1. 05 Oct, 2013 1 commit
  2. 04 Oct, 2013 4 commits
    • Ilya Dryomov's avatar
      Btrfs: fix a use-after-free bug in btrfs_dev_replace_finishing · 1357272f
      Ilya Dryomov authored
      free_device rcu callback, scheduled from btrfs_rm_dev_replace_srcdev,
      can be processed before btrfs_scratch_superblock is called, which would
      result in a use-after-free on btrfs_device contents.  Fix this by
      zeroing the superblock before the rcu callback is registered.
      
      Cc: Stefan Behrens <sbehrens@giantdisaster.de>
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Signed-off-by: default avatarJosef Bacik <jbacik@fusionio.com>
      1357272f
    • Ilya Dryomov's avatar
      Btrfs: eliminate races in worker stopping code · 964fb15a
      Ilya Dryomov authored
      The current implementation of worker threads in Btrfs has races in
      worker stopping code, which cause all kinds of panics and lockups when
      running btrfs/011 xfstest in a loop.  The problem is that
      btrfs_stop_workers is unsynchronized with respect to check_idle_worker,
      check_busy_worker and __btrfs_start_workers.
      
      E.g., check_idle_worker race flow:
      
             btrfs_stop_workers():            check_idle_worker(aworker):
      - grabs the lock
      - splices the idle list into the
        working list
      - removes the first worker from the
        working list
      - releases the lock to wait for
        its kthread's completion
                                        - grabs the lock
                                        - if aworker is on the working list,
                                          moves aworker from the working list
                                          to the idle list
                                        - releases the lock
      - grabs the lock
      - puts the worker
      - removes the second worker from the
        working list
                                    ......
              btrfs_stop_workers returns, aworker is on the idle list
                       FS is umounted, memory is freed
                                    ......
                    aworker is waken up, fireworks ensue
      
      With this applied, I wasn't able to trigger the problem in 48 hours,
      whereas previously I could reliably reproduce at least one of these
      races within an hour.
      Reported-by: default avatarDavid Sterba <dsterba@suse.cz>
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Signed-off-by: default avatarJosef Bacik <jbacik@fusionio.com>
      964fb15a
    • Liu Bo's avatar
      Btrfs: fix crash of compressed writes · 385fe0be
      Liu Bo authored
      The crash[1] is found by xfstests/generic/208 with "-o compress",
      it's not reproduced everytime, but it does panic.
      
      The bug is quite interesting, it's actually introduced by a recent commit
      (573aecaf,
      Btrfs: actually limit the size of delalloc range).
      
      Btrfs implements delay allocation, so during writeback, we
      (1) get a page A and lock it
      (2) search the state tree for delalloc bytes and lock all pages within the range
      (3) process the delalloc range, including find disk space and create
          ordered extent and so on.
      (4) submit the page A.
      
      It runs well in normal cases, but if we're in a racy case, eg.
      buffered compressed writes and aio-dio writes,
      sometimes we may fail to lock all pages in the 'delalloc' range,
      in which case, we need to fall back to search the state tree again with
      a smaller range limit(max_bytes = PAGE_CACHE_SIZE - offset).
      
      The mentioned commit has a side effect, that is, in the fallback case,
      we can find delalloc bytes before the index of the page we already have locked,
      so we're in the case of (delalloc_end <= *start) and return with (found > 0).
      
      This ends with not locking delalloc pages but making ->writepage still
      process them, and the crash happens.
      
      This fixes it by just thinking that we find nothing and returning to caller
      as the caller knows how to deal with it properly.
      
