1. 30 Sep, 2013 10 commits
    • Manfred Spraul's avatar
      ipc/sem.c: fix race in sem_lock() · 5e9d5275
      Manfred Spraul authored
      The exclusion of complex operations in sem_lock() is insufficient: after
      acquiring the per-semaphore lock, a simple op must first check that
      sem_perm.lock is not locked and only after that test check
      complex_count.  The current code does it the other way around - and that
      creates a race.  Details are below.
      
      The patch is a complete rewrite of sem_lock(), based in part on the code
      from Mike Galbraith.  It removes all gotos and all loops and thus the
      risk of livelocks.
      
      I have tested the patch (together with the next one) on my i3 laptop and
      it didn't cause any problems.
      
      The bug is probably also present in 3.10 and 3.11, but for these kernels
      it might be simpler just to move the test of sma->complex_count after
      the spin_is_locked() test.
      
      Details of the bug:
      
      Assume:
       - sma->complex_count = 0.
       - Thread 1: semtimedop(complex op that must sleep)
       - Thread 2: semtimedop(simple op).
      
      Pseudo-Trace:
      
      Thread 1: sem_lock(): acquire sem_perm.lock
      Thread 1: sem_lock(): check for ongoing simple ops
      			Nothing ongoing, thread 2 is still before sem_lock().
      Thread 1: try_atomic_semop()
      	<<< preempted.
      
      Thread 2: sem_lock():
              static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
                                            int nsops)
              {
                      int locknum;
               again:
                      if (nsops == 1 && !sma->complex_count) {
                              struct sem *sem = sma->sem_base + sops->sem_num;
      
                              /* Lock just the semaphore we are interested in. */
                              spin_lock(&sem->lock);
      
                              /*
                               * If sma->complex_count was set while we were spinning,
                               * we may need to look at things we did not lock here.
                               */
                              if (unlikely(sma->complex_count)) {
                                      spin_unlock(&sem->lock);
                                      goto lock_array;
                              }
              <<<<<<<<<
      	<<< complex_count is still 0.
      	<<<
              <<< Here it is preempted
              <<<<<<<<<
      
      Thread 1: try_atomic_semop() returns, notices that it must sleep.
      Thread 1: increases sma->complex_count.
      Thread 1: drops sem_perm.lock
      Thread 2:
                      /*
                       * Another process is holding the global lock on the
                       * sem_array; we cannot enter our critical section,
                       * but have to wait for the global lock to be released.
                       */
                      if (unlikely(spin_is_locked(&sma->sem_perm.lock))) {
                              spin_unlock(&sem->lock);
                              spin_unlock_wait(&sma->sem_perm.lock);
                              goto again;
                      }
      	<<< sem_perm.lock already dropped, thus no "goto again;"
      
                      locknum = sops->sem_num;
      Signed-off-by: default avatarManfred Spraul <manfred@colorfullife.com>
      Cc: Mike Galbraith <bitbucket@online.de>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Davidlohr Bueso <davidlohr.bueso@hp.com>
      Cc: <stable@vger.kernel.org>	[3.10+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5e9d5275
    • David Rientjes's avatar
      mm/compaction.c: periodically schedule when freeing pages · f6ea3adb
      David Rientjes authored
      We've been getting warnings about an excessive amount of time spent
      allocating pages for migration during memory compaction without
      scheduling.  isolate_freepages_block() already periodically checks for
      contended locks or the need to schedule, but isolate_freepages() never
      does.
      
      When a zone is massively long and no suitable targets can be found, this
      iteration can be quite expensive without ever doing cond_resched().
      
      Check periodically for the need to reschedule while the compaction free
      scanner iterates.
      Signed-off-by: default avatarDavid Rientjes <rientjes@google.com>
      Reviewed-by: default avatarRik van Riel <riel@redhat.com>
      Reviewed-by: default avatarWanpeng Li <liwanp@linux.vnet.ibm.com>
      Acked-by: default avatarMel Gorman <mgorman@suse.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f6ea3adb
    • Dan Aloni's avatar
      fs/binfmt_elf.c: prevent a coredump with a large vm_map_count from Oopsing · 72023656
      Dan Aloni authored
      A high setting of max_map_count, and a process core-dumping with a large
      enough vm_map_count could result in an NT_FILE note not being written,
      and the kernel crashing immediately later because it has assumed
      otherwise.
      
