1. 01 Feb, 2017 4 commits
  2. 31 Jan, 2017 10 commits
  3. 30 Jan, 2017 11 commits
  4. 29 Jan, 2017 3 commits
    • Linus Torvalds's avatar
      Linux 4.10-rc6 · 566cf877
      Linus Torvalds authored
      566cf877
    • Linus Torvalds's avatar
      drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj() · 39cb2c9a
      Linus Torvalds authored
      I've seen this trigger twice now, where the i915_gem_object_to_ggtt()
      call in intel_unpin_fb_obj() returns NULL, resulting in an oops
      immediately afterwards as the (inlined) call to i915_vma_unpin_fence()
      tries to dereference it.
      
      It seems to be some race condition where the object is going away at
      shutdown time, since both times happened when shutting down the X
      server.  The call chains were different:
      
       - VT ioctl(KDSETMODE, KD_TEXT):
      
          intel_cleanup_plane_fb+0x5b/0xa0 [i915]
          drm_atomic_helper_cleanup_planes+0x6f/0x90 [drm_kms_helper]
          intel_atomic_commit_tail+0x749/0xfe0 [i915]
          intel_atomic_commit+0x3cb/0x4f0 [i915]
          drm_atomic_commit+0x4b/0x50 [drm]
          restore_fbdev_mode+0x14c/0x2a0 [drm_kms_helper]
          drm_fb_helper_restore_fbdev_mode_unlocked+0x34/0x80 [drm_kms_helper]
          drm_fb_helper_set_par+0x2d/0x60 [drm_kms_helper]
          intel_fbdev_set_par+0x18/0x70 [i915]
          fb_set_var+0x236/0x460
          fbcon_blank+0x30f/0x350
          do_unblank_screen+0xd2/0x1a0
          vt_ioctl+0x507/0x12a0
          tty_ioctl+0x355/0xc30
          do_vfs_ioctl+0xa3/0x5e0
          SyS_ioctl+0x79/0x90
          entry_SYSCALL_64_fastpath+0x13/0x94
      
       - i915 unpin_work workqueue:
      
          intel_unpin_work_fn+0x58/0x140 [i915]
          process_one_work+0x1f1/0x480
          worker_thread+0x48/0x4d0
          kthread+0x101/0x140
      
      and this patch purely papers over the issue by adding a NULL pointer
      check and a WARN_ON_ONCE() to avoid the oops that would then generally
      make the machine unresponsive.
      
      Other callers of i915_gem_object_to_ggtt() seem to also check for the
      returned pointer being NULL and warn about it, so this clearly has
      happened before in other places.
      
      [ Reported it originally to the i915 developers on Jan 8, applying the
        ugly workaround on my own now after triggering the problem for the
        second time with no feedback.
      
        This is likely to be the same bug reported as
      
           https://bugs.freedesktop.org/show_bug.cgi?id=98829
           https://bugs.freedesktop.org/show_bug.cgi?id=99134
      
        which has a patch for the underlying problem, but it hasn't gotten to
        me, so I'm applying the workaround. ]
      
      Cc: Daniel Vetter <daniel.vetter@intel.com>
      Cc: Jani Nikula <jani.nikula@linux.intel.com>
      Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
      Cc: Chris Wilson <chris@chris-wilson.co.uk>
      Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Cc: Imre Deak <imre.deak@intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      39cb2c9a
    • Linus Torvalds's avatar
      Merge branch 'parisc-4.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · 2c5d9555
      Linus Torvalds authored
      Pull two parisc fixes from Helge Deller:
       "One fix to avoid usage of BITS_PER_LONG in user-space exported swab.h
        header which breaks compiling qemu, and one trivial fix for printk
        continuation in the parisc parport driver"
      
      * 'parisc-4.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header
        parisc, parport_gsc: Fixes for printk continuation lines
      2c5d9555
  5. 28 Jan, 2017 8 commits
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 53cd1ad1
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "Two I2C driver bugfixes.
      
