commit 2acf1c25b979aaae983bfd7c0c4dd04b31ccfc01 Author: Jiri Slaby Date: Sat Mar 22 22:02:40 2014 +0100 Linux 3.12.17 commit f9c8e356e5c574cfa6ace53bb9956b4469fe606a Author: Daniel Borkmann Date: Mon Jan 6 00:57:54 2014 +0100 netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages commit b22f5126a24b3b2f15448c3f2a254fc10cbc2b92 upstream. Some occurences in the netfilter tree use skb_header_pointer() in the following way ... struct dccp_hdr _dh, *dh; ... skb_header_pointer(skb, dataoff, sizeof(_dh), &dh); ... where dh itself is a pointer that is being passed as the copy buffer. Instead, we need to use &_dh as the forth argument so that we're copying the data into an actual buffer that sits on the stack. Currently, we probably could overwrite memory on the stack (e.g. with a possibly mal-formed DCCP packet), but unintentionally, as we only want the buffer to be placed into _dh variable. Fixes: 2bc780499aa3 ("[NETFILTER]: nf_conntrack: add DCCP protocol support") Signed-off-by: Daniel Borkmann Signed-off-by: Pablo Neira Ayuso Signed-off-by: Jiri Slaby commit 9a110858ed2e494b8be683c6959113f73685eb1f Author: David Rientjes Date: Mon Mar 3 15:38:18 2014 -0800 mm: close PageTail race commit 668f9abbd4334e6c29fa8acd71635c4f9101caa7 upstream. Commit bf6bddf1924e ("mm: introduce compaction and migration for ballooned pages") introduces page_count(page) into memory compaction which dereferences page->first_page if PageTail(page). This results in a very rare NULL pointer dereference on the aforementioned page_count(page). Indeed, anything that does compound_head(), including page_count() is susceptible to racing with prep_compound_page() and seeing a NULL or dangling page->first_page pointer. This patch uses Andrea's implementation of compound_trans_head() that deals with such a race and makes it the default compound_head() implementation. This includes a read memory barrier that ensures that if PageTail(head) is true that we return a head page that is neither NULL nor dangling. The patch then adds a store memory barrier to prep_compound_page() to ensure page->first_page is set. This is the safest way to ensure we see the head page that we are expecting, PageTail(page) is already in the unlikely() path and the memory barriers are unfortunately required. Hugetlbfs is the exception, we don't enforce a store memory barrier during init since no race is possible. Signed-off-by: David Rientjes Cc: Holger Kiehl Cc: Christoph Lameter Cc: Rafael Aquini Cc: Vlastimil Babka Cc: Michal Hocko Cc: Mel Gorman Cc: Andrea Arcangeli Cc: Rik van Riel Cc: "Kirill A. Shutemov" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit 2c34f0e29e5edb61af1d5cf8030da18fb9e8d1c1 Author: Thomas Petazzoni Date: Wed Mar 26 00:25:42 2014 +0100 net: mvneta: fix usage as a module on RGMII configurations commit e3a8786c10e75903f1269474e21fe8cb49c3a670 upstream. Commit 5445eaf309ff ('mvneta: Try to fix mvneta when compiled as module') fixed the mvneta driver to make it work properly when loaded as a module in SGMII configuration, which was tested successful by the author on the Armada XP OpenBlocks AX3, which uses SGMII. However, it turns out that the Armada XP GP, which uses RGMII, is affected by a similar problem: its SERDES configuration is lost when mvneta is loaded as a module, because this configuration is set by the bootloader, and then lost because the clock is gated by the clock framework until the mvneta driver is loaded again and the clock is re-enabled. However, it turns out that for the RGMII case, setting the SERDES configuration is not sufficient: the PCS enable bit in the MVNETA_GMAC_CTRL_2 register must also be set, like in the SGMII configuration. Therefore, this commit reworks the SGMII/RGMII initialization: the only difference between the two now is a different SERDES configuration, all the rest is identical. In detail, to achieve this, the commit: * Renames MVNETA_SGMII_SERDES_CFG to MVNETA_SERDES_CFG because it is not specific to SGMII, but also used on RGMII configurations. * Adds a MVNETA_RGMII_SERDES_PROTO definition, that must be used as the MVNETA_SERDES_CFG value in RGMII configurations. * Removes the mvneta_gmac_rgmii_set() and mvneta_port_sgmii_config() functions, and instead directly do the SGMII/RGMII configuration in mvneta_port_up(), from where those functions where called. It is worth mentioning that mvneta_gmac_rgmii_set() had an 'enable' parameter that was always passed as '1', so it was pretty useless. * Reworks the mvneta_port_up() function to