      Reproduction of the oops-causing bug described here:
      
          https://lkml.org/lkml/2013/8/30/50
      
      Rge ussue originated in commit 2aa362c4 ("coredump: extend core dump
      note section to contain file names of mapped file") from Oct 4, 2012.
      
      This patch make that section optional in that case.  fill_files_note()
      should signify the error, and also let the info struct in
      elf_core_dump() be zero-initialized so that we can check for the
      optionally written note.
      
      [akpm@linux-foundation.org: avoid abusing E2BIG, remove a couple of not-really-needed local variables]
      [akpm@linux-foundation.org: fix sparse warning]
      Signed-off-by: default avatarDan Aloni <alonid@stratoscale.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Denys Vlasenko <vda.linux@googlemail.com>
      Reported-by: default avatarMartin MOKREJS <mmokrejs@gmail.com>
      Tested-by: default avatarMartin MOKREJS <mmokrejs@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      72023656
    • Joonyoung Shim's avatar
      revert "mm/memory-hotplug: fix lowmem count overflow when offline pages" · 7393dc45
      Joonyoung Shim authored
      This reverts commit cea27eb2 ("mm/memory-hotplug: fix lowmem count
      overflow when offline pages").
      
      The fixed bug by commit cea27eb2 was fixed to another way by commit
      3dcc0571 ("mm: correctly update zone->managed_pages").  That commit
      enhances memory_hotplug.c to adjust totalhigh_pages when hot-removing
      memory, for details please refer to:
      
        http://marc.info/?l=linux-mm&m=136957578620221&w=2
      
      As a result, commit cea27eb2 currently causes duplicated decreasing
      of totalhigh_pages, thus the revert.
      Signed-off-by: default avatarJoonyoung Shim <jy0922.shim@samsung.com>
      Reviewed-by: default avatarWanpeng Li <liwanp@linux.vnet.ibm.com>
      Cc: Jiang Liu <liuj97@gmail.com>
      Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
      Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7393dc45
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/egtvedt/linux-avr32 · 5c282e85
      Linus Torvalds authored
      Pull AVR32 fixes from Hans-Christian Egtvedt.
      
      Fix build warnings and use the Kbuild infrastructure for generic headers
      rather than doing it by hand.
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/egtvedt/linux-avr32:
        avr32: cast syscall_return to silence compiler warning
        avr32: fix clockevents kernel warning
        avr32: use Kbuild infrastructure to handle the asm-generic headers
      5c282e85
    • Linus Torvalds's avatar
      Merge tag 'for-linus-20130929' of git://github.com/sctscore/official-linux · 8945546d
      Linus Torvalds authored
      Pull S+core fixes from Lennox Wu:
       "These updates include updating information of maintainers, fix some
        trivial errors, and add a necessary function for supporting ipv6"
      
      * tag 'for-linus-20130929' of git://github.com/sctscore/official-linux:
        Score: Update the information of Score maintaners
        Score: Modify the Makefile of Score, remove -mlong-calls for compiling
        Score: Implement the function csum_ipv6_magic
        Score: The commit is for compiling successfully
      8945546d
    • Linus Torvalds's avatar
      Merge tag 'arc-fixes-for-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc · 815a4bb1
      Linus Torvalds authored
      Pull ARC Fixes from Vineet Gupta:
       - Handle unaligned access in zero delay loops
       - spinlock livelock fix for SMP systemC model
       - fix 32bit overflow in access_ok
       - better setup of clockevents
      
