1. 23 May, 2014 16 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc · 1ee1ceaf
      Linus Torvalds authored
      Pull sparc fixes from David Miller:
       "A small bunch of bug fixes, in particular:
      
         1) On older cpus we need a different chunk of virtual address space
            to map the huge page TSB.
      
         2) Missing memory barrier in Niagara2 memcpy.
      
         3) trinity showed some places where fault validation was
            unnecessarily loud on sparc64
      
         4) Some sysfs printf's need a type adjustment, from Toralf Förster"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
        sparc64: fix format string mismatch in arch/sparc/kernel/sysfs.c
        sparc64: Add membar to Niagara2 memcpy code.
        sparc64: Fix huge TSB mapping on pre-UltraSPARC-III cpus.
        sparc64: Don't bark so loudly about 32-bit tasks generating 64-bit fault addresses.
      1ee1ceaf
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 5fa6a683
      Linus Torvalds authored
      Pull networking fixes from David Miller:
       "It looks like a sizeble collection but this is nearly 3 weeks of bug
        fixing while you were away.
      
         1) Fix crashes over IPSEC tunnels with NAT, the latter can reroute
            the packet through a non-IPSEC protected path and the code has to
            be able to handle SKBs attached to routes lacking an attached xfrm
            state.  From Steffen Klassert.
      
         2) Fix OOPSs in ipv4 and ipv6 ipsec layers for unsupported
            sub-protocols, also from Steffen Klassert.
      
         3) Set local_df on fragmented netfilter skbs otherwise we won't be
            able to forward successfully, from Florian Westphal.
      
         4) cdc_mbim ipv6 neighbour code does __vlan_find_dev_deep without
            holding RCU lock, from Bjorn Mork.
      
         5) local_df test in ip_may_fragment is inverted, from Florian
            Westphal.
      
         6) jme driver doesn't check for DMA mapping failures, from Neil
            Horman.
      
         7) qlogic driver doesn't calculate number of TX queues properly, from
            Shahed Shaikh.
      
         8) fib_info_cnt can drift irreversibly positive if we fail to
            allocate the fi->fib_metrics array, from Sergey Popovich.
      
         9) Fix use after free in ip6_route_me_harder(), also from Sergey
            Popovich.
      
        10) When SYSCTL is disabled, we don't handle local_port_range and
            ping_group_range defaults properly at all, from Cong Wang.
      
        11) Unaccelerated VLAN tagged frames improperly handled by cdc_mbim
            driver, fix from Bjorn Mork.
      
        12) cassini driver needs nested lock annotations for TX locking, from
            Emil Goode.
      
        13) On init error ipv6 VTI driver can unregister pernet ops twice,
            oops.  Fix from Mahtias Krause.
      
        14) If macvlan device is down, don't propagate IFF_ALLMULTI changes,
            from Peter Christensen.
      
        15) Missing NULL pointer check while parsing netlink config options in
            ip6_tnl_validate().  From Susant Sahani.
      
        16) Fix handling of neighbour entries during ipv6 router reachability
            probing, from Duan Jiong.
      
        17) x86 and s390 JIT address randomization has some address
            calculation bugs leading to crashes, from Alexei Starovoitov and
            Heiko Carstens.
      
        18) Clear up those uglies with nop patching and net_get_random_once(),
            from Hannes Frederic Sowa.
      
        19) Option length miscalculated in ip6_append_data(), fix also from
            Hannes Frederic Sowa.
      
        20) A while ago we fixed a race during device unregistry when a
            namespace went down, turns out there is a second place that needs
            similar protection.  From Cong Wang.
      
        21) In the new Altera TSE driver multicast filtering isn't working,
            disable it and just use promisc mode until the cause is found.
            From Vince Bridgers.
      
        22) When we disable router enabling in ipv6 we have to flush the
            cached routes explicitly, from Duan Jiong.
      
        23) NBMA tunnels should not cache routes on the tunnel object because
            the key is variable, from Timo Teräs.
      
        24) With stacked devices GRO information in skb->cb[] can be not setup
            properly, make sure it is in all code paths.  From Eric Dumazet.
      
        25) Really fix stacked vlan locking, multiple levels of nesting with
            intervening non-vlan devices are possible.  From Vlad Yasevich.
      
        26) Fallback ipip tunnel device's mtu is not setup properly, from
            Steffen Klassert.
      
        27) The packet scheduler's tcindex filter can crash because we
            structure copy objects with list_head's inside, oops.  From Cong
            Wang.
      