set the MVNETA_SERDES_CFG register to the appropriate value depending on the RGMII vs. SGMII configuration. It also unconditionally set the PCS_ENABLE bit (was already done for SGMII, but is now also needed for RGMII), and sets the PORT_RGMII bit (which was already done for both SGMII and RGMII). This commit was successfully tested with mvneta compiled as a module, on both the OpenBlocks AX3 (SGMII configuration) and the Armada XP GP (RGMII configuration). Reported-by: Steve McIntyre Signed-off-by: Thomas Petazzoni Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit 44144f93431a036087f82ef44e6b248a47f08476 Author: Thomas Petazzoni Date: Wed Mar 26 00:25:41 2014 +0100 net: mvneta: rename MVNETA_GMAC2_PSC_ENABLE to MVNETA_GMAC2_PCS_ENABLE commit a79121d3b57e7ad61f0b5d23eae05214054f3ccd upstream. Bit 3 of the MVNETA_GMAC_CTRL_2 is actually used to enable the PCS, not the PSC: there was a typo in the name of the define, which this commit fixes. Signed-off-by: Thomas Petazzoni Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby commit a41fd7536d9cbc81cf02033c3efa4078431fa4d0 Author: Al Viro Date: Sun Mar 23 00:28:40 2014 -0400 make prepend_name() work correctly when called with negative *buflen commit e825196d48d2b89a6ec3a8eff280098d2a78207e upstream. In all callchains leading to prepend_name(), the value left in *buflen is eventually discarded unused if prepend_name() has returned a negative. So we are free to do what prepend() does, and subtract from *buflen *before* checking for underflow (which turns into checking the sign of subtraction result, of course). Signed-off-by: Al Viro Signed-off-by: Jiri Slaby commit 2c611dc0ca77c8012fee6f33cf05040b16dbee38 Author: Artem Fetishev Date: Fri Mar 28 13:33:39 2014 -0700 x86: fix boot on uniprocessor systems commit 825600c0f20e595daaa7a6dd8970f84fa2a2ee57 upstream. On x86 uniprocessor systems topology_physical_package_id() returns -1 which causes rapl_cpu_prepare() to leave rapl_pmu variable uninitialized which leads to GPF in rapl_pmu_init(). See arch/x86/kernel/cpu/perf_event_intel_rapl.c. It turns out that physical_package_id and core_id can actually be retreived for uniprocessor systems too. Enabling them also fixes rapl_pmu code. Signed-off-by: Artem Fetishev Cc: Stephane Eranian Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Thomas Gleixner Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit c890d3e4ff2070295ebc7f9467cff1719820646d Author: Daniel Vetter Date: Wed Mar 26 20:10:09 2014 +0100 drm/i915: Undo gtt scratch pte unmapping again commit 8ee661b505613ef2747b350ca2871a31b3781bee upstream. It apparently blows up on some machines. This functionally reverts commit 828c79087cec61eaf4c76bb32c222fbe35ac3930 Author: Ben Widawsky Date: Wed Oct 16 09:21:30 2013 -0700 drm/i915: Disable GGTT PTEs on GEN6+ suspend Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64841 Reported-and-Tested-by: Brad Jackson Cc: Takashi Iwai Cc: Paulo Zanoni Cc: Todd Previte Signed-off-by: Daniel Vetter Signed-off-by: Dave Airlie Signed-off-by: Jiri Slaby commit 9002dd5fee74e18a10392d68c2d857ec8d0800fa Author: Scott Wood Date: Tue Mar 18 16:10:24 2014 -0500 i2c: cpm: Fix build by adding of_address.h and of_irq.h commit 5f12c5eca6e6b7aeb4b2028d579f614b4fe7a81f upstream. Fixes a build break due to the undeclared use of irq_of_parse_and_map() and of_iomap(). This build break was apparently introduced while the driver was unbuildable due to the bug fixed by 62c19c9d29e65086e5ae76df371ed2e6b23f00cd ("i2c: Remove usage of orphaned symbol OF_I2C"). When 62c19c was added in v3.14-rc7, the driver was enabled again, breaking the powerpc mpc85xx_defconfig and mpc85xx_smp_defconfig. 62c19c is marked for stable, so this should go there as well. Reported-by: Geert Uytterhoeven Signed-off-by: Scott Wood Signed-off-by: Wolfram Sang Signed-off-by: Jiri Slaby commit 1f21fba458a6e8352324cc86f2d6dc5ca16711f9 Author: David Vrabel Date: Tue Mar 25 10:38:37 2014 +0000 Revert "xen: properly account for _PAGE_NUMA during xen pte translations" commit 5926f87fdaad4be3ed10cec563bf357915e55a86 upstream. This reverts commit a9c8e4beeeb64c22b84c803747487857fe424b68. PTEs in Xen PV guests must contain machine addresses if _PAGE_PRESENT is set and pseudo-physical addresses is _PAGE_PRESENT is clear. This is because during a domain save/restore (migration) the page table entries are "canonicalised" and uncanonicalised". i.e., MFNs are converted to PFNs during domain save so that on a restore the page table entries may be rewritten with the