AgeCommit message (Collapse)AuthorFilesLines
2013-05-26Linux 3.10-rc3v3.10-rc3Linus Torvalds1-1/+1
2013-05-26ipc/sem.c: Fix missing wakeups in do_smart_update_queue()Manfred Spraul1-5/+22
do_smart_update_queue() is called when an operation (semop, semctl(SETVAL), semctl(SETALL), ...) modified the array. It must check which of the sleeping tasks can proceed. do_smart_update_queue() missed a few wakeups: - if a sleeping complex op was completed, then all per-semaphore queues must be scanned - not only those that were modified by *sops - if a sleeping simple op proceeded, then the global queue must be scanned again And: - the test for "|sops == NULL) before scanning the global queue is not required: If the global queue is empty, then it doesn't need to be scanned - regardless of the reason for calling do_smart_update_queue() The patch is not optimized, i.e. even completing a wait-for-zero operation causes a rescan. This is done to keep the patch as simple as possible. Signed-off-by: Manfred Spraul <> Acked-by: Davidlohr Bueso <> Cc: Rik van Riel <> Cc: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-26Merge tag 'nfs-for-3.10-3' of git:// Torvalds11-41/+78
Pull NFS client bugfixes from Trond Myklebust: - Stable fix to prevent an rpc_task wakeup race - Fix a NFSv4.1 session drain deadlock - Fix a NFSv4/v4.1 mount regression when not running rpc.gssd - Ensure auth_gss pipe detection works in namespaces - Fix SETCLIENTID fallback if rpcsec_gss is not available * tag 'nfs-for-3.10-3' of git:// NFS: Fix SETCLIENTID fallback if GSS is not available SUNRPC: Prevent an rpc_task wakeup race NFSv4.1 Fix a pNFS session draining deadlock SUNRPC: Convert auth_gss pipe detection to work in namespaces SUNRPC: Faster detection if gssd is actually running SUNRPC: Fix a bug in gss_create_upcall
2013-05-26Merge tag 'edac_fixes_for_3.10' of ↵Linus Torvalds1-2/+2
git:// Pull amd64 edac fix from Borislav Petkov: "A sysfs file permissions correction" * tag 'edac_fixes_for_3.10' of git:// amd64_edac: Fix bogus sysfs file permissions
2013-05-26Merge branch 'parisc-for-3.10' of ↵Linus Torvalds12-71/+62
git:// Pull parisc fixes from Helge Deller: "This time we made the kernel- and interruption stack allocation reentrant which fixed some strange kernel crashes (specifically protection ID traps). Furthemore this patchset fixes the interrupt stack in UP and SMP configurations by using native locking instructions. And finally usage of floating point calculations on parisc were disabled in the MPILIB." * 'parisc-for-3.10' of git:// parisc: fix irq stack on UP and SMP parisc/superio: Use module_pci_driver to register driver parisc: make interrupt and interruption stack allocation reentrant parisc: show number of FPE and unaligned access handler calls in /proc/interrupts parisc: add additional parisc git tree to MAINTAINERS file parisc: use PAGE_SHIFT instead of hardcoded value 12 in pacache.S parisc: add rp5470 entry to machine database MPILIB: disable usage of floating point registers on parisc
2013-05-26Merge tag 'for-linus-v3.10-rc3' of git:// Torvalds8-21/+47
Pull xfs fixes from Ben Myers: "Here are fixes for corruption on 512 byte filesystems, a rounding error, a use-after-free, some flags to fix lockdep reports, and several fixes related to CRCs. We have a somewhat larger post -rc1 queue than usual due to fixes related to the CRC feature we merged for 3.10: - Fix for corruption with FSX on 512 byte blocksize filesystems - Fix rounding error in xfs_free_file_space - Fix use-after-free with extent free intents - Add several missing KM_NOFS flags to fix lockdep reports - Several fixes for CRC related code" * tag 'for-linus-v3.10-rc3' of git:// xfs: remote attribute lookups require the value length xfs: xfs_attr_shortform_allfit() does not handle attr3 format. xfs: xfs_da3_node_read_verify() doesn't handle XFS_ATTR3_LEAF_MAGIC xfs: fix missing KM_NOFS tags to keep lockdep happy xfs: Don't reference the EFI after it is freed xfs: fix rounding in xfs_free_file_space xfs: fix sub-page blocksize data integrity writes
2013-05-25Merge tag 'for-v3.10-fixes' of git:// Torvalds3-2/+3
Pull bettery fixes from Anton Vorontsov: "Last minute one-liners: wrong kfree usage fix, module alias fixup and kconfig adjustments" * tag 'for-v3.10-fixes' of git:// pm2301_charger: Fix module alias prefix wm831x_backup: Fix wrong kfree call for devdata-> bq27x00: Fix I2C dependency in KConfig lp8788-charger: Fix kconfig dependency
2013-05-25Merge tag 'pm+acpi-3.10-rc3' of ↵Linus Torvalds8-137/+144