        28) Fix CHECKSUM_COMPLETE handling for ipv6 GRE tunnels, from Eric
            Dumazet.
      
        29) In some configurations 'itag' in __mkroute_input() can end up
            being used uninitialized because of how fib_validate_source()
            works.  Fix it by explitly initializing itag to zero like all the
            other fib_validate_source() callers do, from Li RongQing"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (116 commits)
        batman: fix a bogus warning from batadv_is_on_batman_iface()
        ipv4: initialise the itag variable in __mkroute_input
        bonding: Send ALB learning packets using the right source
        bonding: Don't assume 802.1Q when sending alb learning packets.
        net: doc: Update references to skb->rxhash
        stmmac: Remove unbalanced clk_disable call
        ipv6: gro: fix CHECKSUM_COMPLETE support
        net_sched: fix an oops in tcindex filter
        can: peak_pci: prevent use after free at netdev removal
        ip_tunnel: Initialize the fallback device properly
        vlan: Fix build error wth vlan_get_encap_level()
        can: c_can: remove obsolete STRICT_FRAME_ORDERING Kconfig option
        MAINTAINERS: Pravin Shelar is Open vSwitch maintainer.
        bnx2x: Convert return 0 to return rc
        bonding: Fix alb mode to only use first level vlans.
        bonding: Fix stacked device detection in arp monitoring
        macvlan: Fix lockdep warnings with stacked macvlan devices
        vlan: Fix lockdep warning with stacked vlan devices.
        net: Allow for more then a single subclass for netif_addr_lock
        net: Find the nesting level of a given device by type.
        ...
      5fa6a683
    • Linus Torvalds's avatar
      Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f02f79db
      Linus Torvalds authored
      Pull scheduler fixes from Ingo Molnar:
       "The biggest commit is an irqtime accounting loop latency fix, the rest
        are misc fixes all over the place: deadline scheduling, docs, numa,
        balancer and a bad to-idle latency fix"
      
      * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/numa: Initialize newidle balance stats in sd_numa_init()
        sched: Fix updating rq->max_idle_balance_cost and rq->next_balance in idle_balance()
        sched: Skip double execution of pick_next_task_fair()
        sched: Use CPUPRI_NR_PRIORITIES instead of MAX_RT_PRIO in cpupri check
        sched/deadline: Fix memory leak
        sched/deadline: Fix sched_yield() behavior
        sched: Sanitize irq accounting madness
        sched/docbook: Fix 'make htmldocs' warnings caused by missing description
      f02f79db
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · e6a32c3a
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "The biggest changes are fixes for races that kept triggering Trinity
        crashes, plus liblockdep build fixes and smaller misc fixes.
      
        The liblockdep bits in perf/urgent are a pull mistake - they should
        have been in locking/urgent - but by the time I noticed other commits
        were added and testing was done :-/ Sorry about that"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf: Fix a race between ring_buffer_detach() and ring_buffer_attach()
        perf: Prevent false warning in perf_swevent_add
        perf: Limit perf_event_attr::sample_period to 63 bits
        tools/liblockdep: Remove all build files when doing make clean
        tools/liblockdep: Build liblockdep from tools/Makefile
        perf/x86/intel: Fix Silvermont's event constraints
        perf: Fix perf_event_init_context()
        perf: Fix race in removing an event
      e6a32c3a
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 2b2d323a
      Linus Torvalds authored
      Pull drm radeon and nouveau fixes from Dave Airlie:
       "Fixes for the other big two.
      
        The radeon VCE one is large but it fixes some userspace triggerable
        issues, otherwise its blackscreens and oopses.
      
