1. 24 Sep, 2013 3 commits
    • Jeff Mahoney's avatar
      reiserfs: fix race with flush_used_journal_lists and flush_journal_list · 721a769c
      Jeff Mahoney authored
      There are two locks involved in managing the journal lists. The general
      reiserfs_write_lock and the journal->j_flush_mutex.
      
      While flush_journal_list is sleeping to acquire the j_flush_mutex or to
      submit a block for write, it will drop the write lock. This allows
      another thread to acquire the write lock and ultimately call
      flush_used_journal_lists to traverse the list of journal lists and
      select one for flushing. It can select the journal_list that has just
      had flush_journal_list called on it in the original thread and call it
      again with the same journal_list.
      
      The second thread then drops the write lock to acquire j_flush_mutex and
      the first thread reacquires it and continues execution and eventually
      clears and frees the journal list before dropping j_flush_mutex and
      returning.
      
      The second thread acquires j_flush_mutex and ends up operating on a
      journal_list that has already been released. If the memory hasn't
      been reused, we'll soon after hit a BUG_ON because the transaction id
      has already been cleared. If it's been reused, we'll crash in other
      fun ways.
      
      Since flush_journal_list will synchronize on j_flush_mutex, we can fix
      the race by taking a proper reference in flush_used_journal_lists
      and checking to see if it's still valid after the mutex is taken. It's
      safe to iterate the list of journal lists and pick a list with
      just the write lock as long as a reference is taken on the journal list
      before we drop the lock. We already have code to handle whether a
      transaction has been flushed already so we can use that to handle the
      race and get rid of the trans_id BUG_ON.
      Signed-off-by: default avatarJeff Mahoney <jeffm@suse.com>
      Signed-off-by: default avatarJan Kara <jack@suse.cz>
      721a769c
    • Jeff Mahoney's avatar
      reiserfs: remove useless flush_old_journal_lists · 7bc9cc07
      Jeff Mahoney authored
      Commit a3172027 introduced test_transaction as a requirement for
      flushing old lists -- but it can never return 1 unless the transaction
      has already been flushed.
      
      As a result, we have a routine that iterates the j_realblocks list but
      doesn't actually do anything. Since it's been this way since 2006 and
      the latency numbers were what Chris expected, let's just rip it out.
      Signed-off-by: default avatarJeff Mahoney <jeffm@suse.com>
      Signed-off-by: default avatarJan Kara <jack@suse.cz>
      7bc9cc07
    • Jan Kara's avatar
      udf: Fortify LVID loading · 69d75671
      Jan Kara authored
      A user has reported an oops in udf_statfs() that was caused by
      numOfPartitions entry in LVID structure being corrupted. Fix the problem
      by verifying whether numOfPartitions makes sense at least to the extent
      that LVID fits into a single block as it should.
      Reported-by: default avatarJuergen Weigert <jw@suse.com>
      Signed-off-by: default avatarJan Kara <jack@suse.cz>
      69d75671
  2. 23 Sep, 2013 1 commit
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · d8524ae9
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       - some small fixes for msm and exynos
       - a regression revert affecting nouveau users with old userspace
       - intel pageflip deadlock and gpu hang fixes, hsw modesetting hangs
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (22 commits)
        Revert "drm: mark context support as a legacy subsystem"
        drm/i915: Don't enable the cursor on a disable pipe
        drm/i915: do not update cursor in crtc mode set
        drm/exynos: fix return value check in lowlevel_buffer_allocate()
        drm/exynos: Fix address space warnings in exynos_drm_fbdev.c
        drm/exynos: Fix address space warning in exynos_drm_buf.c
        drm/exynos: Remove redundant OF dependency
        drm/msm: drop unnecessary set_need_resched()
        drm/i915: kill set_need_resched
        drm/msm: fix potential NULL pointer dereference
        drm/i915/dvo: set crtc timings again for panel fixed modes
        drm/i915/sdvo: Robustify the dtd<->drm_mode conversions
        drm/msm: workaround for missing irq
        drm/msm: return -EBUSY if bo still active
        drm/msm: fix return value check in ERR_PTR()
        drm/msm: fix cmdstream size check
        drm/msm: hangcheck harder
        drm/msm: handle read vs write fences
        drm/i915/sdvo: Fully translate sync flags in the dtd->mode conversion
        drm/i915: Use proper print format for debug prints
        ...
      d8524ae9
  3. 22 Sep, 2013 3 commits
    • Linus Torvalds's avatar
      Merge branch 'for-3.12/core' of git://git.kernel.dk/linux-block · 68cf8d0c
      Linus Torvalds authored
      Pull block IO fixes from Jens Axboe:
       "After merge window, no new stuff this time only a collection of neatly
        confined and simple fixes"
      