git:// Pull power management and ACPI fixes from Rafael Wysocki: - Additional CPU ID for the intel_pstate driver from Dirk Brandewie. - More cpufreq fixes related to ARM big.LITTLE support and locking from Viresh Kumar. - VIA C7 cpufreq build fix from Rafał Bilski. - ACPI power management fix making it possible to use device power states regardless of the CONFIG_PM setting from Rafael J Wysocki. - New ACPI video blacklist item from Bastian Triller. * tag 'pm+acpi-3.10-rc3' of git:// ACPI / video: Add "Asus UL30A" to ACPI video detect blacklist cpufreq: arm_big_little_dt: Instantiate as platform_driver cpufreq: arm_big_little_dt: Register driver only if DT has valid data cpufreq / e_powersaver: Fix linker error when ACPI processor is a module cpufreq / intel_pstate: Add additional supported CPU ID cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT ACPI / PM: Allow device power states to be used for CONFIG_PM unset
2013-05-25Merge branch 'fixes' of git:// Torvalds9-173/+211
Pull slave-dma fixes from Vinod Koul: "We have two patches from Andy & Rafael fixing the Lynxpoint dma" * 'fixes' of git:// ACPI / LPSS: register clock device for Lynxpoint DMA properly dma: acpi-dma: parse CSRT to extract additional resources
2013-05-25score: remove redundant kcore_list entriesKyle McMartin1-2/+0
kcore_vmalloc is in fs/proc/kcore.c and kcore_mem is unused across the tree. Noticed while grepping the tree for some other kcore stuff. (score looks pretty unmaintained to me.) Signed-off-by: Kyle McMartin <> Signed-off-by: Linus Torvalds <>
2013-05-25Merge tag 'arc-v3.10-fixes' of ↵Linus Torvalds11-70/+41
git:// Pull ARC fixes from Vineet Gupta: - Fallouts/wreckage of Cache Flush optimizations / aliasing dcache support - Fix for an interesting bug where piped input to grep was getting mysteriously clobbered * tag 'arc-v3.10-fixes' of git:// ARC: lazy dcache flush broke gdb in non-aliasing configs ARC: Use enough bits for determining page's cache color ARC: Brown paper bag bug in macro for checking cache color ARC: copy_(to|from)_user() to honor usermode-access permissions ARC: [mm] Prevent stray dcache lines after__sync_icache_dcach() ARC: [TB10x] Remove redundant abilis,simple-pinctrl mechanism
2013-05-25Merge branch 'fixes' of git:// Torvalds3-3/+2
Pull ARM fixes from Russell King: "Just three this time, all really quite small" * 'fixes' of git:// ARM: 7729/1: vfp: ensure VFP_arch is non-zero when VFP is not supported ARM: 7727/1: remove the .vm_mm value from gate_vma ARM: 7723/1: crypto: sha1-armv4-large.S: fix SP handling
2013-05-25ARC: lazy dcache flush broke gdb in non-aliasing configsVineet Gupta2-19/+11
gdbserver inserting a breakpoint ends up calling copy_user_page() for a code page. The generic version of which (non-aliasing config) didn't set the PG_arch_1 bit hence update_mmu_cache() didn't sync dcache/icache for corresponding dynamic loader code page - causing garbade to be executed. So now aliasing versions of copy_user_highpage()/clear_page() are made default. There is no significant overhead since all of special alias handling code is compiled out for non-aliasing build Signed-off-by: Vineet Gupta <>
2013-05-24Merge branch 'akpm' (incoming from Andrew Morton)Linus Torvalds40-417/+1031
Merge fixes from Andrew Morton: "A bunch of fixes and one simple fbdev driver which missed the merge window because people will still talking about it (to no great effect)." * emailed patches from Andrew Morton <>: (30 commits) aio: fix kioctx not being freed after cancellation at exit time mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areas drivers/rtc/rtc-max8998.c: check for pdata presence before dereferencing ocfs2: goto out_unlock if ocfs2_get_clusters_nocache() failed in ocfs2_fiemap() random: fix accounting race condition with lockless irq entropy_count update drivers/char/random.c: fix priming of last_data mm/memory_hotplug.c: fix printk format warnings nilfs2: fix issue of nilfs_set_page_dirty() for page at EOF boundary drivers/block/brd.c: fix brd_lookup_page() race fbdev: FB_GOLDFISH should depend on HAS_DMA drivers/rtc/rtc-pl031.c: pass correct pointer to free_irq() auditfilter.c: fix kernel-doc warnings aio: fix io_getevents documentation revert "selftest: add simple test for soft-dirty bit" drivers/leds/leds-ot200.c: fix error caused by shifted mask mm/THP: use pmd_populate() to update the pmd with pgtable_t pointer linux/kernel.h: fix kernel-doc warning mm compaction: fix of improper cache flush in migration code rapidio/tsi721: fix bug in MSI interrupt handling hfs: avoid crash in hfs_bnode_create ...
