1. 25 1月, 2017 9 次提交
    • E
      proc: add a schedule point in proc_pid_readdir() · 3ba4bcee
      Eric Dumazet 提交于
      We have seen proc_pid_readdir() invocations holding cpu for more than 50
      ms.  Add a cond_resched() to be gentle with other tasks.
      
      [akpm@linux-foundation.org: coding style fix]
      Link: http://lkml.kernel.org/r/1484238380.15816.42.camel@edumazet-glaptop3.roam.corp.google.comSigned-off-by: NEric Dumazet <edumazet@google.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      3ba4bcee
    • L
      mm: alloc_contig: re-allow CMA to compact FS pages · 424f6c48
      Lucas Stach 提交于
      Commit 73e64c51 ("mm, compaction: allow compaction for GFP_NOFS
      requests") changed compation to skip FS pages if not explicitly allowed
      to touch them, but missed to update the CMA compact_control.
      
      This leads to a very high isolation failure rate, crippling performance
      of CMA even on a lightly loaded system.  Re-allow CMA to compact FS
      pages by setting the correct GFP flags, restoring CMA behavior and
      performance to the kernel 4.9 level.
      
      Fixes: 73e64c51 (mm, compaction: allow compaction for GFP_NOFS requests)
      Link: http://lkml.kernel.org/r/20170113115155.24335-1-l.stach@pengutronix.deSigned-off-by: NLucas Stach <l.stach@pengutronix.de>
      Acked-by: NMichal Hocko <mhocko@suse.com>
      Acked-by: NVlastimil Babka <vbabka@suse.cz>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Cc: Mel Gorman <mgorman@techsingularity.net>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      424f6c48
    • D
      mm/slub.c: trace free objects at KERN_INFO · aa2efd5e
      Daniel Thompson 提交于
      Currently when trace is enabled (e.g.  slub_debug=T,kmalloc-128 ) the
      trace messages are mostly output at KERN_INFO.  However the trace code
      also calls print_section() to hexdump the head of a free object.  This
      is hard coded to use KERN_ERR, meaning the console is deluged with trace
      messages even if we've asked for quiet.
      
      Fix this the obvious way but adding a level parameter to
      print_section(), allowing calls from the trace code to use the same
      trace level as other trace messages.
      
      Link: http://lkml.kernel.org/r/20170113154850.518-1-daniel.thompson@linaro.orgSigned-off-by: NDaniel Thompson <daniel.thompson@linaro.org>
      Acked-by: NChristoph Lameter <cl@linux.com>
      Acked-by: NDavid Rientjes <rientjes@google.com>
      Cc: Pekka Enberg <penberg@kernel.org>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      aa2efd5e
    • A
      userfaultfd: fix SIGBUS resulting from false rwsem wakeups · 15a77c6f
      Andrea Arcangeli 提交于
      With >=32 CPUs the userfaultfd selftest triggered a graceful but
      unexpected SIGBUS because VM_FAULT_RETRY was returned by
      handle_userfault() despite the UFFDIO_COPY wasn't completed.
      
      This seems caused by rwsem waking the thread blocked in
      handle_userfault() and we can't run up_read() before the wait_event
      sequence is complete.
      
      Keeping the wait_even sequence identical to the first one, would require
      running userfaultfd_must_wait() again to know if the loop should be
      repeated, and it would also require retaking the rwsem and revalidating
      the whole vma status.
      
      It seems simpler to wait the targeted wakeup so that if false wakeups
      materialize we still wait for our specific wakeup event, unless of
      course there are signals or the uffd was released.
      
      Debug code collecting the stack trace of the wakeup showed this:
      
        $ ./userfaultfd 100 99999
        nr_pages: 25600, nr_pages_per_cpu: 800
        bounces: 99998, mode: racing ver poll, userfaults: 32 35 90 232 30 138 69 82 34 30 139 40 40 31 20 19 43 13 15 28 27 38 21 43 56 22 1 17 31 8 4 2
        bounces: 99997, mode: rnd ver poll, Bus error (core dumped)
      
          save_stack_trace+0x2b/0x50
          try_to_wake_up+0x2a6/0x580
          wake_up_q+0x32/0x70
          rwsem_wake+0xe0/0x120
          call_rwsem_wake+0x1b/0x30
          up_write+0x3b/0x40
          vm_mmap_pgoff+0x9c/0xc0
          SyS_mmap_pgoff+0x1a9/0x240
          SyS_mmap+0x22/0x30
          entry_SYSCALL_64_fastpath+0x1f/0xbd
          0xffffffffffffffff
          FAULT_FLAG_ALLOW_RETRY missing 70
        CPU: 24 PID: 1054 Comm: userfaultfd Tainted: G        W       4.8.0+ #30
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
        Call Trace:
          dump_stack+0xb8/0x112
          handle_userfault+0x572/0x650
          handle_mm_fault+0x12cb/0x1520
          __do_page_fault+0x175/0x500
          trace_do_page_fault+0x61/0x270
          do_async_page_fault+0x19/0x90
          async_page_fault+0x25/0x30
      
