1. 11 3月, 2016 2 次提交
  2. 10 3月, 2016 24 次提交
    • M
      s390/mm: four page table levels vs. fork · 3446c13b
      Martin Schwidefsky 提交于
      The fork of a process with four page table levels is broken since
      git commit 6252d702 "[S390] dynamic page tables."
      
      All new mm contexts are created with three page table levels and
      an asce limit of 4TB. If the parent has four levels dup_mmap will
      add vmas to the new context which are outside of the asce limit.
      The subsequent call to copy_page_range will walk the three level
      page table structure of the new process with non-zero pgd and pud
      indexes. This leads to memory clobbers as the pgd_index *and* the
      pud_index is added to the mm->pgd pointer without a pgd_deref
      in between.
      
      The init_new_context() function is selecting the number of page
      table levels for a new context. The function is used by mm_init()
      which in turn is called by dup_mm() and mm_alloc(). These two are
      used by fork() and exec(). The init_new_context() function can
      distinguish the two cases by looking at mm->context.asce_limit,
      for fork() the mm struct has been copied and the number of page
      table levels may not change. For exec() the mm_alloc() function
      set the new mm structure to zero, in this case a three-level page
      table is created as the temporary stack space is located at
      STACK_TOP_MAX = 4TB.
      
      This fixes CVE-2016-2143.
      Reported-by: NMarcin Kościelnicki <koriakin@0x04.net>
      Reviewed-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
      3446c13b
    • L
      Merge tag 'spi-fix-v4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · 8e0f93cd
      Linus Torvalds 提交于
      Pull spi fixes from Mark Brown:
       "A few driver specific fixes for the Rockchip and i.MX SPI controllers,
        especially for the i.MX they're annoying bugs if you run into them"
      
      * tag 'spi-fix-v4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: imx: fix spi resource leak with dma transfer
        spi: imx: allow only WML aligned transfers to use DMA
        spi: rockchip: add missing spi_master_put
        spi: rockchip: disable runtime pm when in err case
      8e0f93cd
    • M
      3ee20abb
    • M
      c23663ac
    • L
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 718e47a5
      Linus Torvalds 提交于
      Pull ext4 fix from Ted Ts'o:
       "This fixes a regression which crept in v4.5-rc5"
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: iterate over buffer heads correctly in move_extent_per_page()
      718e47a5
    • L
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · a6e434e9
      Linus Torvalds 提交于
      Pull drm fixes from Dave Airlie:
       "A few imx fixes I missed from a couple of weeks ago, they still aren't
        that big and fix some regression and a fail to boot problem.
      
        Other than that, a couple of regression fixes for radeon/amdgpu, one
        regression fix for vmwgfx and one regression fix for tda998x"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        Revert "drm/radeon/pm: adjust display configuration after powerstate"
        drm/amdgpu/dp: add back special handling for NUTMEG
        drm/radeon/dp: add back special handling for NUTMEG
        drm/i2c: tda998x: Choose between atomic or non atomic dpms helper
        drm/vmwgfx: Add back ->detect() and ->fill_modes()
        drm/radeon: Fix error handling in radeon_flip_work_func.
        drm/amdgpu: Fix error handling in amdgpu_flip_work_func.
        drm/imx: Add missing DRM_FORMAT_RGB565 to ipu_plane_formats
        drm/imx: notify DRM core about CRTC vblank state
        gpu: ipu-v3: Reset IPU before activating IRQ
        gpu: ipu-v3: Do not bail out on missing optional port nodes
      a6e434e9
    • L
      Merge tag 'trace-fixes-v4.5-rc7' of... · 8205ff1d
      Linus Torvalds 提交于
      Merge tag 'trace-fixes-v4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
      
      Pull tracing fix from Steven Rostedt:
       "I previously sent a fix that prevents all trace events from being
        called if the current cpu is offline.
      
        But I forgot that in 3.18, we added lockdep checks to test RCU usage
        even when the event is disabled.  Although there cannot be any bug
        when a cpu is going offline, we now get false warnings triggered by
        the added checks of the event being disabled.
      
