1. 21 Jun, 2015 1 commit
  2. 18 Jun, 2015 1 commit
    • Nikolay Aleksandrov's avatar
      bridge: fix br_stp_set_bridge_priority race conditions · 2dab80a8
      Nikolay Aleksandrov authored
      After the ->set() spinlocks were removed br_stp_set_bridge_priority
      was left running without any protection when used via sysfs. It can
      race with port add/del and could result in use-after-free cases and
      corrupted lists. Tested by running port add/del in a loop with stp
      enabled while setting priority in a loop, crashes are easily
      reproducible.
      The spinlocks around sysfs ->set() were removed in commit:
      14f98f25 ("bridge: range check STP parameters")
      There's also a race condition in the netlink priority support that is
      fixed by this change, but it was introduced recently and the fixes tag
      covers it, just in case it's needed the commit is:
      af615762 ("bridge: add ageing_time, stp_state, priority over netlink")
      Signed-off-by: default avatarNikolay Aleksandrov <razor@blackwall.org>
      Fixes: 14f98f25 ("bridge: range check STP parameters")
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2dab80a8
  3. 15 Jun, 2015 1 commit
  4. 14 Jun, 2015 1 commit
    • Marcelo Ricardo Leitner's avatar
      sctp: fix ASCONF list handling · 2d45a02d
      Marcelo Ricardo Leitner authored
      ->auto_asconf_splist is per namespace and mangled by functions like
      sctp_setsockopt_auto_asconf() which doesn't guarantee any serialization.
      
      Also, the call to inet_sk_copy_descendant() was backuping
      ->auto_asconf_list through the copy but was not honoring
      ->do_auto_asconf, which could lead to list corruption if it was
      different between both sockets.
      
      This commit thus fixes the list handling by using ->addr_wq_lock
      spinlock to protect the list. A special handling is done upon socket
      creation and destruction for that. Error handlig on sctp_init_sock()
      will never return an error after having initialized asconf, so
      sctp_destroy_sock() can be called without addrq_wq_lock. The lock now
      will be take on sctp_close_sock(), before locking the socket, so we
      don't do it in inverse order compared to sctp_addr_wq_timeout_handler().
      
      Instead of taking the lock on sctp_sock_migrate() for copying and
      restoring the list values, it's preferred to avoid rewritting it by
      implementing sctp_copy_descendant().
      
      Issue was found with a test application that kept flipping sysctl
      default_auto_asconf on and off, but one could trigger it by issuing
      simultaneous setsockopt() calls on multiple sockets or by
      creating/destroying sockets fast enough. This is only triggerable
      locally.
      
      Fixes: 9f7d653b ("sctp: Add Auto-ASCONF support (core).")
      Reported-by: default avatarJi Jianwen <jiji@redhat.com>
      Suggested-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Suggested-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
      Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      2d45a02d
  5. 13 Jun, 2015 1 commit
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · c8d17b45
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Fix uninitialized struct station_info in cfg80211_wireless_stats(),
          from Johannes Berg.
      
       2) Revert commit attempt to fix ipv6 protocol resubmission, it adds
          regressions.
      
       3) Endless loops can be created in bridge port lists, fix from Nikolay
          Aleksandrov.
      
       4) Don't WARN_ON() if sk->sk_forward_alloc is non-zero in
          sk_clear_memalloc, it is a legal situation during swap deactivation.
          Fix from Mel Gorman.
      
       5) Fix order of disabling interrupts and unlocking NAPI in enic driver
          to avoid a race.  From Govindarajulu Varadarajan.
      
       6) High and low register writes are swapped when programming the start
          of periodic output in igb driver.  From Richard Cochran.
      
       7) Fix device rename handling in mpls stack, from Robert Shearman.
      
       8) Do not trigger compaction synchronously when optimistically trying
          to allocate an order 3 page in alloc_skb_with_frags() and
          skb_page_frag_refill().  From Shaohua Li.
      
       9) Authentication with COOKIE_ECHO is not handled properly in SCTP, fix
          from Marcelo Ricardo Leitner.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
        Doc: networking: Fix URL for wiki.wireshark.org in udplite.txt
        sctp: allow authenticating DATA chunks that are bundled with COOKIE_ECHO
        net: don't wait for order-3 page allocation
        mpls: handle device renames for per-device sysctls
        net: igb: fix the start time for periodic output signals
        enic: fix memory leak in rq_clean
        enic: check return value for stat dump
        enic: unlock napi busy poll before unmasking intr
        net, swap: Remove a warning and clarify why sk_mem_reclaim is required when deactivating swap
        bridge: fix multicast router rlist endless loop
        tipc: disconnect socket directly after probe failure
        Revert "ipv6: Fix protocol resubmission"
        cfg80211: wext: clear sinfo struct before calling driver
      c8d17b45
  6. 12 Jun, 2015 13 commits
    • Masanari Iida's avatar
      Doc: networking: Fix URL for wiki.wireshark.org in udplite.txt · b07d4961
      Masanari Iida authored
      This patch fix URL (http to https) for wiki.wireshark.org.
      Signed-off-by: default avatarMasanari Iida <standby24x7@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b07d4961
    • Marcelo Ricardo Leitner's avatar
      sctp: allow authenticating DATA chunks that are bundled with COOKIE_ECHO · ae36806a
      Marcelo Ricardo Leitner authored
      Currently, we can ask to authenticate DATA chunks and we can send DATA
      chunks on the same packet as COOKIE_ECHO, but if you try to combine
      both, the DATA chunk will be sent unauthenticated and peer won't accept
      it, leading to a communication failure.
      
      This happens because even though the data was queued after it was
      requested to authenticate DATA chunks, it was also queued before we
      could know that remote peer can handle authenticating, so
      sctp_auth_send_cid() returns false.
      