        Nouveau fixes a bleeding laptop panel issue when displayport is used
        sometimes"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/radeon/pm: don't allow debugfs/sysfs access when PX card is off (v2)
        drm/radeon: avoid segfault on device open when accel is not working.
        drm/radeon: fix typo in finding PLL params
        drm/radeon: fix register typo on si
        drm/radeon: fix buffer placement under memory pressure v2
        drm/radeon: fix page directory update size estimation
        drm/radeon: handle non-VGA class pci devices with ATRM
        drm/radeon: fix DCE83 check for mullins
        drm/radeon: check VCE relocation buffer range v3
        drm/radeon: also try GART for CPU accessed buffers
        drm/gf119-/disp: fix nasty bug which can clobber SOR0's clock setup
        drm/nvd9/therm: handle another kind of PWM fan
      2b2d323a
    • Linus Torvalds's avatar
      Merge branch 'akpm' (incoming from Andrew) · fc3ac5c7
      Linus Torvalds authored
      Merge misc fixes from Andrew Morton:
       "9 fixes"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        MAINTAINERS: add closing angle bracket to Vince Bridgers' email address
        Documentation: fix DOCBOOKS=... building
        ocfs2: fix double kmem_cache_destroy in dlm_init
        mm/memory-failure.c: fix memory leak by race between poison and unpoison
        wait: swap EXIT_ZOMBIE(Z) and EXIT_DEAD(X) chars in TASK_STATE_TO_CHAR_STR
        memcg: fix swapcache charge from kernel thread context
        mm: madvise: fix MADV_WILLNEED on shmem swapouts
        mm/filemap.c: avoid always dirtying mapping->flags on O_DIRECT
        hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage
      fc3ac5c7
    • Tobias Klauser's avatar
      MAINTAINERS: add closing angle bracket to Vince Bridgers' email address · 0d9327ab
      Tobias Klauser authored
      Signed-off-by: default avatarTobias Klauser <tklauser@distanz.ch>
      Cc: Vince Bridgers <vbridgers2013@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0d9327ab
    • Johannes Berg's avatar
      Documentation: fix DOCBOOKS=... building · e60cbeed
      Johannes Berg authored
      Prior to commit 42661299 ("[media] DocBook: Move all media docbook
      stuff into its own directory") it was possible to build only a single
      (or more) book(s) by calling, for example
      
          make htmldocs DOCBOOKS=80211.xml
      
      This now fails:
      
          cp: target `.../Documentation/DocBook//media_api' is not a directory
      
      Ignore errors from that copy to make this possible again.
      
      Fixes: 42661299 ("[media] DocBook: Move all media docbook stuff into its own directory")
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Acked-by: default avatarRandy Dunlap <rdunlap@xenotime.net>
      Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e60cbeed
    • Joseph Qi's avatar
      ocfs2: fix double kmem_cache_destroy in dlm_init · 66db6cfd
      Joseph Qi authored
      In dlm_init, if create dlm_lockname_cache failed in
      dlm_init_master_caches, it will destroy dlm_lockres_cache which created
      before twice.  And this will cause system die when loading modules.
      Signed-off-by: default avatarJoseph Qi <joseph.qi@huawei.com>
      Cc: Mark Fasheh <mfasheh@suse.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      66db6cfd
    • Naoya Horiguchi's avatar
      mm/memory-failure.c: fix memory leak by race between poison and unpoison · 3e030ecc
      Naoya Horiguchi authored
      When a memory error happens on an in-use page or (free and in-use)
      hugepage, the victim page is isolated with its refcount set to one.
      
      When you try to unpoison it later, unpoison_memory() calls put_page()
      for it twice in order to bring the page back to free page pool (buddy or
      free hugepage list).  However, if another memory error occurs on the
      page which we are unpoisoning, memory_failure() returns without
      releasing the refcount which was incremented in the same call at first,
      which results in memory leak and unconsistent num_poisoned_pages
      statistics.  This patch fixes it.
      Signed-off-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Cc: Andi Kleen <andi@firstfloor.org>
      Cc: <stable@vger.kernel.org>    [2.6.32+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      3e030ecc
    • Masatake YAMATO's avatar
      wait: swap EXIT_ZOMBIE(Z) and EXIT_DEAD(X) chars in TASK_STATE_TO_CHAR_STR · ad0f614e
      Masatake YAMATO authored
      In commit ad86622b ("wait: swap EXIT_ZOMBIE and EXIT_DEAD to hide
      EXIT_TRACE from user-space") the order of task state definitions were
      changed: EXIT_DEAD and EXIT_ZOMBIE were swapped.  Though the charterers
      for the states in TASK_STATE_TO_CHAR_STR string were not updated.  This
      patch synchronizes the string to the order of definitions.
      Signed-off-by: default avatarMasatake YAMATO <yamato@redhat.com>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ad0f614e
    • Michal Hocko's avatar
      memcg: fix swapcache charge from kernel thread context · 6f6acb00
      Michal Hocko authored
      Commit 284f39af ("mm: memcg: push !mm handling out to page cache
      charge function") explicitly checks for page cache charges without any
      mm context (from kernel thread context[1]).
      