      This always happens when the main userfault selftest thread is running
      clone() while glibc runs either mprotect or mmap (both taking mmap_sem
      down_write()) to allocate the thread stack of the background threads,
      while locking/userfault threads already run at full throttle and are
      susceptible to false wakeups that may cause handle_userfault() to return
      before than expected (which results in graceful SIGBUS at the next
      attempt).
      
      This was reproduced only with >=32 CPUs because the loop to start the
      thread where clone() is too quick with fewer CPUs, while with 32 CPUs
      there's already significant activity on ~32 locking and userfault
      threads when the last background threads are started with clone().
      
      This >=32 CPUs SMP race condition is likely reproducible only with the
      selftest because of the much heavier userfault load it generates if
      compared to real apps.
      
      We'll have to allow "one more" VM_FAULT_RETRY for the WP support and a
      patch floating around that provides it also hidden this problem but in
      reality only is successfully at hiding the problem.
      
      False wakeups could still happen again the second time
      handle_userfault() is invoked, even if it's a so rare race condition
      that getting false wakeups twice in a row is impossible to reproduce.
      This full fix is needed for correctness, the only alternative would be
      to allow VM_FAULT_RETRY to be returned infinitely.  With this fix the WP
      support can stick to a strict "one more" VM_FAULT_RETRY logic (no need
      of returning it infinite times to avoid the SIGBUS).
      
      Link: http://lkml.kernel.org/r/20170111005535.13832-2-aarcange@redhat.comSigned-off-by: NAndrea Arcangeli <aarcange@redhat.com>
      Reported-by: NShubham Kumar Sharma <shubham.kumar.sharma@oracle.com>
      Tested-by: NMike Kravetz <mike.kravetz@oracle.com>
      Acked-by: NHillf Danton <hillf.zj@alibaba-inc.com>
      Cc: Michael Rapoport <RAPOPORT@il.ibm.com>
      Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
      Cc: Pavel Emelyanov <xemul@parallels.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      15a77c6f
    • A
      drivers/memstick/core/memstick.c: avoid -Wnonnull warning · de182cc8
      Arnd Bergmann 提交于
      gcc-7 produces a harmless false-postive warning about a possible NULL
      pointer access:
      
        drivers/memstick/core/memstick.c: In function 'h_memstick_read_dev_id':
        drivers/memstick/core/memstick.c:309:3: error: argument 2 null where non-null expected [-Werror=nonnull]
           memcpy(mrq->data, buf, mrq->data_len);
      
      This can't happen because the caller sets the command to 'MS_TPC_READ_REG',
      which causes the data direction to be 'READ' and the NULL pointer not
      accessed.
      
      As a simple workaround for the warning, we can pass a pointer to the
      data that we actually want to read into.  This is not needed here, but
      also harmless, and lets the compiler know that the access is ok.
      
      Link: http://lkml.kernel.org/r/20170111144143.548867-1-arnd@arndb.deSigned-off-by: NArnd Bergmann <arnd@arndb.de>
      Cc: Alex Dubov <oakad@yahoo.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      de182cc8
    • D
      kernel/watchdog: prevent false hardlockup on overloaded system · b94f5118
      Don Zickus 提交于
      On an overloaded system, it is possible that a change in the watchdog
      threshold can be delayed long enough to trigger a false positive.
      
      This can easily be achieved by having a cpu spinning indefinitely on a
      task, while another cpu updates watchdog threshold.
      
      What happens is while trying to park the watchdog threads, the hrtimers
      on the other cpus trigger and reprogram themselves with the new slower
      watchdog threshold.  Meanwhile, the nmi watchdog is still programmed
      with the old faster threshold.
      
      Because the one cpu is blocked, it prevents the thread parking on the
      other cpus from completing, which is needed to shutdown the nmi watchdog
      and reprogram it correctly.  As a result, a false positive from the nmi
      watchdog is reported.
      