      [1]:
      ------------[ cut here ]------------
      kernel BUG at mm/page-writeback.c:2170!
      [...]
      CPU: 2 PID: 11755 Comm: btrfs-delalloc- Tainted: G           O 3.11.0+ #8
      [...]
      RIP: 0010:[<ffffffff810f5093>]  [<ffffffff810f5093>] clear_page_dirty_for_io+0x1e/0x83
      [...]
      [ 4934.248731] Stack:
      [ 4934.248731]  ffff8801477e5dc8 ffffea00049b9f00 ffff8801869f9ce8 ffffffffa02b841a
      [ 4934.248731]  0000000000000000 0000000000000000 0000000000000fff 0000000000000620
      [ 4934.248731]  ffff88018db59c78 ffffea0005da8d40 ffffffffa02ff860 00000001810016c0
      [ 4934.248731] Call Trace:
      [ 4934.248731]  [<ffffffffa02b841a>] extent_range_clear_dirty_for_io+0xcf/0xf5 [btrfs]
      [ 4934.248731]  [<ffffffffa02a8889>] compress_file_range+0x1dc/0x4cb [btrfs]
      [ 4934.248731]  [<ffffffff8104f7af>] ? detach_if_pending+0x22/0x4b
      [ 4934.248731]  [<ffffffffa02a8bad>] async_cow_start+0x35/0x53 [btrfs]
      [ 4934.248731]  [<ffffffffa02c694b>] worker_loop+0x14b/0x48c [btrfs]
      [ 4934.248731]  [<ffffffffa02c6800>] ? btrfs_queue_worker+0x25c/0x25c [btrfs]
      [ 4934.248731]  [<ffffffff810608f5>] kthread+0x8d/0x95
      [ 4934.248731]  [<ffffffff81060868>] ? kthread_freezable_should_stop+0x43/0x43
      [ 4934.248731]  [<ffffffff814fe09c>] ret_from_fork+0x7c/0xb0
      [ 4934.248731]  [<ffffffff81060868>] ? kthread_freezable_should_stop+0x43/0x43
      [ 4934.248731] Code: ff 85 c0 0f 94 c0 0f b6 c0 59 5b 5d c3 0f 1f 44 00 00 55 48 89 e5 41 54 53 48 89 fb e8 2c de 00 00 49 89 c4 48 8b 03 a8 01 75 02 <0f> 0b 4d 85 e4 74 52 49 8b 84 24 80 00 00 00 f6 40 20 01 75 44
      [ 4934.248731] RIP  [<ffffffff810f5093>] clear_page_dirty_for_io+0x1e/0x83
      [ 4934.248731]  RSP <ffff8801869f9c48>
      [ 4934.280307] ---[ end trace 36f06d3f8750236a ]---
      Signed-off-by: default avatarLiu Bo <bo.li.liu@oracle.com>
      Signed-off-by: default avatarJosef Bacik <jbacik@fusionio.com>
      385fe0be
    • Josef Bacik's avatar
      Btrfs: fix transid verify errors when recovering log tree · 60e7cd3a
      Josef Bacik authored
      If we crash with a log, remount and recover that log, and then crash before we
      can commit another transaction we will get transid verify errors on the next
      mount.  This is because we were not zero'ing out the log when we committed the
      transaction after recovery.  This is ok as long as we commit another transaction
      at some point in the future, but if you abort or something else goes wrong you
      can end up in this weird state because the recovery stuff says that the tree log
      should have a generation+1 of the super generation, which won't be the case of
      the transaction that was started for recovery.  Fix this by removing the check
      and _always_ zero out the log portion of the super when we commit a transaction.
      This fixes the transid verify issues I was seeing with my force errors tests.
      Thanks,
      Signed-off-by: default avatarJosef Bacik <jbacik@fusionio.com>
      60e7cd3a
  3. 29 Sep, 2013 10 commits
    • Linus Torvalds's avatar
      Linux 3.12-rc3 · 15c03dd4
      Linus Torvalds authored
      15c03dd4
    • Linus Torvalds's avatar
      Merge tag 'usb-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 30ceb4ec
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are a number of USB driver fixes for 3.12-rc3.
      
