <david@fromorbit.com>
      07d5035a
    • Dave Chinner's avatar
      xfs: unmount does not wait for shutdown during unmount · 9c23eccc
      Dave Chinner authored
      And interesting situation can occur if a log IO error occurs during
      the unmount of a filesystem. The cases reported have the same
      signature - the update of the superblock counters fails due to a log
      write IO error:
      
      XFS (dm-16): xfs_do_force_shutdown(0x2) called from line 1170 of file fs/xfs/xfs_log.c.  Return address = 0xffffffffa08a44a1
      XFS (dm-16): Log I/O Error Detected.  Shutting down filesystem
      XFS (dm-16): Unable to update superblock counters. Freespace may not be correct on next mount.
      XFS (dm-16): xfs_log_force: error 5 returned.
      XFS (¿-¿¿¿): Please umount the filesystem and rectify the problem(s)
      
      It can be seen that the last line of output contains a corrupt
      device name - this is because the log and xfs_mount structures have
      already been freed by the time this message is printed. A kernel
      oops closely follows.
      
      The issue is that the shutdown is occurring in a separate IO
      completion thread to the unmount. Once the shutdown processing has
      started and all the iclogs are marked with XLOG_STATE_IOERROR, the
      log shutdown code wakes anyone waiting on a log force so they can
      process the shutdown error. This wakes up the unmount code that
      is doing a synchronous transaction to update the superblock
      counters.
      
      The unmount path now sees all the iclogs are marked with
      XLOG_STATE_IOERROR and so never waits on them again, knowing that if
      it does, there will not be a wakeup trigger for it and we will hang
      the unmount if we do. Hence the unmount runs through all the
      remaining code and frees all the filesystem structures while the
      xlog_iodone() is still processing the shutdown. When the log
      shutdown processing completes, xfs_do_force_shutdown() emits the
      "Please umount the filesystem and rectify the problem(s)" message,
      and xlog_iodone() then aborts all the objects attached to the iclog.
      An iclog that has already been freed....
      
      The real issue here is that there is no serialisation point between
      the log IO and the unmount. We have serialisations points for log
      writes, log forces, reservations, etc, but we don't actually have
      any code that wakes for log IO to fully complete. We do that for all
      other types of object, so why not iclogbufs?
      
      Well, it turns out that we can easily do this. We've got xfs_buf
      handles, and that's what everyone else uses for IO serialisation.
      i.e. bp->b_sema. So, lets hold iclogbufs locked over IO, and only
      release the lock in xlog_iodone() when we are finished with the
      buffer. That way before we tear down the iclog, we can lock and
      unlock the buffer to ensure IO completion has finished completely
      before we tear it down.
      Signed-off-by: default avatarDave Chinner <dchinner@redhat.com>
      Tested-by: default avatarMike Snitzer <snitzer@redhat.com>
      Tested-by: default avatarBob Mastors <bob.mastors@solidfire.com>
      Reviewed-by: default avatarBrian Foster <bfoster@redhat.com>
      Signed-off-by: default avatarDave Chinner <david@fromorbit.com>
      9c23eccc
    • Dave Chinner's avatar
      xfs: collapse range is delalloc challenged · d39a2ced
      Dave Chinner authored
      FSX has been detecting data corruption after to collapse range
      calls. The key observation is that the offset of the last extent in
      the file was not being shifted, and hence when the file size was
      adjusted it was truncating away data because the extents handled
      been correctly shifted.
      
      Tracing indicated that before the collapse, the extent list looked
      like:
      
      ....
      ino 0x5788 state  idx 6 offset 26 block 195904 count 10 flag 0
      ino 0x5788 state  idx 7 offset 39 block 195917 count 35 flag 0
      ino 0x5788 state  idx 8 offset 86 block 195964 count 32 flag 0
      
      and after the shift of 2 blocks:
      
      ino 0x5788 state  idx 6 offset 24 block 195904 count 10 flag 0
      ino 0x5788 state  idx 7 offset 37 block 195917 count 35 flag 0
      ino 0x5788 state  idx 8 offset 86 block 195964 count 32 flag 0
      
      Note that the last extent did not change offset. After the changing
      of the file size:
      
      ino 0x5788 state  idx 6 offset 24 block 195904 count 10 flag 0
      ino 0x5788 state  idx 7 offset 37 block 195917 count 35 flag 0
      ino 0x5788 state  idx 8 offset 86 block 195964 count 30 flag 0
      
      You can see that the last extent had it's length truncated,
      indicating that we've lost data.
      
      The reason for this is that the xfs_bmap_shift_extents() loop uses
      XFS_IFORK_NEXTENTS() to determine how many extents are in the inode.
      This, unfortunately, doesn't take into account delayed allocation
      extents - it's a count of physically allocated extents - and hence
      when the file being collapsed has a delalloc extent like this one
      does prior to the range being collapsed:
      
      ....
      ino 0x5788 state  idx 4 offset 11 block 4503599627239429 count 1 flag 0
      ....
      
      it gets the count wrong and terminates the shift loop early.
      
      Fix it by using the in-memory extent array size that includes
      delayed allocation extents to determine the number of extents on the
      inode.
      Signed-off-by: default avatarDave Chinner <dchinner@redhat.com>
      Tested-by: default avatarBrian Foster <bfoster@redhat.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarDave Chinner <david@fromorbit.com>
      d39a2ced