      Fix this by setting a park_in_progress flag to block all lockups until
      the parking is complete.
      
      Fix provided by Ulrich Obergfell.
      
      [akpm@linux-foundation.org: s/park_in_progress/watchdog_park_in_progress/]
      Link: http://lkml.kernel.org/r/1481041033-192236-1-git-send-email-dzickus@redhat.comSigned-off-by: NDon Zickus <dzickus@redhat.com>
      Reviewed-by: NAaron Tomlin <atomlin@redhat.com>
      Cc: Ulrich Obergfell <uobergfe@redhat.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      b94f5118
    • R
      dax: fix build warnings with FS_DAX and !FS_IOMAP · 6affb9d7
      Ross Zwisler 提交于
      As reported by Arnd:
      
        https://lkml.org/lkml/2017/1/10/756
      
      Compiling with the following configuration:
      
        # CONFIG_EXT2_FS is not set
        # CONFIG_EXT4_FS is not set
        # CONFIG_XFS_FS is not set
        # CONFIG_FS_IOMAP depends on the above filesystems, as is not set
        CONFIG_FS_DAX=y
      
      generates build warnings about unused functions in fs/dax.c:
      
        fs/dax.c:878:12: warning: `dax_insert_mapping' defined but not used [-Wunused-function]
         static int dax_insert_mapping(struct address_space *mapping,
                    ^~~~~~~~~~~~~~~~~~
        fs/dax.c:572:12: warning: `copy_user_dax' defined but not used [-Wunused-function]
         static int copy_user_dax(struct block_device *bdev, sector_t sector, size_t size,
                    ^~~~~~~~~~~~~
        fs/dax.c:542:12: warning: `dax_load_hole' defined but not used [-Wunused-function]
         static int dax_load_hole(struct address_space *mapping, void **entry,
                    ^~~~~~~~~~~~~
        fs/dax.c:312:14: warning: `grab_mapping_entry' defined but not used [-Wunused-function]
         static void *grab_mapping_entry(struct address_space *mapping, pgoff_t index,
                      ^~~~~~~~~~~~~~~~~~
      
      Now that the struct buffer_head based DAX fault paths and I/O path have
      been removed we really depend on iomap support being present for DAX.
      Make this explicit by selecting FS_IOMAP if we compile in DAX support.
      
      This allows us to remove conditional selections of FS_IOMAP when FS_DAX
      was present for ext2 and ext4, and to remove an #ifdef in fs/dax.c.
      
      Link: http://lkml.kernel.org/r/1484087383-29478-1-git-send-email-ross.zwisler@linux.intel.comSigned-off-by: NRoss Zwisler <ross.zwisler@linux.intel.com>
      Reported-by: NArnd Bergmann <arnd@arndb.de>
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Reviewed-by: NJan Kara <jack@suse.cz>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      6affb9d7
    • K
      mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp · 8310d48b
      Keno Fischer 提交于
      In commit 19be0eaf ("mm: remove gup_flags FOLL_WRITE games from
      __get_user_pages()"), the mm code was changed from unsetting FOLL_WRITE
      after a COW was resolved to setting the (newly introduced) FOLL_COW
      instead.  Simultaneously, the check in gup.c was updated to still allow
      writes with FOLL_FORCE set if FOLL_COW had also been set.
      
      However, a similar check in huge_memory.c was forgotten.  As a result,
      remote memory writes to ro regions of memory backed by transparent huge
      pages cause an infinite loop in the kernel (handle_mm_fault sets
      FOLL_COW and returns 0 causing a retry, but follow_trans_huge_pmd bails
      out immidiately because `(flags & FOLL_WRITE) && !pmd_write(*pmd)` is
      true.
      
      While in this state the process is stil SIGKILLable, but little else
      works (e.g.  no ptrace attach, no other signals).  This is easily
      reproduced with the following code (assuming thp are set to always):
      
          #include <assert.h>
          #include <fcntl.h>
          #include <stdint.h>
          #include <stdio.h>
          #include <string.h>
          #include <sys/mman.h>
          #include <sys/stat.h>
          #include <sys/types.h>
          #include <sys/wait.h>
          #include <unistd.h>
      
