1. 25 Aug, 2017 3 commits
    • Linus Torvalds's avatar
      Merge tag 'sound-4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 8efeb350
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "We're keeping in a good shape, this batch contains just a few small
        fixes (a regression fix for ASoC rt5677 codec, NULL dereference and
        error-path fixes in firewire, and a corner-case ioctl error fix for
        user TLV), as well as usual quirks for USB-audio and HD-audio"
      
      * tag 'sound-4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ASoC: rt5677: Reintroduce I2C device IDs
        ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978)
        ALSA: core: Fix unexpected error at replacing user TLV
        ALSA: usb-audio: Add delay quirk for H650e/Jabra 550a USB headsets
        ALSA: firewire-motu: destroy stream data surely at failure of card initialization
        ALSA: firewire: fix NULL pointer dereference when releasing uninitialized data of iso-resource
      8efeb350
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-4.13-rc7' of git://git.infradead.org/users/vkoul/slave-dma · 985e7755
      Linus Torvalds authored
      Pull dmaengine fix from Vinod Koul:
       "A single fix for tegra210-adma driver to check of_irq_get() error"
      
      * tag 'dmaengine-fix-4.13-rc7' of git://git.infradead.org/users/vkoul/slave-dma:
        dmaengine: tegra210-adma: fix of_irq_get() error check
      985e7755
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.13-rc7' of git://people.freedesktop.org/~airlied/linux · 9e154001
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Fixes for rc7, nothing too crazy, some core, i915, and sunxi fixes,
        Intel CI has been responsible for some of these fixes being required"
      
      * tag 'drm-fixes-for-v4.13-rc7' of git://people.freedesktop.org/~airlied/linux:
        drm/i915/gvt: Fix the kernel null pointer error
        drm: Release driver tracking before making the object available again
        drm/i915: Clear lost context-switch interrupts across reset
        drm/i915/bxt: use NULL for GPIO connection ID
        drm/i915/cnl: Fix LSPCON support.
        drm/i915/vbt: ignore extraneous child devices for a port
        drm/i915: Initialize 'data' in intel_dsi_dcs_backlight.c
        drm/atomic: If the atomic check fails, return its value first
        drm/atomic: Handle -EDEADLK with out-fences correctly
        drm: Fix framebuffer leak
        drm/imx: ipuv3-plane: fix YUV framebuffer scanout on the base plane
        gpu: ipu-v3: add DRM dependency
        drm/rockchip: Fix suspend crash when drm is not bound
        drm/sun4i: Implement drm_driver lastclose to restore fbdev console
      9e154001
  2. 24 Aug, 2017 20 commits
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2017-08-24' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes · da611979
      Dave Airlie authored
      Core Changes:
      - Release driver tracking before making the object available again (Chris)
      
      Cc: Chris Wilson <chris@chris-wilson.co.uk>
      
      * tag 'drm-misc-fixes-2017-08-24' of git://anongit.freedesktop.org/git/drm-misc:
        drm: Release driver tracking before making the object available again
      da611979
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2017-08-24' of... · 4b5587c8
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2017-08-24' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes
      
      drm/i915 fixes for v4.13-rc7
      
      * tag 'drm-intel-fixes-2017-08-24' of git://anongit.freedesktop.org/git/drm-intel:
        drm/i915/gvt: Fix the kernel null pointer error
        drm/i915: Clear lost context-switch interrupts across reset
        drm/i915/bxt: use NULL for GPIO connection ID
        drm/i915/cnl: Fix LSPCON support.
        drm/i915/vbt: ignore extraneous child devices for a port
        drm/i915: Initialize 'data' in intel_dsi_dcs_backlight.c
      4b5587c8
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · 90a6cd50
      Linus Torvalds authored
      Pull more rdma fixes from Doug Ledford:
       "Well, I thought we were going to be done for this -rc cycle. I should
        have known better than to say so though.
      
        We have four additional items that trickled in.
      
