Nick Piggin reports:

> I'm getting use after frees in aio code in NFS
>
> [ 2703.396766] Call Trace:
> [ 2703.396858]  [<ffffffff8100b057>] ? native_sched_clock+0x27/0x80
> [ 2703.396959]  [<ffffffff8108509e>] ? put_lock_stats+0xe/0x40
> [ 2703.397058]  [<ffffffff81088348>] ? lock_release_holdtime+0xa8/0x140
> [ 2703.397159]  [<ffffffff8108a2a5>] lock_acquire+0x95/0x1b0
> [ 2703.397260]  [<ffffffff811627db>] ? aio_put_req+0x2b/0x60
> [ 2703.397361]  [<ffffffff81039701>] ? get_parent_ip+0x11/0x50
> [ 2703.397464]  [<ffffffff81612a31>] _raw_spin_lock_irq+0x41/0x80
> [ 2703.397564]  [<ffffffff811627db>] ? aio_put_req+0x2b/0x60
> [ 2703.397662]  [<ffffffff811627db>] aio_put_req+0x2b/0x60
> [ 2703.397761]  [<ffffffff811647fe>] do_io_submit+0x2be/0x7c0
> [ 2703.397895]  [<ffffffff81164d0b>] sys_io_submit+0xb/0x10
> [ 2703.397995]  [<ffffffff8100307b>] system_call_fastpath+0x16/0x1b
>
> Adding some tracing, it is due to nfs completing the request then
> returning something other than -EIOCBQUEUED, so aio.c
> also completes the request.

To address this, prevent the NFS direct I/O engine from completing
async iocbs when the forward path returns an error without starting
any I/O.

This fix appears to survive ^C during both "xfstest no. 208" and "fsx
-Z."

It's likely this bug has existed for a very long while, as we are seeing
very similar symptoms in OEL 5.  Copying stable.

Cc: Stable <stable@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

On Mon, 17 Jan 2011, Mi Jinlong wrote:

>
>
> Jesper Juhl:
> > strrchr() can return NULL if nothing is found. If this happens we'll
> > dereference a NULL pointer in
> > fs/nfs/nfs4filelayoutdev.c::decode_and_add_ds().
> >
> > I tried to find some other code that guarantees that this can never
> > happen but I was unsuccessful. So, unless someone else can point to some
> > code that ensures this can never be a problem, I believe this patch is
> > needed.
> >
> > While I was changing this code I also noticed that all the dprintk()
> > statements, except one, start with "%s:". The one missing the ":" I added
> > it to.
>
>   Maybe another one also should be changed at decode_and_add_ds() at line 243:
>
>    243  printk("%s Decoded address and port %s\n", __func__, buf);
>
Missed that one. Thanks.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Cleanup of the allocated list entries should not call
put_nfs_open_context() on each entry, as the context will
always be NULL, causing an oops.
Signed-off-by: Fred Isaman <iisaman@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging:
  hwmon: (lm93) Add support for LM94

Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  perf: Validate cpu early in perf_event_alloc()
  perf: Find_get_context: fix the per-cpu-counter check
  perf: Fix contexted inheritance

Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86: Clear irqstack thread_info
  x86: Make relocatable kernel work with new binutils

* 'upstream' of git://git.linux-mips.org/pub/scm/upstream-linus: (26 commits)
  MIPS: Malta: enable Cirrus FB console
  MIPS: add CONFIG_VIRTUALIZATION for virtio support
  MIPS: Implement __read_mostly
  MIPS: ath79: add common WMAC device for AR913X based boards
  MIPS: ath79: Add initial support for the Atheros AP81 reference board
  MIPS: ath79: add common SPI controller device
  SPI: Add SPI controller driver for the Atheros AR71XX/AR724X/AR913X SoCs
  MIPS: ath79: add common GPIO buttons device
  MIPS: ath79: add common watchdog device
  MIPS: ath79: add common GPIO LEDs device
  MIPS: ath79: add initial support for the Atheros PB44 reference board
  MIPS: ath79: utilize the MIPS multi-machine support
  MIPS: ath79: add GPIOLIB support
  MIPS: Add initial support for the Atheros AR71XX/AR724X/AR931X SoCs
  MIPS: jump label: Add MIPS support.
  MIPS: Use WARN() in uasm for better diagnostics.
  MIPS: Optimize TLB handlers for Octeon CPUs
  MIPS: Add LDX and LWX instructions to uasm.
  MIPS: Use BBIT instructions in TLB handlers
  MIPS: Declare uasm bbit0 and bbit1 functions.
  ...

This patch adds basic support for LM94 to the LM93 driver. LM94 specific
sensors and features are not supported.
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
Acked-by: Jean Delvare <khali@linux-fr.org>

Starting from perf_event_alloc()->perf_init_event(), the kernel
assumes that event->cpu is either -1 or the valid CPU number.