      The fix is whenever we set up an active key, re-check send queue for
      chunks that now should be authenticated. As a result, such packet will
      now contain COOKIE_ECHO + AUTH + DATA chunks, in that order.
      Reported-by: default avatarLiu Wei <weliu@redhat.com>
      Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
      Acked-by: default avatarVlad Yasevich <vyasevich@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      ae36806a
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · b85dfd30
      Linus Torvalds authored
      Pull block layer fixes from Jens Axboe:
       "Remember about a week ago when I sent the last pull request for 4.1?
        Well, I lied.  Now, I don't want to shift the blame, but Dan, Ming,
        and Richard made a liar out of me.
      
        Here are three small patches that should go into 4.1.  More
        specifically, this pull request contains:
      
         - A Kconfig dependency for the pmem block driver, so it can't be
           selected if HAS_IOMEM isn't availble.  From Richard Weinberger.
      
         - A fix for genhd, making the ext_devt_lock softirq safe.  This makes
           lockdep happier, since we also end up grabbing this lock on release
           off the softirq path.  From Dan Williams.
      
         - A blk-mq software queue release fix from Ming Lei.
      
        Last two are headed to stable, first fixes an issue introduced in this
        cycle"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        block: pmem: Add dependency on HAS_IOMEM
        block: fix ext_dev_lock lockdep report
        blk-mq: free hctx->ctxs in queue's release handler
      b85dfd30
    • Linus Torvalds's avatar
      Merge tag 'md/4.1-rc7-fixes' of git://neil.brown.name/md · 7b565d9d
      Linus Torvalds authored
      Pull three more md fixes from Neil Brown:
       "Hasn't been a good cycle for md has it :-(
      
        The main issue fixed here is a rare race which can result in two
        reshape threads running at once, which doesn't end well.
      
        Also a minor issue with a write to a sysfs file returning the wrong
        value.  Backports to 4.0-stable are indicated"
      
      * tag 'md/4.1-rc7-fixes' of git://neil.brown.name/md:
        md: make sure MD_RECOVERY_DONE is clear before starting recovery/resync
        md: Close race when setting 'action' to 'idle'.
        md: don't return 0 from array_state_store
      7b565d9d
    • Linus Torvalds's avatar
      Merge git://git.infradead.org/intel-iommu · c39f3bc6
      Linus Torvalds authored
      Pull VT-d hardware workarounds from David Woodhouse:
       "This contains a workaround for hardware issues which I *thought* were
        never going to be seen on production hardware.  I'm glad I checked
        that before the 4.1 release...
      
        Firstly, PASID support is so broken on existing chips that we're just
        going to declare the old capability bit 28 as 'reserved' and change
        the VT-d spec to move PASID support to another bit.  So any existing
        hardware doesn't support SVM; it only sets that (now) meaningless bit
        28.
      
        That patch *wasn't* imperative for 4.1 because we don't have PASID
        support yet.  But *even* the extended context tables are broken — if
        you just enable the wider tables and use none of the new bits in them,
        which is precisely what 4.1 does, you find that translations don't
        work.  It's this problem which I thought was caught in time to be
        fixed before production, but wasn't.
      
        To avoid triggering this issue, we now *only* enable the extended
        context tables on hardware which also advertises "we have PASID
        support and we actually tested it this time" with the new PASID
        feature bit.
      
        In addition, I've added an 'intel_iommu=ecs_off' command line
        parameter to allow us to disable it manually if we need to"
      
      * git://git.infradead.org/intel-iommu:
        iommu/vt-d: Only enable extended context tables if PASID is supported
        iommu/vt-d: Change PASID support to bit 40 of Extended Capability Register
      c39f3bc6
    • David Woodhouse's avatar
      iommu/vt-d: Only enable extended context tables if PASID is supported · c83b2f20
      David Woodhouse authored
      Although the extended tables are theoretically a completely orthogonal
      feature to PASID and anything else that *uses* the newly-available bits,
      some of the early hardware has problems even when all we do is enable
      them and use only the same bits that were in the old context tables.
      
      For now, there's no motivation to support extended tables unless we're
      going to use PASID support to do SVM. So just don't use them unless
      PASID support is advertised too. Also add a command-line bailout just in
      case later chips also have issues.
      
      The equivalent problem for PASID support has already been fixed with the
      upcoming VT-d spec update and commit bd00c606 ("iommu/vt-d: Change
      PASID support to bit 40 of Extended Capability Register"), because the
      problematic platforms use the old definition of the PASID-capable bit,
      which is now marked as reserved and meaningless.
      
      So with this change, we'll magically start using ECS again only when we
      see the new hardware advertising "hey, we have PASID support and we
      actually tested it this time" on bit 40.
      
      The VT-d hardware architect has promised that we are not going to have
      any reason to support ECS *without* PASID any time soon, and he'll make
      sure he checks with us before changing that.
      
      In the future, if hypothetical new features also use new bits in the
      context tables and can be seen on implementations *without* PASID support,
      we might need to add their feature bits to the ecs_enabled() macro.
      Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
      c83b2f20
    • NeilBrown's avatar
      md: make sure MD_RECOVERY_DONE is clear before starting recovery/resync · ea358cd0
      NeilBrown authored
      MD_RECOVERY_DONE is normally cleared by md_check_recovery after a
      resync etc finished.  However it is possible for raid5_start_reshape
      to race and start a reshape before MD_RECOVERY_DONE is cleared.  This
      can lean to multiple reshapes running at the same time, which isn't
      good.
      
      To make sure it is cleared before starting a reshape, and also clear
      it when reaping a thread, just to be safe.
      Signed-off-by: default avatarNeilBrown  <neilb@suse.de>
      ea358cd0
    • NeilBrown's avatar
      md: Close race when setting 'action' to 'idle'. · 8e8e2518
      NeilBrown authored
      Checking ->sync_thread without holding the mddev_lock()
      isn't really safe, even after flushing the workqueue which
      ensures md_start_sync() has been run.
      
      While this code is waiting for the lock, md_check_recovery could reap
      the thread itself, and then start another thread (e.g. recovery might
      finish, then reshape starts).  When this thread gets the lock
      md_start_sync() hasn't run so it doesn't get reaped, but
      MD_RECOVERY_RUNNING gets cleared.  This allows two threads to start
      which leads to confusion.
      