      * 'for-3.12/core' of git://git.kernel.dk/linux-block:
        cfq: explicitly use 64bit divide operation for 64bit arguments
        block: Add nr_bios to block_rq_remap tracepoint
        If the queue is dying then we only call the rq->end_io callout. This leaves bios setup on the request, because the caller assumes when the blk_execute_rq_nowait/blk_execute_rq call has completed that the rq->bios have been cleaned up.
        bio-integrity: Fix use of bs->bio_integrity_pool after free
        blkcg: relocate root_blkg setting and clearing
        block: Convert kmalloc_node(...GFP_ZERO...) to kzalloc_node(...)
        block: trace all devices plug operation
      68cf8d0c
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 0fbf2cc9
      Linus Torvalds authored
      Pull btrfs fixes from Chris Mason:
       "These are mostly bug fixes and a two small performance fixes.  The
        most important of the bunch are Josef's fix for a snapshotting
        regression and Mark's update to fix compile problems on arm"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: (25 commits)
        Btrfs: create the uuid tree on remount rw
        btrfs: change extent-same to copy entire argument struct
        Btrfs: dir_inode_operations should use btrfs_update_time also
        btrfs: Add btrfs: prefix to kernel log output
        btrfs: refuse to remount read-write after abort
        Btrfs: btrfs_ioctl_default_subvol: Revert back to toplevel subvolume when arg is 0
        Btrfs: don't leak transaction in btrfs_sync_file()
        Btrfs: add the missing mutex unlock in write_all_supers()
        Btrfs: iput inode on allocation failure
        Btrfs: remove space_info->reservation_progress
        Btrfs: kill delay_iput arg to the wait_ordered functions
        Btrfs: fix worst case calculator for space usage
        Revert "Btrfs: rework the overcommit logic to be based on the total size"
        Btrfs: improve replacing nocow extents
        Btrfs: drop dir i_size when adding new names on replay
        Btrfs: replay dir_index items before other items
        Btrfs: check roots last log commit when checking if an inode has been logged
        Btrfs: actually log directory we are fsync()'ing
        Btrfs: actually limit the size of delalloc range
        Btrfs: allocate the free space by the existed max extent size when ENOSPC
        ...
      0fbf2cc9
    • Anatol Pomozov's avatar
      cfq: explicitly use 64bit divide operation for 64bit arguments · f3cff25f
      Anatol Pomozov authored
      'samples' is 64bit operant, but do_div() second parameter is 32.
      do_div silently truncates high 32 bits and calculated result
      is invalid.
      
      In case if low 32bit of 'samples' are zeros then do_div() produces
      kernel crash.
      Signed-off-by: default avatarAnatol Pomozov <anatol.pomozov@gmail.com>
      Acked-by: default avatarTejun Heo <tj@kernel.org>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      f3cff25f
  4. 21 Sep, 2013 28 commits
  5. 20 Sep, 2013 5 commits
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-3.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 2457aaf7
      Linus Torvalds authored
      Pull ACPI and power management fixes from Rafael Wysocki:
      
       1) Four fixes for cpufreq regressions introduced by the changes that
          removed Device Tree parsing for CPU device nodes from cpufreq
          drivers from Sudeep KarkadaNagesha.
      
       2) Two fixes for recent cpufreq regressions introduced by changes
          related to the preservation of sysfs attributes over system
          suspend/resume cycles from Viresh Kumar.
      
