1. 05 Jul, 2012 4 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/virt/kvm/kvm · 6bc51545
      Linus Torvalds authored
      Pull KVM fix from Marcelo Tosatti:
       "Memory leak and oops on the x86 mmu code, and sanitization of the
        KVM_IRQFD ioctl."
      
      * git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: MMU: fix shrinking page from the empty mmu
        KVM: fix fault page leak
        KVM: Sanitize KVM_IRQFD flags
        KVM: Add missing KVM_IRQFD API documentation
        KVM: Pass kvm_irqfd to functions
      6bc51545
    • Linus Torvalds's avatar
      Merge branch 'fixes-for-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds · 24eee627
      Linus Torvalds authored
      Pull leds fix from Bryan Wu:
       "Fix for heartbeat led trigger driver"
      
      * 'fixes-for-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds:
        leds: heartbeat: fix bug on panic
      24eee627
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 5eecb9cc
      Linus Torvalds authored
      Pull btrfs updates from Chris Mason:
       "I held off on my rc5 pull because I hit an oops during log recovery
        after a crash.  I wanted to make sure it wasn't a regression because
        we have some logging fixes in here.
      
        It turns out that a commit during the merge window just made it much
        more likely to trigger directory logging instead of full commits,
        which exposed an old bug.
      
        The new backref walking code got some additional fixes.  This should
        be the final set of them.
      
        Josef fixed up a corner where our O_DIRECT writes and buffered reads
        could expose old file contents (not stale, just not the most recent).
        He and Liu Bo fixed crashes during tree log recover as well.
      
        Ilya fixed errors while we resume disk balancing operations on
        readonly mounts."
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: run delayed directory updates during log replay
        Btrfs: hold a ref on the inode during writepages
        Btrfs: fix tree log remove space corner case
        Btrfs: fix wrong check during log recovery
        Btrfs: use _IOR for BTRFS_IOC_SUBVOL_GETFLAGS
        Btrfs: resume balance on rw (re)mounts properly
        Btrfs: restore restriper state on all mounts
        Btrfs: fix dio write vs buffered read race
        Btrfs: don't count I/O statistic read errors for missing devices
        Btrfs: resolve tree mod log locking issue in btrfs_next_leaf
        Btrfs: fix tree mod log rewind of ADD operations
        Btrfs: leave critical region in btrfs_find_all_roots as soon as possible
        Btrfs: always put insert_ptr modifications into the tree mod log
        Btrfs: fix tree mod log for root replacements at leaf level
        Btrfs: support root level changes in __resolve_indirect_ref
        Btrfs: avoid waiting for delayed refs when we must not
      5eecb9cc
    • Linus Torvalds's avatar
      Merge branch 'fixes-for-grant' of git://sources.calxeda.com/kernel/linux · 62ad6449
      Linus Torvalds authored
      Pull DT fixes from Rob Herring:
       "Mainly some documentation updates and 2 fixes:
      
         - An export symbol fix for of_platform_populate from Stephen W.
         - A fix for the order compatible entries are matched to ensure the
           first compatible string is matched when there are multiple matches."
      
      Normally these would go through Grant Likely (thus the "fixes-for-grant"
      branch name), but Grant is in the middle of moving to Scotland, and is
      practically offline until sometime in August. So pull directly from Rob.
      
      * 'fixes-for-grant' of git://sources.calxeda.com/kernel/linux:
        of: match by compatible property first
        dt: mc13xxx.txt: Fix gpio number assignment
        dt: fsl-fec.txt: Fix gpio number assignment
        dt: fsl-mma8450.txt: Add missing 'reg' description
        dt: fsl-imx-esdhc.txt: Fix gpio number assignment
        dt: fsl-imx-cspi.txt: Fix comment about GPIOs used for chip selects
        of: Add Avionic Design vendor prefix
        of: export of_platform_populate()
      62ad6449
  2. 04 Jul, 2012 4 commits
    • Alexander Holler's avatar
      leds: heartbeat: fix bug on panic · fb31fbeb
      Alexander Holler authored
      With commit 49dca5ae I introduced
      a bug (visible if CONFIG_PROVE_RCU is enabled) which occures when a panic
      has happened:
      