      * tag 'arc-fixes-for-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
        ARC: Use clockevents_config_and_register over clockevents_register_device
        ARC: Workaround spinlock livelock in SMP SystemC simulation
        ARC: Fix 32-bit wrap around in access_ok()
        ARC: Handle zero-overhead-loop in unaligned access handler
      815a4bb1
    • Gabor Juhos's avatar
      avr32: cast syscall_return to silence compiler warning · 395e73a2
      Gabor Juhos authored
      The patch fixes the following compiler warning:
          CC      arch/avr32/kernel/process.o
        arch/avr32/kernel/process.c: In function 'copy_thread':
        arch/avr32/kernel/process.c:292: warning: assignment makes integer \
        from pointer without a cast
      Signed-off-by: default avatarGabor Juhos <juhosg@openwrt.org>
      Acked-by: default avatarHans-Christian Egtvedt <egtvedt@samfundet.no>
      395e73a2
    • Gabor Juhos's avatar
      avr32: fix clockevents kernel warning · 1b0135b5
      Gabor Juhos authored
      Since commit 01426478
      (avr32: Use generic idle loop) the kernel throws the
      following warning on avr32:
      
        WARNING: at 900322e4 [verbose debug info unavailable]
        Modules linked in:
        CPU: 0 PID: 0 Comm: swapper Not tainted 3.12.0-rc2 #117
        task: 901c3ecc ti: 901c0000 task.ti: 901c0000
        PC is at cpu_idle_poll_ctrl+0x1c/0x38
        LR is at comparator_mode+0x3e/0x40
        pc : [<900322e4>]    lr : [<90014882>]    Not tainted
        sp : 901c1f74  r12: 00000000  r11: 901c74a0
        r10: 901d2510  r9 : 00000001  r8 : 901db4de
        r7 : 901c74a0  r6 : 00000001  r5 : 00410020  r4 : 901db574
        r3 : 00410024  r2 : 90206fe0  r1 : 00000000  r0 : 007f0000
        Flags: qvnzc
        Mode bits: hjmde....G
        CPU Mode: Supervisor
        Call trace:
         [<90039ede>] clockevents_set_mode+0x16/0x2e
         [<90039f00>] clockevents_shutdown+0xa/0x1e
         [<9003a078>] clockevents_exchange_device+0x58/0x70
         [<9003a78c>] tick_check_new_device+0x38/0x54
         [<9003a1a2>] clockevents_register_device+0x32/0x90
         [<900035c4>] time_init+0xa8/0x108
         [<90000520>] start_kernel+0x128/0x23c
      
      When the 'avr32_comparator' clockevent device is registered,
      the clockevent core sets the mode of that clockevent device
      to CLOCK_EVT_MODE_SHUTDOWN. Due to this, the 'comparator_mode'
      function calls the 'cpu_idle_poll_ctrl' to disables idle poll.
      This results in the aforementioned warning because the polling
      is not enabled yet.
      
      Change the code to only disable idle poll if it is enabled by
      the same function to avoid the warning.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarGabor Juhos <juhosg@openwrt.org>
      Acked-by: default avatarHans-Christian Egtvedt <egtvedt@samfundet.no>
      1b0135b5
    • Steven Rostedt's avatar
      avr32: use Kbuild infrastructure to handle the asm-generic headers · 46663d05
      Steven Rostedt authored
      Use kbuild to add asm-generic headers that do nothing, also remove the arch
      specific wrapper headers.
      
      This only affects headers that do nothing but include the generic
      equivalent. It does not touch any header that does a little more.
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      Signed-off-by: default avatarHans-Christian Egtvedt <egtvedt@samfundet.no>
      46663d05
  2. 29 Sep, 2013 10 commits
    • Linus Torvalds's avatar
      Linux 3.12-rc3 · 15c03dd4
      Linus Torvalds authored
      15c03dd4
    • Linus Torvalds's avatar
      Merge tag 'usb-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 30ceb4ec
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are a number of USB driver fixes for 3.12-rc3.
      
