1. 31 Aug, 2015 27 commits
  2. 03 Aug, 2015 7 commits
    • NeilBrown's avatar
      md/raid0: update queue parameter in a safer location. · 199dc6ed
      NeilBrown authored
      When a (e.g.) RAID5 array is reshaped to RAID0, the updating
      of queue parameters (e.g. max number of sectors per bio) is
      done in the wrong place.
      It should be part of ->run, but it is actually part of ->takeover.
      This means it happens before level_store() calls:
      
      	blk_set_stacking_limits(&mddev->queue->limits);
      
      and so it ineffective.  This can lead to errors from underlying
      devices.
      
      So move all the relevant settings out of create_stripe_zones()
      and into raid0_run().
      
      As this can lead to a bug-on it is suitable for any -stable
      kernel which supports reshape to RAID0.  So 2.6.35 or later.
      As the bug has been present for five years there is no urgency,
      so no need to rush into -stable.
      
      Fixes: 9af204cf ("md: Add support for Raid5->Raid0 and Raid10->Raid0 takeover")
      Cc: stable@vger.kernel.org (v2.6.35+ - please delay until after -final release).
      Reported-by: default avatarYi Zhang <yizhan@redhat.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.com>
      199dc6ed
    • Benjamin Randazzo's avatar
      md: simplify get_bitmap_file now that "file" is zeroed. · 25eafe1a
      Benjamin Randazzo authored
      There is no point assigning '\0' to file->pathname[0] as
      file is now zeroed out, so remove that branch and
      simplify the code.
      
      [Original patch combined this with the change to use
       kzalloc.  I split the two so that the change to kzalloc
       is easier to backport. - neilb]
      Signed-off-by: default avatarBenjamin Randazzo <benjamin@randazzo.fr>
      Signed-off-by: default avatarNeilBrown <neilb@suse.com>
      25eafe1a
    • NeilBrown's avatar
      md/raid5: don't let shrink_slab shrink too far. · 49895bcc
      NeilBrown authored
      I have a report of drop_one_stripe() called from
      raid5_cache_scan() apparently finding ->max_nr_stripes == 0.
      
      This should not be allowed.
      
      So add a test to keep max_nr_stripes above min_nr_stripes.
      
      Also use a 'mask' rather than a 'mod' in drop_one_stripe
      to ensure 'hash' is valid even if max_nr_stripes does reach zero.
      
      
      Fixes: edbe83ab ("md/raid5: allow the stripe_cache to grow and shrink.")
      Cc: stable@vger.kernel.org (4.1 - please release with 2d5b569b)
      Reported-by: default avatarTomas Papan <tomas.papan@gmail.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.com>
      49895bcc
    • Benjamin Randazzo's avatar
      md: use kzalloc() when bitmap is disabled · b6878d9e
      Benjamin Randazzo authored
      In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a
      mdu_bitmap_file_t called "file".
      
      5769         file = kmalloc(sizeof(*file), GFP_NOIO);
      5770         if (!file)
      5771                 return -ENOMEM;
      
      This structure is copied to user space at the end of the function.
      
      5786         if (err == 0 &&
      5787             copy_to_user(arg, file, sizeof(*file)))
      5788                 err = -EFAULT
      
      But if bitmap is disabled only the first byte of "file" is initialized
      with zero, so it's possible to read some bytes (up to 4095) of kernel
      space memory from user space. This is an information leak.
      
      5775         /* bitmap disabled, zero the first byte and copy out */
      5776         if (!mddev->bitmap_info.file)
      5777                 file->pathname[0] = '\0';
      Signed-off-by: default avatarBenjamin Randazzo <benjamin@randazzo.fr>
      Signed-off-by: default avatarNeilBrown <neilb@suse.com>
      b6878d9e
    • NeilBrown's avatar
      md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies · 423f04d6
      NeilBrown authored
      raid1_end_read_request() assumes that the In_sync bits are consistent
      with the ->degaded count.
      raid1_spare_active updates the In_sync bit before the ->degraded count
      and so exposes an inconsistency, as does error()
      So extend the spinlock in raid1_spare_active() and error() to hide those
      inconsistencies.
      
      This should probably be part of
        Commit: 34cab6f4 ("md/raid1: fix test for 'was read error from
        last working device'.")
      as it addresses the same issue.  It fixes the same bug and should go
      to -stable for same reasons.
      
