Skip to content
GitLab
  1. Jan 17, 2014
  3. Jan 16, 2014
  5. Jan 15, 2014
    • Linus Torvalds's avatar
      Merge branch 'akpm' (incoming from Andrew) · 2e67c562
      Linus Torvalds authored 
      Merge patches from Andrew Morton:
 "Six fixes"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  lib/percpu_counter.c: fix __percpu_counter_add()
  crash_dump: fix compilation error (on MIPS at least)
  mm: fix crash when using XFS on loopback
  MIPS: fix blast_icache32 on loongson2
  MIPS: fix case mismatch in local_r4k_flush_icache_range()
  nilfs2: fix segctor bug that causes file system corruption
      2e67c562
    • Linus Torvalds's avatar
      Merge tag 'md/3.13-fixes' of git://neil.brown.name/md · 1a60864f
      Linus Torvalds authored 
      Pull late md fixes from Neil Brown:
 "Half a dozen md bug fixes.

  All of these fix real bugs the people have hit, and are tagged for
  -stable.  Sorry they are late ....  Christmas holidays and all that.
  Hopefully they can still squeak into 3.13"

* tag 'md/3.13-fixes' of git://neil.brown.name/md:
  md: fix problem when adding device to read-only array with bitmap.
  md/raid10: fix bug when raid10 recovery fails to recover a block.
  md/raid5: fix a recently broken BUG_ON().
  md/raid1: fix request counting bug in new 'barrier' code.
  md/raid10: fix two bugs in handling of known-bad-blocks.
  md/raid5: Fix possible confusion when multiple write errors occur.
      1a60864f
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 145830df
      Linus Torvalds authored 
      Pull drm fixes from Dave Airlie:
 "One nouveau regression fix on older cards, i915 black screen fixes,
  and a revert for a strange G33 intel problem"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/nouveau: fix null ptr dereferences on some boards
  Revert "drm: copy mode type in drm_mode_connector_list_update()"
  drm/i915/bdw: make sure south port interrupts are enabled properly v2
  drm/i915: Don't grab crtc mutexes in intel_modeset_gem_init()
  drm/i915: fix DDI PLLs HW state readout code
      145830df
    • Ming Lei's avatar
      lib/percpu_counter.c: fix __percpu_counter_add() · 74e72f89
      Ming Lei authored 
      

__percpu_counter_add() may be called in softirq/hardirq handler (such
as, blk_mq_queue_exit() is typically called in hardirq/softirq handler),
so we need to call this_cpu_add()(irq safe helper) to update percpu
counter, otherwise counts may be lost.

This fixes the problem that 'rmmod null_blk' hangs in blk_cleanup_queue()
because of miscounting of request_queue->mq_usage_counter.

This patch is the v1 of previous one of "lib/percpu_counter.c:
disable local irq when updating percpu couter", and takes Andrew's
approach which may be more efficient for ARCHs(x86, s390) that
have optimized this_cpu_add().

Signed-off-by: default avatarMing Lei <tom.leiming@gmail.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Shaohua Li <shli@fusionio.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Fan Du <fan.du@windriver.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      74e72f89
    • Qais Yousef's avatar
      crash_dump: fix compilation error (on MIPS at least) · 5a610fcc
      Qais Yousef authored 
        In file included from kernel/crash_dump.c:2:0:
  include/linux/crash_dump.h:22:27: error: unknown type name `pgprot_t'

when CONFIG_CRASH_DUMP=y

The error was traced back to commit 9cb21813

 ("vmcore: introduce
remap_oldmem_pfn_range()")

include <asm/pgtable.h> to get the missing definition

Signed-off-by: default avatarQais Yousef <qais.yousef@imgtec.com>
Reviewed-by: default avatarJames Hogan <james.hogan@imgtec.com>
Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Acked-by: default avatarVivek Goyal <vgoyal@redhat.com>
Cc: <stable@vger.kernel.org>	[3.12+]
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5a610fcc
    • Mikulas Patocka's avatar
      mm: fix crash when using XFS on loopback · 03e5ac2f
      Mikulas Patocka authored 
      Commit 8456a648 ("slab: use struct page for slab management") causes
a crash in the LVM2 testsuite on PA-RISC (the crashing test is
fsadm.sh).  The testsuite doesn't crash on 3.12, crashes on 3.13-rc1 and
later.