      This seemed to be the only possible case where memory could be charged
      without mm context so commit 03583f1a ("memcg: remove unnecessary
      !mm check from try_get_mem_cgroup_from_mm()") removed the mm check from
      get_mem_cgroup_from_mm().  This however caused another NULL ptr
      dereference during early boot when loopback kernel thread splices to
      tmpfs as reported by Stephan Kulow:
      
        BUG: unable to handle kernel NULL pointer dereference at 0000000000000360
        IP: get_mem_cgroup_from_mm.isra.42+0x2b/0x60
        Oops: 0000 [#1] SMP
        Modules linked in: btrfs dm_multipath dm_mod scsi_dh multipath raid10 raid456 async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx raid1 raid0 md_mod parport_pc parport nls_utf8 isofs usb_storage iscsi_ibft iscsi_boot_sysfs arc4 ecb fan thermal nfs lockd fscache nls_iso8859_1 nls_cp437 sg st hid_generic usbhid af_packet sunrpc sr_mod cdrom ata_generic uhci_hcd virtio_net virtio_blk ehci_hcd usbcore ata_piix floppy processor button usb_common virtio_pci virtio_ring virtio edd squashfs loop ppa]
        CPU: 0 PID: 97 Comm: loop1 Not tainted 3.15.0-rc5-5-default #1
        Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
        Call Trace:
          __mem_cgroup_try_charge_swapin+0x40/0xe0
          mem_cgroup_charge_file+0x8b/0xd0
          shmem_getpage_gfp+0x66b/0x7b0
          shmem_file_splice_read+0x18f/0x430
          splice_direct_to_actor+0xa2/0x1c0
          do_lo_receive+0x5a/0x60 [loop]
          loop_thread+0x298/0x720 [loop]
          kthread+0xc6/0xe0
          ret_from_fork+0x7c/0xb0
      
      Also Branimir Maksimovic reported the following oops which is tiggered
      for the swapcache charge path from the accounting code for kernel threads:
      
        CPU: 1 PID: 160 Comm: kworker/u8:5 Tainted: P           OE 3.15.0-rc5-core2-custom #159
        Hardware name: System manufacturer System Product Name/MAXIMUSV GENE, BIOS 1903 08/19/2013
        task: ffff880404e349b0 ti: ffff88040486a000 task.ti: ffff88040486a000
        RIP: get_mem_cgroup_from_mm.isra.42+0x2b/0x60
        Call Trace:
          __mem_cgroup_try_charge_swapin+0x45/0xf0
          mem_cgroup_charge_file+0x9c/0xe0
          shmem_getpage_gfp+0x62c/0x770
          shmem_write_begin+0x38/0x40
          generic_perform_write+0xc5/0x1c0
          __generic_file_aio_write+0x1d1/0x3f0
          generic_file_aio_write+0x4f/0xc0
          do_sync_write+0x5a/0x90
          do_acct_process+0x4b1/0x550
          acct_process+0x6d/0xa0
          do_exit+0x827/0xa70
          kthread+0xc3/0xf0
      
      This patch fixes the issue by reintroducing mm check into
      get_mem_cgroup_from_mm.  We could do the same trick in
      __mem_cgroup_try_charge_swapin as we do for the regular page cache path
      but it is not worth troubles.  The check is not that expensive and it is
      better to have get_mem_cgroup_from_mm more robust.
      
      [1] - http://marc.info/?l=linux-mm&m=139463617808941&w=2
      
      Fixes: 03583f1a ("memcg: remove unnecessary !mm check from try_get_mem_cgroup_from_mm()")
      Reported-and-tested-by: default avatarStephan Kulow <coolo@suse.com>
      Reported-by: default avatarBranimir Maksimovic <branimir.maksimovic@gmail.com>
      Signed-off-by: default avatarMichal Hocko <mhocko@suse.cz>
      Acked-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Cc: Hugh Dickins <hughd@google.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6f6acb00
    • Johannes Weiner's avatar
      mm: madvise: fix MADV_WILLNEED on shmem swapouts · 55231e5c
      Johannes Weiner authored
      MADV_WILLNEED currently does not read swapped out shmem pages back in.
      
      Commit 0cd6144a ("mm + fs: prepare for non-page entries in page
      cache radix trees") made find_get_page() filter exceptional radix tree
      entries but failed to convert all find_get_page() callers that WANT
      exceptional entries over to find_get_entry().  One of them is shmem swap
      readahead in madvise, which now skips over any swap-out records.
      
      Convert it to find_get_entry().
      