      So don't both if MD_RECOVERY_RUNNING isn't set, but if it is do
      the flush and the test and the reap all under the mddev_lock to
      avoid any race with md_check_recovery.
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      Fixes: 6791875e ("md: make reconfig_mutex optional for writes to md sysfs files.")
      Cc: stable@vger.kernel.org (v4.0+)
      8e8e2518
    • NeilBrown's avatar
      md: don't return 0 from array_state_store · c008f1d3
      NeilBrown authored
      Returning zero from a 'store' function is bad.
      The return value should be either len length of the string
      or an error.
      
      So use 'len' if 'err' is zero.
      
      Fixes: 6791875e ("md: make reconfig_mutex optional for writes to md sysfs files.")
      Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      Cc: stable@vger.kernel (v4.0+)
      c008f1d3
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · df5f4158
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "i915 and radeon fixes:
      
        i915:
            fix for connector oops regression
            DDC probing fix
      
        radeon:
            two radeon reverts, along with a freeze workaround and a fix"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/radeon: Make sure radeon_vm_bo_set_addr always unreserves the BO
        Revert "drm/radeon: adjust pll when audio is not enabled"
        Revert "drm/radeon: don't share plls if monitors differ in audio support"
        drm/radeon: fix freeze for laptop with Turks/Thames GPU.
        drm/i915: Fix DDC probe for passive adapters
        drm/i915: Properly initialize SDVO analog connectors
      df5f4158
    • Shaohua Li's avatar
      net: don't wait for order-3 page allocation · fb05e7a8
      Shaohua Li authored
      We saw excessive direct memory compaction triggered by skb_page_frag_refill.
      This causes performance issues and add latency. Commit 5640f768
      introduces the order-3 allocation. According to the changelog, the order-3
      allocation isn't a must-have but to improve performance. But direct memory
      compaction has high overhead. The benefit of order-3 allocation can't
      compensate the overhead of direct memory compaction.
      
      This patch makes the order-3 page allocation atomic. If there is no memory
      pressure and memory isn't fragmented, the alloction will still success, so we
      don't sacrifice the order-3 benefit here. If the atomic allocation fails,
      direct memory compaction will not be triggered, skb_page_frag_refill will
      fallback to order-0 immediately, hence the direct memory compaction overhead is
      avoided. In the allocation failure case, kswapd is waken up and doing
      compaction, so chances are allocation could success next time.
      
      alloc_skb_with_frags is the same.
      
      The mellanox driver does similar thing, if this is accepted, we must fix
      the driver too.
      
      V3: fix the same issue in alloc_skb_with_frags as pointed out by Eric
      V2: make the changelog clearer
      
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Chris Mason <clm@fb.com>
      Cc: Debabrata Banerjee <dbavatar@gmail.com>
      Signed-off-by: default avatarShaohua Li <shli@fb.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fb05e7a8
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2015-06-11' of git://anongit.freedesktop.org/drm-intel into drm-fixes · 6e2eb00f
      Dave Airlie authored
      Fix for the regression Linus called out, and another for probing
      dongles.
      
      * tag 'drm-intel-fixes-2015-06-11' of git://anongit.freedesktop.org/drm-intel:
        drm/i915: Fix DDC probe for passive adapters
        drm/i915: Properly initialize SDVO analog connectors
      6e2eb00f
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-4.1' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 950c3707
      Dave Airlie authored
      Two regression reverts, and two fixes, one for a dpm boot freeze.
      
      * 'drm-fixes-4.1' of git://people.freedesktop.org/~agd5f/linux:
        drm/radeon: Make sure radeon_vm_bo_set_addr always unreserves the BO
        Revert "drm/radeon: adjust pll when audio is not enabled"
        Revert "drm/radeon: don't share plls if monitors differ in audio support"
        drm/radeon: fix freeze for laptop with Turks/Thames GPU.
      950c3707
  7. 11 Jun, 2015 17 commits
    • Robert Shearman's avatar
      mpls: handle device renames for per-device sysctls · 0fae3bf0
      Robert Shearman authored
      If a device is renamed and the original name is subsequently reused
      for a new device, the following warning is generated:
      
      sysctl duplicate entry: /net/mpls/conf/veth0//input
      CPU: 3 PID: 1379 Comm: ip Not tainted 4.1.0-rc4+ #20
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
       0000000000000000 0000000000000000 ffffffff81566aaf 0000000000000000
       ffffffff81236279 ffff88002f7d7f00 0000000000000000 ffff88000db336d8
       ffff88000db33698 0000000000000005 ffff88002e046000 ffff8800168c9280
      Call Trace:
       [<ffffffff81566aaf>] ? dump_stack+0x40/0x50
       [<ffffffff81236279>] ? __register_sysctl_table+0x289/0x5a0
       [<ffffffffa051a24f>] ? mpls_dev_notify+0x1ff/0x300 [mpls_router]
       [<ffffffff8108db7f>] ? notifier_call_chain+0x4f/0x70
       [<ffffffff81470e72>] ? register_netdevice+0x2b2/0x480
       [<ffffffffa0524748>] ? veth_newlink+0x178/0x2d3 [veth]
       [<ffffffff8147f84c>] ? rtnl_newlink+0x73c/0x8e0
       [<ffffffff8147f27a>] ? rtnl_newlink+0x16a/0x8e0
       [<ffffffff81459ff2>] ? __kmalloc_reserve.isra.30+0x32/0x90
       [<ffffffff8147ccfd>] ? rtnetlink_rcv_msg+0x8d/0x250
       [<ffffffff8145b027>] ? __alloc_skb+0x47/0x1f0
       [<ffffffff8149badb>] ? __netlink_lookup+0xab/0xe0
       [<ffffffff8147cc70>] ? rtnetlink_rcv+0x30/0x30
       [<ffffffff8149e7a0>] ? netlink_rcv_skb+0xb0/0xd0
       [<ffffffff8147cc64>] ? rtnetlink_rcv+0x24/0x30
       [<ffffffff8149df17>] ? netlink_unicast+0x107/0x1a0
       [<ffffffff8149e4be>] ? netlink_sendmsg+0x50e/0x630
       [<ffffffff8145209c>] ? sock_sendmsg+0x3c/0x50
       [<ffffffff81452beb>] ? ___sys_sendmsg+0x27b/0x290
       [<ffffffff811bd258>] ? mem_cgroup_try_charge+0x88/0x110
       [<ffffffff811bd5b6>] ? mem_cgroup_commit_charge+0x56/0xa0
       [<ffffffff811d7700>] ? do_filp_open+0x30/0xa0
       [<ffffffff8145336e>] ? __sys_sendmsg+0x3e/0x80
       [<ffffffff8156c3f2>] ? system_call_fastpath+0x16/0x75
      