 Bad Address (null pointer deref?): Code=15 regs=000000413edd89a0 (Addr=000006202224647d)
 CPU: 3 PID: 24008 Comm: loop0 Not tainted 3.13.0-rc6 #5
 task: 00000001bf3c0048 ti: 000000413edd8000 task.ti: 000000413edd8000

      YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
 PSW: 00001000000001101111100100001110 Not tainted
 r00-03  000000ff0806f90e 00000000405c8de0 000000004013e6c0 000000413edd83f0
 r04-07  00000000405a95e0 0000000000000200 00000001414735f0 00000001bf349e40
 r08-11  0000000010fe3d10 0000000000000001 00000040829c7778 000000413efd9000
 r12-15  0000000000000000 000000004060d800 0000000010fe3000 0000000010fe3000
 r16-19  000000413edd82a0 00000041078ddbc0 0000000000000010 0000000000000001
 r20-23  0008f3d0d83a8000 0000000000000000 00000040829c7778 00000000...
      03e5ac2f
    • Aaro Koskinen's avatar
      MIPS: fix blast_icache32 on loongson2 · 43a06847
      Aaro Koskinen authored 
      Commit 14bd8c08

 ("MIPS: Loongson: Get rid of Loongson 2 #ifdefery
all over arch/mips") failed to add Loongson2 specific blast_icache32
functions.  Fix that.

The patch fixes the following crash seen with 3.13-rc1:

  Reserved instruction in kernel code[#1]:
  [...]
  Call Trace:
    blast_icache32_page+0x8/0xb0
    r4k_flush_cache_page+0x19c/0x200
    do_wp_page.isra.97+0x47c/0xe08
    handle_mm_fault+0x938/0x1118
    __do_page_fault+0x140/0x540
    resume_userspace_check+0x0/0x10
  Code: 00200825  64834000  00200825 <bc900000> bc900020  bc900040  bc900060  bc900080  bc9000a0

Signed-off-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
Reviewed-by: default avatarAurelien Jarno <aurelien@aurel32.net>
Acked-by: default avatarJohn Crispin <blogic@openwrt.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      43a06847
    • Huacai Chen's avatar
      MIPS: fix case mismatch in local_r4k_flush_icache_range() · bad009fe
      Huacai Chen authored 
      Currently, Loongson-2 call protected_blast_icache_range() and others
call protected_loongson23_blast_icache_range(), but I think the correct
behavior should be the opposite.  BTW, Loongson-3's cache-ops is
compatible with MIPS64, but not compatible with Loongson-2.  So, rename
xxx_loongson23_yyy things to xxx_loongson2_yyy.

The patch fixes early boot hang with 3.13-rc1, introduced in commit
14bd8c08

 ("MIPS: Loongson: Get rid of Loongson 2 #ifdefery all over
arch/mips").

Signed-off-by: default avatarHuacai Chen <chenhc@lemote.com>
Signed-off-by: default avatarAaro Koskinen <aaro.koskinen@iki.fi>
Reviewed-by: default avatarAurelien Jarno <aurelien@aurel32.net>
Acked-by: default avatarJohn Crispin <blogic@openwrt.org>
Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      bad009fe
    • Andreas Rohner's avatar
      nilfs2: fix segctor bug that causes file system corruption · 70f2fe3a
      Andreas Rohner authored 
      

There is a bug in the function nilfs_segctor_collect, which results in
active data being written to a segment, that is marked as clean.  It is
possible, that this segment is selected for a later segment
construction, whereby the old data is overwritten.

The problem shows itself with the following kernel log message:

  nilfs_sufile_do_cancel_free: segment 6533 must be clean

Usually a few hours later the file system gets corrupted:

  NILFS: bad btree node (blocknr=8748107): level = 0, flags = 0x0, nchildren = 0
  NILFS error (device sdc1): nilfs_bmap_last_key: broken bmap (inode number=114660)

The issue can be reproduced with a file system that is nearly full and
with the cleaner running, while some IO intensive task is running.
Although it is quite hard to reproduce.

This is what happens:

 1. The cleaner starts the segment construction
 2. nilfs_segctor_collect is called
 3. sc_stage is on NILFS_ST_SUFILE and segments are freed
 4. sc_stage is on NILFS_ST_DAT current segment is full
 5. nilfs_segctor_extend_segments is called, which
    allocates a new segment
 6. The new segment is one of the segments freed in step 3
 7. nilfs_sufile_cancel_freev is called and produces an error message
 8. Loop around and the collection starts again
 9. sc_stage is on NILFS_ST_SUFILE and segments are freed
    including the newly allocated segment, which will contain active
    data and can be allocated at a later time
10. A few hours later another segment construction allocates the
    segment and causes file system corruption

This can be prevented by simply reordering the statements.  If
nilfs_sufile_cancel_freev is called before nilfs_segctor_extend_segments
the freed segments are marked as dirty and cannot be allocated any more.