new MFNs on the destination. This canonicalisation is only done for PTEs that are present. This change resulted in writing PTEs with MFNs if _PAGE_PROTNONE (or _PAGE_NUMA) was set but _PAGE_PRESENT was clear. These PTEs would be migrated as-is which would result in unexpected behaviour in the destination domain. Either a) the MFN would be translated to the wrong PFN/page; b) setting the _PAGE_PRESENT bit would clear the PTE because the MFN is no longer owned by the domain; or c) the present bit would not get set. Symptoms include "Bad page" reports when munmapping after migrating a domain. Signed-off-by: David Vrabel Acked-by: Konrad Rzeszutek Wilk Signed-off-by: Jiri Slaby commit d9533eb760138b04989cd6ff64121cf45f8a6636 Author: Wei Liu Date: Sat Mar 15 16:11:47 2014 +0000 xen/balloon: flush persistent kmaps in correct position commit 09ed3d5ba06137913960f9c9385f71fc384193ab upstream. Xen balloon driver will update ballooned out pages' P2M entries to point to scratch page for PV guests. In 24f69373e2 ("xen/balloon: don't alloc page while non-preemptible", kmap_flush_unused was moved after updating P2M table. In that case for 32 bit PV guest we might end up with P2M X -----> S (S is mfn of balloon scratch page) M2P Y -----> X (Y is mfn in persistent kmap entry) kmap_flush_unused() iterates through all the PTEs in the kmap address space, using pte_to_page() to obtain the page. If the p2m and the m2p are inconsistent the incorrect page is returned. This will clear page->address on the wrong page which may cause subsequent oopses if that page is currently kmap'ed. Move the flush back between get_page and __set_phys_to_machine to fix this. Signed-off-by: Wei Liu Signed-off-by: David Vrabel Signed-off-by: Jiri Slaby commit 6ed1a01c0d5512d66c04326cd4963ee1d871fa9c Author: Hans de Goede Date: Wed Mar 26 13:30:52 2014 -0700 Input: cypress_ps2 - don't report as a button pads commit 6797b39e6f6f34c74177736e146406e894b9482b upstream. The cypress PS/2 trackpad models supported by the cypress_ps2 driver emulate BTN_RIGHT events in firmware based on the finger position, as part of this no motion events are sent when the finger is in the button area. The INPUT_PROP_BUTTONPAD property is there to indicate to userspace that BTN_RIGHT events should be emulated in userspace, which is not necessary in this case. When INPUT_PROP_BUTTONPAD is advertised userspace will wait for a motion event before propagating the button event higher up the stack, as it needs current abs x + y data for its BTN_RIGHT emulation. Since in the cypress_ps2 pads don't report motion events in the button area, this means that clicks in the button area end up being ignored, so INPUT_PROP_BUTTONPAD actually causes problems for these touchpads, and removing it fixes: https://bugs.freedesktop.org/show_bug.cgi?id=76341 Reported-by: Adam Williamson Tested-by: Adam Williamson Reviewed-by: Peter Hutterer Signed-off-by: Hans de Goede Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Slaby commit 45b50b25b36538728f55f0a930b312af7fbb6e6f Author: Hans de Goede Date: Fri Mar 28 01:01:38 2014 -0700 Input: synaptics - add manual min/max quirk for ThinkPad X240 commit 8a0435d958fb36d93b8df610124a0e91e5675c82 upstream. This extends Benjamin Tissoires manual min/max quirk table with support for the ThinkPad X240. Signed-off-by: Hans de Goede Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Slaby commit 0247679c66e193b785e7f1ac9c363612279c214f Author: Benjamin Tissoires Date: Fri Mar 28 00:43:00 2014 -0700 Input: synaptics - add manual min/max quirk commit 421e08c41fda1f0c2ff6af81a67b491389b653a5 upstream. The new Lenovo Haswell series (-40's) contains a new Synaptics touchpad. However, these new Synaptics devices report bad axis ranges. Under Windows, it is not a problem because the Windows driver uses RMI4 over SMBus to talk to the device. Under Linux, we are using the PS/2 fallback interface and it occurs the reported ranges are wrong. Of course, it would be too easy to have only one range for the whole series, each touchpad seems to be calibrated in a different way. We can not use SMBus to get the actual range because I suspect the firmware will switch into the SMBus mode and stop talking through PS/2 (this is the case for hybrid HID over I2C / PS/2 Synaptics touchpads). So as a temporary solution (until RMI4 land into upstream), start a new list of quirks with the min/max manually set. Signed-off-by: Benjamin Tissoires Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Slaby commit 