      Fix this by unregistering the previous sysctl table (registered for
      the path containing the original device name) and re-registering the
      table for the path containing the new device name.
      
      Fixes: 37bde799 ("mpls: Per-device enabling of packet input")
      Reported-by: default avatarScott Feldman <sfeldma@gmail.com>
      Signed-off-by: default avatarRobert Shearman <rshearma@brocade.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0fae3bf0
    • Richard Cochran's avatar
      net: igb: fix the start time for periodic output signals · 58c98be1
      Richard Cochran authored
      When programming the start of a periodic output, the code wrongly places
      the seconds value into the "low" register and the nanoseconds into the
      "high" register.  Even though this is backwards, it slipped through my
      testing, because the re-arming code in the interrupt service routine is
      correct, and the signal does appear starting with the second edge.
      
      This patch fixes the issue by programming the registers correctly.
      Signed-off-by: default avatarRichard Cochran <richardcochran@gmail.com>
      Reviewed-by: default avatarJacob Keller <jacob.e.keller@intel.com>
      Acked-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      58c98be1
    • Richard Weinberger's avatar
      block: pmem: Add dependency on HAS_IOMEM · b6f2098f
      Richard Weinberger authored
      Not all architectures have io memory.
      
      Fixes:
      drivers/block/pmem.c: In function ‘pmem_alloc’:
      drivers/block/pmem.c:146:2: error: implicit declaration of function ‘ioremap_nocache’ [-Werror=implicit-function-declaration]
        pmem->virt_addr = ioremap_nocache(pmem->phys_addr, pmem->size);
        ^
      drivers/block/pmem.c:146:18: warning: assignment makes pointer from integer without a cast [enabled by default]
        pmem->virt_addr = ioremap_nocache(pmem->phys_addr, pmem->size);
                        ^
      drivers/block/pmem.c:182:2: error: implicit declaration of function ‘iounmap’ [-Werror=implicit-function-declaration]
        iounmap(pmem->virt_addr);
        ^
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      Reviewed-by: default avatarRoss Zwisler <ross.zwisler@linux.intel.com>
      Signed-off-by: default avatarJens Axboe <axboe@fb.com>
      b6f2098f
    • Linus Torvalds's avatar
      Merge tag 'trace-rb-bm-fix-4.1-rc7' of... · cff100f5
      Linus Torvalds authored
      Merge tag 'trace-rb-bm-fix-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
      
      Pull ring buffer benchmark buglet fix from Steven Rostedt:
       "Wang Long fixed a minor bug in the module parameter for the ring
        buffer benchmark, where the produce_fifo was being ignored and the
        producer thread's priority was being set with the consumer_fifo
        parameter"
      
      * tag 'trace-rb-bm-fix-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        ring-buffer-benchmark: Fix the wrong sched_priority of producer
      cff100f5
    • Dan Williams's avatar
      block: fix ext_dev_lock lockdep report · 4d66e5e9
      Dan Williams authored
       =================================
       [ INFO: inconsistent lock state ]
       4.1.0-rc7+ #217 Tainted: G           O
       ---------------------------------
       inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
       swapper/6/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
        (ext_devt_lock){+.?...}, at: [<ffffffff8143a60c>] blk_free_devt+0x3c/0x70
       {SOFTIRQ-ON-W} state was registered at:
         [<ffffffff810bf6b1>] __lock_acquire+0x461/0x1e70
         [<ffffffff810c1947>] lock_acquire+0xb7/0x290
         [<ffffffff818ac3a8>] _raw_spin_lock+0x38/0x50
         [<ffffffff8143a07d>] blk_alloc_devt+0x6d/0xd0  <-- take the lock in process context
      [..]
        [<ffffffff810bf64e>] __lock_acquire+0x3fe/0x1e70
        [<ffffffff810c00ad>] ? __lock_acquire+0xe5d/0x1e70
        [<ffffffff810c1947>] lock_acquire+0xb7/0x290
        [<ffffffff8143a60c>] ? blk_free_devt+0x3c/0x70
        [<ffffffff818ac3a8>] _raw_spin_lock+0x38/0x50
        [<ffffffff8143a60c>] ? blk_free_devt+0x3c/0x70
        [<ffffffff8143a60c>] blk_free_devt+0x3c/0x70    <-- take the lock in softirq
        [<ffffffff8143bfec>] part_release+0x1c/0x50
        [<ffffffff8158edf6>] device_release+0x36/0xb0
        [<ffffffff8145ac2b>] kobject_cleanup+0x7b/0x1a0
        [<ffffffff8145aad0>] kobject_put+0x30/0x70
        [<ffffffff8158f147>] put_device+0x17/0x20
        [<ffffffff8143c29c>] delete_partition_rcu_cb+0x16c/0x180
        [<ffffffff8143c130>] ? read_dev_sector+0xa0/0xa0
        [<ffffffff810e0e0f>] rcu_process_callbacks+0x2ff/0xa90
        [<ffffffff810e0dcf>] ? rcu_process_callbacks+0x2bf/0xa90
        [<ffffffff81067e2e>] __do_softirq+0xde/0x600
      
      Neil sees this in his tests and it also triggers on pmem driver unbind
      for the libnvdimm tests.  This fix is on top of an initial fix by Keith
      for incorrect usage of mutex_lock() in this path: 2da78092 "block:
      Fix dev_t minor allocation lifetime".  Both this and 2da78092 are
      candidates for -stable.
      