        These are all for host controller issues that have been reported, and
        there's a fix for an annoying error message that gets printed every
        time you remove a USB 3 device from the system that's been bugging me
        for a while"
      
      * tag 'usb-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: dwc3: add support for Merrifield
        USB: fsl/ehci: fix failure of checking PHY_CLK_VALID during reinitialization
        USB: Fix breakage in ffs_fs_mount()
        fsl/usb: Resolve PHY_CLK_VLD instability issue for ULPI phy
        usb/core/devio.c: Don't reject control message to endpoint with wrong direction bit
        usb: chipidea: USB_CHIPIDEA should depend on HAS_DMA
        usb: chipidea: udc: free pending TD at removal procedure
        usb: chipidea: imx: Add usb_phy_shutdown at probe's error path
        usb: chipidea: Fix memleak for ci->hw_bank.regmap when removal
        usb: chipidea: udc: fix the oops after rmmod gadget
        USB: fix PM config symbol in uhci-hcd, ehci-hcd, and xhci-hcd
        USB: OHCI: accept very late isochronous URBs
        USB: UHCI: accept very late isochronous URBs
        USB: iMX21: accept very late isochronous URBs
        usbcore: check usb device's state before sending a Set SEL control transfer
        xhci: Fix race between ep halt and URB cancellation
        usb: Fix xHCI host issues on remote wakeup.
        xhci: Ensure a command structure points to the correct trb on the command ring
        xhci: Fix oops happening after address device timeout
      30ceb4ec
    • Linus Torvalds's avatar
      Merge tag 'tty-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 26c019fc
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are some serial at tty driver fixes for 3.12-rc3
      
        The serial driver fixes some kref leaks, documentation is moved to the
        proper places, and the tty and n_tty fixes resolve some reported
        regressions.  There is still one outstanding tty regression fix that
        isn't in here yet, as I want to test it out some more, it will be sent
        for 3.12-rc4 if it checks out"
      
      * tag 'tty-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        tty: ar933x_uart: move devicetree binding documentation
        tty: Fix SIGTTOU not sent with tcflush()
        n_tty: Fix EOF push index when termios changes
        serial: pch_uart: remove unnecessary tty_port_tty_get
        serial: pch_uart: fix tty-kref leak in dma-rx path
        serial: pch_uart: fix tty-kref leak in rx-error path
        serial: tegra: fix tty-kref leak
      26c019fc
    • Linus Torvalds's avatar
      Merge tag 'staging-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 31795c40
      Linus Torvalds authored
      Pull staging fixes from Greg KH:
       "Here are some staging driver fixes, MAINTAINER updates, and a new
        device id.  All of these have been in the linux-next tree, and are
        pretty simple patches"
      
      * tag 'staging-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: r8188eu: Add new device ID
        staging: imx-drm: Fix probe failure
        staging: vt6656: [BUG] iwctl_siwencodeext return if device not open
        staging: vt6656: [BUG] main_usb.c oops on device_close move flag earlier.
        staging: vt6656: rxtx.c [BUG] s_vGetFreeContext dead lock on null apTD.
        Staging: rtl8192u: r819xU_cmdpkt: checking NULL value after doing dev_alloc_skb
        staging: usbip: Orphan usbip
        staging: r8188eu: Add files for new drive: Cocci spatch "noderef"
        staging: r8188eu: Cocci spatch "noderef"
        staging: octeon-usb: Cocci spatch "noderef"
        staging: r8188eu: Add files for new drive: Cocci spatch "noderef"
        MAINTAINERS: staging: dgnc and dgap drivers: add maintainer
        staging: lustre: Cocci spatch "noderef"
      31795c40
    • Linus Torvalds's avatar
      Merge tag 'driver-core-3.12-rc3' of... · 434ac47d
      Linus Torvalds authored
      Merge tag 'driver-core-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
      
      Pull driver core / sysfs fixes from Greg KH:
       "Here are 2 fixes for 3.12-rc3.  One fixes a sysfs problem with
        mounting caused by 3.12-rc1, and the other is a bug reported by the
        chromeos developers with the driver core.
      
