1. 14 Jul, 2014 1 commit
  2. 12 Jul, 2014 1 commit
    • Tejun Heo's avatar
      blkcg: don't call into policy draining if root_blkg is already gone · 0b462c89
      Tejun Heo authored
      While a queue is being destroyed, all the blkgs are destroyed and its
      ->root_blkg pointer is set to NULL.  If someone else starts to drain
      while the queue is in this state, the following oops happens.
      
        NULL pointer dereference at 0000000000000028
        IP: [<ffffffff8144e944>] blk_throtl_drain+0x84/0x230
        PGD e4a1067 PUD b773067 PMD 0
        Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
        Modules linked in: cfq_iosched(-) [last unloaded: cfq_iosched]
        CPU: 1 PID: 537 Comm: bash Not tainted 3.16.0-rc3-work+ #2
        Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
        task: ffff88000e222250 ti: ffff88000efd4000 task.ti: ffff88000efd4000
        RIP: 0010:[<ffffffff8144e944>]  [<ffffffff8144e944>] blk_throtl_drain+0x84/0x230
        RSP: 0018:ffff88000efd7bf0  EFLAGS: 00010046
        RAX: 0000000000000000 RBX: ffff880015091450 RCX: 0000000000000001
        RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
        RBP: ffff88000efd7c10 R08: 0000000000000000 R09: 0000000000000001
        R10: ffff88000e222250 R11: 0000000000000000 R12: ffff880015091450
        R13: ffff880015092e00 R14: ffff880015091d70 R15: ffff88001508fc28
        FS:  00007f1332650740(0000) GS:ffff88001fa80000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
        CR2: 0000000000000028 CR3: 0000000009446000 CR4: 00000000000006e0
        Stack:
         ffffffff8144e8f6 ffff880015091450 0000000000000000 ffff880015091d80
         ffff88000efd7c28 ffffffff8144ae2f ffff880015091450 ffff88000efd7c58
         ffffffff81427641 ffff880015091450 ffffffff82401f00 ffff880015091450
        Call Trace:
         [<ffffffff8144ae2f>] blkcg_drain_queue+0x1f/0x60
         [<ffffffff81427641>] __blk_drain_queue+0x71/0x180
         [<ffffffff81429b3e>] blk_queue_bypass_start+0x6e/0xb0
         [<ffffffff814498b8>] blkcg_deactivate_policy+0x38/0x120
         [<ffffffff8144ec44>] blk_throtl_exit+0x34/0x50
         [<ffffffff8144aea5>] blkcg_exit_queue+0x35/0x40
         [<ffffffff8142d476>] blk_release_queue+0x26/0xd0
         [<ffffffff81454968>] kobject_cleanup+0x38/0x70
         [<ffffffff81454848>] kobject_put+0x28/0x60
         [<ffffffff81427505>] blk_put_queue+0x15/0x20
         [<ffffffff817d07bb>] scsi_device_dev_release_usercontext+0x16b/0x1c0
         [<ffffffff810bc339>] execute_in_process_context+0x89/0xa0
         [<ffffffff817d064c>] scsi_device_dev_release+0x1c/0x20
         [<ffffffff817930e2>] device_release+0x32/0xa0
         [<ffffffff81454968>] kobject_cleanup+0x38/0x70
         [<ffffffff81454848>] kobject_put+0x28/0x60
         [<ffffffff817934d7>] put_device+0x17/0x20
         [<ffffffff817d11b9>] __scsi_remove_device+0xa9/0xe0
         [<ffffffff817d121b>] scsi_remove_device+0x2b/0x40
         [<ffffffff817d1257>] sdev_store_delete+0x27/0x30
         [<ffffffff81792ca8>] dev_attr_store+0x18/0x30
         [<ffffffff8126f75e>] sysfs_kf_write+0x3e/0x50
         [<ffffffff8126ea87>] kernfs_fop_write+0xe7/0x170
         [<ffffffff811f5e9f>] vfs_write+0xaf/0x1d0
         [<ffffffff811f69bd>] SyS_write+0x4d/0xc0
         [<ffffffff81d24692>] system_call_fastpath+0x16/0x1b
      
      776687bc ("block, blk-mq: draining can't be skipped even if
      bypass_depth was non-zero") made it easier to trigger this bug by
      making blk_queue_bypass_start() drain even when it loses the first
      bypass test to blk_cleanup_queue(); however, the bug has always been
      there even before the commit as blk_queue_bypass_start() could race
      against queue destruction, win the initial bypass test but perform the
      actual draining after blk_cleanup_queue() already destroyed all blkgs.
      