      [ 1526.520230] ===============================
      [ 1526.520230] [ INFO: suspicious RCU usage. ]
      [ 1526.520230] 3.5.0-rc1+ #12 Not tainted
      [ 1526.520230] -------------------------------
      [ 1526.520230] /c/kernel-tests/mm/include/linux/rcupdate.h:436 Illegal context switch in RCU read-side critical section!
      [ 1526.520230]
      [ 1526.520230] other info that might help us debug this:
      [ 1526.520230]
      [ 1526.520230]
      [ 1526.520230] rcu_scheduler_active = 1, debug_locks = 0
      [ 1526.520230] 3 locks held by net.agent/3279:
      [ 1526.520230]  #0:  (&mm->mmap_sem){++++++}, at: [<ffffffff82f85962>] do_page_fault+0x193/0x390
      [ 1526.520230]  #1:  (panic_lock){+.+...}, at: [<ffffffff82ed2830>] panic+0x37/0x1d3
      [ 1526.520230]  #2:  (rcu_read_lock){.+.+..}, at: [<ffffffff810b9b28>] rcu_lock_acquire+0x0/0x29
      [ 1526.520230]
      [ 1526.520230] stack backtrace:
      [ 1526.520230] Pid: 3279, comm: net.agent Not tainted 3.5.0-rc1+ #12
      [ 1526.520230] Call Trace:
      [ 1526.520230]  [<ffffffff810e1570>] lockdep_rcu_suspicious+0x109/0x112
      [ 1526.520230]  [<ffffffff810bfe3a>] rcu_preempt_sleep_check+0x45/0x47
      [ 1526.520230]  [<ffffffff810bfe5a>] __might_sleep+0x1e/0x19a
      [ 1526.520230]  [<ffffffff82f8010e>] down_write+0x26/0x81
      [ 1526.520230]  [<ffffffff8276a966>] led_trigger_unregister+0x1f/0x9c
      [ 1526.520230]  [<ffffffff8276def5>] heartbeat_reboot_notifier+0x15/0x19
      [ 1526.520230]  [<ffffffff82f85bf5>] notifier_call_chain+0x96/0xcd
      [ 1526.520230]  [<ffffffff82f85cba>] __atomic_notifier_call_chain+0x8e/0xff
      [ 1526.520230]  [<ffffffff81094b7c>] ? kmsg_dump+0x37/0x1eb
      [ 1526.520230]  [<ffffffff82f85d3f>] atomic_notifier_call_chain+0x14/0x16
      [ 1526.520230]  [<ffffffff82ed28e1>] panic+0xe8/0x1d3
      [ 1526.520230]  [<ffffffff811473e2>] out_of_memory+0x15d/0x1d3
      
      So in case of a panic, now just turn of the LED. Other approaches like
      scheduling a work to unregister the trigger aren't working because there
      isn't much which still runs after a panic occured (except timers).
      Signed-off-by: default avatarAlexander Holler <holler@ahsoftware.de>
      Signed-off-by: default avatarBryan Wu <bryan.wu@canonical.com>
      fb31fbeb
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mturquette/linux · 9e85a6f9
      Linus Torvalds authored
      Pull fix to common clk framework from Michael Turquette:
       "The previous set of common clk fixes for -rc5 left an uninitialized
        int which could lead to bad array indexing when switching clock
        parents.  The issue is fixed with a trivial change to the code flow in
        __clk_set_parent."
      
      * tag 'clk-fixes-for-linus' of git://git.linaro.org/people/mturquette/linux:
        clk: fix parent validation in __clk_set_parent()
      9e85a6f9
    • Linus Torvalds's avatar
      Merge tag 'md-3.5-fixes' of git://neil.brown.name/md · 6c8addcb
      Linus Torvalds authored
      Pull raid10 build failure fix from NeilBrown:
       "I really shouldn't do important things late in the day.  It seems that
        I get careless."
      
      * tag 'md-3.5-fixes' of git://neil.brown.name/md:
        md/raid10: fix careless build error
      6c8addcb
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 56728748
      Linus Torvalds authored
      Pull networking update from David Miller:
      
       1) Fix RX sequence number handling in mwifiex, from Stone Piao.
      
       2) Netfilter ipset mis-compares device names, fix from Florian
          Westphal.
      
       3) Fix route leak in ipv6 IPVS, from Eric Dumazet.
      
       4) NFS fixes.  Several buffer overflows in NCI layer from Dan
          Rosenberg, and release sock OOPS'er fix from Eric Dumazet.
      
       5) Fix WEP handling ath9k, we started using a bit the chip provides to
          indicate undecrypted packets but that bit turns out to be unreliable
          in certain configurations.  Fix from Felix Fietkau.
      
       6) Fix Kconfig dependency bug in wlcore, from Randy Dunlap.
      
       7) New USB IDs for rtlwifi driver from Larry Finger.
      
       8) Fix crashes in qmi_wwan usbnet driver when disconnecting, from Bjørn
          Mork.
      
       9) Gianfar driver programs coalescing settings properly in single queue
          mode, but does not do so in multi-queue mode.  Fix from Claudiu
          Manoil.
      
      10) Missing module.h include in davinci_cpdma.c, from Daniel Mack.
      