        Both have been in linux-next for a bit"
      
      * tag 'driver-core-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        driver core : Fix use after free of dev->parent in device_shutdown
        sysfs: Allow mounting without CONFIG_NET
      434ac47d
    • Linus Torvalds's avatar
      Merge tag 'char-misc-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · c23c2234
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some HyperV and MEI driver fixes for 3.12-rc3.  They resolve
        some issues that people have been reporting for them"
      
      * tag 'char-misc-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        Drivers: hv: vmbus: Terminate vmbus version negotiation on timeout
        Drivers: hv: util: Correctly support ws2008R2 and earlier
        mei: cancel stall timers in mei_reset
        mei: bus: stop wait for read during cl state transition
        mei: make me client counters less error prone
      c23c2234
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · cac66535
      Linus Torvalds authored
      Pull perf revert from Ingo Molnar:
       "This fixes the 'perf top' regression Markus Trippelsdorf reported"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        Revert "perf symbols: Demangle cloned functions"
      cac66535
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · b97b869a
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Nothing too major, radeon still has some dpm changes for off by
        default.
      
        Radeon, intel, msm:
         - radeon: a few more dpm fixes (still off by default), uvd fixes
         - i915: runtime warn backtrace and regression fix
         - msm: iommu changes fallout"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (27 commits)
        drm/msm: use drm_gem_dumb_destroy helper
        drm/msm: deal with mach/iommu.h removal
        drm/msm: Remove iommu include from mdp4_kms.c
        drm/msm: Odd PTR_ERR usage
        drm/i915: Fix up usage of SHRINK_STOP
        drm/radeon: fix hdmi audio on DCE3.0/3.1 asics
        drm/i915: preserve pipe A quirk in i9xx_set_pipeconf
        drm/i915/tv: clear adjusted_mode.flags
        drm/i915/dp: increase i2c-over-aux retry interval on AUX DEFER
        drm/radeon/cik: fix overflow in vram fetch
        drm/radeon: add missing hdmi callbacks for rv6xx
        drm/i915: Use a temporary va_list for two-pass string handling
        drm/radeon/uvd: lower msg&fb buffer requirements on UVD3
        drm/radeon: disable tests/benchmarks if accel is disabled
        drm/radeon: don't set default clocks for SI when DPM is disabled
        drm/radeon/dpm/ci: filter clocks based on voltage/clk dep tables
        drm/radeon/dpm/si: filter clocks based on voltage/clk dep tables
        drm/radeon/dpm/ni: filter clocks based on voltage/clk dep tables
        drm/radeon/dpm/btc: filter clocks based on voltage/clk dep tables
        drm/radeon/dpm: fetch the max clk from voltage dep tables helper
        ...
      b97b869a
    • Ingo Molnar's avatar
      Revert "perf symbols: Demangle cloned functions" · 14951f22
      Ingo Molnar authored
      This reverts commit de95ab53.
      
      Markus Trippelsdorf reported that this commit broke 'perf top':
      
       > I just see a gray screen with no text at all. Sometimes the
       > following error messages are printed:
       >
       >  *** Error in `perf': invalid fastbin entry (free): 0x00000000029b18c0
       >  ***
       >  *** Error in `perf': malloc(): memory corruption (fast): 0x0000000000ee0b10 ***
      
      While this code is fixable, the commit itself fails on several levels:
      
       - it should have been a separate helper function
       - why the heck does it do strchr() twice
       - it casts a const char * over into char *
       - sloppy style
       - it's not even a regression fix!
      
      So lets revert it and re-try the patch in v3.13.
      Reported-by: default avatarMarkus Trippelsdorf <markus@trippelsdorf.de>
      Cc: Andi Kleen <ak@linux.intel.com>
      Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      14951f22
    • Dave Airlie's avatar
      Merge branch 'msm-fixes-3.12-rc2' of git://people.freedesktop.org/~robclark/linux into drm-fixes · 66544179
      Dave Airlie authored
      A small fix + deal with fallout of iommu changes + use new
      drm_gem_dumb_destroy helper.
      
      * 'msm-fixes-3.12-rc2' of git://people.freedesktop.org/~robclark/linux:
        drm/msm: use drm_gem_dumb_destroy helper
        drm/msm: deal with mach/iommu.h removal
        drm/msm: Remove iommu include from mdp4_kms.c
        drm/msm: Odd PTR_ERR usage
      66544179
  3. 28 Sep, 2013 20 commits