3e477ed8dc6eb0415e9118d691688664080029ed Author: Dmitry Torokhov Date: Thu Mar 6 12:57:24 2014 -0800 Input: mousedev - fix race when creating mixed device commit e4dbedc7eac7da9db363a36f2bd4366962eeefcc upstream. We should not be using static variable mousedev_mix in methods that can be called before that singleton gets assigned. While at it let's add open and close methods to mousedev structure so that we do not need to test if we are dealing with multiplexor or normal device and simply call appropriate method directly. This fixes: https://bugzilla.kernel.org/show_bug.cgi?id=71551 Reported-by: GiulioDP Tested-by: GiulioDP Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Slaby commit 710e5cbeeb6869bb0f1227ce3cba7374449fdeb4 Author: Theodore Ts'o Date: Sun Mar 30 10:20:01 2014 -0400 ext4: atomically set inode->i_flags in ext4_set_inode_flags() commit 00a1a053ebe5febcfc2ec498bd894f035ad2aa06 upstream. Use cmpxchg() to atomically set i_flags instead of clearing out the S_IMMUTABLE, S_APPEND, etc. flags and then setting them from the EXT4_IMMUTABLE_FL, EXT4_APPEND_FL flags, since this opens up a race where an immutable file has the immutable flag cleared for a brief window of time. Reported-by: John Sullivan Signed-off-by: "Theodore Ts'o" Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit f01b3751f964df3266ed9e52b1676ff52a91b60f Author: Martin Schwidefsky Date: Mon Dec 2 18:00:36 2013 +0100 s390/time,vdso: fix clock_gettime for CLOCK_MONOTONIC commit ca5de58ba746b08c920b2024aaf01aa1500b110d upstream. With git commit 79c74ecbebf76732f91b82a62ce7fc8a88326962 "s390/time,vdso: convert to the new update_vsyscall interface" the new update_vsyscall function already does the sum of xtime and wall_to_monotonic. The old update_vsyscall function only copied the wall_to_monotonic offset. The vdso code needs to be modified to take this into consideration. Signed-off-by: Martin Schwidefsky Signed-off-by: Jiri Slaby commit 1c1fa991d7937e90eae0b15ade01632732ef3712 Author: Ping Cheng Date: Thu Mar 27 15:40:02 2014 -0700 Input: wacom - add support for three new Intuos Pro devices commit b5fd2a3e92ca5c8c1f3c20d31ac5daed3ec4d604 upstream. Two tablets in this series support both pen and touch. One (Intuos S) only supports pen. This patch also updates the driver to process wireless devices that do not support touch interface. Tested-by: Jason Gerecke Acked-by: Chris Bagwell Signed-off-by: Ping Cheng Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Slaby commit 9573757c7e68349864ea6767c85c963185c1f37e Author: Michal Kubecek Date: Thu Jan 30 08:50:20 2014 +0100 ipvs: fix AF assignment in ip_vs_conn_new() commit 2a971354e74f3837d14b9c8d7f7983b0c9c330e4 upstream. If a fwmark is passed to ip_vs_conn_new(), it is passed in vaddr, not daddr. Therefore we should set AF to AF_UNSPEC in vaddr assignment (like we do in ip_vs_ct_in_get()), otherwise we may copy only first 4 bytes of an IPv6 address into cp->daddr. Signed-off-by: Bogdano Arendartchuk Signed-off-by: Michal Kubecek Acked-by: Julian Anastasov Signed-off-by: Simon Horman Signed-off-by: Jiri Slaby commit c8a3d3bcd7dc2893790c38695a8ecd79c4fbad99 Author: David Howells Date: Mon Feb 17 15:01:47 2014 +0000 FS-Cache: Handle removal of unadded object to the fscache_object_list rb tree commit 7026f1929e18921fd67bf478f475a8fdfdff16ae upstream. When FS-Cache allocates an object, the following sequence of events can occur: -->fscache_alloc_object() -->cachefiles_alloc_object() [via cache->ops->alloc_object] <--[returns new object] -->fscache_attach_object() <--[failed] -->cachefiles_put_object() [via cache->ops->put_object] -->fscache_object_destroy() -->fscache_objlist_remove() -->rb_erase() to remove the object from fscache_object_list. resulting in a crash in the rbtree code. The problem is that the object is only added to fscache_object_list on the success path of fscache_attach_object() where it calls fscache_objlist_add(). So if fscache_attach_object() fails, the object won't have been added to the objlist rbtree. We do, however, unconditionally try to remove the object from the tree. Thanks to NeilBrown for finding this and suggesting this solution. Reported-by: NeilBrown Signed-off-by: David Howells Tested-by: (a customer of) NeilBrown Signed-off-by: Linus Torvalds Signed-off-by: Jiri Slaby commit 67ea60618db0ee32fb9fb37050e467612959d060 Author: Dongmao Zhang Date: Tue Dec 10 10:52:22 2013 -0600 dlm: set zero linger time on sctp socket commit ece35848c1847cdf3dd07954578d3e99238ebbae upstream. The recovery time for a failed