      11) Need dummy handler for IPSET_CMD_NONE otherwise we crash in ipset if
          we get this via nfnetlink, fix from Tomasz Bursztyka.
      
      12) Missing RCU unlock in nfnetlink error path, also from Tomasz.
      
      13) Fix divide by zero in igbvf when the user tries to set an RX
          coalescing value of 0 usecs, from Mitch A Williams.
      
      14) We can process SCTP sacks for the wrong transport, oops.  Fix from
          Neil Horman.
      
      15) Remove hw IP payload checksumming from e1000e driver.  This has zery
          value in our stack, and turning it on creates a very unintuitive
          restriction for users when using jumbo MTUs.
      
          Specifically, when IP payload checksums are on you cannot use both
          receive hashing offload and jumbo MTU.  Fix from Bruce Allan.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (27 commits)
        e1000e: remove use of IP payload checksum
        sctp: be more restrictive in transport selection on bundled sacks
        igbvf: fix divide by zero
        netfilter: nfnetlink: fix missing rcu_read_unlock in nfnetlink_rcv_msg
        netfilter: ipset: fix crash if IPSET_CMD_NONE command is sent
        davinci_cpdma: include linux/module.h
        gianfar: Fix RXICr/TXICr programming for multi-queue mode
        net: Downgrade CAP_SYS_MODULE deprecated message from error to warning.
        net: qmi_wwan: fix Oops while disconnecting
        mwifiex: fix memory leak associated with IE manamgement
        ath9k: fix panic caused by returning a descriptor we have queued for reuse
        mac80211: correct behaviour on unrecognised action frames
        ath9k: enable serialize_regmode for non-PCIE AR9287
        rtlwifi: rtl8192cu: New USB IDs
        NFC: Return from rawsock_release when sk is NULL
        iwlwifi: fix activating inactive stations
        wlcore: drop INET dependency
        ath9k: fix dynamic WEP related regression
        NFC: Prevent multiple buffer overflows in NCI
        netfilter: update location of my trees
        ...
      56728748
  3. 03 Jul, 2012 32 commits
    • NeilBrown's avatar
      md/raid10: fix careless build error · 10684112
      NeilBrown authored
      build error introduced by commit b357f04a
      
      That function doesn't get extra args until a later patch.  Bother.
      
      Reported-by: Fengguang Wu <wfg@linux.intel.com> 
      Reported-by: default avatarSimon Kirby <sim@hostway.ca>
      Reported-by: default avatarTobias Klausmann <tobias.johannes.klausmann@mni.thm.de>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      10684112
    • Linus Torvalds's avatar
      floppy: cancel any pending fd_timeouts before adding a new one · dab058fd
      Linus Torvalds authored
      In commit 070ad7e7 ("floppy: convert to delayed work and
      single-thread wq") the 'fd_timeout' timer was converted to a delayed
      work.  However, the "del_timer(&fd_timeout)" was lost in the process,
      and any previous pending timeouts would stay active when we then
      re-queued the timeout.
      
      This resulted in the floppy probe sequence having a (stale) 20s timeout
      rather than the intended 3s timeout, and thus made booting with the
      floppy driver (but no actual floppy controller) take much longer than it
      should.
      
      Of course, there's little reason for most people to compile the floppy
      driver into the kernel at all, which is why most people never noticed.
      
      Canceling the delayed work where we used to do the del_timer() fixes the
      issue, and makes the floppy probing use the proper new timeout instead.
      The three second timeout is still very wasteful, but better than the 20s
      one.
      Reported-and-tested-by: default avatarAndi Kleen <ak@linux.intel.com>
      Reported-and-tested-by: default avatarCalvin Walton <calvin.walton@kepstin.ca>
      Cc: Jiri Kosina <jkosina@suse.cz>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      dab058fd
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · a3da2c69
      Linus Torvalds authored
      Pull block bits from Jens Axboe:
       "As vacation is coming up, thought I'd better get rid of my pending
        changes in my for-linus branch for this iteration.  It contains:
      
         - Two patches for mtip32xx.  Killing a non-compliant sysfs interface
           and moving it to debugfs, where it belongs.
      
         - A few patches from Asias.  Two legit bug fixes, and one killing an
           interface that is no longer in use.
      
         - A patch from Jan, making the annoying partition ioctl warning a bit
           less annoying, by restricting it to !CAP_SYS_RAWIO only.
      
         - Three bug fixes for drbd from Lars Ellenberg.
      
         - A fix for an old regression for umem, it hasn't really worked since
           the plugging scheme was changed in 3.0.
      
         - A few fixes from Tejun.
      