      Fixes: 2da78092 ("block: Fix dev_t minor allocation lifetime")
      Cc: <stable@vger.kernel.org>
      Cc: Keith Busch <keith.busch@intel.com>
      Reported-by: default avatarNeilBrown <neilb@suse.de>
      Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
      Signed-off-by: default avatarJens Axboe <axboe@fb.com>
      4d66e5e9
    • Michel Dänzer's avatar
      drm/radeon: Make sure radeon_vm_bo_set_addr always unreserves the BO · ee18e599
      Michel Dänzer authored
      Some error paths didn't unreserve the BO. This resulted in a deadlock
      down the road on the next attempt to reserve the (still reserved) BO.
      
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=90873
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarMichel Dänzer <michel.daenzer@amd.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      ee18e599
    • Alex Deucher's avatar
      Revert "drm/radeon: adjust pll when audio is not enabled" · ebb9bf18
      Alex Deucher authored
      This reverts commit 7fe04d6f.
      
      Fixes some systems at the expense of others.  Need to properly
      fix the pll divider selection.
      
      bug:
      https://bugzilla.kernel.org/show_bug.cgi?id=99651
      
      Cc: stable@vger.kernel.org
      ebb9bf18
    • Alex Deucher's avatar
      Revert "drm/radeon: don't share plls if monitors differ in audio support" · 6fb3c025
      Alex Deucher authored
      This reverts commit a10f0df0.
      
      Fixes some systems at the expense of others.  Need to properly
      fix the pll divider selection.
      
      bug:
      https://bugzilla.kernel.org/show_bug.cgi?id=99651
      
      Cc: stable@vger.kernel.org
      6fb3c025
    • Jérôme Glisse's avatar
      drm/radeon: fix freeze for laptop with Turks/Thames GPU. · 6dfd1972
      Jérôme Glisse authored
      Laptop with Turks/Thames GPU will freeze if dpm is enabled. It seems
      the SMC engine is relying on some state inside the CP engine. CP needs
      to chew at least one packet for it to get in good state for dynamic
      power management.
      
      This patch simply disabled and re-enable DPM after the ring test which
      is enough to avoid the freeze.
      Signed-off-by: default avatarJérôme Glisse <jglisse@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      6dfd1972
    • Wang Long's avatar
      ring-buffer-benchmark: Fix the wrong sched_priority of producer · 10802932
      Wang Long authored
      The producer should be used producer_fifo as its sched_priority,
      so correct it.
      
      Link: http://lkml.kernel.org/r/1433923957-67842-1-git-send-email-long.wanglong@huawei.com
      
      Cc: stable@vger.kernel.org # 2.6.33+
      Signed-off-by: default avatarWang Long <long.wanglong@huawei.com>
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      10802932
    • Govindarajulu Varadarajan's avatar
      enic: fix memory leak in rq_clean · 8b13b4e0
      Govindarajulu Varadarajan authored
      When incoming packet qualifies for rx_copybreak, we copy the data to newly
      allocated skb. We do not free/unmap the original buffer. At this point driver
      assumes this buffer is unallocated. When enic_rq_alloc_buf() is called for
      buffer allocation, it checks if buf->os_buf is NULL. If its not NULL that means
      buffer can be re-used.
      
      When vnic_rq_clean() is called for freeing all rq buffers, and if the
      rx_copybreak reused buffer falls outside the used desc, we do not free the
      buffer. The following trace is observer when dma-debug is enabled.
      
      Fix is to walk through complete ring and clean if buffer is present.
      