      Fixes: 0cd6144a ("mm + fs: prepare for non-page entries in page cache radix trees")
      Signed-off-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Reported-by: default avatarHugh Dickins <hughd@google.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      55231e5c
    • Jens Axboe's avatar
      mm/filemap.c: avoid always dirtying mapping->flags on O_DIRECT · 7fcbbaf1
      Jens Axboe authored
      In some testing I ran today (some fio jobs that spread over two nodes),
      we end up spending 40% of the time in filemap_check_errors().  That
      smells fishy.  Looking further, this is basically what happens:
      
      blkdev_aio_read()
          generic_file_aio_read()
              filemap_write_and_wait_range()
                  if (!mapping->nr_pages)
                      filemap_check_errors()
      
      and filemap_check_errors() always attempts two test_and_clear_bit() on
      the mapping flags, thus dirtying it for every single invocation.  The
      patch below tests each of these bits before clearing them, avoiding this
      issue.  In my test case (4-socket box), performance went from 1.7M IOPS
      to 4.0M IOPS.
      Signed-off-by: default avatarJens Axboe <axboe@fb.com>
      Acked-by: default avatarJeff Moyer <jmoyer@redhat.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7fcbbaf1
    • Chen Yucong's avatar
      hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage · b985194c
      Chen Yucong authored
      For handling a free hugepage in memory failure, the race will happen if
      another thread hwpoisoned this hugepage concurrently.  So we need to
      check PageHWPoison instead of !PageHWPoison.
      
      If hwpoison_filter(p) returns true or a race happens, then we need to
      unlock_page(hpage).
      Signed-off-by: default avatarChen Yucong <slaoub@gmail.com>
      Reviewed-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Tested-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Reviewed-by: default avatarAndi Kleen <ak@linux.intel.com>
      Cc: <stable@vger.kernel.org>	[2.6.36+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b985194c
    • Linus Torvalds's avatar
      parisc: 'renameat2()' doesn't need (or have) a separate compat system call · 9abd09ac
      Linus Torvalds authored
      The 'renameat2()' system call was incorrectly added as a ENTRY_COMP() in
      the parisc system call table by commit 18e480aa ("parisc: add
      renameat2 syscall").  That causes a link-time error due to there not
      being any compat version of that system call:
      
        arch/parisc/kernel/built-in.o: In function `sys_call_table':
        (.rodata+0xad0): undefined reference to `compat_sys_renameat2'
        make: *** [vmlinux] Error 1
      
      Easily fixed by marking the system call as being the same for compat as
      for native by using ENTRY_SAME() instead of ENTRY_COMP().
      Reported-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Acked-by: default avatarMiklos Szeredi <miklos@szeredi.hu>
      Acked-by: default avatarHelge Deller <deller@gmx.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      9abd09ac
  2. 22 May, 2014 7 commits
  3. 21 May, 2014 17 commits
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-3.15' of git://people.freedesktop.org/~deathsimple/linux into drm-fixes · 77c01bef
      Dave Airlie authored
      radeon fixes, VCE one is big but does fix a userspace crash.
      
      * 'drm-fixes-3.15' of git://people.freedesktop.org/~deathsimple/linux:
        drm/radeon/pm: don't allow debugfs/sysfs access when PX card is off (v2)
        drm/radeon: avoid segfault on device open when accel is not working.
        drm/radeon: fix typo in finding PLL params
        drm/radeon: fix register typo on si
        drm/radeon: fix buffer placement under memory pressure v2
        drm/radeon: fix page directory update size estimation
        drm/radeon: handle non-VGA class pci devices with ATRM
        drm/radeon: fix DCE83 check for mullins
        drm/radeon: check VCE relocation buffer range v3
        drm/radeon: also try GART for CPU accessed buffers
      77c01bef
    • Dave Airlie's avatar
      Merge branch 'drm-nouveau-next' of... · 763b2573
      Dave Airlie authored
      Merge branch 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes
      
      fixes nasty panel bleeding bug.
      
      * 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
        drm/gf119-/disp: fix nasty bug which can clobber SOR0's clock setup
        drm/nvd9/therm: handle another kind of PWM fan
      763b2573
    • Linus Torvalds's avatar
      Linux 3.15-rc6 · 4b660a7f
      Linus Torvalds authored
      4b660a7f
    • Eric Dumazet's avatar
      ipv6: gro: fix CHECKSUM_COMPLETE support · 4de462ab
      Eric Dumazet authored
      When GRE support was added in linux-3.14, CHECKSUM_COMPLETE handling
      broke on GRE+IPv6 because we did not update/use the appropriate csum :
      
      GRO layer is supposed to use/update NAPI_GRO_CB(skb)->csum instead of
      skb->csum
      
      Tested using a GRE tunnel and IPv6 traffic. GRO aggregation now happens
      at the first level (ethernet device) instead of being done in gre
      tunnel. Native IPv6+TCP is still properly aggregated.
      