Signed-off-by: default avatarAndreas Rohner <andreas.rohner@gmx.net>
Reviewed-by: default avatarRyusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: default avatarAndreas Rohner <andreas.rohner@gmx.net>
Signed-off-by: default avatarRyusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      70f2fe3a
    • Ingo Molnar's avatar
      Merge branch 'clockevents/3.13-fixes' of... · e59da0ae
      Ingo Molnar authored 
      Merge branch 'clockevents/3.13-fixes' of git://git.linaro.org/people/daniel.lezcano/linux

 into timers/urgent

Pull clock driver fix from Daniel Lezcano:

 " * Soren Brinkmann fixed the cadence_ttc driver where a call to
     clk_get_rate happens in an interrupt context. More precisely in an IPI
     when the broadcast timer is initialized for each cpu in the cpuidle
     driver. "

Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      e59da0ae
    • Dave Airlie's avatar
      Merge branch 'drm-nouveau-next' of git://git.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes · 703a8c2d
      Dave Airlie authored 
      Single regression fix for nouveau

* 'drm-nouveau-next' of git://git.freedesktop.org/git/nouveau/linux-2.6:
  drm/nouveau: fix null ptr dereferences on some boards
      703a8c2d
    • Ben Skeggs's avatar
      drm/nouveau: fix null ptr dereferences on some boards · fdd239ac
      Ben Skeggs authored 
      

Regression from "device: populate master subdev pointer only when fully
constructed"

Reported-by: default avatarBob Gleitsmann <rjgleits@bellsouth.net>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      fdd239ac
    • Jean Delvare's avatar
      hwmon: (coretemp) Fix truncated name of alarm attributes · 3f9aec76
      Jean Delvare authored 
      

When the core number exceeds 9, the size of the buffer storing the
alarm attribute name is insufficient and the attribute name is
truncated. This causes libsensors to skip these attributes as the
truncated name is not recognized.

Reported-by: default avatarAndreas Hollmann <hollmann@in.tum.de>
Signed-off-by: default avatarJean Delvare <khali@linux-fr.org>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
      3f9aec76
    • Stephen Warren's avatar
      i2c: Re-instate body of i2c_parent_is_i2c_adapter() · 2fac2b89
      Stephen Warren authored 
      The body of i2c_parent_is_i2c_adapter() is currently guarded by
I2C_MUX. It should be CONFIG_I2C_MUX instead.

Among potentially other problems, this resulted in i2c_lock_adapter()
only locking I2C mux child adapters, and not the parent adapter. In
turn, this could allow inter-mingling of mux child selection and I2C
transactions, which could result in I2C transactions being directed to
the wrong I2C bus, and possibly even switching between busses in the
middle of a transaction.

One concrete issue caused by this bug was corrupted HDMI EDID reads
during boot on the NVIDIA Tegra Seaboard system, although this only
became apparent in recent linux-next, when the boot timing was changed
just enough to trigger the race condition.

Fixes: 3923172b

 ("i2c: reduce parent checking to a NOOP in non-I2C_MUX case")
Cc: Phil Carmody <phil.carmody@partner.samsung.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarStephen Warren <swarren@nvidia.com>
Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
      2fac2b89
  7. Jan 14, 2014
    • NeilBrown's avatar
      md: fix problem when adding device to read-only array with bitmap. · 8313b8e5
      NeilBrown authored 
      If an array is started degraded, and then the missing device
is found it can be re-added and a minimal bitmap-based recovery
will bring it fully up-to-date.

If the array is read-only a recovery would not be allowed.
But also if the array is read-only and the missing device was
present very recently, then there could be no need for any
recovery at all, so we simply include the device in the read-only
array without any recovery.

However... if the missing device was removed a little longer ago
it could be missing some updates, but if a bitmap is present it will
be conditionally accepted pending a bitmap-based update.  We don't
currently detect this case properly and will include that old
device into the read-only array with no recovery even though it really
needs a recovery.

This patch keeps track of whether a bitmap-based-recovery is really
needed or not in the new Bitmap_sync rdev flag.  If that is set,
then the device will not be added to a read-only array.

Cc: Andrei Warkentin <andreiw@vmware.com>
Fixes: d70ed2e4


Cc: stable@vger.kernel.org (3.2+)
Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      8313b8e5
    • NeilBrown's avatar
      md/raid10: fix bug when raid10 recovery fails to recover a block. · e8b84915
      NeilBrown authored 
      commit e875ecea
    md/raid10 record bad blocks as needed during recovery.

added code to the "cannot recover this block" path to record a bad
block rather than fail the whole recovery.
Unfortunately this new case was placed *after* r10bio was freed rather
than *before*, yet it still uses r10bio.
This is will crash with a null dereference.

So move the freeing of r10bio down where it is safe.

Cc: stable@vger.kernel.org (v3.1+)
Fixes: e875ecea


Reported-by: default avatarDamian Nowak <spam@nowaker.net>
URL: https://bugzilla.kernel.org/show_bug.cgi?id=68181


Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      e8b84915
    • NeilBrown's avatar
      md/raid5: fix a recently broken BUG_ON(). · 5af9bef7
      NeilBrown authored 
      commit 6d183de4
    md/raid5: fix newly-broken locking in get_active_stripe.

simplified a BUG_ON, but removed too much so now it sometimes fires
when it shouldn't.