         - A splice fix from Eric Dumazet, fixing an issue with pipe
           resizing."
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        scsi: Silence unnecessary warnings about ioctl to partition
        block: Drop dead function blk_abort_queue()
        block: Mitigate lock unbalance caused by lock switching
        block: Avoid missed wakeup in request waitqueue
        umem: fix up unplugging
        splice: fix racy pipe->buffers uses
        drbd: fix null pointer dereference with on-congestion policy when diskless
        drbd: fix list corruption by failing but already aborted reads
        drbd: fix access of unallocated pages and kernel panic
        xen/blkfront: Add WARN to deal with misbehaving backends.
        blkcg: drop local variable @q from blkg_destroy()
        mtip32xx: Create debugfs entries for troubleshooting
        mtip32xx: Remove 'registers' and 'flags' from sysfs
        blkcg: fix blkg_alloc() failure path
        block: blkcg_policy_cfq shouldn't be used if !CONFIG_CFQ_GROUP_IOSCHED
        block: fix return value on cfq_init() failure
        mtip32xx: Remove version.h header file inclusion
        xen/blkback: Copy id field when doing BLKIF_DISCARD.
      a3da2c69
    • Xiao Guangrong's avatar
      KVM: MMU: fix shrinking page from the empty mmu · 85b70591
      Xiao Guangrong authored
      Fix:
      
       [ 3190.059226] BUG: unable to handle kernel NULL pointer dereference at           (null)
       [ 3190.062224] IP: [<ffffffffa02aac66>] mmu_page_zap_pte+0x10/0xa7 [kvm]
       [ 3190.063760] PGD 104f50067 PUD 112bea067 PMD 0
       [ 3190.065309] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
       [ 3190.066860] CPU 1
      [ ...... ]
       [ 3190.109629] Call Trace:
       [ 3190.111342]  [<ffffffffa02aada6>] kvm_mmu_prepare_zap_page+0xa9/0x1fc [kvm]
       [ 3190.113091]  [<ffffffffa02ab2f5>] mmu_shrink+0x11f/0x1f3 [kvm]
       [ 3190.114844]  [<ffffffffa02ab25d>] ? mmu_shrink+0x87/0x1f3 [kvm]
       [ 3190.116598]  [<ffffffff81150c9d>] ? prune_super+0x142/0x154
       [ 3190.118333]  [<ffffffff8110a4f4>] ? shrink_slab+0x39/0x31e
       [ 3190.120043]  [<ffffffff8110a687>] shrink_slab+0x1cc/0x31e
       [ 3190.121718]  [<ffffffff8110ca1d>] do_try_to_free_pages
      
      This is caused by shrinking page from the empty mmu, although we have
      checked n_used_mmu_pages, it is useless since the check is out of mmu-lock
      Signed-off-by: default avatarXiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      85b70591
    • Xiao Guangrong's avatar
      KVM: fix fault page leak · f4119304
      Xiao Guangrong authored
      fault_page is forgot to be freed
      Signed-off-by: default avatarXiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      f4119304
    • Rajendra Nayak's avatar
      clk: fix parent validation in __clk_set_parent() · 863b1327
      Rajendra Nayak authored
      The below commit introduced a bug in __clk_set_parent()
      which could cause it to *skip* the parent validation
      which makes sure the parent passed to the api is a valid
      one.
      
          commit 7975059d
          Author: Rajendra Nayak <rnayak@ti.com>
          Date:   Wed Jun 6 14:41:31 2012 +0530
      
              clk: Allow late cache allocation for clk->parents
      
      This was identified by the following compiler warning..
      
          drivers/clk/clk.c: In function '__clk_set_parent':
          drivers/clk/clk.c:1083:5: warning: 'i' may be used uninitialized in this function [-Wuninitialized]
      
      .. as reported by Marc Kleine-Budde.
      
      There were various options discussed on how to fix this, one
      being initing 'i' to clk->num_parents, but the below approach
      was found to be more appropriate as it also makes the 'parent
      validation' code simpler to read.
      Reported-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      Signed-off-by: default avatarRajendra Nayak <rnayak@ti.com>
      Signed-off-by: default avatarMike Turquette <mturquette@linaro.org>
      Cc: stable@kernel.org
      863b1327
    • Linus Torvalds's avatar
      Merge tag 'sound-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · ff826b2b
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Just a few driver-specific fixes for ASoC and HD-audio."
      
      * tag 'sound-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda - Fix no sound from ALC662 after Windows reboot
        ASoC: tlv320aic3x: Fix codec pll configure bug
        ASoC: wm2200: Add missing BCLK rate
      ff826b2b
    • Linus Torvalds's avatar
      Merge tag 'dm-3.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-dm · 3492ee72
      Linus Torvalds authored
      Pull device-mapper fixes from Alasdair G Kergon:
       "Four minor thin provisioning fixes and correct and update dm-verity
        documentation."
      