      Fixes: bf5a755f ("net-gre-gro: Add GRE support to the GRO stack")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Jerry Chu <hkchu@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4de462ab
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc · 6538d625
      Linus Torvalds authored
      Pull two powerpc fixes from Ben Herrenschmidt:
       "Here are a couple of fixes for 3.15.  One from Anton fixes a nasty
        regression I introduced when trying to fix a loss of irq_work whose
        consequences is that we can completely lose timer interrupts on a
        CPU... not pretty.
      
        The other one is a change to our PCIe reset hook to use a firmware
        call instead of direct config space accesses to trigger a fundamental
        reset on the root port.  This is necessary so that the FW gets a
        chance to disable the link down error monitoring, which would
        otherwise trip and cause subsequent fatal EEH error"
      
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
        powerpc: irq work racing with timer interrupt can result in timer interrupt hang
        powerpc/powernv: Reset root port in firmware
      6538d625
    • Cong Wang's avatar
      net_sched: fix an oops in tcindex filter · bf63ac73
      Cong Wang authored
      Kelly reported the following crash:
      
              IP: [<ffffffff817a993d>] tcf_action_exec+0x46/0x90
              PGD 3009067 PUD 300c067 PMD 11ff30067 PTE 800000011634b060
              Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
              CPU: 1 PID: 639 Comm: dhclient Not tainted 3.15.0-rc4+ #342
              Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
              task: ffff8801169ecd00 ti: ffff8800d21b8000 task.ti: ffff8800d21b8000
              RIP: 0010:[<ffffffff817a993d>]  [<ffffffff817a993d>] tcf_action_exec+0x46/0x90
              RSP: 0018:ffff8800d21b9b90  EFLAGS: 00010283
              RAX: 00000000ffffffff RBX: ffff88011634b8e8 RCX: ffff8800cf7133d8
              RDX: ffff88011634b900 RSI: ffff8800cf7133e0 RDI: ffff8800d210f840
              RBP: ffff8800d21b9bb0 R08: ffffffff8287bf60 R09: 0000000000000001
              R10: ffff8800d2b22b24 R11: 0000000000000001 R12: ffff8800d210f840
              R13: ffff8800d21b9c50 R14: ffff8800cf7133e0 R15: ffff8800cad433d8
              FS:  00007f49723e1840(0000) GS:ffff88011a800000(0000) knlGS:0000000000000000
              CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
              CR2: ffff88011634b8f0 CR3: 00000000ce469000 CR4: 00000000000006e0
              Stack:
               ffff8800d2170188 ffff8800d210f840 ffff8800d2171b90 0000000000000000
               ffff8800d21b9be8 ffffffff817c55bb ffff8800d21b9c50 ffff8800d2171b90
               ffff8800d210f840 ffff8800d21b0300 ffff8800d21b9c50 ffff8800d21b9c18
              Call Trace:
               [<ffffffff817c55bb>] tcindex_classify+0x88/0x9b
               [<ffffffff817a7f7d>] tc_classify_compat+0x3e/0x7b
               [<ffffffff817a7fdf>] tc_classify+0x25/0x9f
               [<ffffffff817b0e68>] htb_enqueue+0x55/0x27a
               [<ffffffff817b6c2e>] dsmark_enqueue+0x165/0x1a4
               [<ffffffff81775642>] __dev_queue_xmit+0x35e/0x536
               [<ffffffff8177582a>] dev_queue_xmit+0x10/0x12
               [<ffffffff818f8ecd>] packet_sendmsg+0xb26/0xb9a
               [<ffffffff810b1507>] ? __lock_acquire+0x3ae/0xdf3
               [<ffffffff8175cf08>] __sock_sendmsg_nosec+0x25/0x27
               [<ffffffff8175d916>] sock_aio_write+0xd0/0xe7
               [<ffffffff8117d6b8>] do_sync_write+0x59/0x78
               [<ffffffff8117d84d>] vfs_write+0xb5/0x10a
               [<ffffffff8117d96a>] SyS_write+0x49/0x7f
               [<ffffffff8198e212>] system_call_fastpath+0x16/0x1b
      
      This is because we memcpy struct tcindex_filter_result which contains
      struct tcf_exts, obviously struct list_head can not be simply copied.
      This is a regression introduced by commit 33be6271
      (net_sched: act: use standard struct list_head).
      