          #define TEST_SIZE 5 * 1024 * 1024
      
          int main(void) {
            int status;
            pid_t child;
            int fd = open("/proc/self/mem", O_RDWR);
            void *addr = mmap(NULL, TEST_SIZE, PROT_READ,
                              MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
            assert(addr != MAP_FAILED);
            pid_t parent_pid = getpid();
            if ((child = fork()) == 0) {
              void *addr2 = mmap(NULL, TEST_SIZE, PROT_READ | PROT_WRITE,
                                 MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
              assert(addr2 != MAP_FAILED);
              memset(addr2, 'a', TEST_SIZE);
              pwrite(fd, addr2, TEST_SIZE, (uintptr_t)addr);
              return 0;
            }
            assert(child == waitpid(child, &status, 0));
            assert(WIFEXITED(status) && WEXITSTATUS(status) == 0);
            return 0;
          }
      
      Fix this by updating follow_trans_huge_pmd in huge_memory.c analogously
      to the update in gup.c in the original commit.  The same pattern exists
      in follow_devmap_pmd.  However, we should not be able to reach that
      check with FOLL_COW set, so add WARN_ONCE to make sure we notice if we
      ever do.
      
      [akpm@linux-foundation.org: coding-style fixes]
      Link: http://lkml.kernel.org/r/20170106015025.GA38411@juliacomputing.comSigned-off-by: NKeno Fischer <keno@juliacomputing.com>
      Acked-by: NKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Greg Thelen <gthelen@google.com>
      Cc: Nicholas Piggin <npiggin@gmail.com>
      Cc: Willy Tarreau <w@1wt.eu>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Michal Hocko <mhocko@suse.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      8310d48b
    • Y
      memory_hotplug: make zone_can_shift() return a boolean value · 8a1f780e
      Yasuaki Ishimatsu 提交于
      online_{kernel|movable} is used to change the memory zone to
      ZONE_{NORMAL|MOVABLE} and online the memory.
      
      To check that memory zone can be changed, zone_can_shift() is used.
      Currently the function returns minus integer value, plus integer
      value and 0. When the function returns minus or plus integer value,
      it means that the memory zone can be changed to ZONE_{NORNAL|MOVABLE}.
      
      But when the function returns 0, there are two meanings.
      
      One of the meanings is that the memory zone does not need to be changed.
      For example, when memory is in ZONE_NORMAL and onlined by online_kernel
      the memory zone does not need to be changed.
      
      Another meaning is that the memory zone cannot be changed. When memory
      is in ZONE_NORMAL and onlined by online_movable, the memory zone may
      not be changed to ZONE_MOVALBE due to memory online limitation(see
      Documentation/memory-hotplug.txt). In this case, memory must not be
      onlined.
      
      The patch changes the return type of zone_can_shift() so that memory
      online operation fails when memory zone cannot be changed as follows:
      
      Before applying patch:
         # grep -A 35 "Node 2" /proc/zoneinfo
         Node 2, zone   Normal
         <snip>
            node_scanned  0
                 spanned  8388608
                 present  7864320
                 managed  7864320
         # echo online_movable > memory4097/state
         # grep -A 35 "Node 2" /proc/zoneinfo
         Node 2, zone   Normal
         <snip>
            node_scanned  0
                 spanned  8388608
                 present  8388608
                 managed  8388608
      
         online_movable operation succeeded. But memory is onlined as
         ZONE_NORMAL, not ZONE_MOVABLE.
      
      After applying patch:
         # grep -A 35 "Node 2" /proc/zoneinfo
         Node 2, zone   Normal
         <snip>
            node_scanned  0
                 spanned  8388608
                 present  7864320
                 managed  7864320
         # echo online_movable > memory4097/state
         bash: echo: write error: Invalid argument
         # grep -A 35 "Node 2" /proc/zoneinfo
         Node 2, zone   Normal
         <snip>
            node_scanned  0
                 spanned  8388608
                 present  7864320
                 managed  7864320
      
         online_movable operation failed because of failure of changing
         the memory zone from ZONE_NORMAL to ZONE_MOVABLE
      
      Fixes: df429ac0 ("memory-hotplug: more general validation of zone during online")
      Link: http://lkml.kernel.org/r/2f9c3837-33d7-b6e5-59c0-6ca4372b2d84@gmail.comSigned-off-by: NYasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
      Reviewed-by: NReza Arbab <arbab@linux.vnet.ibm.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      8a1f780e
  2. 24 1月, 2017 3 次提交
    • L
      Merge branch 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile · a4685d2f
      Linus Torvalds 提交于
      Pull tile bugfix from Chris Metcalf:
       "This avoids an issue with short userspace reads for regset via ptrace"
      
      * 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
        tile/ptrace: Preserve previous registers for short regset write
      a4685d2f
    • L
      Merge tag 'gpio-v4.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · 63021182
      Linus Torvalds 提交于
      Pull GPIO fix from Linus Walleij:
       "A single lockdep fix, nothing else going on. This makes lockdep
        noiseless and work properly with threaded GPIO IRQchips.
      