      * tag 'dm-3.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-dm:
        dm: verity fix documentation
        dm persistent data: fix allocation failure in space map checker init
        dm persistent data: handle space map checker creation failure
        dm persistent data: fix shadow_info_leak on dm_tm_destroy
        dm thin: commit metadata before creating metadata snapshot
      3492ee72
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 73e60805
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "One regression fix, two radeon fixes (one for an oops), and an i915
        fix to unload framebuffers earlier.
      
        We originally were going to leave the i915 fix until -next, but grub2
        in some situations causes vesafb/efifb to be loaded now, and this
        causes big slowdowns, and I have reports in rawhide I'd like to have
        fixed."
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/i915: kick any firmware framebuffers before claiming the gtt
        drm: edid: Don't add inferred modes with higher resolution
        drm/radeon: fix rare segfault
        drm/radeon: fix VM page table setup on SI
      73e60805
    • Linus Torvalds's avatar
      Merge tag 'md-3.5-fixes' of git://neil.brown.name/md · 2fb748d2
      Linus Torvalds authored
      Pull md fixes from NeilBrown:
       "md: collection of bug fixes for 3.5
      
        You go away for 2 weeks vacation and what do you get when you come
        back? Piles of bugs :-)
      
        Some found by inspection, some by testing, some during use in the
        field, and some while developing for the next window..."
      
      * tag 'md-3.5-fixes' of git://neil.brown.name/md:
        md: fix up plugging (again).
        md: support re-add of recovering devices.
        md/raid1: fix bug in read_balance introduced by hot-replace
        raid5: delayed stripe fix
        md/raid456: When read error cannot be recovered, record bad block
        md: make 'name' arg to md_register_thread non-optional.
        md/raid10: fix failure when trying to repair a read error.
        md/raid5: fix refcount problem when blocked_rdev is set.
        md:Add blk_plug in sync_thread.
        md/raid5: In ops_run_io, inc nr_pending before calling md_wait_for_blocked_rdev
        md/raid5: Do not add data_offset before call to is_badblock
        md/raid5: prefer replacing failed devices over want-replacement devices.
        md/raid10: Don't try to recovery unmatched (and unused) chunks.
      2fb748d2
    • Linus Torvalds's avatar
      Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security · 3bfd2454
      Linus Torvalds authored
      Pull security layer fixes from James Morris.
      
      A documentation update, and a nommu build fix.
      
      * 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
        security: Fix nommu build.
        security: document no_new_privs
      3bfd2454
    • Milan Broz's avatar
      dm: verity fix documentation · 18068bdd
      Milan Broz authored
      Veritysetup is now part of cryptsetup package.
      Remove on-disk header description (which is not parsed in kernel)
      and point users to cryptsetup where it the format is documented.
      Mention units for block size paramaters.
      Fix target line specification and dmsetup parameters.
      Signed-off-by: default avatarMilan Broz <mbroz@redhat.com>
      Cc: stable@kernel.org
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      18068bdd
    • Mike Snitzer's avatar
      dm persistent data: fix allocation failure in space map checker init · b0239faa
      Mike Snitzer authored
      If CONFIG_DM_DEBUG_SPACE_MAPS is enabled and memory is fragmented and a
      sufficiently-large metadata device is used in a thin pool then the space
      map checker will fail to allocate the memory it requires.
      
      Switch from kmalloc to vmalloc to allow larger virtually contiguous
      allocations for the space map checker's internal count arrays.
      Reported-by: default avatarVivek Goyal <vgoyal@redhat.com>
      Cc: stable@kernel.org
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      b0239faa
    • Mike Snitzer's avatar
      dm persistent data: handle space map checker creation failure · 62662303
      Mike Snitzer authored
      If CONFIG_DM_DEBUG_SPACE_MAPS is enabled and dm_sm_checker_create()
      fails, dm_tm_create_internal() would still return success even though it
      cleaned up all resources it was supposed to have created.  This will
      lead to a kernel crash:
      
      general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
      ...
      RIP: 0010:[<ffffffff81593659>]  [<ffffffff81593659>] dm_bufio_get_block_size+0x9/0x20
      Call Trace:
        [<ffffffff81599bae>] dm_bm_block_size+0xe/0x10
        [<ffffffff8159b8b8>] sm_ll_init+0x78/0xd0
        [<ffffffff8159c1a6>] sm_ll_new_disk+0x16/0xa0
        [<ffffffff8159c98e>] dm_sm_disk_create+0xfe/0x160
        [<ffffffff815abf6e>] dm_pool_metadata_open+0x16e/0x6a0
        [<ffffffff815aa010>] pool_ctr+0x3f0/0x900
        [<ffffffff8158d565>] dm_table_add_target+0x195/0x450
        [<ffffffff815904c4>] table_load+0xe4/0x330
        [<ffffffff815917ea>] ctl_ioctl+0x15a/0x2c0
        [<ffffffff81591963>] dm_ctl_ioctl+0x13/0x20
        [<ffffffff8116a4f8>] do_vfs_ioctl+0x98/0x560
        [<ffffffff8116aa51>] sys_ioctl+0x91/0xa0
        [<ffffffff81869f52>] system_call_fastpath+0x16/0x1b
      