        These are all for host controller issues that have been reported, and
        there's a fix for an annoying error message that gets printed every
        time you remove a USB 3 device from the system that's been bugging me
        for a while"
      
      * tag 'usb-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: dwc3: add support for Merrifield
        USB: fsl/ehci: fix failure of checking PHY_CLK_VALID during reinitialization
        USB: Fix breakage in ffs_fs_mount()
        fsl/usb: Resolve PHY_CLK_VLD instability issue for ULPI phy
        usb/core/devio.c: Don't reject control message to endpoint with wrong direction bit
        usb: chipidea: USB_CHIPIDEA should depend on HAS_DMA
        usb: chipidea: udc: free pending TD at removal procedure
        usb: chipidea: imx: Add usb_phy_shutdown at probe's error path
        usb: chipidea: Fix memleak for ci->hw_bank.regmap when removal
        usb: chipidea: udc: fix the oops after rmmod gadget
        USB: fix PM config symbol in uhci-hcd, ehci-hcd, and xhci-hcd
        USB: OHCI: accept very late isochronous URBs
        USB: UHCI: accept very late isochronous URBs
        USB: iMX21: accept very late isochronous URBs
        usbcore: check usb device's state before sending a Set SEL control transfer
        xhci: Fix race between ep halt and URB cancellation
        usb: Fix xHCI host issues on remote wakeup.
        xhci: Ensure a command structure points to the correct trb on the command ring
        xhci: Fix oops happening after address device timeout
      30ceb4ec
    • Linus Torvalds's avatar
      Merge tag 'tty-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 26c019fc
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are some serial at tty driver fixes for 3.12-rc3
      
        The serial driver fixes some kref leaks, documentation is moved to the
        proper places, and the tty and n_tty fixes resolve some reported
        regressions.  There is still one outstanding tty regression fix that
        isn't in here yet, as I want to test it out some more, it will be sent
        for 3.12-rc4 if it checks out"
      
      * tag 'tty-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        tty: ar933x_uart: move devicetree binding documentation
        tty: Fix SIGTTOU not sent with tcflush()
        n_tty: Fix EOF push index when termios changes
        serial: pch_uart: remove unnecessary tty_port_tty_get
        serial: pch_uart: fix tty-kref leak in dma-rx path
        serial: pch_uart: fix tty-kref leak in rx-error path
        serial: tegra: fix tty-kref leak
      26c019fc
    • Linus Torvalds's avatar
      Merge tag 'staging-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 31795c40
      Linus Torvalds authored
      Pull staging fixes from Greg KH:
       "Here are some staging driver fixes, MAINTAINER updates, and a new
        device id.  All of these have been in the linux-next tree, and are
        pretty simple patches"
      
      * tag 'staging-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: r8188eu: Add new device ID
        staging: imx-drm: Fix probe failure
        staging: vt6656: [BUG] iwctl_siwencodeext return if device not open
        staging: vt6656: [BUG] main_usb.c oops on device_close move flag earlier.
        staging: vt6656: rxtx.c [BUG] s_vGetFreeContext dead lock on null apTD.
        Staging: rtl8192u: r819xU_cmdpkt: checking NULL value after doing dev_alloc_skb
        staging: usbip: Orphan usbip
        staging: r8188eu: Add files for new drive: Cocci spatch "noderef"
        staging: r8188eu: Cocci spatch "noderef"
        staging: octeon-usb: Cocci spatch "noderef"
        staging: r8188eu: Add files for new drive: Cocci spatch "noderef"
        MAINTAINERS: staging: dgnc and dgap drivers: add maintainer
        staging: lustre: Cocci spatch "noderef"
      31795c40
    • Linus Torvalds's avatar
      Merge tag 'driver-core-3.12-rc3' of... · 434ac47d
      Linus Torvalds authored
      Merge tag 'driver-core-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
      
      Pull driver core / sysfs fixes from Greg KH:
       "Here are 2 fixes for 3.12-rc3.  One fixes a sysfs problem with
        mounting caused by 3.12-rc1, and the other is a bug reported by the
        chromeos developers with the driver core.
      