        Summary:
      
        Fix a lockdep issue: the threaded irqchips also need their unique key,
        and take this opportunity to get rid of the horrible macro and replace
        it with a static inline"
      
      * tag 'gpio-v4.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: provide lockdep keys for nested/unnested irqchips
      63021182
    • L
      Merge tag 'drm-fixes-for-v4.10-rc6' of git://people.freedesktop.org/~airlied/linux · 3258943d
      Linus Torvalds 提交于
      Pull drm fixes from Dave Airlie:
       "drm fixes across the board.
      
        Okay holidays and LCA kinda caught up with me, I thought I'd get some
        of this dequeued last week, but Hobart was sunny and warm and not all
        gloomy and rainy as usual.
      
        This is a bit large, but not too much considering it's two weeks stuff
        from AMD and Intel.
      
        core:
         - one locking fix that helps with dynamic suspend/resume races
      
        i915:
         - mostly GVT updates, GVT was a recent introduction so fixes for it
           shouldn't cause any notable side effects.
      
        amdgpu:
         - a bunch of fixes for GPUs with a different memory controller design
           that need different firmware.
      
        exynos:
         - decon regression fixes
      
        msm:
         - two regression fixes
      
        etnaviv:
         - a workaround for an mmu bug that needs a lot more work.
      
        virtio:
         - sparse fix, and a maintainers update"
      
      * tag 'drm-fixes-for-v4.10-rc6' of git://people.freedesktop.org/~airlied/linux: (56 commits)
        drm/exynos/decon5433: set STANDALONE_UPDATE_F on output enablement
        drm/exynos/decon5433: fix CMU programming
        drm/exynos/decon5433: do not disable video after reset
        drm/i915: Ignore bogus plane coordinates on SKL when the plane is not visible
        drm/i915: Remove WaDisableLSQCROPERFforOCL KBL workaround.
        drm/amdgpu: add support for new hainan variants
        drm/radeon: add support for new hainan variants
        drm/amdgpu: change clock gating mode for uvd_v4.
        drm/amdgpu: fix program vce instance logic error.
        drm/amdgpu: fix bug set incorrect value to vce register
        Revert "drm/amdgpu: Only update the CUR_SIZE register when necessary"
        drm/msm: fix potential null ptr issue in non-iommu case
        drm/msm/mdp5: rip out plane->pending tracking
        drm/exynos/decon5433: set STANDALONE_UPDATE_F also if planes are disabled
        drm/exynos/decon5433: update shadow registers iff there are active windows
        drm/i915/gvt: rewrite gt reset handler using new function intel_gvt_reset_vgpu_locked
        drm/i915/gvt: fix vGPU instance reuse issues by vGPU reset function
        drm/i915/gvt: introduce intel_vgpu_reset_mmio() to reset mmio space
        drm/i915/gvt: move mmio init/clean function to mmio.c
        drm/i915/gvt: introduce intel_vgpu_reset_cfg_space to reset configuration space
        ...
      3258943d
  3. 23 1月, 2017 12 次提交
  4. 22 1月, 2017 5 次提交
    • L
      Merge tag 'usb-4.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · c497f8d1
      Linus Torvalds 提交于
      Pull USB fixes from Greg KH:
       "Here are a few small USB fixes for 4.10-rc5.
      
        Most of these are gadget/dwc2 fixes for reported issues, all of these
        have been in linux-next for a while. The last one is a single xhci
        WARN_ON removal to handle an issue that the dwc3 driver is hitting in
        the 4.10-rc tree. The warning is harmless and needs to be removed, and
        a "real" fix that is more complex will show up in 4.11-rc1 for this
        device.
      
        That last patch hasn't been in linux-next yet due to the weekend
        timing, but it's a "simple" WARN_ON() removal so what could go wrong?
        :)"
      
      Famous last words.
      