When the STRIPE_EXPANDING flag is set, the stripe_head might be on a
special list while multiple stripe_heads are collected, or it might
not be on any list, even a 'free' list when the refcount is zero.  As
long as STRIPE_EXPANDING is set, it will be found and added back to a
list eventually.

So both of the BUG_ONs which test for the ->lru being empty or not
need to avoid the case where STRIPE_EXPANDING is set.

The patch which broke this was marked for -stable, so this patch needs
to be applied to any branch that received 6d183de4

Fixes: 6d183de4


Cc: stable@vger.kernel.org (any release to which above was applied)
Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      5af9bef7
    • NeilBrown's avatar
      md/raid1: fix request counting bug in new 'barrier' code. · 41a336e0
      NeilBrown authored 
      

The new iobarrier implementation in raid1 (which keeps normal writes
and resync activity separate) counts every request what is not before
the current resync point in either next_window_requests or
current_window_requests.
It flags that the request is counted by setting ->start_next_window.

allow_barrier follows this model exactly and decrements one of the
*_window_requests if and only if ->start_next_window is set.

However wait_barrier(), which increments *_window_requests uses a
slightly different test for setting -.start_next_window (which is set
from the return value of this function).
So there is a possibility of the counts getting out of sync, and this
leads to the resync hanging.

So change wait_barrier() to return a non-zero value in exactly the
same cases that it increments *_window_requests.

But was introduced in 3.13-rc1.

Reported-by: default avatarBruno Wolff III <bruno@wolff.to>
URL: https://bugzilla.kernel.org/show_bug.cgi?id=68061
Fixes: 79ef3a8a


Cc: majianpeng <majianpeng@gmail.com>
Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      41a336e0
    • NeilBrown's avatar
      md/raid10: fix two bugs in handling of known-bad-blocks. · b50c259e
      NeilBrown authored 
      If we discover a bad block when reading we split the request and
potentially read some of it from a different device.

The code path of this has two bugs in RAID10.
1/ we get a spin_lock with _irq, but unlock without _irq!!
2/ The calculation of 'sectors_handled' is wrong, as can be clearly
   seen by comparison with raid1.c

This leads to at least 2 warnings and a probable crash is a RAID10
ever had known bad blocks.

Cc: stable@vger.kernel.org (v3.1+)
Fixes: 856e08e2


Reported-by: default avatarDamian Nowak <spam@nowaker.net>
URL: https://bugzilla.kernel.org/show_bug.cgi?id=68181


Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      b50c259e
    • NeilBrown's avatar
      md/raid5: Fix possible confusion when multiple write errors occur. · 1cc03eb9
      NeilBrown authored 
      commit 5d8c71f9
    md: raid5 crash during degradation

Fixed a crash in an overly simplistic way which could leave
R5_WriteError or R5_MadeGood set in the stripe cache for devices
for which it is no longer relevant.
When those devices are removed and spares added the flags are still
set and can cause incorrect behaviour.

commit 14a75d3e


    md/raid5: preferentially read from replacement device if possible.

Fixed the same bug if a more effective way, so we can now revert
the original commit.

Reported-and-tested-by: default avatarAlexander Lyakas <alex.bolshoy@gmail.com>
Cc: stable@vger.kernel.org (3.2+ - 3.2 will need a different fix though)
Fixes: 5d8c71f9


Signed-off-by: default avatarNeilBrown <neilb@suse.de>
      1cc03eb9
    • Dave Airlie's avatar
      Revert "drm: copy mode type in drm_mode_connector_list_update()" · abce1ec9
      Dave Airlie authored 
      This reverts commit 3fbd6439

.

This caused some strange booting lockup issues on an Intel G33
belonging to Daniel Vetter, very unusual, I was hoping Daniel
would track this down, but it looks like instead I'll have to hack
a different fix for -next.

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      abce1ec9
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2014-01-13' of... · c0eeb856
      Dave Airlie authored 
      Merge tag 'drm-intel-fixes-2014-01-13' of git://people.freedesktop.org/~danvet/drm-intel into drm-fixes

Black screen fixes, one for hsw+bdw each and a regression fix for
locking+load detection.

* tag 'drm-intel-fixes-2014-01-13' of git://people.freedesktop.org/~danvet/drm-intel:
  drm/i915/bdw: make sure south port interrupts are enabled properly v2
  drm/i915: Don't grab crtc mutexes in intel_modeset_gem_init()
  drm/i915: fix DDI PLLs HW state readout code
      c0eeb856
  9. Jan 13, 2014
  11. Jan 12, 2014