node was taking a long time because the failed node could not perform the full shutdown process. Removing the linger time speeds this up. The dlm does not care what happens to messages to or from the failed node. Signed-off-by: Dongmao Zhang Signed-off-by: David Teigland Signed-off-by: Jiri Slaby commit 96ab13e36b6c1496193063b28fc6af3c722ef618 Author: Andy Adamson Date: Wed Jan 29 11:34:38 2014 -0500 NFSv4.1 free slot before resending I/O to MDS commit f9c96fcc501a43dbc292b17fc0ded4b54e63b79d upstream. Fix a dynamic session slot leak where a slot is preallocated and I/O is resent through the MDS. Signed-off-by: Andy Adamson Signed-off-by: Trond Myklebust Signed-off-by: Jiri Slaby commit fca36cf65b30ce5abb69284ba5404eb4d03f9545 Author: Jeff Layton Date: Tue Jan 28 13:47:46 2014 -0500 nfs: add memory barriers around NFS_INO_INVALID_DATA and NFS_INO_INVALIDATING commit 4db72b40fdbc706f8957e9773ae73b1574b8c694 upstream. If the setting of NFS_INO_INVALIDATING gets reordered to before the clearing of NFS_INO_INVALID_DATA, then another task may hit a race window where both appear to be clear, even though the inode's pages are still in need of invalidation. Fix this by adding the appropriate memory barriers. Signed-off-by: Jeff Layton Signed-off-by: Trond Myklebust Signed-off-by: Jiri Slaby commit 2791fc92400a2a504eda346688eeb40949e5e1ba Author: Trond Myklebust Date: Tue Jan 28 09:37:16 2014 -0500 NFS: Fix races in nfs_revalidate_mapping commit 17dfeb9113397a6119091a491ef7182649f0c5a9 upstream. Commit d529ef83c355f97027ff85298a9709fe06216a66 (NFS: fix the handling of NFS_INO_INVALID_DATA flag in nfs_revalidate_mapping) introduces a potential race, since it doesn't test the value of nfsi->cache_validity and set the bitlock in nfsi->flags atomically. Signed-off-by: Trond Myklebust Cc: Jeff Layton Signed-off-by: Jiri Slaby commit a18d760264c9ff07b35ec501403f037c2654cded Author: Jeff Layton Date: Mon Jan 27 13:46:15 2014 -0500 NFS: fix the handling of NFS_INO_INVALID_DATA flag in nfs_revalidate_mapping commit d529ef83c355f97027ff85298a9709fe06216a66 upstream. There is a possible race in how the nfs_invalidate_mapping function is handled. Currently, we go and invalidate the pages in the file and then clear NFS_INO_INVALID_DATA. The problem is that it's possible for a stale page to creep into the mapping after the page was invalidated (i.e., via readahead). If another writer comes along and sets the flag after that happens but before invalidate_inode_pages2 returns then we could clear the flag without the cache having been properly invalidated. So, we must clear the flag first and then invalidate the pages. Doing this however, opens another race: It's possible to have two concurrent read() calls that end up in nfs_revalidate_mapping at the same time. The first one clears the NFS_INO_INVALID_DATA flag and then goes to call nfs_invalidate_mapping. Just before calling that though, the other task races in, checks the flag and finds it cleared. At that point, it trusts that the mapping is good and gets the lock on the page, allowing the read() to be satisfied from the cache even though the data is no longer valid. These effects are easily manifested by running diotest3 from the LTP test suite on NFS. That program does a series of DIO writes and buffered reads. The operations are serialized and page-aligned but the existing code fails the test since it occasionally allows a read to come out of the cache incorrectly. While mixing direct and buffered I/O isn't recommended, I believe it's possible to hit this in other ways that just use buffered I/O, though that situation is much harder to reproduce. The problem is that the checking/clearing of that flag and the invalidation of the mapping really need to be atomic. Fix this by serializing concurrent invalidations with a bitlock. At the same time, we also need to allow other places that check NFS_INO_INVALID_DATA to check whether we might be in the middle of invalidating the file, so fix up a couple of places that do that to look for the new NFS_INO_INVALIDATING flag. Doing this requires us to be careful not to set the bitlock unnecessarily, so this code only does that if it believes it will be doing an invalidation. Signed-off-by: Jeff Layton Signed-off-by: Trond Myklebust Signed-off-by: Jiri Slaby commit 1b70c8f6bb164e25075e32d15ded960b97797a50 Author: Weston Andros Adamson Date: Tue Jan 21 15:21:33 2014 -0500 pnfs: fix BUG in filelayout_recover_commit_reqs commit 471252cd8b34b0609973740b25dcd1ff01dc1889 