        The 'VLLS mode support' patch should have been entitled 'reconfigure
        pinctrl after suspend' to make the bugfix more clear. Sorry, I missed
        that, yet didn't want to rebase"
      
      * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: imx-lpi2c: add VLLS mode support
        i2c: i2c-cadence: Initialize configuration before probing devices
      53cd1ad1
    • Helge Deller's avatar
      parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header · 2ad5d52d
      Helge Deller authored
      In swab.h the "#if BITS_PER_LONG > 32" breaks compiling userspace programs if
      BITS_PER_LONG is #defined by userspace with the sizeof() compiler builtin.
      
      Solve this problem by using __BITS_PER_LONG instead.  Since we now
      #include asm/bitsperlong.h avoid further potential userspace pollution
      by moving the #define of SHIFT_PER_LONG to bitops.h which is not
      exported to userspace.
      
      This patch unbreaks compiling qemu on hppa/parisc.
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      Cc: <stable@vger.kernel.org>
      2ad5d52d
    • Helge Deller's avatar
      83b5d1e3
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-4.10-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · d56a5ca3
      Linus Torvalds authored
      Pull NFS client bugfixes from Trond Myklebust:
       "Stable patches:
         - NFSv4.1: Fix a deadlock in layoutget
         - NFSv4 must not bump sequence ids on NFS4ERR_MOVED errors
         - NFSv4 Fix a regression with OPEN EXCLUSIVE4 mode
         - Fix a memory leak when removing the SUNRPC module
      
        Bugfixes:
         - Fix a reference leak in _pnfs_return_layout"
      
      * tag 'nfs-for-4.10-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        pNFS: Fix a reference leak in _pnfs_return_layout
        nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"
        SUNRPC: cleanup ida information when removing sunrpc module
        NFSv4.0: always send mode in SETATTR after EXCLUSIVE4
        nfs: Don't increment lock sequence ID after NFS4ERR_MOVED
        NFSv4.1: Fix a deadlock in layoutget
      d56a5ca3
    • Linus Torvalds's avatar
      Merge tag 'md/4.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md · dd553962
      Linus Torvalds authored
      Pull MD fixes from Shaohua Li:
       "This fixes several corner cases for raid5 cache, which is merged into
        this cycle"
      
      * tag 'md/4.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md:
        md/r5cache: disable write back for degraded array
        md/r5cache: shift complex rmw from read path to write path
        md/r5cache: flush data only stripes in r5l_recovery_log()
        md/raid5: move comment of fetch_block to right location
        md/r5cache: read data into orig_page for prexor of cached data
        md/raid5-cache: delete meaningless code
      dd553962
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 64a172d2
      Linus Torvalds authored
      Pull arm64 fix from Catalin Marinas:
       "Fix kernel panic on ACPI-based systems where CPU capacity description
        is not currently handled"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: skip register_cpufreq_notifier on ACPI-based systems
      64a172d2
    • Linus Torvalds's avatar
      Merge tag 'arc-4.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc · ef1dce99
      Linus Torvalds authored
      Pull ARC fixes from Vineet Gupta:
       "Hopefully last set of changes for ARC for 4.10:
      
         - fix for unaligned access emulation corner case
      
         - fix for udelay loop inline asm regression
      
         - fix irq affinity finally for AXS103 board [Yuriy]
      
         - final fixes for setting IO-coherency sanely in SMP"
      
      * tag 'arc-4.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
        ARC: [arcompact] handle unaligned access delay slot corner case
        ARCv2: smp-boot: wake_flag polling by non-Masters needs to be uncached
        ARC: smp-boot: Decouple Non masters waiting API from jump to entry point
        ARCv2: MCIP: update the BCR per current changes
        ARC: udelay: fix inline assembler by adding LP_COUNT to clobber list
        ARCv2: MCIP: Deprecate setting of affinity in Device Tree
      ef1dce99
    • Douglas Miller's avatar
      percpu-refcount: fix reference leak during percpu-atomic transition · 966d2b04
      Douglas Miller authored
      percpu_ref_tryget() and percpu_ref_tryget_live() should return
      "true" IFF they acquire a reference. But the return value from
      atomic_long_inc_not_zero() is a long and may have high bits set,
      e.g. PERCPU_COUNT_BIAS, and the return value of the tryget routines
      is bool so the reference may actually be acquired but the routines
      return "false" which results in a reference leak since the caller
      assumes it does not need to do a corresponding percpu_ref_put().
      