2013-05-24Merge tag 'fixes-for-linus' of ↵Linus Torvalds50-236/+185
git:// Pull ARM SoC fixes from Olof Johansson: "We didn't have any fixes sent up for -rc2, so this is a slightly larger batch. A bit all over the place platform-wise; OMAP, at91, marvell, renesas, sunxi, ux500, etc. I tried to summarize highlights but there isn't a whole lot to point out. Lots of little things fixed all over. A couple of defconfig updates due to new/changing options." * tag 'fixes-for-linus' of git:// (44 commits) ARM: at91/sama5: fix incorrect PMC pcr div definition ARM: at91/dt: fix macb pinctrl_macb_rmii_mii_alt definition ARM: at91: at91sam9n12: move external irq declatation to DT ARM: shmobile: marzen: Use error values in usb_power_* ARM: tegra: defconfig fixes ARM: nomadik: fix IRQ assignment for SMC ethernet ARM: vt8500: Add missing NULL terminator in dt_compat clk: tegra: add ac97 controller clock clk: tegra: remove USB from clk init table ARM: dts: mvebu: Fix wrong the address reg value for the L2-cache node ARM: plat-orion: Fix num_resources and id for ge10 and ge11 ARM: OMAP2+: hwmod: Remove sysc slave idle and auto idle apis SERIAL: OMAP: Remove the slave idle handling from the driver ARM: OMAP2+: serial: Remove the un-used slave idle hooks ARM: OMAP2+: hwmod-data: UART IP needs software control to manage sidle modes ARM: OMAP2+: hwmod: Add a new flag to handle SIDLE in SWSUP only in active ARM: OMAP2+: hwmod: Fix sidle programming in _enable_sysc()/_idle_sysc() arm: mvebu: fix the 'ranges' property to handle PCIe ARM: mvebu: select ARCH_REQUIRE_GPIOLIB for mvebu platform ARM: AM33XX: Add missing .clkdm_name to clkdiv32k_ick clock ...
2013-05-24aio: fix kioctx not being freed after cancellation at exit timeBenjamin LaHaise1-1/+3
The recent changes overhauling fs/aio.c introduced a bug that results in the kioctx not being freed when outstanding kiocbs are cancelled at exit_aio() time. Specifically, a kiocb that is cancelled has its completion events discarded by batch_complete_aio(), which then fails to wake up the process stuck in free_ioctx(). Fix this by modifying the wait_event() condition in free_ioctx() appropriately. This patch was tested with the cancel operation in the thread based code posted yesterday. [ fix build] Signed-off-by: Benjamin LaHaise <> Signed-off-by: Kent Overstreet <> Cc: Kent Overstreet <> Cc: Josh Boyer <> Cc: Zach Brown <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areasCliff Wickman1-34/+36
A panic can be caused by simply cat'ing /proc/<pid>/smaps while an application has a VM_PFNMAP range. It happened in-house when a benchmarker was trying to decipher the memory layout of his program. /proc/<pid>/smaps and similar walks through a user page table should not be looking at VM_PFNMAP areas. Certain tests in walk_page_range() (specifically split_huge_page_pmd()) assume that all the mapped PFN's are backed with page structures. And this is not usually true for VM_PFNMAP areas. This can result in panics on kernel page faults when attempting to address those page structures. There are a half dozen callers of walk_page_range() that walk through a task's entire page table (as N. Horiguchi pointed out). So rather than change all of them, this patch changes just walk_page_range() to ignore VM_PFNMAP areas. The logic of hugetlb_vma() is moved back into walk_page_range(), as we want to test any vma in the range. VM_PFNMAP areas are used by: - graphics memory manager gpu/drm/drm_gem.c - global reference unit sgi-gru/grufile.c - sgi special memory char/mspec.c - and probably several out-of-tree modules [ remove now-unused hugetlb_vma() stub] Signed-off-by: Cliff Wickman <> Reviewed-by: Naoya Horiguchi <> Cc: Mel Gorman <> Cc: Andrea Arcangeli <> Cc: Dave Hansen <> Cc: David Sterba <> Cc: Johannes Weiner <> Cc: KOSAKI Motohiro <> Cc: "Kirill A. Shutemov" <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24drivers/rtc/rtc-max8998.c: check for pdata presence before dereferencingTomasz Figa1-1/+1
Currently the driver can crash with a NULL pointer dereference if no pdata is provided, despite of successful registration of the MFD part. This patch fixes the problem by adding a NULL check before dereferencing the pdata pointer. Signed-off-by: Tomasz Figa <> Signed-off-by: Kyungmin Park <> Cc: Sachin Kamat <> Reviewed-by: Jingoo Han <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24ocfs2: goto out_unlock if ocfs2_get_clusters_nocache() failed in ocfs2_fiemap()Joseph Qi1-1/+1
Last time we found there is lock/unlock bug in ocfs2_file_aio_write, and then we did a thorough search for all lock resources in ocfs2_inode_info, including rw, inode and open lockres and found this bug. My kernel version is 3.0.13, and it is also in the lastest version 3.9. In ocfs2_fiemap, once ocfs2_get_clusters_nocache failed, it should goto out_unlock instead of out, because we need release buffer head, up read alloc sem and unlock inode. Signed-off-by: Joseph Qi <> Reviewed-by: Jie Liu <> Cc: Mark Fasheh <> Cc: Joel Becker <> Acked-by: Sunil Mushran <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24random: fix accounting race condition with lockless irq entropy_count updateJiri Kosina1-8/+16