        Both have been in linux-next for a bit"
      
      * tag 'driver-core-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        driver core : Fix use after free of dev->parent in device_shutdown
        sysfs: Allow mounting without CONFIG_NET
      434ac47d
    • Linus Torvalds's avatar
      Merge tag 'char-misc-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · c23c2234
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some HyperV and MEI driver fixes for 3.12-rc3.  They resolve
        some issues that people have been reporting for them"
      
      * tag 'char-misc-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        Drivers: hv: vmbus: Terminate vmbus version negotiation on timeout
        Drivers: hv: util: Correctly support ws2008R2 and earlier
        mei: cancel stall timers in mei_reset
        mei: bus: stop wait for read during cl state transition
        mei: make me client counters less error prone
      c23c2234
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · cac66535
      Linus Torvalds authored
      Pull perf revert from Ingo Molnar:
       "This fixes the 'perf top' regression Markus Trippelsdorf reported"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        Revert "perf symbols: Demangle cloned functions"
      cac66535
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · b97b869a
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Nothing too major, radeon still has some dpm changes for off by
        default.
      
        Radeon, intel, msm:
         - radeon: a few more dpm fixes (still off by default), uvd fixes
         - i915: runtime warn backtrace and regression fix
         - msm: iommu changes fallout"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (27 commits)
        drm/msm: use drm_gem_dumb_destroy helper
        drm/msm: deal with mach/iommu.h removal
        drm/msm: Remove iommu include from mdp4_kms.c
        drm/msm: Odd PTR_ERR usage
        drm/i915: Fix up usage of SHRINK_STOP
        drm/radeon: fix hdmi audio on DCE3.0/3.1 asics
        drm/i915: preserve pipe A quirk in i9xx_set_pipeconf
        drm/i915/tv: clear adjusted_mode.flags
        drm/i915/dp: increase i2c-over-aux retry interval on AUX DEFER
        drm/radeon/cik: fix overflow in vram fetch
        drm/radeon: add missing hdmi callbacks for rv6xx
        drm/i915: Use a temporary va_list for two-pass string handling
        drm/radeon/uvd: lower msg&fb buffer requirements on UVD3
        drm/radeon: disable tests/benchmarks if accel is disabled
        drm/radeon: don't set default clocks for SI when DPM is disabled
        drm/radeon/dpm/ci: filter clocks based on voltage/clk dep tables
        drm/radeon/dpm/si: filter clocks based on voltage/clk dep tables
        drm/radeon/dpm/ni: filter clocks based on voltage/clk dep tables
        drm/radeon/dpm/btc: filter clocks based on voltage/clk dep tables
        drm/radeon/dpm: fetch the max clk from voltage dep tables helper
        ...
      b97b869a
    • Ingo Molnar's avatar
      Revert "perf symbols: Demangle cloned functions" · 14951f22
      Ingo Molnar authored
      This reverts commit de95ab53.
      
      Markus Trippelsdorf reported that this commit broke 'perf top':
      
       > I just see a gray screen with no text at all. Sometimes the
       > following error messages are printed:
       >
       >  *** Error in `perf': invalid fastbin entry (free): 0x00000000029b18c0
       >  ***
       >  *** Error in `perf': malloc(): memory corruption (fast): 0x0000000000ee0b10 ***
      
      While this code is fixable, the commit itself fails on several levels:
      
       - it should have been a separate helper function
       - why the heck does it do strchr() twice
       - it casts a const char * over into char *
       - sloppy style
       - it's not even a regression fix!
      
      So lets revert it and re-try the patch in v3.13.
      Reported-by: default avatarMarkus Trippelsdorf <markus@trippelsdorf.de>
      Cc: Andi Kleen <ak@linux.intel.com>
      Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      14951f22
    • Dave Airlie's avatar
      Merge branch 'msm-fixes-3.12-rc2' of git://people.freedesktop.org/~robclark/linux into drm-fixes · 66544179
      Dave Airlie authored
      A small fix + deal with fallout of iommu changes + use new
      drm_gem_dumb_destroy helper.
      
      * 'msm-fixes-3.12-rc2' of git://people.freedesktop.org/~robclark/linux:
        drm/msm: use drm_gem_dumb_destroy helper
        drm/msm: deal with mach/iommu.h removal
        drm/msm: Remove iommu include from mdp4_kms.c
        drm/msm: Odd PTR_ERR usage
      66544179
  4. 28 Sep, 2013 21 commits
  5. 27 Sep, 2013 4 commits