      * tag 'usb-4.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        xhci: remove WARN_ON if dma mask is not set for platform devices
        usb: dwc2: host: fix Wmaybe-uninitialized warning
        usb: dwc2: gadget: Fix GUSBCFG.USBTRDTIM value
        usb: gadget: udc: atmel: remove memory leak
        usb: dwc3: exynos fix axius clock error path to do cleanup
        usb: dwc2: Avoid suspending if we're in gadget mode
        usb: dwc2: use u32 for DT binding parameters
        usb: gadget: f_fs: Fix iterations on endpoints.
        usb: dwc2: gadget: Fix DMA memory freeing
        usb: gadget: composite: Fix function used to free memory
      c497f8d1
    • L
      Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm · f68d8531
      Linus Torvalds 提交于
      Pull libnvdimm fixes from Dan Williams:
       "Two fixes:
      
         - a regression fix for the multiple-pmem-namespace-per-region support
           added in 4.9. Even if an existing environment is not using that
           feature the act of creating and a destroying a single namespace
           with the ndctl utility will lead to the proliferation of extra
           unwanted namespace devices.
      
         - a fix for the error code returned from the pmem driver when the
           memcpy_mcsafe() routine returns -EFAULT. Btrfs seems to be the only
           block I/O consumer that tries to parse the meaning of the error
           code when it is non-zero.
      
        Neither of these fixes are critical, the namespace leak is awkward in
        that it can cause device naming to change and complicates debugging
        namespace initialization issues. The error code fix is included out of
        caution for what other consumers might be expecting -EIO for block I/O
        errors"
      
      * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
        libnvdimm, namespace: fix pmem namespace leak, delete when size set to zero
        pmem: return EIO on read_pmem() failure
      f68d8531
    • L
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · f5e8c0ff
      Linus Torvalds 提交于
      Pull clk fix from Stephen Boyd:
       "One fix for Samsung Exynos524x SoCs where recent IOMMU patches have
        caused some of these clocks to turn off when they were always left on
        before"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk/samsung: exynos542x: mark some clocks as critical
      f5e8c0ff
    • L
      Merge tag 'arc-4.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc · 455a70cb
      Linus Torvalds 提交于
      Pull ARC fixes from Vineet Gupta:
      
       - more intc updates [Yuriv]
      
       - fix module build when unwinder is turned off
      
       - IO Coherency Programming model updates
      
       - other miscellaneous
      
      * tag 'arc-4.10-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
        ARC: Revert "ARC: mm: IOC: Don't enable IOC by default"
        ARC: mm: split arc_cache_init to allow __init reaping of bulk
        ARCv2: IOC: Use actual memory size to setup aperture size
        ARCv2: IOC: Adhere to progamming model guidelines to avoid DMA corruption
        ARCv2: IOC: refactor the IOC and SLC operations into own functions
        ARC: module: Fix !CONFIG_ARC_DW2_UNWIND builds
        ARCv2: save r30 on kernel entry as gcc uses it for code-gen
        ARCv2: IRQ: Call entry/exit functions for chained handlers in MCIP
        ARC: IRQ: Use hwirq instead of virq in mask/unmask
        ARC: mmu: clarify the MMUv3 programming model
      455a70cb
    • L
      Merge tag 'powerpc-4.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 83fd57a7
      Linus Torvalds 提交于
      Pull powerpc fixes from Michael Ellerman:
       "Two fixes for fallout from the hugetlb changes we merged this cycle.
      
        Ten other fixes, four only affect Power9, and the rest are a bit of a
        mixture though nothing terrible.
      
        Thanks to: Aneesh Kumar K.V, Anton Blanchard, Benjamin Herrenschmidt,
        Dave Martin, Gavin Shan, Madhavan Srinivasan, Nicholas Piggin, Reza
        Arbab"
      
      * tag 'powerpc-4.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc: Ignore reserved field in DCSR and PVR reads and writes
        powerpc/ptrace: Preserve previous TM fprs/vsrs on short regset write
        powerpc/ptrace: Preserve previous fprs/vsrs on short regset write
        powerpc/perf: Use MSR to report privilege level on P9 DD1
        selftest/powerpc: Wrong PMC initialized in pmc56_overflow test
        powerpc/eeh: Enable IO path on permanent error
        powerpc/perf: Fix PM_BRU_CMPL event code for power9
        powerpc/mm: Fix little-endian 4K hugetlb
        powerpc/mm/hugetlb: Don't panic when we don't find the default huge page size
        powerpc: Fix pgtable pmd cache init
        powerpc/icp-opal: Fix missing KVM case and harden replay
        powerpc/mm: Fix memory hotplug BUG() on radix
      83fd57a7
  5. 21 1月, 2017 10 次提交
    • L
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 4c9eff7a
      Linus Torvalds 提交于
      Pull KVM fixes from Radim Krčmář:
       "ARM:
         - Fix for timer setup on VHE machines
         - Drop spurious warning when the timer races against the vcpu running
           again
         - Prevent a vgic deadlock when the initialization fails (for stable)
      