        One was a simple mistake on my part. I took a patch into my for-next
        thinking that the issue was less severe than it was. I was then
        notified that it needed to be in my -rc area instead.
      
        The other three were just found late in testing.
      
        Summary:
      
         - One core fix accidentally applied first to for-next and then cherry
           picked back because it needed to be in the -rc cycles instead
      
         - Another core fix
      
         - Two mlx5 fixes"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
        IB/mlx5: Always return success for RoCE modify port
        IB/mlx5: Fix Raw Packet QP event handler assignment
        IB/core: Avoid accessing non-allocated memory when inferring port type
        RDMA/uverbs: Initialize cq_context appropriately
      90a6cd50
    • Linus Torvalds's avatar
      Merge tag 'acpi-4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 4898b99c
      Linus Torvalds authored
      Pull ACPI fixes from Rafael Wysocki:
       "These fix two recent regressions (in ACPICA and in the ACPI EC driver)
        and one bug in code introduced during the 4.12 cycle (ACPI device
        properties library routine).
      
        Specifics:
      
         - Fix a regression in the ACPI EC driver causing a kernel to crash
           during initialization on some systems due to a code ordering issue
           exposed by a recent change (Lv Zheng).
      
         - Fix a recent regression in ACPICA due to a change of the behavior
           of a library function in a way that is not backwards compatible
           with some existing callers of it (Rafael Wysocki).
      
         - Fix a coding mistake in a library function related to the handling
           of ACPI device properties introduced during the 4.12 cycle (Sakari
           Ailus)"
      
      * tag 'acpi-4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: device property: Fix node lookup in acpi_graph_get_child_prop_value()
        ACPICA: Fix acpi_evaluate_object_typed()
        ACPI: EC: Fix regression related to wrong ECDT initialization order
      4898b99c
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v4.13' of... · f7bbf075
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - fix linker script regression caused by dead code elimination support
      
       - fix typos and outdated comments
      
       - specify kselftest-clean as a PHONY target
      
       - fix "make dtbs_install" when $(srctree) includes shell special
         characters like '~'
      
       - Move -fshort-wchar to the global option list because defining it
         partially emits warnings
      
      * tag 'kbuild-fixes-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        kbuild: update comments of Makefile.asm-generic
        kbuild: Do not use hyphen in exported variable name
        Makefile: add kselftest-clean to PHONY target list
        Kbuild: use -fshort-wchar globally
        fixdep: trivial: typo fix and correction
        kbuild: trivial cleanups on the comments
        kbuild: linker script do not match C names unless LD_DEAD_CODE_DATA_ELIMINATION is configured
      f7bbf075
    • Linus Torvalds's avatar
      Merge branch 'for-4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · b71a5e3f
      Linus Torvalds authored
      Pull btrfs fix from David Sterba:
       "We have one more fixup that stems from the blk_status_t conversion
        that did not quite cover everything.
      
        The normal cases were not affected because the code is 0, but any
        error and retries could mix up new and old values"
      
      * 'for-4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        Btrfs: fix blk_status_t/errno confusion
      b71a5e3f
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 415be6c2
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
       "Various bug fixes:
      
         - Two small memory leaks in error paths.
      
         - A missed return error code on an error path.
      
         - A fix to check the tracing ring buffer CPU when it doesn't exist
           (caused by setting maxcpus on the command line that is less than
           the actual number of CPUs, and then onlining them manually).
      
         - A fix to have the reset of boot tracers called by lateinit_sync()
           instead of just lateinit(). As some of the tracers register via
           lateinit(), and if the clear happens before the tracer is
           registered, it will never start even though it was told to via the
           kernel command line"
      
      * tag 'trace-v4.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Fix freeing of filter in create_filter() when set_str is false
        tracing: Fix kmemleak in tracing_map_array_free()
        ftrace: Check for null ret_stack on profile function graph entry function
        ring-buffer: Have ring_buffer_alloc_read_page() return error on offline CPU
        tracing: Missing error code in tracer_alloc_buffers()
        tracing: Call clear_boot_tracer() at lateinit_sync
      415be6c2
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 1cffe595
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
       "A small number of bugfixes, again nothing serious.
      