upstream. cond_resched_lock(cinfo->lock) is called everywhere else while holding the cinfo->lock spinlock. Not holding this lock while calling transfer_commit_list in filelayout_recover_commit_reqs causes the BUG below. It's true that we can't hold this lock while calling pnfs_put_lseg, because that might try to lock the inode lock - which might be the same lock as cinfo->lock. To reproduce, mount a 2 DS pynfs server and run an O_DIRECT command that crosses a stripe boundary and is not page aligned, such as: dd if=/dev/zero of=/mnt/f bs=17000 count=1 oflag=direct BUG: sleeping function called from invalid context at linux/fs/nfs/nfs4filelayout.c:1161 in_atomic(): 0, irqs_disabled(): 0, pid: 27, name: kworker/0:1 2 locks held by kworker/0:1/27: #0: (events){.+.+.+}, at: [] process_one_work+0x175/0x3a5 #1: ((&dreq->work)){+.+...}, at: [] process_one_work+0x175/0x3a5 CPU: 0 PID: 27 Comm: kworker/0:1 Not tainted 3.13.0-rc3-branch-dros_testing+ #21 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013 Workqueue: events nfs_direct_write_schedule_work [nfs] 0000000000000000 ffff88007a39bbb8 ffffffff81491256 ffff88007b87a130 ffff88007a39bbd8 ffffffff8105f103 ffff880079614000 ffff880079617d40 ffff88007a39bc20 ffffffffa011603e ffff880078988b98 0000000000000000 Call Trace: [] dump_stack+0x4d/0x66 [] __might_sleep+0x100/0x105 [] transfer_commit_list+0x94/0xf1 [nfs_layout_nfsv41_files] [] filelayout_recover_commit_reqs+0x3b/0x68 [nfs_layout_nfsv41_files] [] nfs_direct_write_reschedule+0x9f/0x1d6 [nfs] [] ? mark_lock+0x1df/0x224 [] ? trace_hardirqs_off_caller+0x37/0xa4 [] ? trace_hardirqs_off+0xd/0xf [] nfs_direct_write_schedule_work+0x9d/0xb7 [nfs] [] ? process_one_work+0x175/0x3a5 [] process_one_work+0x1f6/0x3a5 [] ? process_one_work+0x175/0x3a5 [] worker_thread+0x149/0x1f5 [] ? rescuer_thread+0x28d/0x28d [] kthread+0xd2/0xda [] ? __kthread_parkme+0x61/0x61 [] ret_from_fork+0x7c/0xb0 [] ? __kthread_parkme+0x61/0x61 Signed-off-by: Weston Andros Adamson Signed-off-by: Trond Myklebust Signed-off-by: Jiri Slaby commit 59653950df4c63079a10c015606eda9abc2221b8 Author: Christoph Hellwig Date: Thu Nov 14 08:50:30 2013 -0800 nfs: increment i_dio_count for reads, too commit 1f90ee27461e31a1c18e5d819f6ea6f5c7304b16 upstream. i_dio_count is used to protect dio access against truncate. We want to make sure there are no dio reads pending either when doing a truncate. I suspect on plain NFS things might work even without this, but once we use a pnfs layout driver that access backing devices directly things will go bad without the proper synchronization. Signed-off-by: Christoph Hellwig Signed-off-by: Trond Myklebust Signed-off-by: Jiri Slaby commit 2f786d997db547ad88c6560e7d9f214ab6d5e913 Author: Christoph Hellwig Date: Thu Nov 14 08:50:29 2013 -0800 nfs: defer inode_dio_done call until size update is done commit 2a009ec98cce440c0992fc9a2353e96cdb0b048b upstream. We need to have the I/O fully finished before telling the truncate code that we are done. Signed-off-by: Christoph Hellwig Signed-off-by: Trond Myklebust Signed-off-by: Jiri Slaby commit 2fae4cc0d0b46c9ee3b95dfd0d22055066a71736 Author: Christoph Hellwig Date: Thu Nov 14 08:50:28 2013 -0800 nfs: fix size updates for aio writes commit 9811cd57f4c6b5b60ec104de68a88303717e3106 upstream. nfs_file_direct_write only updates the inode size if it succeeded and returned the number of bytes written. But in the AIO case nfs_direct_wait turns the return value into -EIOCBQUEUED and we skip the size update. Instead the aio completion path should updated it, which this patch does. The implementation is a little hacky because there is no obvious way to find out we are called for a write in nfs_direct_complete. Signed-off-by: Christoph Hellwig Signed-off-by: Trond Myklebust Signed-off-by: Jiri Slaby commit 2e3b72ab7008ddfad528d2711a8f95c9ef942f7b Author: Alexander Aring Date: Sat Dec 21 05:39:04 2013 +0100 nfs: fix dead code of ipv6_addr_scope commit a8c2275493b866961f4429a741251c630c4fc6d7 upstream. The correct way to check on IPV6_ADDR_SCOPE_LINKLOCAL is to check with the ipv6_addr_src_scope function. Currently this can't be work, because ipv6_addr_scope returns a int with a mask of IPV6_ADDR_SCOPE_MASK (0x00f0U) and IPV6_ADDR_SCOPE_LINKLOCAL is 0x02. So the condition is always false. Signed-off-by: Alexander Aring Signed-off-by: Trond Myklebust Signed-off-by: Jiri Slaby commit da6bf1d4a5ac4141869039c2a36bf1c80ed36953 Author: Trond Myklebust Date: Wed Dec 4 12:09:45 2013 -0500 NFSv4.1: Prevent a 3-way deadlock between layoutreturn, open