        s390:
         - Fix a kernel memory exposure (for stable)
      
        x86:
         - Fix exception injection when hypercall instruction cannot be
           patched"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: s390: do not expose random data via facility bitmap
        KVM: x86: fix fixing of hypercalls
        KVM: arm/arm64: vgic: Fix deadlock on error handling
        KVM: arm64: Access CNTHCTL_EL2 bit fields correctly on VHE systems
        KVM: arm/arm64: Fix occasional warning from the timer work function
      4c9eff7a
    • L
      Merge branch 'scsi-target-for-v4.10' of... · 51162264
      Linus Torvalds 提交于
      Merge branch 'scsi-target-for-v4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/bvanassche/linux
      
      Pull SCSI target fixes from Bart Van Assche:
      
       - two small fixes for the ibmvscsis driver
      
       - ten patches with bug fixes for the target mode of the qla2xxx driver
      
       - four patches that avoid that the "sparse" and "smatch" static
         analyzer tools report false positives for the qla2xxx code base
      
      * 'scsi-target-for-v4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/bvanassche/linux:
        qla2xxx: Disable out-of-order processing by default in firmware
        qla2xxx: Fix erroneous invalid handle message
        qla2xxx: Reduce exess wait during chip reset
        qla2xxx: Terminate exchange if corrupted
        qla2xxx: Fix crash due to null pointer access
        qla2xxx: Collect additional information to debug fw dump
        qla2xxx: Reset reserved field in firmware options to 0
        qla2xxx: Set tcm_qla2xxx version to automatically track qla2xxx version
        qla2xxx: Include ATIO queue in firmware dump when in target mode
        qla2xxx: Fix wrong IOCB type assumption
        qla2xxx: Avoid that building with W=1 triggers complaints about set-but-not-used variables
        qla2xxx: Move two arrays from header files to .c files
        qla2xxx: Declare an array with file scope static
        qla2xxx: Fix indentation
        ibmvscsis: Fix sleeping in interrupt context
        ibmvscsis: Fix max transfer length
      51162264
    • L
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · e3737b91
      Linus Torvalds 提交于
      Pull block fixes from Jens Axboe:
       "Just two small fixes for this -rc.
      
        One is just killing an unused variable from Keith, but the other
        fixes a performance regression for nbd in this series, where we
        inadvertently flipped when we set MSG_MORE when outputting data"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        nbd: only set MSG_MORE when we have more to send
        blk-mq: Remove unused variable
      e3737b91
    • L
      Merge tag 'spi-fix-v4.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · cca112ec
      Linus Torvalds 提交于
      Pull spi fixes from Mark Brown:
       "The usual small smattering of driver specific fixes. A few bits that
        stand out here:
      
         - the R-Car patches adding fallbacks are just adding new compatible
           strings to the driver so that device trees are written in a more
           robustly future proof fashion, this isn't strictly a fix but it's
           just new IDs and it's better to get it into mainline sooner to
           improve the ABI
      
         - the DesignWare "switch to new API part 2" patch is actually a
           misleadingly titled fix for a bit that got missed in the original
           conversion"
      
      * tag 'spi-fix-v4.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: davinci: use dma_mapping_error()
        spi: spi-axi: Free resources on error path
        spi: pxa2xx: add missed break
        spi: dw-mid: switch to new dmaengine_terminate_* API (part 2)
        spi: dw: Make debugfs name unique between instances
        spi: sh-msiof: Do not use C++ style comment
        spi: armada-3700: Set mode bits correctly
        spi: armada-3700: fix unsigned compare than zero on irq
        spi: sh-msiof: Add R-Car Gen 2 and 3 fallback bindings
        spi: SPI_FSL_DSPI should depend on HAS_DMA
      cca112ec
    • L
      Merge tag 'ceph-for-4.10-rc5' of git://github.com/ceph/ceph-client · e90665a5
      Linus Torvalds 提交于
      Pull ceph fixes from Ilya Dryomov:
       "Three filesystem endianness fixes (one goes back to the 2.6 era, all
        marked for stable) and two fixups for this merge window's patches"
      