         - Alexander Dahl found multiple bugs in the Atmel memory interface
           driver
      
         - A randconfig build fix for at91 was incomplete, the second attempt
           fixes the remaining corner case
      
         - One fix for the TI Keystone queue handler
      
         - The Odroid XU4 HDMI port (added in 4.13) needs a small DT fix"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: dts: exynos: add needs-hpd for Odroid-XU3/4
        ARM: at91: don't select CONFIG_ARM_CPU_SUSPEND for old platforms
        soc: ti: knav: Add a NULL pointer check for kdev in knav_pool_create
        memory: atmel-ebi: Fix smc cycle xlate converter
        memory: atmel-ebi: Allow t_DF timings of zero ns
        memory: atmel-ebi: Fix smc timing return value evaluation
      1cffe595
    • Eric W. Biederman's avatar
      pty: Repair TIOCGPTPEER · 311fc65c
      Eric W. Biederman authored
      The implementation of TIOCGPTPEER has two issues.
      
      When /dev/ptmx (as opposed to /dev/pts/ptmx) is opened the wrong
      vfsmount is passed to dentry_open.  Which results in the kernel displaying
      the wrong pathname for the peer.
      
      The second is simply by caching the vfsmount and dentry of the peer it leaves
      them open, in a way they were not previously Which because of the inreased
      reference counts can cause unnecessary behaviour differences resulting in
      regressions.
      
      To fix these move the ioctl into tty_io.c at a generic level allowing
      the ioctl to have access to the struct file on which the ioctl is
      being called.  This allows the path of the slave to be derived when
      opening the slave through TIOCGPTPEER instead of requiring the path to
      the slave be cached.  Thus removing the need for caching the path.
      
      A new function devpts_ptmx_path is factored out of devpts_acquire and
      used to implement a function devpts_mntget.   The new function devpts_mntget
      takes a filp to perform the lookup on and fsi so that it can confirm
      that the superblock that is found by devpts_ptmx_path is the proper superblock.
      
      v2: Lots of fixes to make the code actually work
      v3: Suggestions by Linus
          - Removed the unnecessary initialization of filp in ptm_open_peer
          - Simplified devpts_ptmx_path as gotos are no longer required
      
      [ This is the fix for the issue that was reverted in commit
        143c97cc, but this time without breaking 'pbuilder' due to
        increased reference counts   - Linus ]
      
      Fixes: 54ebbfb1 ("tty: add TIOCGPTPEER ioctl")
      Reported-by: default avatarChristian Brauner <christian.brauner@canonical.com>
      Reported-and-tested-by: default avatarStefan Lippers-Hollmann <s.l-h@gmx.de>
      Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      311fc65c
    • Rafael J. Wysocki's avatar
      Merge branches 'acpica-fix', 'acpi-ec-fix' and 'acpi-properties-fix' · d5d6c1dd
      Rafael J. Wysocki authored
      * acpica-fix:
        ACPICA: Fix acpi_evaluate_object_typed()
      
      * acpi-ec-fix:
        ACPI: EC: Fix regression related to wrong ECDT initialization order
      
      * acpi-properties-fix:
        ACPI: device property: Fix node lookup in acpi_graph_get_child_prop_value()
      d5d6c1dd
    • Majd Dibbiny's avatar
      IB/mlx5: Always return success for RoCE modify port · ec255879
      Majd Dibbiny authored
      CM layer calls ib_modify_port() regardless of the link layer.
      
      For the Ethernet ports, qkey violation and Port capabilities
      are meaningless. Therefore, always return success for ib_modify_port
      calls on the Ethernet ports.
      