Change perf_event_alloc() to validate this argument early. This
also means we can remove the similar check in
find_get_context().
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Prasad <prasad@linux.vnet.ibm.com>
Cc: Roland McGrath <roland@redhat.com>
Cc: gregkh@suse.de
Cc: stable@kernel.org
LKML-Reference: <20110118161032.GC693@redhat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

If task == NULL, find_get_context() should always check that cpu
is correct.

Afaics, the bug was introduced by 38a81da2 "perf events: Clean
up pid passing", but even before that commit "&& cpu != -1" was
not exactly right, -ESRCH from find_task_by_vpid() is not
accurate.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Prasad <prasad@linux.vnet.ibm.com>
Cc: Roland McGrath <roland@redhat.com>
Cc: gregkh@suse.de
Cc: stable@kernel.org
LKML-Reference: <20110118161008.GB693@redhat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

While most users of a physical Malta board are using the serial port
as the console, a lot of QEMU users would prefer to interact with a
graphical console. Enable the Cirrus FB support in the Malta default
configuration to make that possible. Note that the default console will
still be the serial port, users have to pass "console=tty0" to the
kernel to use the Cirrus FB.
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
To: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/2001/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Add CONFIG_VIRTUALIZATION to the MIPS architecture and include the
the virtio code there. Used to enable the virtio drivers under QEMU.
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
To: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/2002/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Just do what everyone else is doing by placing __read_mostly things in
the .data.read_mostly section.

mips_io_port_base can not be read-only (const) and writable
(__read_mostly) at the same time.  One of them has to go, so I chose
to eliminate the __read_mostly.  It will still get stuck in a portion
of memory that is not adjacent to things that are written, and thus
not be on a dirty cache line, for whatever that is worth.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
To: linux-mips@linux-mips.org
Patchwork: http://patchwork.linux-mips.org/patch/1702/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Add common platform_device and helper code to make the registration
of the built-in wireless MAC easier on the Atheros AR9130/AR9132
based boards. Also register the WMAC device on the AR81 board.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: Imre Kaloz <kaloz@openwrt.org>,
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Cc: Cliff Holden <Cliff.Holden@Atheros.com>
Cc: Kathy Giori <Kathy.Giori@Atheros.com>
Patchwork: https://patchwork.linux-mips.org/patch/1962/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Cc: Cliff Holden <Cliff.Holden@Atheros.com>
Cc: Kathy Giori <Kathy.Giori@Atheros.com>
Patchwork: https://patchwork.linux-mips.org/patch/1952/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Several boards are using the built-in SPI controller of the
AR71XX/AR724X/AR913X SoCs. This patch adds common platform_device
and helper code to register it. Additionally, the patch registers
the SPI bus on the PB44 board.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: Imre Kaloz <kaloz@openwrt.org>
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Cc: Cliff Holden <Cliff.Holden@Atheros.com>
Cc: Kathy Giori <Kathy.Giori@Atheros.com>
Patchwork: https://patchwork.linux-mips.org/patch/1956/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

The Atheros AR71XX/AR724X/AR913X SoCs have a built-in SPI controller. This
patch implements a driver for that.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: spi-devel-general@lists.sourceforge.net
Acked-by: Grant Likely <grant.likely@secretlab.ca>
Cc: linux-mips@linux-mips.org
Cc: Imre Kaloz <kaloz@openwrt.org>
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Cc: Cliff Holden <Cliff.Holden@Atheros.com>
Cc: Kathy Giori <Kathy.Giori@Atheros.com>
Patchwork: https://patchwork.linux-mips.org/patch/1960/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Almost all boards have one or more push buttons connected to GPIO lines.
This patch adds common code to register a platform_device for them.

The patch also adds support for the buttons on the PB44 board.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Cc: Cliff Holden <Cliff.Holden@Atheros.com>
Cc: Kathy Giori <Kathy.Giori@Atheros.com>
Patchwork: https://patchwork.linux-mips.org/patch/1954/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

All supported SoCs have a built-in hardware watchdog driver. This patch
registers a platform_device for that to make it usable.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Cc: Cliff Holden <Cliff.Holden@Atheros.com>
Cc: Kathy Giori <Kathy.Giori@Atheros.com>
Patchwork: https://patchwork.linux-mips.org/patch/1955/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Almost all boards have one or more LEDs connected to GPIO lines. This
patch adds common code to register a platform_device for them.

The patch also adds support for the LEDs on the PB44 board.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Cc: Cliff Holden <Cliff.Holden@Atheros.com>
Cc: Kathy Giori <Kathy.Giori@Atheros.com>
Patchwork: https://patchwork.linux-mips.org/patch/1953/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Cc: Imre Kaloz <kaloz@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Cc: Cliff Holden <Cliff.Holden@Atheros.com>
Cc: Kathy Giori <Kathy.Giori@Atheros.com>
Patchwork: https://patchwork.linux-mips.org/patch/1950/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Cc: Imre Kaloz <kaloz@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Cc: Cliff Holden <Cliff.Holden@Atheros.com>
Cc: Kathy Giori <Kathy.Giori@Atheros.com>
Patchwork: https://patchwork.linux-mips.org/patch/1949/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