and state recovery commit f22e5edd2244609aed3906207a62223e7707a34d upstream. Andy Adamson reports: The state manager is recovering expired state and recovery OPENs are being processed. If kswapd is pruning inodes at the same time, a deadlock can occur when kswapd calls evict_inode on an NFSv4.1 inode with a layout, and the resultant layoutreturn gets an error that the state mangager is to handle, causing the layoutreturn to wait on the (NFS client) cl_rpcwaitq. At the same time an open is waiting for the inode deletion to complete in __wait_on_freeing_inode. If the open is either the open called by the state manager, or an open from the same open owner that is holding the NFSv4 sequence id which causes the OPEN from the state manager to wait for the sequence id on the Seqid_waitqueue, then the state is deadlocked with kswapd. The fix is simply to have layoutreturn ignore all errors except NFS4ERR_DELAY. We already know that layouts are dropped on all server reboots, and that it has to be coded to deal with the "forgetful client model" that doesn't send layoutreturns. Reported-by: Andy Adamson Link: http://lkml.kernel.org/r/1385402270-14284-1-git-send-email-andros@netapp.com Signed-off-by: Trond Myklebust Signed-off-by: Jiri Slaby commit f5ddb3e95e4caa2414ddd79ed6f046f61da218a7 Author: Andy Adamson Date: Wed Nov 20 13:00:17 2013 -0500 SUNRPC: do not fail gss proc NULL calls with EACCES commit c297c8b99b07f496ff69a719cfb8e8fe852832ed upstream. Otherwise RPCSEC_GSS_DESTROY messages are not sent. Signed-off-by: Andy Adamson Signed-off-by: Trond Myklebust Signed-off-by: Jiri Slaby commit e8bdefebda1ee5641d5eaf30ada4ae8dc3acff8e Author: Olaf Hering Date: Sun Dec 15 21:40:35 2013 +0100 fbmem: really support wildcard video=options for all fbdev drivers commit f5d2b7c28b67d627646b6a0142bc201a7b1516b0 upstream. Documentation/fb/modedb.txt states that video=option should be considered a global option. But video_setup and fb_get_options are not coded that way. Instead its required to boot with video=driver:option to set a given option in drvier. This is cumbersome because it requires to know in advance which driver will be active for a given board/kernel. The following patch implements the documented catchall for the fbdev drivers. It is now possible to boot with video=XxY without the need to know the active driver in advance. The specific case it tries to fix is syslinux in the SUSE installer which offers a menu to set a display resolution. Right now this just appends the vga= option the kernel. But in addition to vga= it should be possible to pass a generic video=XxY for all framebuffer/drm drivers. With this change forcing a certain window size of VM displays is now much easier. Today the video= option is stored in a global fb_mode_option. But unfortunately only drm uses it. Note: this change introduces a small memleak if video=option is actually used because fb_mode_option is const. Most drivers use strsep to get to individual options. This could be fixed in a followup patch which always releases the option string in every caller of fb_get_options. Signed-off-by: Olaf Hering Signed-off-by: Tomi Valkeinen Signed-off-by: Jiri Slaby commit ee023577f66a1c647011384cb839d09747a083a4 Author: Toshi Kani Date: Tue Jan 21 14:33:15 2014 -0800 arch/x86/mm/srat: Skip NUMA_NO_NODE while parsing SLIT commit a85eba8814631d0d48361c8b9a7ee0984e80c03c upstream. When ACPI SLIT table has an I/O locality (i.e. a locality unique to an I/O device), numa_set_distance() emits this warning message: NUMA: Warning: node ids are out of bound, from=-1 to=-1 distance=10 acpi_numa_slit_init() calls numa_set_distance() with pxm_to_node(), which assumes that all localities have been parsed with SRAT previously. SRAT does not list I/O localities, where as SLIT lists all localities including I/Os. Hence, pxm_to_node() returns NUMA_NO_NODE (-1) for an I/O locality. I/O localities are not supported and are ignored today, but emitting such warning message leads to unnecessary confusion. Change acpi_numa_slit_init() to avoid calling numa_set_distance() with NUMA_NO_NODE. Signed-off-by: Toshi Kani Acked-by: David Rientjes Signed-off-by: Andrew Morton Cc: Yinghai Lu Link: http://lkml.kernel.org/n/tip-dSvpjjvp8aMzs1ybkftxohlh@git.kernel.org Signed-off-by: Ingo Molnar Signed-off-by: Jiri Slaby commit 6b11f0eda2cfd467f186b303bf8d9e4de08cf70b Author: Oliver Neukum Date: Tue Oct 1 14:34:46 2013 +0200 crypto: sha256_ssse3 - also test for BMI2 commit 16c0c4e1656c14ef9deac189a4240b5ca19c6919 