Commit 902c098a3663 ("random: use lockless techniques in the interrupt path") turned IRQ path from being spinlock protected into lockless cmpxchg-retry update. That commit removed r->lock serialization between crediting entropy bits from IRQ context and accounting when extracting entropy on userspace read path, but didn't turn the r->entropy_count reads/updates in account() to use cmpxchg as well. It has been observed, that under certain circumstances this leads to read() on /dev/urandom to return 0 (EOF), as r->entropy_count gets corrupted and becomes negative, which in turn results in propagating 0 all the way from account() to the actual read() call. Convert the accounting code to be the proper lockless counterpart of what has been partially done by 902c098a3663. Signed-off-by: Jiri Kosina <> Cc: Theodore Ts'o <> Cc: Greg KH <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24drivers/char/random.c: fix priming of last_dataJarod Wilson1-15/+15
Commit ec8f02da9ea5 ("random: prime last_data value per fips requirements") added priming of last_data per fips requirements. Unfortuantely, it did so in a way that can lead to multiple threads all incrementing nbytes, but only one actually doing anything with the extra data, which leads to some fun random corruption and panics. The fix is to simply do everything needed to prime last_data in a single shot, so there's no window for multiple cpus to increment nbytes -- in fact, we won't even increment or decrement nbytes anymore, we'll just extract the needed EXTRACT_SIZE one time per pool and then carry on with the normal routine. All these changes have been tested across multiple hosts and architectures where panics were previously encoutered. The code changes are are strictly limited to areas only touched when when booted in fips mode. This change should also go into 3.8-stable, to make the myriads of fips users on 3.8.x happy. Signed-off-by: Jarod Wilson <> Tested-by: Jan Stancek <> Tested-by: Jan Stodola <> Cc: Herbert Xu <> Acked-by: Neil Horman <> Cc: "David S. Miller" <> Cc: Matt Mackall <> Cc: "Theodore Ts'o" <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24mm/memory_hotplug.c: fix printk format warningsRandy Dunlap1-3/+6
Fix printk format warnings in mm/memory_hotplug.c by using "%pa": mm/memory_hotplug.c: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 2 has type 'resource_size_t' [-Wformat] mm/memory_hotplug.c: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'resource_size_t' [-Wformat] Signed-off-by: Randy Dunlap <> Reported-by: Geert Uytterhoeven <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24nilfs2: fix issue of nilfs_set_page_dirty() for page at EOF boundaryRyusuke Konishi1-4/+23
nilfs2: fix issue of nilfs_set_page_dirty for page at EOF boundary DESCRIPTION: There are use-cases when NILFS2 file system (formatted with block size lesser than 4 KB) can be remounted in RO mode because of encountering of "broken bmap" issue. The issue was reported by Anthony Doggett <>: "The machine I've been trialling nilfs on is running Debian Testing, Linux version 3.2.0-4-686-pae ( (gcc version 4.6.3 (Debian 4.6.3-14) ) #1 SMP Debian 3.2.35-2), but I've also reproduced it (identically) with Debian Unstable amd64 and Debian Experimental (using the 3.8-trunk kernel). The problematic partitions were formatted with "mkfs.nilfs2 -b 1024 -B 8192"." SYMPTOMS: (1) System log contains error messages likewise: [63102.496756] nilfs_direct_assign: invalid pointer: 0 [63102.496786] NILFS error (device dm-17): nilfs_bmap_assign: broken bmap (inode number=28) [63102.496798] [63102.524403] Remounting filesystem read-only (2) The NILFS2 file system is remounted in RO mode. REPRODUSING PATH: (1) Create volume group with name "unencrypted" by means of vgcreate utility. (2) Run script (prepared by Anthony Doggett <>): ----------------[BEGIN SCRIPT]-------------------- VG=unencrypted lvcreate --size 2G --name ntest $VG mkfs.nilfs2 -b 1024 -B 8192 /dev/mapper/$VG-ntest mkdir /var/tmp/n mkdir /var/tmp/n/ntest mount /dev/mapper/$VG-ntest /var/tmp/n/ntest mkdir /var/tmp/n/ntest/thedir cd /var/tmp/n/ntest/thedir sleep 2 date darcs init sleep 2 dmesg|tail -n 5 date darcs whatsnew || true date sleep 2 dmesg|tail -n 5 ----------------[END SCRIPT]-------------------- REPRODUCIBILITY: 100% INVESTIGATION: As it was discovered, the issue takes place during segment construction after executing such sequence of user-space operations: open("_darcs/index", O_RDWR|O_CREAT|O_NOCTTY, 0666) = 7 fstat(7, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0 ftruncate(7, 60) The error message "NILFS error (device dm-17): nilfs_bmap_assign: broken bmap (inode number=28)" takes place because of trying to get block number for third block of the file with logical offset #3072 bytes. As it is possible to see from above output, the file has 60 bytes of the whole size. So, it is enough one block (1 KB in size) allocation for the whole file. Trying to operate with several blocks instead of one takes place because of discovering several dirty buffers for this file in nilfs_segctor_scan_file() method. The root cause of this issue is in nilfs_set_page_dirty function which is called just before writing to an mmapped page. When nilfs_page_mkwrite function handles a page at EOF boundary, it fills hole blocks only inside EOF through __block_page_mkwrite(). The __block_page_mkwrite() function calls set_page_dirty() after filling hole blocks, thus nilfs_set_page_dirty function (= a_ops->set_page_dirty) is called. However, the current implementation of nilfs_set_page_dirty() wrongly marks all buffers dirty even for page at EOF boundary. As a result, buffers outside EOF are inconsistently marked dirty and queued for write even though they are not mapped with nilfs_get_block function. FIX: This modifies nilfs_set_page_dirty() not to mark hole blocks dirty. Thanks to Vyacheslav Dubeyko for his effort on analysis and proposals for this issue. Signed-off-by: Ryusuke Konishi <> Reported-by: Anthony Doggett <> Reported-by: Vyacheslav Dubeyko <> Cc: Vyacheslav Dubeyko <> Tested-by: Ryusuke Konishi <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24drivers/block/brd.c: fix brd_lookup_page() raceBrian Behlendorf1-2/+2
The index on the page must be set before it is inserted in the radix tree. Otherwise there is a small race which can occur during lookup where the page can be found with the incorrect index. This will trigger the BUG_ON() in brd_lookup_page(). Signed-off-by: Brian Behlendorf <> Reported-by: Chris Wedgwood <> Cc: Jens Axboe <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24fbdev: FB_GOLDFISH should depend on HAS_DMAGeert Uytterhoeven1-1/+1
If NO_DMA=y: drivers/built-in.o: In function `goldfish_fb_remove': drivers/video/goldfishfb.c:301: undefined reference to `dma_free_coherent' drivers/built-in.o: In function `goldfish_fb_probe': drivers/video/goldfishfb.c:247: undefined reference to `dma_alloc_coherent' drivers/video/goldfishfb.c:280: undefined reference to `dma_free_coherent' Signed-off-by: Geert Uytterhoeven <> Cc: Florian Tobias Schandinat <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24drivers/rtc/rtc-pl031.c: pass correct pointer to free_irq()Lars-Peter Clausen1-1/+1
free_irq() expects the same pointer that was passed to request_irq(), otherwise the IRQ is not freed. The issue was found using the following coccinelle script: <smpl> @r1@ type T; T devid; @@ request_irq(..., devid) @r2@ type r1.T; T devid; position p; @@ free_irq@p(..., devid) @@ position p != r2.p; @@ *free_irq@p(...) </smpl> Signed-off-by: Lars-Peter Clausen <> Cc: Srinidhi Kasagar <> Cc: Linus Walleij <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24auditfilter.c: fix kernel-doc warningsRandy Dunlap1-3/+0
Fix kernel-doc warnings in kernel/auditfilter.c: Warning(kernel/auditfilter.c:1029): Excess function parameter 'loginuid' description in 'audit_receive_filter' Warning(kernel/auditfilter.c:1029): Excess function parameter 'sessionid' description in 'audit_receive_filter' Warning(kernel/auditfilter.c:1029): Excess function parameter 'sid' description in 'audit_receive_filter' Signed-off-by: Randy Dunlap <> Cc: Eric Paris <> Cc: Al Viro <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24aio: fix io_getevents documentationJeff Moyer1-2/+1
In reviewing man pages, I noticed that io_getevents is documented to update the timeout that gets passed into the library call. This doesn't happen in kernel space or in the library (even though it's documented to do so in both places). Unless there is objection, I'd like to fix the comments/docs to match the code (I will also update the man page upon consensus). Signed-off-by: Jeff Moyer <> Signed-off-by: Benjamin LaHaise <> Acked-by: Cyril Hrubis <> Acked-by: Michael Kerrisk <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24revert "selftest: add simple test for soft-dirty bit"Andrew Morton3-125/+0
Revert commit 58c7be84fec8 ("selftest: add simple test for soft-dirty bit"). This is the self test for Pavel's pagemap2 patches which didn't actually get merged. Reported-by: Pavel Emelyanov <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24drivers/leds/leds-ot200.c: fix error caused by shifted maskChristian Gmeiner1-7/+7
During the development of this driver an in-house register documentation was used. The last week some integration tests were done and this problem was found. It turned out that the released register documentation is wrong. The fix is very simple: shift all masks by one. Signed-off-by: Christian Gmeiner <> Cc: Bryan Wu <> Cc: Sebastian Andrzej Siewior <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24mm/THP: use pmd_populate() to update the pmd with pgtable_t pointerAneesh Kumar K.V1-1/+6
We should not use set_pmd_at to update pmd_t with pgtable_t pointer. set_pmd_at is used to set pmd with huge pte entries and architectures like ppc64, clear few flags from the pte when saving a new entry. Without this change we observe bad pte errors like below on ppc64 with THP enabled. BUG: Bad page map in process ld mm=0xc000001ee39f4780 pte:7fc3f37848000001 pmd:c000001ec0000000 Signed-off-by: Aneesh Kumar K.V <> Cc: Hugh Dickins <> Cc: Benjamin Herrenschmidt <> Reviewed-by: Andrea Arcangeli <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24linux/kernel.h: fix kernel-doc warningRandy Dunlap1-2/+3
Fix kernel-doc warning in <linux/kernel.h>: Warning(include/linux/kernel.h:590): No description found for parameter 'ip' scripts/kernel-doc cannot handle macros, functions, or function prototypes between the function or macro that is being documented and its definition, so move these prototypes above the function that is being documented. Signed-off-by: Randy Dunlap <> Cc: Steven Rostedt <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24mm compaction: fix of improper cache flush in migration codeLeonid Yegoshin1-1/+1