      Fix it by skippping calling into policy draining if all the blkgs are
      already gone.
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Reported-by: default avatarShirish Pargaonkar <spargaonkar@suse.com>
      Reported-by: default avatarSasha Levin <sasha.levin@oracle.com>
      Reported-by: default avatarJet Chen <jet.chen@intel.com>
      Cc: stable@vger.kernel.org
      Tested-by: default avatarShirish Pargaonkar <spargaonkar@suse.com>
      Signed-off-by: default avatarJens Axboe <axboe@fb.com>
      0b462c89
  3. 10 Jul, 2014 1 commit
  4. 08 Jul, 2014 1 commit
  5. 07 Jul, 2014 4 commits
  6. 06 Jul, 2014 4 commits
    • Linus Torvalds's avatar
      Linux 3.16-rc4 · cd3de83f
      Linus Torvalds authored
      cd3de83f
    • Linus Torvalds's avatar
      Merge tag 'dt-for-linus' of git://git.secretlab.ca/git/linux · 100193f5
      Linus Torvalds authored
      Pull devicetree bugfix from Grant Likely:
       "Important bug fix for parsing 64-bit addresses on 32-bit platforms.
        Without this patch the kernel will try to use memory ranges that
        cannot be reached"
      
      * tag 'dt-for-linus' of git://git.secretlab.ca/git/linux:
        of: Check for phys_addr_t overflows in early_init_dt_add_memory_arch
      100193f5
    • Linus Torvalds's avatar
      Merge tag 'scsi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 8addf0c7
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "This is a set of 13 fixes, a MAINTAINERS update and a sparse update.
        The fixes are mostly correct value initialisations, avoiding NULL
        derefs and some uninitialised pointer avoidance.
      
        All the patches have been incubated in -next for a few days.  The
        final patch (use the scsi data buffer length to extract transfer size)
        has been rebased to add a cc to stable, but only the commit message
        has changed"
      
      * tag 'scsi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        [SCSI] use the scsi data buffer length to extract transfer size
        virtio-scsi: fix various bad behavior on aborted requests
        virtio-scsi: avoid cancelling uninitialized work items
        ibmvscsi: Add memory barriers for send / receive
        ibmvscsi: Abort init sequence during error recovery
        qla2xxx: Fix sparse warning in qla_target.c.
        bnx2fc: Improve stats update mechanism
        bnx2fc: do not scan uninitialized lists in case of error.
        fc: ensure scan_work isn't active when freeing fc_rport
        pm8001: Fix potential null pointer dereference and memory leak.
        MAINTAINERS: Update LSILOGIC MPT FUSION DRIVERS (FC/SAS/SPI) maintainers Email IDs
        be2iscsi: remove potential junk pointer free
        be2iscsi: add an missing goto in error path
        scsi_error: set DID_TIME_OUT correctly
        scsi_error: fix invalid setting of host byte
      8addf0c7
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 110e4308
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "i915, tda998x and vmwgfx fixes,
      
        The main one is i915 fix for missing VGA connectors, along with some
        fixes for the tda998x from Russell fixing some modesetting problems.
      
        (still on holidays, but got a spare moment to find these)"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/vmwgfx: Fix incorrect write to read-only register v2:
        drm/i915: Drop early VLV WA to fix Voltage not getting dropped to Vmin
        drm/i915: only apply crt_present check on VLV
        drm/i915: Wait for vblank after enabling the primary plane on BDW
        drm/i2c: tda998x: add some basic mode validation
        drm/i2c: tda998x: faster polling for edid
        drm/i2c: tda998x: move drm_i2c_encoder_destroy call
      110e4308
  7. 05 Jul, 2014 12 commits
  8. 04 Jul, 2014 16 commits