      It's not very easy to fix it as the code is a mess:
      
             if (old_r)
                     memcpy(&cr, r, sizeof(cr));
             else {
                     memset(&cr, 0, sizeof(cr));
                     tcf_exts_init(&cr.exts, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
             }
             ...
             tcf_exts_change(tp, &cr.exts, &e);
             ...
             memcpy(r, &cr, sizeof(cr));
      
      the above code should equal to:
      
              tcindex_filter_result_init(&cr);
              if (old_r)
                     cr.res = r->res;
              ...
              if (old_r)
                     tcf_exts_change(tp, &r->exts, &e);
              else
                     tcf_exts_change(tp, &cr.exts, &e);
              ...
              r->res = cr.res;
      
      after this change, since there is no need to copy struct tcf_exts.
      
      And it also fixes other places zero'ing struct's contains struct tcf_exts.
      
      Fixes: commit 33be6271 (net_sched: act: use standard struct list_head)
      Reported-by: default avatarKelly Anderson <kelly@xilka.com>
      Tested-by: default avatarKelly Anderson <kelly@xilka.com>
      Cc: David S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bf63ac73
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 11da37b2
      Linus Torvalds authored
      Pull two btrfs fixes from Chris Mason:
       "This has two fixes that we've been testing for 3.16, but since both
        are safe and fix real bugs, it makes sense to send for 3.15 instead"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: send, fix incorrect ref access when using extrefs
        Btrfs: fix EIO on reading file after ioctl clone works on it
      11da37b2
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client · 30625569
      Linus Torvalds authored
      Pull two ceph fixes from Sage Weil:
       "The first patch fixes a problem when we have a page count of 0 for
        sendpage which is triggered by zfs.  The second fixes a bug in CRUSH
        that was resolved in the userland code a while back but fell through
        the cracks on the kernel side"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
        crush: decode and initialize chooseleaf_vary_r
        libceph: fix corruption when using page_count 0 page in rbd
      30625569
    • Linus Torvalds's avatar
      Merge tag 'xfs-for-linus-3.15-rc6' of git://oss.sgi.com/xfs/xfs · 5e9d9fc4
      Linus Torvalds authored
      Pull xfs fixes from Dave Chinner:
       "Code inspection of the XFS error number sign translations found a
        bunch of issues, including returning incorrectly signed errors for
        some data integrity operations.
      
        These leak to userspace and result in applications not getting the
        errors correctly reported.  Hence they need fixing sooner rather than
        later.
      
        A couple of the bugs are in data integrity operations, a couple more
        are in the new COLLAPSE_RANGE code.  One of these came in through a
        recent ext4 merge and so I had to update the base tree to 3.15-rc5
        before fixing the issues"
      
      * tag 'xfs-for-linus-3.15-rc6' of git://oss.sgi.com/xfs/xfs:
        xfs: list_lru_init returns a negative error
        xfs: negate xfs_icsb_init_counters error value
        xfs: negate mount workqueue init error value
        xfs: fix wrong err sign on xfs_set_acl()
        xfs: fix wrong errno from xfs_initxattrs
        xfs: correct error sign on COLLAPSE_RANGE errors
        xfs: xfs_commit_metadata returns wrong errno
        xfs: fix incorrect error sign in xfs_file_aio_read
        xfs: xfs_dir_fsync() returns positive errno
      5e9d9fc4
    • Linus Torvalds's avatar
      Merge branch 'renameat2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs · 80932ec1
      Linus Torvalds authored
      Pull renameat2 arch support from Miklos Szeredi:
       "I've collected architecture patches for the renameat2 syscall that
        maintainers acked and/or asked me to queue.
      