      This was seen when performing CPU hotplug during I/O, as hangs in
      blk_mq_freeze_queue_wait where percpu_ref_kill (blk_mq_freeze_queue_start)
      raced with percpu_ref_tryget (blk_mq_timeout_work).
      Sample stack trace:
      
      __switch_to+0x2c0/0x450
      __schedule+0x2f8/0x970
      schedule+0x48/0xc0
      blk_mq_freeze_queue_wait+0x94/0x120
      blk_mq_queue_reinit_work+0xb8/0x180
      blk_mq_queue_reinit_prepare+0x84/0xa0
      cpuhp_invoke_callback+0x17c/0x600
      cpuhp_up_callbacks+0x58/0x150
      _cpu_up+0xf0/0x1c0
      do_cpu_up+0x120/0x150
      cpu_subsys_online+0x64/0xe0
      device_online+0xb4/0x120
      online_store+0xb4/0xc0
      dev_attr_store+0x68/0xa0
      sysfs_kf_write+0x80/0xb0
      kernfs_fop_write+0x17c/0x250
      __vfs_write+0x6c/0x1e0
      vfs_write+0xd0/0x270
      SyS_write+0x6c/0x110
      system_call+0x38/0xe0
      
      Examination of the queue showed a single reference (no PERCPU_COUNT_BIAS,
      and __PERCPU_REF_DEAD, __PERCPU_REF_ATOMIC set) and no requests.
      However, conditions at the time of the race are count of PERCPU_COUNT_BIAS + 0
      and __PERCPU_REF_DEAD and __PERCPU_REF_ATOMIC set.
      
      The fix is to make the tryget routines use an actual boolean internally instead
      of the atomic long result truncated to a int.
      
      Fixes: e625305b percpu-refcount: make percpu_ref based on longs instead of ints
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=190751Signed-off-by: default avatarDouglas Miller <dougmill@linux.vnet.ibm.com>
      Reviewed-by: default avatarJens Axboe <axboe@fb.com>
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Fixes: e625305b ("percpu-refcount: make percpu_ref based on longs instead of ints")
      Cc: stable@vger.kernel.org # v3.18+
      966d2b04
  6. 27 Jan, 2017 4 commits
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 1b1bc42c
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) GTP fixes from Andreas Schultz (missing genl module alias, clear IP
          DF on transmit).
      
       2) Netfilter needs to reflect the fwmark when sending resets, from Pau
          Espin Pedrol.
      
       3) nftable dump OOPS fix from Liping Zhang.
      
       4) Fix erroneous setting of VIRTIO_NET_HDR_F_DATA_VALID on transmit,
          from Rolf Neugebauer.
      
       5) Fix build error of ipt_CLUSTERIP when procfs is disabled, from Arnd
          Bergmann.
      
       6) Fix regression in handling of NETIF_F_SG in harmonize_features(),
          from Eric Dumazet.
      
       7) Fix RTNL deadlock wrt. lwtunnel module loading, from David Ahern.
      
       8) tcp_fastopen_create_child() needs to setup tp->max_window, from
          Alexey Kodanev.
      
       9) Missing kmemdup() failure check in ipv6 segment routing code, from
          Eric Dumazet.
      
      10) Don't execute unix_bind() under the bindlock, otherwise we deadlock
          with splice. From WANG Cong.
      
      11) ip6_tnl_parse_tlv_enc_lim() potentially reallocates the skb buffer,
          therefore callers must reload cached header pointers into that skb.
          Fix from Eric Dumazet.
      
      12) Fix various bugs in legacy IRQ fallback handling in alx driver, from
          Tobias Regnery.
      
      13) Do not allow lwtunnel drivers to be unloaded while they are
          referenced by active instances, from Robert Shearman.
      
      14) Fix truncated PHY LED trigger names, from Geert Uytterhoeven.
      