      [   40.555386] ------------[ cut here ]------------
      [   40.555396] WARNING: CPU: 0 PID: 491 at lib/dma-debug.c:971 dma_debug_device_change+0x188/0x1f0()
      [   40.555400] pci 0000:06:00.0: DMA-API: device driver has pending DMA allocations while released from device [count=4]
                     One of leaked entries details: [device address=0x00000000ff4cc040] [size=9018 bytes] [mapped with DMA_FROM_DEVICE] [mapped as single]
      [   40.555402] Modules linked in: nfsv3 nfs_acl rpcsec_gss_krb5 auth_rpcgss oid_registry nfsv4 dns_resolver coretemp intel_rapl iosf_mbi x86_pkg_temp_thermal intel_powerclamp kvm_intel kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64 lrw joydev mousedev gf128mul hid_generic glue_helper mgag200 usbhid ttm hid drm_kms_helper drm ablk_helper syscopyarea sysfillrect sysimgblt i2c_algo_bit i2c_core iTCO_wdt cryptd mac_hid evdev pcspkr sb_edac edac_core tpm_tis iTCO_vendor_support ipmi_si wmi tpm ipmi_msghandler shpchp lpc_ich processor acpi_power_meter hwmon button ac sch_fq_codel nfs lockd grace sunrpc fscache sd_mod ehci_pci ehci_hcd megaraid_sas usbcore scsi_mod usb_common enic(-) crc32c_generic crc32c_intel btrfs xor raid6_pq ext4 crc16 mbcache jbd2
      [   40.555467] CPU: 0 PID: 491 Comm: rmmod Not tainted 4.1.0-rc7-ARCH-01305-gf59b71f #118
      [   40.555469] Hardware name: Cisco Systems Inc UCSB-B200-M4/UCSB-B200-M4, BIOS B200M4.2.2.2.23.061220140128 06/12/2014
      [   40.555471]  0000000000000000 00000000e2f8a5b7 ffff880275f8bc48 ffffffff8158d6f0
      [   40.555474]  0000000000000000 ffff880275f8bca0 ffff880275f8bc88 ffffffff8107b04a
      [   40.555477]  ffff8802734e0000 0000000000000004 ffff8804763fb3c0 ffff88027600b650
      [   40.555480] Call Trace:
      [   40.555488]  [<ffffffff8158d6f0>] dump_stack+0x4f/0x7b
      [   40.555492]  [<ffffffff8107b04a>] warn_slowpath_common+0x8a/0xc0
      [   40.555494]  [<ffffffff8107b0d5>] warn_slowpath_fmt+0x55/0x70
      [   40.555498]  [<ffffffff812fa408>] dma_debug_device_change+0x188/0x1f0
      [   40.555503]  [<ffffffff8109aaef>] notifier_call_chain+0x4f/0x80
      [   40.555506]  [<ffffffff8109aecb>] __blocking_notifier_call_chain+0x4b/0x70
      [   40.555510]  [<ffffffff8109af06>] blocking_notifier_call_chain+0x16/0x20
      [   40.555514]  [<ffffffff813f8066>] __device_release_driver+0xf6/0x120
      [   40.555518]  [<ffffffff813f8b08>] driver_detach+0xc8/0xd0
      [   40.555523]  [<ffffffff813f7c59>] bus_remove_driver+0x59/0xe0
      [   40.555527]  [<ffffffff813f93a0>] driver_unregister+0x30/0x70
      [   40.555534]  [<ffffffff8131532d>] pci_unregister_driver+0x2d/0xa0
      [   40.555542]  [<ffffffffa0200ec2>] enic_cleanup_module+0x10/0x14e [enic]
      [   40.555547]  [<ffffffff8110158f>] SyS_delete_module+0x1cf/0x280
      [   40.555551]  [<ffffffff811e284e>] ? ____fput+0xe/0x10
      [   40.555554]  [<ffffffff810980ec>] ? task_work_run+0xbc/0xf0
      [   40.555558]  [<ffffffff815930ee>] system_call_fastpath+0x12/0x71
      [   40.555561] ---[ end trace 4988cadc77c2b236 ]---
      [   40.555562] Mapped at:
      [   40.555563]  [<ffffffff812fa865>] debug_dma_map_page+0x95/0x150
      [   40.555566]  [<ffffffffa01f4a88>] enic_rq_alloc_buf+0x1b8/0x360 [enic]
      [   40.555570]  [<ffffffffa01f7658>] enic_open+0xf8/0x820 [enic]
      [   40.555574]  [<ffffffff8148d50e>] __dev_open+0xce/0x150
      [   40.555579]  [<ffffffff8148d851>] __dev_change_flags+0xa1/0x170
      Signed-off-by: default avatarGovindarajulu Varadarajan <_govind@gmx.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8b13b4e0
    • Govindarajulu Varadarajan's avatar
      enic: check return value for stat dump · 19b596bd
      Govindarajulu Varadarajan authored
      We do not check the return value of enic_dev_stats_dump(). If allocation
      fails, we will hit NULL pointer reference.
      
      Return only if memory allocation fails. For other failures, we return the
      previously recorded values.
      Signed-off-by: default avatarGovindarajulu Varadarajan <_govind@gmx.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      19b596bd
    • Govindarajulu Varadarajan's avatar
      enic: unlock napi busy poll before unmasking intr · 6286e828
      Govindarajulu Varadarajan authored
      There is a small window between vnic_intr_unmask() and enic_poll_unlock_napi().
      In this window if an irq occurs and napi is scheduled on different cpu, it tries
      to acquire enic_poll_lock_napi() and hits the following WARN_ON message.
      
      Fix is to unlock napi_poll before unmasking the interrupt.
      
      [  781.121746] ------------[ cut here ]------------
      [  781.121789] WARNING: CPU: 1 PID: 0 at drivers/net/ethernet/cisco/enic/vnic_rq.h:228 enic_poll_msix_rq+0x36a/0x3c0 [enic]()
      [  781.121834] Modules linked in: nfsv3 nfs_acl rpcsec_gss_krb5 auth_rpcgss oid_registry nfsv4 dns_resolver coretemp intel_rapl iosf_mbi x86_pkg_temp_thermal intel_powerclamp kvm_intel kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel mgag200 ttm drm_kms_helper joydev aes_x86_64 lrw drm gf128mul mousedev glue_helper sb_edac ablk_helper iTCO_wdt iTCO_vendor_support evdev ipmi_si syscopyarea sysfillrect sysimgblt i2c_algo_bit i2c_core edac_core lpc_ich mac_hid cryptd pcspkr ipmi_msghandler shpchp tpm_tis acpi_power_meter tpm wmi processor hwmon button ac sch_fq_codel nfs lockd grace sunrpc fscache hid_generic usbhid hid ehci_pci ehci_hcd sd_mod megaraid_sas usbcore scsi_mod usb_common enic crc32c_generic crc32c_intel btrfs xor raid6_pq ext4 crc16 mbcache jbd2
      [  781.122176] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.1.0-rc6-ARCH-00040-gc46a024e-dirty #106
      [  781.122210] Hardware name: Cisco Systems Inc UCSB-B200-M4/UCSB-B200-M4, BIOS B200M4.2.2.2.23.061220140128 06/12/2014
      [  781.122252]  0000000000000000 bddbbc9d655ec96e ffff880277e43da8 ffffffff81583fe8
      [  781.122286]  0000000000000000 0000000000000000 ffff880277e43de8 ffffffff8107acfa
      [  781.122319]  ffff880272c01000 ffff880273f18000 ffff880273f1a100 0000000000000000
      [  781.122352] Call Trace:
      [  781.122364]  <IRQ>  [<ffffffff81583fe8>] dump_stack+0x4f/0x7b
      [  781.122399]  [<ffffffff8107acfa>] warn_slowpath_common+0x8a/0xc0
      [  781.122425]  [<ffffffff8107ae2a>] warn_slowpath_null+0x1a/0x20
      [  781.122455]  [<ffffffffa01fa9ca>] enic_poll_msix_rq+0x36a/0x3c0 [enic]
      [  781.122487]  [<ffffffff8148525a>] net_rx_action+0x22a/0x370
      [  781.122512]  [<ffffffff8107ed3d>] __do_softirq+0xed/0x2d0
      [  781.122537]  [<ffffffff8107f06e>] irq_exit+0x7e/0xa0
      [  781.122560]  [<ffffffff8158c424>] do_IRQ+0x64/0x100
      [  781.122582]  [<ffffffff8158a42e>] common_interrupt+0x6e/0x6e
      [  781.122605]  <EOI>  [<ffffffff810bd331>] ? cpu_startup_entry+0x121/0x480
      [  781.122638]  [<ffffffff810bd2fc>] ? cpu_startup_entry+0xec/0x480
      [  781.122667]  [<ffffffff810f2ed3>] ? clockevents_register_device+0x113/0x1f0
      [  781.122698]  [<ffffffff81050ab6>] start_secondary+0x196/0x1e0
      [  781.122723] ---[ end trace cec2e9dd3af7b9db ]---
      Signed-off-by: default avatarGovindarajulu Varadarajan <_govind@gmx.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6286e828
    • Mel Gorman's avatar
      net, swap: Remove a warning and clarify why sk_mem_reclaim is required when deactivating swap · 5d753610
      Mel Gorman authored
      Jeff Layton reported the following;
      