        This adds architecture support for the renameat2 syscall to m68k,
        parisc, ia64 and through asm-generic to arc, arm64, c6x, hexagon,
        metag, openrisc, score, tile, unicore32"
      
      * 'renameat2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
        scripts/checksyscalls.sh: Make renameat optional
        asm-generic: Add renameat2 syscall
        ia64: add renameat2 syscall
        parisc: add renameat2 syscall
        m68k: add renameat2 syscall
      80932ec1
    • Toralf Förster's avatar
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v3.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 989d216f
      Linus Torvalds authored
      Pull iommu fixes from Joerg Roedel:
       "Three fixes for the AMD IOMMU driver:
         - fix a locking issue around get_user_pages()
         - fix two issues with device aliasing and exclusion range handling"
      
      * tag 'iommu-fixes-v3.15-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        iommu/amd: fix enabling exclusion range for an exact device
        iommu/amd: Take mmap_sem when calling get_user_pages
        iommu/amd: Fix interrupt remapping for aliased devices
      989d216f
    • Linus Torvalds's avatar
      Merge tag 'stable/for-linus-3.15-rc5-tag' of... · 677d1bb0
      Linus Torvalds authored
      Merge tag 'stable/for-linus-3.15-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft
      
      Pull iscsi_ibft fix from Konrad Rzeszutek Wilk:
       "Fix iBFT regression on Broadcom NICs introduced in 3.2"
      
      * tag 'stable/for-linus-3.15-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft:
        iscsi_ibft: Fix finding Broadcom specific ibft sign
      677d1bb0
    • Linus Torvalds's avatar
      Merge tag 'renesas-sh-drivers-for-v3.15' of... · f6ce579d
      Linus Torvalds authored
      Merge tag 'renesas-sh-drivers-for-v3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas
      
      Pull SH driver fix from Simon Horman:
       "Compile drivers/sh/pm_runtime.c if ARCH_SHMOBILE_MULTI
      
        This resolves a regression introduced in v3.14 by commit bf98c1ea
        ("ARM: Rename ARCH_SHMOBILE to ARCH_SHMOBILE_LEGACY")"
      
      * tag 'renesas-sh-drivers-for-v3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
        drivers: sh: compile drivers/sh/pm_runtime.c if ARCH_SHMOBILE_MULTI
      f6ce579d
    • Linus Torvalds's avatar
      Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media · fba69f04
      Linus Torvalds authored
      Pull media fixes from Mauro Carvalho Chehab:
       "Most of the changes are drivers fixes (rtl28xuu, fc2580, ov7670,
        davinci, gspca, s5p-fimc and s5c73m3).
      
        There is also a compat32 fix and one infoleak fixup at the media
        controller"
      
      * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
        [media] V4L2: fix VIDIOC_CREATE_BUFS in 64- / 32-bit compatibility mode
        [media] V4L2: ov7670: fix a wrong index, potentially Oopsing the kernel from user-space
        [media] media-device: fix infoleak in ioctl media_enum_entities()
        [media] fc2580: fix tuning failure on 32-bit arch
        [media] Prefer gspca_sonixb over sn9c102 for all devices
        [media] media: davinci: vpfe: make sure all the buffers unmapped and released
        [media] staging: media: davinci: vpfe: make sure all the buffers are released
        [media] media: davinci: vpbe_display: fix releasing of active buffers
        [media] media: davinci: vpif_display: fix releasing of active buffers
        [media] media: davinci: vpif_capture: fix releasing of active buffers
        [media] s5p-fimc: Fix YUV422P depth
        [media] s5c73m3: Add missing rename of v4l2_of_get_next_endpoint() function
        [media] rtl28xxu: silence error log about disabled rtl2832_sdr module
        [media] rtl28xxu: do not hard depend on staging SDR module
      fba69f04
    • Linus Torvalds's avatar
      Merge tag 'staging-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 84e12d99
      Linus Torvalds authored
      Pull staging driver fixes from Greg KH:
       "Here are five staging driver fixes for 3.15-rc6 that resolve some
        reported issues.  They are for the imx and rtl8723au drivers"
      
      * tag 'staging-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: rtl8723au: Do not reset wdev->iftype in netdev_close()
        staging: rtl8723au: Use correct pipe type for USB interrupts
        imx-drm: imx-tve: correct DDC property name to 'ddc-i2c-bus'
        imx-drm: imx-drm-core: skip components whose parent device is disabled
        imx-drm: imx-drm-core: fix imx_drm_encoder_get_mux_id
      84e12d99
    • Linus Torvalds's avatar
      Merge tag 'driver-core-3.15-rc6' of... · 439c6109
      Linus Torvalds authored
      Merge tag 'driver-core-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
      
      Pull driver core fixes from Greg KH:
       "Here are two driver core (well, sysfs) fixes for 3.15-rc6 that resolve
        some reported issues and a regression from 3.13"
      
      * tag 'driver-core-3.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        sysfs: make sure read buffer is zeroed
        kernfs, sysfs, cgroup: restrict extra perm check on open to sysfs
      439c6109