      15) Fix a few regressions from virtio_net XDP support, from John
          Fastabend and Jakub Kicinski.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (102 commits)
        ISDN: eicon: silence misleading array-bounds warning
        net: phy: micrel: add support for KSZ8795
        gtp: fix cross netns recv on gtp socket
        gtp: clear DF bit on GTP packet tx
        gtp: add genl family modules alias
        tcp: don't annotate mark on control socket from tcp_v6_send_response()
        ravb: unmap descriptors when freeing rings
        virtio_net: reject XDP programs using header adjustment
        virtio_net: use dev_kfree_skb for small buffer XDP receive
        r8152: check rx after napi is enabled
        r8152: re-schedule napi for tx
        r8152: avoid start_xmit to schedule napi when napi is disabled
        r8152: avoid start_xmit to call napi_schedule during autosuspend
        net: dsa: Bring back device detaching in dsa_slave_suspend()
        net: phy: leds: Fix truncated LED trigger names
        net: phy: leds: Break dependency of phy.h on phy_led_triggers.h
        net: phy: leds: Clear phy_num_led_triggers on failure to avoid crash
        net-next: ethernet: mediatek: change the compatible string
        Documentation: devicetree: change the mediatek ethernet compatible string
        bnxt_en: Fix RTNL lock usage on bnxt_get_port_module_status().
        ...
      1b1bc42c
    • Linus Torvalds's avatar
      Merge tag 'xfs-for-linus-4.10-rc6-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 3365135d
      Linus Torvalds authored
      Pull xfs uodates from Darrick Wong:
       "I have some more fixes this week: better input validation, corruption
        avoidance, build fixes, memory leak fixes, and a couple from Christoph
        to avoid an ENOSPC failure.
      
        Summary:
         - Fix race conditions in the CoW code
         - Fix some incorrect input validation checks
         - Avoid crashing fs by running out of space when freeing inodes
         - Fix toctou race wrt whether or not an inode has an attr
         - Fix build error on arm
         - Fix page refcount corruption when readahead fails
         - Don't corrupt userspace in the bmap ioctl"
      
      * tag 'xfs-for-linus-4.10-rc6-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: prevent quotacheck from overloading inode lru
        xfs: fix bmv_count confusion w/ shared extents
        xfs: clear _XBF_PAGES from buffers when readahead page
        xfs: extsize hints are not unlikely in xfs_bmap_btalloc
        xfs: remove racy hasattr check from attr ops
        xfs: use per-AG reservations for the finobt
        xfs: only update mount/resv fields on success in __xfs_ag_resv_init
        xfs: verify dirblocklog correctly
        xfs: fix COW writeback race
      3365135d
    • Linus Torvalds's avatar
      Merge branch 'for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs · 59063744
      Linus Torvalds authored
      Pull btrfs updates from Chris Mason:
       "Some fixes that we've collected from the list.
      
        We still have one more pending to nail down a regression in lzo
        compression, but I wanted to get this batch out the door"
      
      * 'for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
        Btrfs: remove ->{get, set}_acl() from btrfs_dir_ro_inode_operations
        Btrfs: disable xattr operations on subvolume directories
        Btrfs: remove old tree_root case in btrfs_read_locked_inode()
        Btrfs: fix truncate down when no_holes feature is enabled
        Btrfs: Fix deadlock between direct IO and fast fsync
        btrfs: fix false enospc error when truncating heavily reflinked file
      59063744
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 2fb78e89
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A set of fixes for this series. This contains:
      
         - Set of fixes for the nvme target code
      
         - A revert of patch from this merge window, causing a regression with
           WRITE_SAME on iSCSI targets at least.
      
         - A fix for a use-after-free in the new O_DIRECT bdev code.
      
         - Two fixes for the xen-blkfront driver"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        Revert "sd: remove __data_len hack for WRITE SAME"
        nvme-fc: use blk_rq_nr_phys_segments
        nvmet-rdma: Fix missing dma sync to nvme data structures
        nvmet: Call fatal_error from keep-alive timout expiration
        nvmet: cancel fatal error and flush async work before free controller
        nvmet: delete controllers deletion upon subsystem release
        nvmet_fc: correct logic in disconnect queue LS handling
        block: fix use after free in __blkdev_direct_IO
        xen-blkfront: correct maximum segment accounting
        xen-blkfront: feature flags handling adjustments
      2fb78e89