      Fix the space map checker code to return an appropriate ERR_PTR and have
      dm_sm_disk_create() and dm_tm_create_internal() check for it with
      IS_ERR.
      Reported-by: default avatarVivek Goyal <vgoyal@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      62662303
    • Mike Snitzer's avatar
      dm persistent data: fix shadow_info_leak on dm_tm_destroy · 25d7cd6f
      Mike Snitzer authored
      Cleanup the shadow table before destroying the transaction manager.
      
      Reference: leak was identified with kmemleak when running
      test_discard_random_sectors in the thinp-test-suite.
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      25d7cd6f
    • Joe Thornber's avatar
      dm thin: commit metadata before creating metadata snapshot · 0d200aef
      Joe Thornber authored
      Userland sometimes sees a corrupt metadata block if metadata is changing
      rapidly when a metadata snapshot is reserved for userland,  To make the
      problem go away, commit before we take the metadata snapshot (which is a
      sensible thing to do anyway).
      
      The checksums mean userland spots this corruption immediately so there's
      no risk of acting on incorrect data.  No corruption exists from the
      kernel's point of view, and thin_check passes after pool shutdown.
      
      I believe this is to do with shared blocks at the first level of the
      {device, mapping} btree.  Prior to the metadata-snap support no sharing
      at this level was possible, so this patch is only required after commit
      cc8394d8 ("dm thin: provide userspace
      access to pool metadata").
      Signed-off-by: default avatarJoe Thornber <ejt@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      Signed-off-by: default avatarAlasdair G Kergon <agk@redhat.com>
      0d200aef
    • Paul Mundt's avatar
      security: Fix nommu build. · 75331a59
      Paul Mundt authored
      The security + nommu configuration presently blows up with an undefined
      reference to BDI_CAP_EXEC_MAP:
      
      security/security.c: In function 'mmap_prot':
      security/security.c:687:36: error: dereferencing pointer to incomplete type
      security/security.c:688:16: error: 'BDI_CAP_EXEC_MAP' undeclared (first use in this function)
      security/security.c:688:16: note: each undeclared identifier is reported only once for each function it appears in
      
      include backing-dev.h directly to fix it up.
      Signed-off-by: default avatarPaul Mundt <lethal@linux-sh.org>
      Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
      75331a59
    • Daniel Vetter's avatar
      drm/i915: kick any firmware framebuffers before claiming the gtt · 9f846a16
      Daniel Vetter authored
      Especially vesafb likes to map everything as uc- (yikes), and if that
      mapping hangs around still while we try to map the gtt as wc the
      kernel will downgrade our request to uc-, resulting in abyssal
      performance.
      
      Unfortunately we can't do this as early as readon does (i.e. as the
      first thing we do when initializing the hw) because our fb/mmio space
      region moves around on a per-gen basis. So I've had to move it below
      the gtt initialization, but that seems to work, too. The important
      thing is that we do this before we set up the gtt wc mapping.
      
      Now an altogether different question is why people compile their
      kernels with vesafb enabled, but I guess making things just work isn't
      bad per se ...
      
      v2:
      - s/radeondrmfb/inteldrmfb/
      - fix up error handling
      
      v3: Kill #ifdef X86, this is Intel after all. Noticed by Ben Widawsky.
      
      v4: Jani Nikula complained about the pointless bool primary
      initialization.
      
      v5: Don't oops if we can't allocate, noticed by Chris Wilson.
      
      v6: Resolve conflicts with agp rework and fixup whitespace.
      
      This is commit e188719a in drm-next.
      
      Backport to 3.5 -fixes queue requested by Dave Airlie - due to grub
      using vesa on fedora their initrd seems to load vesafb before loading
      the real kms driver. So tons more people actually experience a
      dead-slow gpu. Hence also the Cc: stable.
      
      Cc: stable@vger.kernel.org
      Reported-and-tested-by: default avatar"Kilarski, Bernard R" <bernard.r.kilarski@intel.com>
      Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      9f846a16
    • Takashi Iwai's avatar
      drm: edid: Don't add inferred modes with higher resolution · 7b668ebe
      Takashi Iwai authored
      When a monitor EDID doesn't give the preferred bit, driver assumes
      that the mode with the higest resolution and rate is the preferred
      mode.  Meanwhile the recent changes for allowing more modes in the
      GFT/CVT ranges give actually more modes, and some modes may be over
      the native size.  Thus such a mode would be picked up as the preferred
      mode although it's no native resolution.
      