       [   74.232485] ------------[ cut here ]------------
       [   74.233354] WARNING: CPU: 2 PID: 754 at net/core/sock.c:364 sk_clear_memalloc+0x51/0x80()
       [   74.234790] Modules linked in: cts rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache xfs libcrc32c snd_hda_codec_generic snd_hda_intel snd_hda_controller snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device nfsd snd_pcm snd_timer snd e1000 ppdev parport_pc joydev parport pvpanic soundcore floppy serio_raw i2c_piix4 pcspkr nfs_acl lockd virtio_balloon acpi_cpufreq auth_rpcgss grace sunrpc qxl drm_kms_helper ttm drm virtio_console virtio_blk virtio_pci ata_generic virtio_ring pata_acpi virtio
       [   74.243599] CPU: 2 PID: 754 Comm: swapoff Not tainted 4.1.0-rc6+ #5
       [   74.244635] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
       [   74.245546]  0000000000000000 0000000079e69e31 ffff8800d066bde8 ffffffff8179263d
       [   74.246786]  0000000000000000 0000000000000000 ffff8800d066be28 ffffffff8109e6fa
       [   74.248175]  0000000000000000 ffff880118d48000 ffff8800d58f5c08 ffff880036e380a8
       [   74.249483] Call Trace:
       [   74.249872]  [<ffffffff8179263d>] dump_stack+0x45/0x57
       [   74.250703]  [<ffffffff8109e6fa>] warn_slowpath_common+0x8a/0xc0
       [   74.251655]  [<ffffffff8109e82a>] warn_slowpath_null+0x1a/0x20
       [   74.252585]  [<ffffffff81661241>] sk_clear_memalloc+0x51/0x80
       [   74.253519]  [<ffffffffa0116c72>] xs_disable_swap+0x42/0x80 [sunrpc]
       [   74.254537]  [<ffffffffa01109de>] rpc_clnt_swap_deactivate+0x7e/0xc0 [sunrpc]
       [   74.255610]  [<ffffffffa03e4fd7>] nfs_swap_deactivate+0x27/0x30 [nfs]
       [   74.256582]  [<ffffffff811e99d4>] destroy_swap_extents+0x74/0x80
       [   74.257496]  [<ffffffff811ecb52>] SyS_swapoff+0x222/0x5c0
       [   74.258318]  [<ffffffff81023f27>] ? syscall_trace_leave+0xc7/0x140
       [   74.259253]  [<ffffffff81798dae>] system_call_fastpath+0x12/0x71
       [   74.260158] ---[ end trace 2530722966429f10 ]---
      
      The warning in question was unnecessary but with Jeff's series the rules
      are also clearer.  This patch removes the warning and updates the comment
      to explain why sk_mem_reclaim() may still be called.
      
      [jlayton: remove if (sk->sk_forward_alloc) conditional. As Leon
                points out that it's not needed.]
      
      Cc: Leon Romanovsky <leon@leon.nu>
      Signed-off-by: default avatarMel Gorman <mgorman@suse.de>
      Signed-off-by: default avatarJeff Layton <jeff.layton@primarydata.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5d753610
    • Nikolay Aleksandrov's avatar
      bridge: fix multicast router rlist endless loop · 1a040eac
      Nikolay Aleksandrov authored
      Since the addition of sysfs multicast router support if one set
      multicast_router to "2" more than once, then the port would be added to
      the hlist every time and could end up linking to itself and thus causing an
      endless loop for rlist walkers.
      So to reproduce just do:
      echo 2 > multicast_router; echo 2 > multicast_router;
      in a bridge port and let some igmp traffic flow, for me it hangs up
      in br_multicast_flood().
      Fix this by adding a check in br_multicast_add_router() if the port is
      already linked.
      The reason this didn't happen before the addition of multicast_router
      sysfs entries is because there's a !hlist_unhashed check that prevents
      it.
      Signed-off-by: default avatarNikolay Aleksandrov <razor@blackwall.org>
      Fixes: 0909e117 ("bridge: Add multicast_router sysfs entries")
      Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1a040eac
    • Erik Hugne's avatar
      tipc: disconnect socket directly after probe failure · b3be5e3e
      Erik Hugne authored
      If the TIPC connection timer expires in a probing state, a
      self abort message is supposed to be generated and delivered
      to the local socket. This is currently broken, and the abort
      message is actually sent out to the peer node with invalid
      addressing information. This will cause the link to enter
      a constant retransmission state and eventually reset.
      We fix this by removing the self-abort message creation and
      tear down connection immediately instead.
      Signed-off-by: default avatarErik Hugne <erik.hugne@ericsson.com>
      Reviewed-by: default avatarYing Xue <ying.xue@windriver.com>
      Reviewed-by: default avatarJon Maloy <jon.maloy@ericsson.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b3be5e3e
    • Linus Torvalds's avatar
      Merge tag 'misc-for-linus-4.1-rc8' of... · 2bfc60dd
      Linus Torvalds authored
      Merge tag 'misc-for-linus-4.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull misc fixes from Guenter Roeck:
       "There are two patches here.  One fixes a build error affecting the
        blackfin architecture, the other fixes a build error affecting the
        score architecture.
      