      Cc: Selvin Xavier <selvin.xavier@broadcom.com>
      Signed-off-by: default avatarMajd Dibbiny <majd@mellanox.com>
      Reviewed-by: default avatarMoni Shoua <monis@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      ec255879
    • Majd Dibbiny's avatar
      IB/mlx5: Fix Raw Packet QP event handler assignment · 1d31e9c0
      Majd Dibbiny authored
      In case we have SQ and RQ for Raw Packet QP, the SQ's event handler
      wasn't assigned.
      
      Fixing this by assigning event handler for each WQ after creation.
      
      [ 1877.145243] Call Trace:
      [ 1877.148644] <IRQ>
      [ 1877.150580] [<ffffffffa07987c5>] ? mlx5_rsc_event+0x105/0x210 [mlx5_core]
      [ 1877.159581] [<ffffffffa0795bd7>] ? mlx5_cq_event+0x57/0xd0 [mlx5_core]
      [ 1877.167137] [<ffffffffa079208e>] mlx5_eq_int+0x53e/0x6c0 [mlx5_core]
      [ 1877.174526] [<ffffffff8101a679>] ? sched_clock+0x9/0x10
      [ 1877.180753] [<ffffffff810f717e>] handle_irq_event_percpu+0x3e/0x1e0
      [ 1877.188014] [<ffffffff810f735d>] handle_irq_event+0x3d/0x60
      [ 1877.194567] [<ffffffff810f9fe7>] handle_edge_irq+0x77/0x130
      [ 1877.201129] [<ffffffff81014c3f>] handle_irq+0xbf/0x150
      [ 1877.207244] [<ffffffff815ed78a>] ? atomic_notifier_call_chain+0x1a/0x20
      [ 1877.214829] [<ffffffff815f434f>] do_IRQ+0x4f/0xf0
      [ 1877.220498] [<ffffffff815e94ad>] common_interrupt+0x6d/0x6d
      [ 1877.227025] <EOI>
      [ 1877.228967] [<ffffffff814834e2>] ? cpuidle_enter_state+0x52/0xc0
      [ 1877.236990] [<ffffffff81483615>] cpuidle_idle_call+0xc5/0x200
      [ 1877.243676] [<ffffffff8101bc7e>] arch_cpu_idle+0xe/0x30
      [ 1877.249831] [<ffffffff810b4725>] cpu_startup_entry+0xf5/0x290
      [ 1877.256513] [<ffffffff815cfee1>] start_secondary+0x265/0x27b
      [ 1877.263111] Code: Bad RIP value.
      [ 1877.267296] RIP [< (null)>] (null)
      [ 1877.273264] RSP <ffff88046fd63df8>
      [ 1877.277531] CR2: 0000000000000000
      
      Fixes: 19098df2 ("IB/mlx5: Refactor mlx5_ib_qp to accommodate other QP types")
      Signed-off-by: default avatarMajd Dibbiny <majd@mellanox.com>
      Reviewed-by: default avatarYishai Hadas <yishaih@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      1d31e9c0
    • Noa Osherovich's avatar
      IB/core: Avoid accessing non-allocated memory when inferring port type · 498ca3c8
      Noa Osherovich authored
      Commit 44c58487 ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types")
      introduced the concept of type in ah_attr:
       * During ib_register_device, each port is checked for its type which
         is stored in ib_device's port_immutable array.
       * During uverbs' modify_qp, the type is inferred using the port number
         in ib_uverbs_qp_dest struct (address vector) by accessing the
         relevant port_immutable array and the type is passed on to
         providers.
      
      IB spec (version 1.3) enforces a valid port value only in Reset to
      Init. During Init to RTR, the address vector must be valid but port
      number is not mentioned as a field in the address vector, so its
      value is not validated, which leads to accesses to a non-allocated
      memory when inferring the port type.
      
      Save the real port number in ib_qp during modify to Init (when the
      comp_mask indicates that the port number is valid) and use this value
      to infer the port type.
      
      Avoid copying the address vector fields if the matching bit is not set
      in the attr_mask. Address vector can't be modified before the port, so
      no valid flow is affected.
      