      For avoiding such a problem, this patch limits the addition of
      inferred modes by checking not to be greater than other modes.
      Also, it checks the duplicated mode entry at the same time.
      Reviewed-by: default avatarAdam Jackson <ajax@redhat.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      7b668ebe
    • Jerome Glisse's avatar
      drm/radeon: fix rare segfault · 1ef5325b
      Jerome Glisse authored
      In gem idle/busy ioctl the radeon object was derefenced after
      drm_gem_object_unreference_unlocked which in case the object
      have been destroyed lead to use of a possibly free pointer with
      possibly wrong data.
      Signed-off-by: default avatarJerome Glisse <jglisse@redhat.com>
      Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      1ef5325b
    • NeilBrown's avatar
      md: fix up plugging (again). · b357f04a
      NeilBrown authored
      The value returned by "mddev_check_plug" is only valid until the
      next 'schedule' as that will unplug things.  This could happen at any
      call to mempool_alloc.
      So just calling mddev_check_plug at the start doesn't really make
      sense.
      
      So call it just before, or just after, queuing things for the thread.
      As the action that happens at unplug is to wake the thread, this makes
      lots of sense.
      If we cannot add a plug (which requires a small GFP_ATOMIC alloc) we
      wake thread immediately.
      
      RAID5 is a bit different.  Requests are queued for the thread and the
      thread is woken by release_stripe.  So we don't need to wake the
      thread on failure.
      However the thread doesn't perform certain actions when there is any
      active plug, so it is important to install a plug before waking the
      thread.  So for RAID5 we install the plug *before* queuing the request
      and waking the thread.
      
      Without this patch it is possible for raid1 or raid10 to queue a
      request without then waking the thread, resulting in the array locking
      up.
      
      Also change raid10 to only flush_pending_write when there are not
      active plugs, just like raid1.
      
      This patch is suitable for 3.0 or later.  I plan to submit it to
      -stable, but I'll like to let it spend a few weeks in mainline
      first to be sure it is completely safe.
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      b357f04a
    • NeilBrown's avatar
      md: support re-add of recovering devices. · f4563091
      NeilBrown authored
      We currently only allow a device to be re-added if it appear to be
      in-sync.  This is overly restrictive as it may be desirable to re-add
      a device that is in the middle of recovery.
      
      So remove the test for "InSync" - the test on rdev->raid_disk is
      sufficient to ensure that the re-add will succeed.
      Reported-by: default avatarAlexander Lyakas <alex.bolshoy@gmail.com>
      Tested-by: default avatarAlexander Lyakas <alex.bolshoy@gmail.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      f4563091
    • NeilBrown's avatar
      md/raid1: fix bug in read_balance introduced by hot-replace · 32644afd
      NeilBrown authored
      When we added hot_replace we doubled the number of devices
      that could be in a RAID1 array.  So we doubled how far read_balance
      would search.  Unfortunately we didn't double the point at which
      it looped back to the beginning - so it effectively loops over
      all non-replacement disks twice.
      This doesn't cause bad behaviour, but it pointless and means we
      never read from replacement devices.
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      32644afd
    • Shaohua Li's avatar
      raid5: delayed stripe fix · fab363b5
      Shaohua Li authored
      There isn't locking setting STRIPE_DELAYED and STRIPE_PREREAD_ACTIVE bits, but
      the two bits have relationship. A delayed stripe can be moved to hold list only
      when preread active stripe count is below IO_THRESHOLD. If a stripe has both
      the bits set, such stripe will be in delayed list and preread count not 0,
      which will make such stripe never leave delayed list.
      Signed-off-by: default avatarShaohua Li <shli@fusionio.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      fab363b5
    • majianpeng's avatar
      md/raid456: When read error cannot be recovered, record bad block · 2e8ac303
      majianpeng authored
      We may not be able to fix a bad block if:
       - the array is degraded
       - the over-write fails.
      
      In these cases we currently eject the device, but we should
      record a bad block if possible.
      Signed-off-by: default avatarmajianpeng <majianpeng@gmail.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      2e8ac303
    • NeilBrown's avatar
      md: make 'name' arg to md_register_thread non-optional. · 0232605d
      NeilBrown authored
      Having the 'name' arg optional and defaulting to the current
      personality name is no necessary and leads to errors, as when
      changing the level of an array we can end up using the
      name of the old level instead of the new one.
      