Page 'new' during MIGRATION can't be flushed with flush_cache_page(). Using flush_cache_page(vma, addr, pfn) is justified only if the page is already placed in process page table, and that is done right after flush_cache_page(). But without it the arch function has no knowledge of process PTE and does nothing. Besides that, flush_cache_page() flushes an application cache page, but the kernel has a different page virtual address and dirtied it. Replace it with flush_dcache_page(new) which is the proper usage. The old page is flushed in try_to_unmap_one() before migration. This bug takes place in Sead3 board with M14Kc MIPS CPU without cache aliasing (but Harvard arch - separate I and D cache) in tight memory environment (128MB) each 1-3days on SOAK test. It fails in cc1 during kernel build (SIGILL, SIGBUS, SIGSEG) if CONFIG_COMPACTION is switched ON. Signed-off-by: Leonid Yegoshin <> Cc: Leonid Yegoshin <> Acked-by: Rik van Riel <> Cc: Michal Hocko <> Acked-by: Mel Gorman <> Cc: Ralf Baechle <> Cc: Russell King <> Cc: David Miller <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24rapidio/tsi721: fix bug in MSI interrupt handlingAlexandre Bounine1-0/+12
Fix bug in MSI interrupt handling which causes loss of event notifications. Typical indication of lost MSI interrupts are stalled message and doorbell transfers between RapidIO endpoints. To avoid loss of MSI interrupts all interrupts from the device must be disabled on entering the interrupt handler routine and re-enabled when exiting it. Re-enabling device interrupts will trigger new MSI message(s) if Tsi721 registered new events since entering interrupt handler routine. This patch is applicable to kernel versions starting from v3.2. Signed-off-by: Alexandre Bounine <> Cc: Matt Porter <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24hfs: avoid crash in hfs_bnode_createJeff Mahoney1-1/+5
Commit 634725a92938 ("hfs: cleanup HFS+ prints") removed the BUG_ON in hfs_bnode_create in hfsplus. This patch removes it from the hfs version and avoids an fsfuzzer crash. Signed-off-by: Jeff Mahoney <> Acked-by: Jeff Mahoney <> Signed-off-by: Jiri Slaby <> Cc: Vyacheslav Dubeyko <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24mm: memcg: remove incorrect VM_BUG_ON for swap cache pages in unchargeJohannes Weiner1-2/+12
Commit 0c59b89c81ea ("mm: memcg: push down PageSwapCache check into uncharge entry functions") added a VM_BUG_ON() on PageSwapCache in the uncharge path after checking that page flag once, assuming that the state is stable in all paths, but this is not the case and the condition triggers in user environments. An uncharge after the last page table reference to the page goes away can race with reclaim adding the page to swap cache. Swap cache pages are usually uncharged when they are freed after swapout, from a path that also handles swap usage accounting and memcg lifetime management. However, since the last page table reference is gone and thus no references to the swap slot left, the swap slot will be freed shortly when reclaim attempts to write the page to disk. The whole swap accounting is not even necessary. So while the race condition for which this VM_BUG_ON was added is real and actually existed all along, there are no negative effects. Remove the VM_BUG_ON again. Reported-by: Heiko Carstens <> Reported-by: Lingzhu Xiang <> Signed-off-by: Johannes Weiner <> Acked-by: Hugh Dickins <> Acked-by: Michal Hocko <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24drivers/video: implement a simple framebuffer driverStephen Warren4-0/+277
A simple frame-buffer describes a raw memory region that may be rendered to, with the assumption that the display hardware has already been set up to scan out from that buffer. This is useful in cases where a bootloader exists and has set up the display hardware, but a Linux driver doesn't yet exist for the display hardware. Examples use-cases include: * The built-in LCD panels on the Samsung ARM chromebook, and Tegra devices, and likely many other ARM or embedded systems. These cannot yet be supported using a full graphics driver, since the panel control should be provided by the CDF (Common Display Framework), which has been stuck in design/review for quite some time. One could support these panels using custom SoC-specific code, but there is a desire to use common infra-structure rather than having each SoC vendor invent their own code, hence the desire to wait for CDF. * Hardware for which a full graphics driver is not yet available, and the path to obtain one upstream isn't yet clear. For example, the Raspberry Pi. * Any hardware in early stages of upstreaming, before a full graphics driver has been tackled. This driver can provide a graphical boot console (even full X support) much earlier in the upstreaming process, thus making new SoC or board support more generally useful earlier. [ make simplefb_formats[] static] Signed-off-by: Stephen Warren <> Cc: Arnd Bergmann <> Acked-by: Olof Johansson <> Cc: Rob Clark <> Cc: Florian Tobias Schandinat <> Cc: Tomasz Figa <> Cc: Laurent Pinchart <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24ocfs2: unlock rw lock if inode lock failedJoseph Qi1-1/+1