      Fixes: 76073054 ("md/raid1: clean up read_balance.")
      Cc: stable@vger.kernel.org (v3.0+)
      Signed-off-by: default avatarNeilBrown <neilb@suse.com>
      423f04d6
    • Linus Torvalds's avatar
      Linux 4.2-rc5 · 74d33293
      Linus Torvalds authored
      74d33293
    • Linus Torvalds's avatar
      Merge tag 'powerpc-4.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · d08c3181
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
       - TCE table memory calculation fix from Alexey
       - Build fix for ans-lcd from Luis
       - Unbalanced IRQ warning fix from Alistair
      
      * tag 'powerpc-4.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/eeh-powernv: Fix unbalanced IRQ warning
        macintosh/ans-lcd: fix build failure after module_init/exit relocation
        powerpc/powernv/ioda2: Fix calculation for memory allocated for TCE table
      d08c3181
  3. 02 Aug, 2015 5 commits
    • Linus Torvalds's avatar
      i915: temporary fix for DP MST docking station NULL pointer dereference · 27667f47
      Linus Torvalds authored
      Ted Ts'o reports that his Lenovo T540p ThinkPad crashes at boot if
      attached to the docking station.  This is a regression that he was able
      to bisect to commit 8c7b5ccb: "drm/i915: Use atomic helpers for
      computing changed flags:"
      
      The reason seems to be the new call to drm_atomic_helper_check_modeset()
      added to intel_modeset_compute_config(), which in turn calls
      update_connector_routing(), and somehow ends up picking a NULL crtc for
      the connector state, causing the subsequent drm_crtc_index() to OOPS.
      
      Daniel Vetter says that the fundamental issue seems to be confusion in
      the encoder selection, and this isn't the right fix, but while he chases
      down the proper fix, this at least avoids the NULL pointer dereference
      and makes Ted's docking station work again.
      Reported-bisected-and-tested-by: default avatarTheodore Ts'o <tytso@mit.edu>
      Cc: Daniel Vetter <daniel.vetter@intel.com>
      Cc: Mani Nikula <jani.nikula@linux.intel.com>
      Cc: Dave Airlie <airlied@gmail.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      27667f47
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · d4edea40
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "A set of three fixes for the ipr driver and one fairly major one for
        memory leaks in the mq path of SCSI"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: fix memory leak with scsi-mq
        ipr: Fix invalid array indexing for HRRQ
        ipr: Fix incorrect trace indexing
        ipr: Fix locking for unit attention handling
      d4edea40
    • Linus Torvalds's avatar
      Merge tag 'armsoc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 30c7b56d
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "Things are calming down nicely here w.r.t. fixes.  This batch
        includes two week's worth since I missed to send before -rc4.
      
        Nothing particularly scary to point out, smaller fixes here and there.
        Shortlog describes it pretty well"
      
      * tag 'armsoc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: dts: keystone: fix dt bindings to use post div register for mainpll
        ARM: nomadik: disable UART0 on Nomadik boards
        ARM: dts: i.MX35: Fix can support.
        ARM: OMAP2+: hwmod: Fix _wait_target_ready() for hwmods without sysc
        ARM: dts: add CPU OPP and regulator supply property for exynos4210
        ARM: dts: Update video-phy node with syscon phandle for exynos3250
        ARM: DRA7: hwmod: fix gpmc hwmod
      30c7b56d
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 01183609
      Linus Torvalds authored
      Pull VFS fix from Al Viro:
       "Spurious ENOTDIR fix"
      
      This should fix the problems reported by Dominique Martinet and Hugh
      Dickins.
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        link_path_walk(): be careful when failing with ENOTDIR
      01183609
    • Al Viro's avatar
      link_path_walk(): be careful when failing with ENOTDIR · 97242f99
      Al Viro authored
      In RCU mode we might end up with dentry evicted just we check
      that it's a directory.  In such case we should return ECHILD
      rather than ENOTDIR, so that pathwalk would be retries in non-RCU
      mode.
      
      Breakage had been introduced in commit b18825a7 - prior to that
      we were looking at nd->inode, which had been fetched before
      verifying that ->d_seq was still valid.  That form of check
      would only be satisfied if at some point the pathname prefix
      would indeed have resolved to a non-directory.  The fix consists
      of checking ->d_seq after we'd run into a non-directory dentry,
      and failing with ECHILD in case of mismatch.
      
      Note that all branches since 3.12 have that problem...
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      97242f99
  4. 01 Aug, 2015 1 commit
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-4.2-rc5' of git://git.infradead.org/users/vkoul/slave-dma · 3f6d9e08
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
       "We had a regression due to reuse of descriptor so we have reverted
        that.
      
        The rest are driver fixes:
      
         - at_hdmac and at_xdmac for residue, trannfer width, and channel config
         - pl330 final fix for dma fails and overflow issue
         - xgene resouce map fix
         - mv_xor big endian op fix"
      
      * tag 'dmaengine-fix-4.2-rc5' of git://git.infradead.org/users/vkoul/slave-dma:
        Revert "dmaengine: virt-dma: don't always free descriptor upon completion"
        dmaengine: mv_xor: fix big endian operation in register mode
        dmaengine: xgene-dma: Fix the resource map to handle overlapping
        dmaengine: at_xdmac: fix transfer data width in at_xdmac_prep_slave_sg()
        dmaengine: at_hdmac: fix residue computation
        dmaengine: at_xdmac: fix bug about channel configuration
        dmaengine: pl330: Really fix choppy sound because of wrong residue calculation
        dmaengine: pl330: Fix overflow when reporting residue in memcpy
      3f6d9e08