       3) Fix for ACPI-based wakeup signaling in the PCI subsystem that
          fails to stop PME polling for devices put into the D3cold power
          state from Rafael J Wysocki.
      
       4) Fix for bad interactions between cpufreq and udev on systems
          supporting intel_pstate where acpi-cpufreq is available as well
          from Yinghai Lu.
      
      * tag 'pm+acpi-3.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        cpufreq: return EEXIST instead of EBUSY for second registering
        PCI / ACPI / PM: Clear pme_poll for devices in D3cold on wakeup
        ARM: shmobile: change dev_id to cpu0 while registering cpu clock
        ARM: i.MX: change dev_id to cpu0 while registering cpu clock
        cpufreq: imx6q-cpufreq: assign cpu_dev correctly to cpu0 device
        cpufreq: cpufreq-cpu0: assign cpu_dev correctly to cpu0 device
        cpufreq: unlock correct rwsem while updating policy->cpu
        cpufreq: Clear policy->cpus bits in __cpufreq_remove_dev_finish()
      2457aaf7
    • Linus Torvalds's avatar
      Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost · d45004f9
      Linus Torvalds authored
      Pull vhost updates from Michael Tsirkin:
       "vhost: minor changes on top of 3.12-rc1
      
        This fixes module loading for vhost-scsi, and tweaks locking in vhost
        core a bit.  Both of these are not exactly release blockers but it's
        early in the cycle so I think it's a good idea to apply them now"
      
      * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
        vhost-scsi: whitespace tweak
        vhost/scsi: use vmalloc for order-10 allocation
        vhost: wake up worker outside spin_lock
      d45004f9
    • David Howells's avatar
      CacheFiles: Don't try to dump the index key if the cookie has been cleared · 509bf24d
      David Howells authored
      Don't try to dump the index key that distinguishes an object if netfs
      data in the cookie the object refers to has been cleared (ie.  the
      cookie has passed most of the way through
      __fscache_relinquish_cookie()).
      
      Since the netfs holds the index key, we can't get at it once the ->def
      and ->netfs_data pointers have been cleared - and a NULL pointer
      exception will ensue, usually just after a:
      
      	CacheFiles: Error: Unexpected object collision
      
      error is reported.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      509bf24d
    • Josh Boyer's avatar
      CacheFiles: Fix memory leak in cachefiles_check_auxdata error paths · 607566ae
      Josh Boyer authored
      In cachefiles_check_auxdata(), we allocate auxbuf but fail to free it if
      we determine there's an error or that the data is stale.
      
      Further, assigning the output of vfs_getxattr() to auxbuf->len gives
      problems with checking for errors as auxbuf->len is a u16.  We don't
      actually need to set auxbuf->len, so keep the length in a variable for
      now.  We shouldn't need to check the upper limit of the buffer as an
      overflow there should be indicated by -ERANGE.
      
      While we're at it, fscache_check_aux() returns an enum value, not an
      int, so assign it to an appropriately typed variable rather than to ret.
      Signed-off-by: default avatarJosh Boyer <jwboyer@fedoraproject.org>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      cc: Hongyi Jia <jiayisuse@gmail.com>
      cc: Milosz Tanski <milosz@adfin.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      607566ae
    • Will Deacon's avatar
      lockref: use cmpxchg64 explicitly for lockless updates · 8f4c3446
      Will Deacon authored
      The cmpxchg() function tends not to support 64-bit arguments on 32-bit
      architectures.  This could be either due to use of unsigned long
      arguments (like on ARM) or lack of instruction support (cmpxchgq on
      x86).  However, these architectures may implement a specific cmpxchg64()
      function to provide 64-bit cmpxchg support instead.
      
      Since the lockref code requires a 64-bit cmpxchg and relies on the
      architecture selecting ARCH_USE_CMPXCHG_LOCKREF, move to using cmpxchg64
      instead of cmpxchg and allow 32-bit architectures to make use of the
      lockless lockref implementation.
      
      Cc: Waiman Long <Waiman.Long@hp.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8f4c3446