upstream. The AVX2 implementation also uses BMI2 instructions, but doesn't test for their availability. The assumption that AVX2 and BMI2 always go together is false. Some Haswells have AVX2 but not BMI2. Signed-off-by: Oliver Neukum Signed-off-by: Herbert Xu Signed-off-by: Jiri Slaby commit fa13abce6b4afb291b5ff0c6a0de5f39e4b540a9 Author: Jeff Mahoney Date: Tue Jan 21 14:34:52 2014 -0800 drm/nouveau: make vga_switcheroo code depend on VGA_SWITCHEROO commit d0ce7b8567ae76b8a6c0eb8361d121deb98c1b3f upstream. Commit 8116188fdef594 ("nouveau/acpi: hook up to the MXM method for mux switching.") broke the build on non-x86 architectures due to the new dependency on MXM and MXM being an x86 platform driver. It built previously since the vga switcheroo registration routines were zereod out on !X86. The code was built in but unused. This patch makes all of the DSM code depend on CONFIG_VGA_SWITCHEROO, allowing it to build on non-x86 and shrinking the module size as well. [rdunlap@infradead.org: fix build eror when VGA_SWITCHEROO is not enabled] Signed-off-by: Jeff Mahoney Signed-off-by: Jiri Slaby Cc: David Airlie Signed-off-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Dave Airlie Signed-off-by: Jiri Slaby commit 8276a9aefbceca886665110d1ad9460391bec9b6 Author: J. Bruce Fields Date: Tue Oct 15 17:03:16 2013 -0400 nfs: use IS_ROOT not DCACHE_DISCONNECTED commit a3f432bfd06a4ec3b812e32d3266e0d1ad75d008 upstream. This check was added by Al Viro with d9e80b7de91db05c1c4d2e5ebbfd70b3b3ba0e0f "nfs d_revalidate() is too trigger-happy with d_drop()", with the explanation that we don't want to remove the root of a disconnected tree, which will still be included on the s_anon list. But DCACHE_DISCONNECTED does *not* actually identify dentries that are disconnected from the dentry tree or hashed on s_anon. IS_ROOT() is the way to do that. Also add a comment from Al's commit to remind us why this check is there. Signed-off-by: J. Bruce Fields Reviewed-by: Christoph Hellwig Signed-off-by: Trond Myklebust Signed-off-by: Jiri Slaby commit 05cf0398b3ab4942b16c8831a0e77ede499fd093 Author: David Howells Date: Fri Aug 30 16:16:34 2013 +0100 X.509: struct x509_certificate needs struct tm declaring commit 57be4a784bf58eb41784aa3431165b455cf7e9c6 upstream. struct x509_certificate needs struct tm declaring by #inclusion of linux/time.h prior to its definition. Signed-off-by: David Howells Reviewed-by: Kees Cook Reviewed-by: Josh Boyer Signed-off-by: Jiri Slaby commit 34bf8801b2b4f6205a4f9e0045fbcf035c709e76 Author: Bockholdt Arne Date: Tue Nov 26 07:13:57 2013 +0000 intel_idle: Fixed C6 state on Avoton/Rangeley processors commit 22e580d07f6529a395c129575127ea6d860aed3a upstream. Corrected the MWAIT flag for C-State C6 on Intel Avoton/Rangeley processors. Signed-off-by: Arne Bockholdt Acked-by: Len Brown Signed-off-by: Rafael J. Wysocki Signed-off-by: Jiri Slaby commit 2aa86e03cdb2567a97d3f8a4d931208ae177b0f7 Author: Len Brown Date: Sat Nov 9 00:30:17 2013 -0500 intel_idle: Support Intel Atom Processor C2000 Product Family commit fab04b2208dd1d4121319f0096c5a5f4b70abc54 upstream. Support the "Intel(R) Atom(TM) Processor C2000 Product Family", formerly code-named Avoton. It is based on the next generation Intel Atom processor architecture, formerly code-named Silvermont. Signed-off-by: Len Brown Signed-off-by: Rafael J. Wysocki Signed-off-by: Jiri Slaby commit f1fa726756246baf267dda0fe9c2d3e8740feae1 Author: James Ralston Date: Mon Nov 4 09:29:48 2013 -0800 i2c: i801: Add Device IDs for Intel Wildcat Point-LP PCH commit afc659241258b40b683998ec801d25d276529f43 upstream. This patch adds the SMBus Device IDs for the Intel Wildcat Point-LP PCH. Signed-off-by: James Ralston Signed-off-by: Wolfram Sang Signed-off-by: Jiri Slaby commit 4c74007da904cc0411d788200034b2fb4c9e0d01 Author: Takashi Iwai Date: Thu Jan 30 17:59:02 2014 +0100 ALSA: hda - Fix inconsistent Mic mute LED commit 7fe307117db5bd7ec6efb93c563dcf44577b6d2b upstream. The current code for controlling mic mute LED in patch_sigmatel.c blindly assumes that there is a single capture switch. But, there can be multiple multiple ones, and each of them flips the state, ended up in an inconsistent state. For fixing this problem, this patch adds kcontrol to be passed to the hook function so that the callee can check which switch is being accessed. In stac_capture_led_hook(), the state is checked as a bitmask, and turns on the LED when all capture switches are off. Signed-off-by: Takashi Iwai Signed-off-by: Jiri Slaby