      * tag 'ceph-for-4.10-rc5' of git://github.com/ceph/ceph-client:
        ceph: fix bad endianness handling in parse_reply_info_extra
        ceph: fix endianness bug in frag_tree_split_cmp
        ceph: fix endianness of getattr mask in ceph_d_revalidate
        libceph: make sure ceph_aes_crypt() IV is aligned
        ceph: fix ceph_get_caps() interruption
      e90665a5
    • L
      Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs · 56ef1882
      Linus Torvalds 提交于
      Pull overlayfs fix from Miklos Szeredi:
       "This fixes a regression introduced in this cycle"
      
      * 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
        ovl: fix possible use after free on redirect dir lookup
      56ef1882
    • L
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse · eefa9feb
      Linus Torvalds 提交于
      Pull fuse fixes from Miklos Szeredi:
       "Fix two regressions, one introduced in 4.9 and a less recent one in
        4.2"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
        fuse: fix time_to_jiffies nsec sanity check
        fuse: clear FR_PENDING flag when moving requests out of pending queue
      eefa9feb
    • L
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · f09ff1de
      Linus Torvalds 提交于
      Pull SCSI fixes from James Bottomley:
       "This is a set of 12 fixes including the mpt3sas one that was causing
        hangs on ATA passthrough.
      
        The others are a couple of zoned block device fixes, a SAS device
        detection bug which lead to SATA drives not being matched to bays, two
        qla2xxx MSI fixes, a qla2xxx req for rsp confusion caused by cut and
        paste, and a few other minor fixes"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: mpt3sas: fix hang on ata passthrough commands
        scsi: lpfc: Set elsiocb contexts to NULL after freeing it
        scsi: sd: Ignore zoned field for host-managed devices
        scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type
        scsi: bfa: fix wrongly initialized variable in bfad_im_bsg_els_ct_request()
        scsi: ses: Fix SAS device detection in enclosure
        scsi: libfc: Fix variable name in fc_set_wwpn
        scsi: lpfc: avoid double free of resource identifiers
        scsi: qla2xxx: remove irq_affinity_notifier
        scsi: qla2xxx: fix MSI-X vector affinity
        scsi: qla2xxx: Fix apparent cut-n-paste error.
        scsi: qla2xxx: Get mutex lock before checking optrom_state
      f09ff1de
    • L
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · f8f2d4bd
      Linus Torvalds 提交于
      Pull arm64 fixes from Catalin Marinas:
      
       - avoid potential stack information leak via the ptrace ABI caused by
         uninitialised variables
      
       - SWIOTLB DMA API fall-back allocation fix when the SWIOTLB buffer is
         not initialised (all RAM is suitable for 32-bit DMA masks)
      
       - fix the bad_mode function returning for unhandled exceptions coming
         from user space
      
       - fix name clash in __page_to_voff()
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: avoid returning from bad_mode
        arm64/ptrace: Reject attempts to set incomplete hardware breakpoint fields
        arm64/ptrace: Avoid uninitialised struct padding in fpr_set()
        arm64/ptrace: Preserve previous registers for short regset write
        arm64/ptrace: Preserve previous registers for short regset write
        arm64/ptrace: Preserve previous registers for short regset write
        arm64: mm: avoid name clash in __page_to_voff()
        arm64: Fix swiotlb fallback allocation
      f8f2d4bd
    • R
      Merge tag 'kvm-s390-master-4.10-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux · fec96901
      Radim Krčmář 提交于
      KVM: s390: Fix for 4.10 (via kvm/master)
      
      Fix a kernel memory exposure.
      fec96901
  6. 20 1月, 2017 1 次提交
    • C
      KVM: s390: do not expose random data via facility bitmap · 04478197
      Christian Borntraeger 提交于
      kvm_s390_get_machine() populates the facility bitmap by copying bytes
      from the host results that are stored in a 256 byte array in the prefix
      page. The KVM code does use the size of the target buffer (2k), thus
      copying and exposing unrelated kernel memory (mostly machine check
      related logout data).
      
      Let's use the size of the source buffer instead.  This is ok, as the
      target buffer will always be greater or equal than the source buffer as
      the KVM internal buffers (and thus S390_ARCH_FAC_LIST_SIZE_BYTE) cover
      the maximum possible size that is allowed by STFLE, which is 256
      doublewords. All structures are zero allocated so we can leave bytes
      256-2047 unchanged.
      
      Add a similar fix for kvm_arch_init_vm().
      Reported-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
      [found with smatch]
      Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
      CC: stable@vger.kernel.org
      Acked-by: NCornelia Huck <cornelia.huck@de.ibm.com>
      04478197