This patch implements generic GPIO routines for the built-in
GPIO controllers of the Atheros AR71XX/AR724X/AR913X SoCs.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: linux-mips@linux-mips.org
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Cc: Cliff Holden <Cliff.Holden@Atheros.com>
Cc: Kathy Giori <Kathy.Giori@Atheros.com>
Patchwork: https://patchwork.linux-mips.org/patch/1948/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

This patch adds initial support for various Atheros SoCs based on the
MIPS 24Kc core. The following models are supported at the moment:

  - AR7130
  - AR7141
  - AR7161
  - AR9130
  - AR9132
  - AR7240
  - AR7241
  - AR7242

The current patch contains minimal support only, but the resulting
kernel can boot into user-space with using of an initramfs image on
various boards which are using these SoCs. Support for more built-in
devices and individual boards will be implemented in further patches.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Cc: Cliff Holden <Cliff.Holden@Atheros.com>
Cc: Kathy Giori <Kathy.Giori@Atheros.com>
Patchwork: https://patchwork.linux-mips.org/patch/1947/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

In order not to be left behind, we add jump label support for MIPS.

Tested on 64-bit big endian (Octeon), and 32-bit little endian
(malta/qemu).
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
To: linux-mips@linux-mips.org
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Jason Baron <jbaron@redhat.com>
Patchwork: https://patchwork.linux-mips.org/patch/1923/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

On the off chance that uasm ever warns about overflow, there is no way
to know what the offending instruction is.

Change the printks to WARNs, so we can get a nice stack trace.  It has
the added benefit of being much more noticeable than the short single
line warning message, so is less likely to be ignored.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
To: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/1905/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Octeon can use scratch registers in the TLB handlers.  Octeon II can
use LDX instructions.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
To: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/1904/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Needed by Octeon II optimized TLB handlers.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
To: linux-mips@linux-mips.org
Pachwork: https://patchwork.linux-mips.org/patch/1903/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

If the CPU supports BBIT0 and BBIT1, use them in TLB handlers as they
are more efficient than an AND followed by an branch and then
restoring the clobbered register.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
To: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/1873/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

these are already defined, but declaring them allow them to be used
outside of uasm.c.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
To: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/1872/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Decide at runtime to use either Context or KScratch to hold the PGD
pointer.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
To: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/1876/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: David Daney <ddaney@caviumnetworks.com>
To: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/1875/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Probe c0_config4 for KScratch registers and report them in /proc/cpuinfo.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
To: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/1877/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

This patch adds a generic solution to support multiple machines based on
a given SoC within a single kernel image. It is implemented already for
several other architectures but MIPS has no generic support for that yet.

[Ralf: This competes with DT but DT is a much more complex solution and this
code has been used by OpenWRT for a long time so for now DT is a bad reason
to stop the merge but longer term this should be migrated to DT.]
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Cc: linux-mips@linux-mips.org
Cc: kaloz@openwrt.org
Cc: Luis R. Rodriguez <lrodriguez@atheros.com>
Cc: Cliff Holden <Cliff.Holden@Atheros.com>
Patchwork: https://patchwork.linux-mips.org/patch/1814/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Using %pR standardizes the struct resource output.
Signed-off-by: Joe Perches <joe@perches.com>
To: Jiri Kosina <trivial@kernel.org>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/1772/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Joe Perches <joe@perches.com>
To: Jiri Kosina <trivial@kernel.org>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/1756/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/parisc-2.6:
  parisc: fix compile breakage caused by inlining maybe_mkwrite
  parisc : Remove broken line wrapping handling pdc_iodc_print()

* 'next' of git://git.monstr.eu/linux-2.6-microblaze:
  microblaze: Fix asm/pgtable.h
  microblaze: Fix missing pagemap.h

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: hda - Fix initialization for HP 2011 notebooks
  ALSA: hda - Add support for VMware controller
  ALSA: hda - consitify string arrays
  ALSA: hda - Add add multi-streaming playback for AD1988
  ASoC: EP93xx: fixed LRCLK rate and DMA oper. in I2S code
  ASoC: WM8990: msleep() takes milliseconds not jiffies
  ALSA : au88x0 - Limit number of channels to fix Oops via OSS emu
  ALSA: constify functions in ac97
  ASoC: WL1273 FM radio: Fix breakage with MFD API changes
  ALSA: hda - More coverage for odd-number channels elimination for HDMI
  ALSA: hda - Store PCM parameters properly in HDMI open callback
  ALSA: hda - Rearrange fixup struct in patch_realtek.c
  ALSA: oxygen: Xonar DG: fix CS4245 register writes
  ALSA: hda - Suppress the odd number of channels for HDMI
  ALSA: hda - Add fixup-call in init callback
  ALSA: hda - Reorganize fixup structure for Realtek
  ALSA: hda - Apply Sony VAIO hweq fixup only once
  ALSA: hda - Apply mario fixup only once
  ALSA: hda - Remove unused fixup entry for ALC262