      Fixes: 44c58487 ('IB/core: Define 'ib' and 'roce' rdma_ah_attr types')
      Signed-off-by: default avatarNoa Osherovich <noaos@mellanox.com>
      Reviewed-by: default avatarYishai Hadas <yishaih@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      498ca3c8
    • Tom Rini's avatar
      ASoC: rt5677: Reintroduce I2C device IDs · 9ce76511
      Tom Rini authored
      Not all devices with ACPI and this combination of sound devices will
      have the required information provided via ACPI.  Reintroduce the I2C
      device ID to restore sound functionality on on the Chromebook 'Samus'
      model.
      
      [ More background note:
       the commit a36afb0a ("ASoC: rt5677: Introduce proper table...")
       moved the i2c ID probed via ACPI ("RT5677CE:00") to a proper
       acpi_device_id table.  Although the action itself is correct per se,
       the overseen issue is the reference id->driver_data at
       rt5677_i2c_probe() for retrieving the corresponding chip model for
       the given id.  Since id=NULL is passed for ACPI matching case, we get
       an Oops now.
      
       We already have queued more fixes for 4.14 and they already address
       the issue, but they are bigger changes that aren't preferable for the
       late 4.13-rc stage.  So, this patch just papers over the bug as a
       once-off quick fix for a particular ACPI matching.  -- tiwai ]
      
      Fixes: a36afb0a ("ASoC: rt5677: Introduce proper table for ACPI enumeration")
      Signed-off-by: default avatarTom Rini <trini@konsulko.com>
      Acked-by: default avatarMark Brown <broonie@kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      9ce76511
    • Omar Sandoval's avatar
      Btrfs: fix blk_status_t/errno confusion · 58efbc9f
      Omar Sandoval authored
      This fixes several instances of blk_status_t and bare errno ints being
      mixed up, some of which are real bugs.
      
      In the normal case, 0 matches BLK_STS_OK, so we don't observe any
      effects of the missing conversion, but in case of errors or passes
      through the repair/retry paths, the errors get mixed up.
      
      The changes were identified using 'sparse', we don't have reports of the
      buggy behaviour.
      
      Fixes: 4e4cbee9 ("block: switch bios to blk_status_t")
      Signed-off-by: default avatarOmar Sandoval <osandov@fb.com>
      Reviewed-by: default avatarLiu Bo <bo.li.liu@oracle.com>
      Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      58efbc9f
    • Cao jin's avatar
    • Steven Rostedt (VMware)'s avatar
      tracing: Fix freeing of filter in create_filter() when set_str is false · 8b0db1a5
      Steven Rostedt (VMware) authored
      Performing the following task with kmemleak enabled:
      
       # cd /sys/kernel/tracing/events/irq/irq_handler_entry/
       # echo 'enable_event:kmem:kmalloc:3 if irq >' > trigger
       # echo 'enable_event:kmem:kmalloc:3 if irq > 31' > trigger
       # echo scan > /sys/kernel/debug/kmemleak
       # cat /sys/kernel/debug/kmemleak
      unreferenced object 0xffff8800b9290308 (size 32):
        comm "bash", pid 1114, jiffies 4294848451 (age 141.139s)
        hex dump (first 32 bytes):
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        backtrace:
          [<ffffffff81cef5aa>] kmemleak_alloc+0x4a/0xa0
          [<ffffffff81357938>] kmem_cache_alloc_trace+0x158/0x290
          [<ffffffff81261c09>] create_filter_start.constprop.28+0x99/0x940
          [<ffffffff812639c9>] create_filter+0xa9/0x160
          [<ffffffff81263bdc>] create_event_filter+0xc/0x10
          [<ffffffff812655e5>] set_trigger_filter+0xe5/0x210
          [<ffffffff812660c4>] event_enable_trigger_func+0x324/0x490
          [<ffffffff812652e2>] event_trigger_write+0x1a2/0x260
          [<ffffffff8138cf87>] __vfs_write+0xd7/0x380
          [<ffffffff8138f421>] vfs_write+0x101/0x260
          [<ffffffff8139187b>] SyS_write+0xab/0x130
          [<ffffffff81cfd501>] entry_SYSCALL_64_fastpath+0x1f/0xbe
          [<ffffffffffffffff>] 0xffffffffffffffff
      
      The function create_filter() is passed a 'filterp' pointer that gets
      allocated, and if "set_str" is true, it is up to the caller to free it, even
      on error. The problem is that the pointer is not freed by create_filter()
      when set_str is false. This is a bug, and it is not up to the caller to free
      the filter on error if it doesn't care about the string.
      