        The score maintainer (Lennox Wu) has a hard time sending you the score
        patch, and the blackfin maintainer (Steven Miao) has been silent since
        -rc1.  Since 4.1 is about to be released, I figured it would be useful
        to get the patches upstream to avoid the related build failures in the
        final release"
      
      * tag 'misc-for-linus-4.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        score: Fix exception handler label
        blackfin: Fix build error
      2bfc60dd
  8. 10 Jun, 2015 5 commits
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · f5278565
      Linus Torvalds authored
      Merge misc fixes from Andrew Morton:
       "The gcc-4.4.4 workaround has actually been merged into a KVM tree by
        Paolo but it is stuck in linux-next and mainline needs it"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        arch/x86/kvm/mmu.c: work around gcc-4.4.4 bug
        sched, numa: do not hint for NUMA balancing on VM_MIXEDMAP mappings
        zsmalloc: fix a null pointer dereference in destroy_handle_cache()
        mm: memcontrol: fix false-positive VM_BUG_ON() on -rt
        checkpatch: fix "GLOBAL_INITIALISERS" test
        zram: clear disk io accounting when reset zram device
        memcg: do not call reclaim if !__GFP_WAIT
        mm/memory_hotplug.c: set zone->wait_table to null after freeing it
      f5278565
    • Andrew Morton's avatar
      arch/x86/kvm/mmu.c: work around gcc-4.4.4 bug · 5ec45a19
      Andrew Morton authored
      Fix this compile issue with gcc-4.4.4:
      
         arch/x86/kvm/mmu.c: In function 'kvm_mmu_pte_write':
         arch/x86/kvm/mmu.c:4256: error: unknown field 'cr0_wp' specified in initializer
         arch/x86/kvm/mmu.c:4257: error: unknown field 'cr4_pae' specified in initializer
         arch/x86/kvm/mmu.c:4257: warning: excess elements in union initializer
         ...
      
      gcc-4.4.4 (at least) has issues when using anonymous unions in
      initializers.
      
      Fixes: edc90b7d ("KVM: MMU: fix SMAP virtualization")
      Cc: Xiao Guangrong <guangrong.xiao@linux.intel.com>
      Cc: Paolo Bonzini <pbonzini@redhat.com>
      Cc: Davidlohr Bueso <dave@stgolabs.net>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5ec45a19
    • Mel Gorman's avatar
      sched, numa: do not hint for NUMA balancing on VM_MIXEDMAP mappings · 8e76d4ee
      Mel Gorman authored
      Jovi Zhangwei reported the following problem
      
        Below kernel vm bug can be triggered by tcpdump which mmaped a lot of pages
        with GFP_COMP flag.
      
        [Mon May 25 05:29:33 2015] page:ffffea0015414000 count:66 mapcount:1 mapping:          (null) index:0x0
        [Mon May 25 05:29:33 2015] flags: 0x20047580004000(head)
        [Mon May 25 05:29:33 2015] page dumped because: VM_BUG_ON_PAGE(compound_order(page) && !PageTransHuge(page))
        [Mon May 25 05:29:33 2015] ------------[ cut here ]------------
        [Mon May 25 05:29:33 2015] kernel BUG at mm/migrate.c:1661!
        [Mon May 25 05:29:33 2015] invalid opcode: 0000 [#1] SMP
      
      In this case it was triggered by running tcpdump but it's not necessary
      reproducible on all systems.
      
        sudo tcpdump -i bond0.100 'tcp port 4242' -c 100000000000 -w 4242.pcap
      
      Compound pages cannot be migrated and it was not expected that such pages
      be marked for NUMA balancing.  This did not take into account that drivers
      such as net/packet/af_packet.c may insert compound pages into userspace
      with vm_insert_page.  This patch tells the NUMA balancing protection
      scanner to skip all VM_MIXEDMAP mappings which avoids the possibility that
      compound pages are marked for migration.
      Signed-off-by: default avatarMel Gorman <mgorman@suse.de>
      Reported-by: default avatarJovi Zhangwei <jovi@cloudflare.com>
      Cc: Ingo Molnar <mingo@elte.hu>
      Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8e76d4ee
    • Sergey Senozhatsky's avatar
      zsmalloc: fix a null pointer dereference in destroy_handle_cache() · 02f7b414
      Sergey Senozhatsky authored
      If zs_create_pool()->create_handle_cache()->kmem_cache_create() or
      pool->name allocation fails, zs_create_pool()->destroy_handle_cache()
      will dereference the NULL pool->handle_cachep.
      
      Modify destroy_handle_cache() to avoid this.
      Signed-off-by: default avatarSergey Senozhatsky <sergey.senozhatsky@gmail.com>
      Cc: Minchan Kim <minchan@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      02f7b414
    • Johannes Weiner's avatar
      mm: memcontrol: fix false-positive VM_BUG_ON() on -rt · f371763a
      Johannes Weiner authored
      On -rt, the VM_BUG_ON(!irqs_disabled()) triggers inside the memcg
      swapout path because the spin_lock_irq(&mapping->tree_lock) in the
      caller doesn't actually disable the hardware interrupts - which is fine,
      because on -rt the tophalves run in process context and so we are still
      safe from preemption while updating the statistics.
      
      Remove the VM_BUG_ON() but keep the comment of what we rely on.
      Signed-off-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Reported-by: default avatarClark Williams <williams@redhat.com>
      Cc: Fernando Lopez-Lezcano <nando@ccrma.Stanford.EDU>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f371763a