      So make it non-optional and always explicitly pass the name
      of the level that the array will be.
      Reported-by: default avatarmajianpeng <majianpeng@gmail.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      0232605d
    • NeilBrown's avatar
      md/raid10: fix failure when trying to repair a read error. · 055d3747
      NeilBrown authored
      commit 58c54fcc
           md/raid10: handle further errors during fix_read_error better.
      
      in 3.1 added "r10_sync_page_io" which takes an IO size in sectors.
      But we were passing the IO size in bytes!!!
      This resulting in bio_add_page failing, and empty request being sent
      down, and a consequent BUG_ON in scsi_lib.
      
      [fix missing space in error message at same time]
      
      This fix is suitable for 3.1.y and later.
      
      Cc: stable@vger.kernel.org
      Reported-by: default avatarChristian Balzer <chibi@gol.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      055d3747
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc · 9d4056aa
      Linus Torvalds authored
      Pull a couple more powerpc fixes from Benjamin Herrenschmidt:
       "Here are two more fixes that I "missed" when scrubbing patchwork last
        week which are worth still having in 3.5."
      
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
        powerpc/kvm: sldi should be sld
        powerpc/xmon: Use cpumask iterator to avoid warning
      9d4056aa
    • Andy Lutomirski's avatar
      security: document no_new_privs · 09b24357
      Andy Lutomirski authored
      Document no_new_privs.
      Signed-off-by: default avatarAndy Lutomirski <luto@amacapital.net>
      Acked-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
      09b24357
    • NeilBrown's avatar
      md/raid5: fix refcount problem when blocked_rdev is set. · 5f066c63
      NeilBrown authored
      commit 43220aa0
          md/raid5: fix a hang on device failure.
      
      fixed a hang, but introduced a refcounting in-balance so
      that if the presence of bad-blocks ever caused an rdev to
      be 'blocked' we would increment the refcount on the rdev and
      never decrement it.
      
      So added the needed rdev_dec_pending when md_wait_for_blocked_rdev
      is not called.
      Reported-by: default avatarmajianpeng <majianpeng@gmail.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      5f066c63
    • majianpeng's avatar
      md:Add blk_plug in sync_thread. · 7c2c57c9
      majianpeng authored
      Add blk_plug in sync_thread will increase the performance of sync.
      Because sync_thread did not blk_plug,so when raid sync, the bio merge
      not well.
      
      Testing environment:
      SATA controller: Intel Corporation 82801JI (ICH10 Family) SATA AHCI
      Controller.
      OS:Linux xxx 3.5.0-rc2+ #340 SMP Tue Jun 12 09:00:25 CST 2012
      x86_64 x86_64 x86_64 GNU/Linux.
      RAID5: four ST31000524NS disk.
      
      Without blk_plug:recovery speed about 63M/Sec;
      Add blk_plug:recovery speed about 120M/Sec.
      
      Using blktrace:
      blktrace -d /dev/sdb -w 60  -o -|blkparse -i -
      
      without blk_plug:
      Total (8,16):
       Reads Queued:      309811,     1239MiB	 Writes Queued:           0,        0KiB
       Read Dispatches:   283583,     1189MiB	 Write Dispatches:        0,        0KiB
       Reads Requeued:         0		 Writes Requeued:         0
       Reads Completed:   273351,     1149MiB	 Writes Completed:        0,        0KiB
       Read Merges:        23533,    94132KiB	 Write Merges:            0,        0KiB
       IO unplugs:             0        	 Timer unplugs:           0
      
      add blk_plug:
      Total (8,16):
       Reads Queued:      428697,     1714MiB	 Writes Queued:           0,        0KiB
       Read Dispatches:     3954,     1714MiB	 Write Dispatches:        0,        0KiB
       Reads Requeued:         0		 Writes Requeued:         0
       Reads Completed:     3956,     1715MiB	 Writes Completed:        0,        0KiB
       Read Merges:       424743,     1698MiB	 Write Merges:            0,        0KiB
       IO unplugs:             0        	 Timer unplugs:        3384
      
      The ratio of merge will be markedly increased.
      Signed-off-by: default avatarmajianpeng <majianpeng@gmail.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      7c2c57c9
    • majianpeng's avatar
      md/raid5: In ops_run_io, inc nr_pending before calling md_wait_for_blocked_rdev · 1850753d
      majianpeng authored
      In ops_run_io(), the call to md_wait_for_blocked_rdev will decrement
      nr_pending so we lose the reference we hold on the rdev.
      So atomic_inc it first to maintain the reference.
      
      This bug was introduced by commit  73e92e51
          md/raid5.  Don't write to known bad block on doubtful devices.
      
      which appeared in 3.0, so patch is suitable for stable kernels since
      then.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarmajianpeng <majianpeng@gmail.com>
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      1850753d