In ocfs2_file_aio_write(), it does ocfs2_rw_lock() first and then ocfs2_inode_lock(). But if ocfs2_inode_lock() failed, it goes to out_sems without unlocking rw lock. This will cause a bug in ocfs2_lock_res_free() when testing res->l_ex_holders, which is increased in __ocfs2_cluster_lock() and decreased in __ocfs2_cluster_unlock(). Signed-off-by: Joseph Qi <> Cc: Joel Becker <> Cc: Mark Fasheh <> Cc: Li Zefan <> Cc: "Duyongfeng (B)" <> Acked-by: Sunil Mushran <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24mm: mmu_notifier: re-fix freed page still mapped in secondary MMUXiao Guangrong1-40/+39
Commit 751efd8610d3 ("mmu_notifier_unregister NULL Pointer deref and multiple ->release()") breaks the fix 3ad3d901bbcf ("mm: mmu_notifier: fix freed page still mapped in secondary MMU"). Since hlist_for_each_entry_rcu() is changed now, we can not revert that patch directly, so this patch reverts the commit and simply fix the bug spotted by that patch This bug spotted by commit 751efd8610d3 is: There is a race condition between mmu_notifier_unregister() and __mmu_notifier_release(). Assume two tasks, one calling mmu_notifier_unregister() as a result of a filp_close() ->flush() callout (task A), and the other calling mmu_notifier_release() from an mmput() (task B). A B t1 srcu_read_lock() t2 if (!hlist_unhashed()) t3 srcu_read_unlock() t4 srcu_read_lock() t5 hlist_del_init_rcu() t6 synchronize_srcu() t7 srcu_read_unlock() t8 hlist_del_rcu() <--- NULL pointer deref. This can be fixed by using hlist_del_init_rcu instead of hlist_del_rcu. The another issue spotted in the commit is "multiple ->release() callouts", we needn't care it too much because it is really rare (e.g, can not happen on kvm since mmu-notify is unregistered after exit_mmap()) and the later call of multiple ->release should be fast since all the pages have already been released by the first call. Anyway, this issue should be fixed in a separate patch. -stable suggestions: Any version that has commit 751efd8610d3 need to be backported. I find the oldest version has this commit is 3.0-stable. [ tweak comments] Signed-off-by: Xiao Guangrong <> Tested-by: Robin Holt <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24wait: fix false timeouts when using wait_event_timeout()Imre Deak1-5/+11
Many callers of the wait_event_timeout() and wait_event_interruptible_timeout() expect that the return value will be positive if the specified condition becomes true before the timeout elapses. However, at the moment this isn't guaranteed. If the wake-up handler is delayed enough, the time remaining until timeout will be calculated as 0 - and passed back as a return value - even if the condition became true before the timeout has passed. Fix this by returning at least 1 if the condition becomes true. This semantic is in line with what wait_for_condition_timeout() does; see commit bb10ed09 ("sched: fix wait_for_completion_timeout() spurious failure under heavy load"). Daniel said "We have 3 instances of this bug in drm/i915. One case even where we switch between the interruptible and not interruptible wait_event_timeout variants, foolishly presuming they have the same semantics. I very much like this." One such bug is reported at Signed-off-by: Imre Deak <> Acked-by: Daniel Vetter <> Acked-by: David Howells <> Acked-by: Jens Axboe <> Cc: "Paul E. McKenney" <> Cc: Dave Jones <> Cc: Lukas Czerner <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24fat: fix possible overflow for fat_clustersOGAWA Hirofumi1-1/+14
Intermediate value of fat_clusters can be overflowed on 32bits arch. Reported-by: Krzysztof Strasburger <> Signed-off-by: OGAWA Hirofumi <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24rapidio: documentation update for enumeration changesAlexandre Bounine2-11/+134
Update RapidIO documentation to reflect changes made to enumeration/discovery build configuration and user space triggering mechanism. Signed-off-by: Alexandre Bounine <> Cc: Matt Porter <> Cc: Li Yang <> Cc: Kumar Gala <> Cc: Andre van Herk <> Cc: Micha Nelissen <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24rapidio: add enumeration/discovery start from user spaceAlexandre Bounine6-7/+102
Add RapidIO enumeration/discovery start from user space. User space start allows to defer RapidIO fabric scan until the moment when all participating endpoints are initialized avoiding mandatory synchronized start of all endpoints (which may be challenging in systems with large number of RapidIO endpoints). Signed-off-by: Alexandre Bounine <> Cc: Matt Porter <> Cc: Li Yang <> Cc: Kumar Gala <> Cc: Andre van Herk <> Cc: Micha Nelissen <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24rapidio: make enumeration/discovery configurableAlexandre Bounine8-139/+304