      Link: http://lkml.kernel.org/r/1502705898-27571-2-git-send-email-chuhu@redhat.com
      
      Cc: stable@vger.kernel.org
      Fixes: 38b78eb8 ("tracing: Factorize filter creation")
      Reported-by: default avatarChunyu Hu <chuhu@redhat.com>
      Tested-by: default avatarChunyu Hu <chuhu@redhat.com>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      8b0db1a5
    • Chunyu Hu's avatar
      tracing: Fix kmemleak in tracing_map_array_free() · 475bb3c6
      Chunyu Hu authored
      kmemleak reported the below leak when I was doing clear of the hist
      trigger. With this patch, the kmeamleak is gone.
      
      unreferenced object 0xffff94322b63d760 (size 32):
        comm "bash", pid 1522, jiffies 4403687962 (age 2442.311s)
        hex dump (first 32 bytes):
          00 01 00 00 04 00 00 00 08 00 00 00 ff 00 00 00  ................
          10 00 00 00 00 00 00 00 80 a8 7a f2 31 94 ff ff  ..........z.1...
        backtrace:
          [<ffffffff9e96c27a>] kmemleak_alloc+0x4a/0xa0
          [<ffffffff9e424cba>] kmem_cache_alloc_trace+0xca/0x1d0
          [<ffffffff9e377736>] tracing_map_array_alloc+0x26/0x140
          [<ffffffff9e261be0>] kretprobe_trampoline+0x0/0x50
          [<ffffffff9e38b935>] create_hist_data+0x535/0x750
          [<ffffffff9e38bd47>] event_hist_trigger_func+0x1f7/0x420
          [<ffffffff9e38893d>] event_trigger_write+0xfd/0x1a0
          [<ffffffff9e44dfc7>] __vfs_write+0x37/0x170
          [<ffffffff9e44f552>] vfs_write+0xb2/0x1b0
          [<ffffffff9e450b85>] SyS_write+0x55/0xc0
          [<ffffffff9e203857>] do_syscall_64+0x67/0x150
          [<ffffffff9e977ce7>] return_from_SYSCALL_64+0x0/0x6a
          [<ffffffffffffffff>] 0xffffffffffffffff
      unreferenced object 0xffff9431f27aa880 (size 128):
        comm "bash", pid 1522, jiffies 4403687962 (age 2442.311s)
        hex dump (first 32 bytes):
          00 00 8c 2a 32 94 ff ff 00 f0 8b 2a 32 94 ff ff  ...*2......*2...
          00 e0 8b 2a 32 94 ff ff 00 d0 8b 2a 32 94 ff ff  ...*2......*2...
        backtrace:
          [<ffffffff9e96c27a>] kmemleak_alloc+0x4a/0xa0
          [<ffffffff9e425348>] __kmalloc+0xe8/0x220
          [<ffffffff9e3777c1>] tracing_map_array_alloc+0xb1/0x140
          [<ffffffff9e261be0>] kretprobe_trampoline+0x0/0x50
          [<ffffffff9e38b935>] create_hist_data+0x535/0x750
          [<ffffffff9e38bd47>] event_hist_trigger_func+0x1f7/0x420
          [<ffffffff9e38893d>] event_trigger_write+0xfd/0x1a0
          [<ffffffff9e44dfc7>] __vfs_write+0x37/0x170
          [<ffffffff9e44f552>] vfs_write+0xb2/0x1b0
          [<ffffffff9e450b85>] SyS_write+0x55/0xc0
          [<ffffffff9e203857>] do_syscall_64+0x67/0x150
          [<ffffffff9e977ce7>] return_from_SYSCALL_64+0x0/0x6a
          [<ffffffffffffffff>] 0xffffffffffffffff
      