Systems that use RapidIO fabric may need to implement their own enumeration and discovery methods which are better suitable for needs of a target application. The following set of patches is intended to simplify process of introduction of new RapidIO fabric enumeration/discovery methods. The first patch offers ability to add new RapidIO enumeration/discovery methods using kernel configuration options. This new configuration option mechanism allows to select statically linked or modular enumeration/discovery method(s) from the list of existing methods or use external module(s). This patch also updates the currently existing enumeration/discovery code to be used as a statically linked or modular method. The corresponding configuration option is named "Basic enumeration/discovery" method. This is the only one configuration option available today but new methods are expected to be introduced after adoption of provided patches. The second patch address a long time complaint of RapidIO subsystem users regarding fabric enumeration/discovery start sequence. Existing implementation offers only a boot-time enumeration/discovery start which requires synchronized boot of all endpoints in RapidIO network. While it works for small closed configurations with limited number of endpoints, using this approach in systems with large number of endpoints is quite challenging. To eliminate requirement for synchronized start the second patch introduces RapidIO enumeration/discovery start from user space. For compatibility with the existing RapidIO subsystem implementation, automatic boot time enumeration/discovery start can be configured in by specifying "rio-scan.scan=1" command line parameter if statically linked basic enumeration method is selected. This patch: Rework to implement RapidIO enumeration/discovery method selection combined with ability to use enumeration/discovery as a kernel module. This patch adds ability to introduce new RapidIO enumeration/discovery methods using kernel configuration options. Configuration option mechanism allows to select statically linked or modular enumeration/discovery method from the list of existing methods or use external modules. If a modular enumeration/discovery is selected each RapidIO mport device can have its own method attached to it. The existing enumeration/discovery code was updated to be used as statically linked or modular method. This configuration option is named "Basic enumeration/discovery" method. Several common routines have been moved from rio-scan.c to make them available to other enumeration methods and reduce number of exported symbols. Signed-off-by: Alexandre Bounine <> Cc: Matt Porter <> Cc: Li Yang <> Cc: Kumar Gala <> Cc: Andre van Herk <> Cc: Micha Nelissen <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24drivers/block/xsysace.c: fix id with missing port-numberGernot Vormayr1-2/+1
If the port number is missing from the device-tree the device gets named xs` instead of xsa. This fixes the check for missing ids. Tested on ml507 board. Signed-off-by: Gernot Vormayr <> Cc: Greg Kroah-Hartman <> Cc: Jens Axboe <> Cc: Grant Likely <> Cc: Rob Herring <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
2013-05-24Merge tag 'sunxi-fixes-for-3.10' of git:// into fixesOlof Johansson3-3/+6
From Maxime Ripard: Small set of fixes for 3.10: - Fix build breakage in pinctrl driver when no other architecture is selected - Fix Mini X-plus device tree build * tag 'sunxi-fixes-for-3.10' of git:// ARM: sunxi: select ARCH_REQUIRE_GPIOLIB ARM: sunxi: Fix Mini X-plus device tree build Signed-off-by: Olof Johansson <>
2013-05-24xfs: remote attribute lookups require the value lengthDave Chinner1-1/+2
When reading a remote attribute, to correctly calculate the length of the data buffer for CRC enable filesystems, we need to know the length of the attribute data. We get this information when we look up the attribute, but we don't store it in the args structure along with the other remote attr information we get from the lookup. Add this information to the args structure so we can use it appropriately. Signed-off-by: Dave Chinner <> Reviewed-by: Ben Myers <> Signed-off-by: Ben Myers <> (cherry picked from commit e461fcb194172b3f709e0b478d2ac1bdac7ab9a3)
2013-05-24xfs: xfs_attr_shortform_allfit() does not handle attr3 format.Dave Chinner1-11/+13
xfstests generic/117 fails with: XFS: Assertion failed: leaf-> == cpu_to_be16(XFS_ATTR_LEAF_MAGIC) indicating a function that does not handle the attr3 format correctly. Fix it. Signed-off-by: Dave Chinner <> Reviewed-by: Ben Myers <> Signed-off-by: Ben Myers <> (cherry picked from commit b38958d715316031fe9ea0cc6c22043072a55f49)
2013-05-24xfs: xfs_da3_node_read_verify() doesn't handle XFS_ATTR3_LEAF_MAGICDave Chinner1-0/+1
Signed-off-by: Dave Chinner <> Reviewed-by: Ben Myers <> Signed-off-by: Ben Myers <> (cherry picked from commit 72916fb8cbcf0c2928f56cdc2fbe8c7bf5517758)
2013-05-24xfs: fix missing KM_NOFS tags to keep lockdep happyDave Chinner4-5/+7
There are several places where we use KM_SLEEP allocation contexts and use the fact that they are called from transaction context to add KM_NOFS where appropriate. Unfortunately, there are several places where the code makes this assumption but can be called from outside transaction context but with filesystem locks held. These places need explicit KM_NOFS annotations to avoid lockdep complaining about reclaim contexts. Signed-off-by: Dave Chinner <> Reviewed-by: Ben Myers <> Signed-off-by: Ben Myers <> (cherry picked from commit ac14876cf9255175bf3bdad645bf8aa2b8fb2d7c)