      Link: http://lkml.kernel.org/r/1502705898-27571-1-git-send-email-chuhu@redhat.com
      
      Cc: stable@vger.kernel.org
      Fixes: 08d43a5f ("tracing: Add lock-free tracing_map")
      Signed-off-by: default avatarChunyu Hu <chuhu@redhat.com>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      475bb3c6
    • Steven Rostedt (VMware)'s avatar
      ftrace: Check for null ret_stack on profile function graph entry function · a8f0f9e4
      Steven Rostedt (VMware) authored
      There's a small race when function graph shutsdown and the calling of the
      registered function graph entry callback. The callback must not reference
      the task's ret_stack without first checking that it is not NULL. Note, when
      a ret_stack is allocated for a task, it stays allocated until the task exits.
      The problem here, is that function_graph is shutdown, and a new task was
      created, which doesn't have its ret_stack allocated. But since some of the
      functions are still being traced, the callbacks can still be called.
      
      The normal function_graph code handles this, but starting with commit
      8861dd30 ("ftrace: Access ret_stack->subtime only in the function
      profiler") the profiler code references the ret_stack on function entry, but
      doesn't check if it is NULL first.
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=196611
      
      Cc: stable@vger.kernel.org
      Fixes: 8861dd30 ("ftrace: Access ret_stack->subtime only in the function profiler")
      Reported-by: lilydjwg@gmail.com
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      a8f0f9e4
    • Linus Torvalds's avatar
      Revert "pty: fix the cached path of the pty slave file descriptor in the master" · 143c97cc
      Linus Torvalds authored
      This reverts commit c8c03f18.
      
      It turns out that while fixing the ptmx file descriptor to have the
      correct 'struct path' to the associated slave pty is a really good
      thing, it breaks some user space tools for a very annoying reason.
      
      The problem is that /dev/ptmx and its associated slave pty (/dev/pts/X)
      are on different mounts.  That was what caused us to have the wrong path
      in the first place (we would mix up the vfsmount of the 'ptmx' node,
      with the dentry of the pty slave node), but it also means that now while
      we use the right vfsmount, having the pty master open also keeps the pts
      mount busy.
      
      And it turn sout that that makes 'pbuilder' very unhappy, as noted by
      Stefan Lippers-Hollmann:
      
       "This patch introduces a regression for me when using pbuilder
        0.228.7[2] (a helper to build Debian packages in a chroot and to
        create and update its chroots) when trying to umount /dev/ptmx (inside
        the chroot) on Debian/ unstable (full log and pbuilder configuration
        file[3] attached).
      
        [...]
        Setting up build-essential (12.3) ...
        Processing triggers for libc-bin (2.24-15) ...
        I: unmounting dev/ptmx filesystem
        W: Could not unmount dev/ptmx: umount: /var/cache/pbuilder/build/1340/dev/ptmx: target is busy
                (In some cases useful info about processes that
                 use the device is found by lsof(8) or fuser(1).)"
      
      apparently pbuilder tries to unmount the /dev/pts filesystem while still
      holding at least one master node open, which is arguably not very nice,
      but we don't break user space even when fixing other bugs.
      
      So this commit has to be reverted.
      
      I'll try to figure out a way to avoid caching the path to the slave pty
      in the master pty.  The only thing that actually wants that slave pty
      path is the "TIOCGPTPEER" ioctl, and I think we could just recreate the
      path at that time.
      Reported-by: default avatarStefan Lippers-Hollmann <s.l-h@gmx.de>
      Cc: Eric W Biederman <ebiederm@xmission.com>
      Cc: Christian Brauner <christian.brauner@canonical.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      143c97cc
  3. 23 Aug, 2017 9 commits
  4. 22 Aug, 2017 8 commits