        I removed the check from the tracepoint code itself, and added it to
        the condition section (which is "1" for 'no condition').  This way the
        online cpu check will get checked in all the right locations"
      
      * tag 'trace-fixes-v4.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Fix check for cpu online when event is disabled
      8205ff1d
    • E
      ext4: iterate over buffer heads correctly in move_extent_per_page() · 6ffe77ba
      Eryu Guan 提交于
      In commit bcff2488 ("ext4: don't read blocks from disk after extents
      being swapped") bh is not updated correctly in the for loop and wrong
      data has been written to disk. generic/324 catches this on sub-page
      block size ext4.
      
      Fixes: bcff2488 ("ext4: don't read blocks from disk after extentsbeing swapped")
      Signed-off-by: NEryu Guan <guaneryu@gmail.com>
      Signed-off-by: NTheodore Ts'o <tytso@mit.edu>
      6ffe77ba
    • L
      Merge branch 'akpm' (patches from Andrew) · 380173ff
      Linus Torvalds 提交于
      Merge fixes from Andrew Morton:
       "13 fixes"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        dma-mapping: avoid oops when parameter cpu_addr is null
        mm/hugetlb: use EOPNOTSUPP in hugetlb sysctl handlers
        memremap: check pfn validity before passing to pfn_to_page()
        mm, thp: fix migration of PTE-mapped transparent huge pages
        dax: check return value of dax_radix_entry()
        ocfs2: fix return value from ocfs2_page_mkwrite()
        arm64: kasan: clear stale stack poison
        sched/kasan: remove stale KASAN poison after hotplug
        kasan: add functions to clear stack poison
        mm: fix mixed zone detection in devm_memremap_pages
        list: kill list_force_poison()
        mm: __delete_from_page_cache show Bad page if mapped
        mm/hugetlb: hugetlb_no_page: rate-limit warning message
      380173ff
    • Z
      dma-mapping: avoid oops when parameter cpu_addr is null · d6b7eaeb
      Zhen Lei 提交于
      To keep consistent with kfree, which tolerate ptr is NULL.  We do this
      because sometimes we may use goto statement, so that success and failure
      case can share parts of the code.  But unfortunately, dma_free_coherent
      called with parameter cpu_addr is null will cause oops, such as showed
      below:
      
        Unable to handle kernel paging request at virtual address ffffffc020d3b2b8
        pgd = ffffffc083a61000
        [ffffffc020d3b2b8] *pgd=0000000000000000, *pud=0000000000000000
        CPU: 4 PID: 1489 Comm: malloc_dma_1 Tainted: G           O    4.1.12 #1
        Hardware name: ARM64 (DT)
        PC is at __dma_free_coherent.isra.10+0x74/0xc8
        LR is at __dma_free+0x9c/0xb0
        Process malloc_dma_1 (pid: 1489, stack limit = 0xffffffc0837fc020)
        [...]
        Call trace:
          __dma_free_coherent.isra.10+0x74/0xc8
          __dma_free+0x9c/0xb0
          malloc_dma+0x104/0x158 [dma_alloc_coherent_mtmalloc]
          kthread+0xec/0xfc
      Signed-off-by: NZhen Lei <thunder.leizhen@huawei.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      d6b7eaeb
    • J
      mm/hugetlb: use EOPNOTSUPP in hugetlb sysctl handlers · 86613628
      Jan Stancek 提交于
      Replace ENOTSUPP with EOPNOTSUPP.  If hugepages are not supported, this
      value is propagated to userspace.  EOPNOTSUPP is part of uapi and is
      widely supported by libc libraries.
      
      It gives nicer message to user, rather than:
      
        # cat /proc/sys/vm/nr_hugepages
        cat: /proc/sys/vm/nr_hugepages: Unknown error 524
      
      And also LTP's proc01 test was failing because this ret code (524)
      was unexpected:
      
        proc01      1  TFAIL  :  proc01.c:396: read failed: /proc/sys/vm/nr_hugepages: errno=???(524): Unknown error 524
        proc01      2  TFAIL  :  proc01.c:396: read failed: /proc/sys/vm/nr_hugepages_mempolicy: errno=???(524): Unknown error 524
        proc01      3  TFAIL  :  proc01.c:396: read failed: /proc/sys/vm/nr_overcommit_hugepages: errno=???(524): Unknown error 524
      Signed-off-by: NJan Stancek <jstancek@redhat.com>
      Acked-by: NNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Acked-by: NKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Acked-by: NDavid Rientjes <rientjes@google.com>
      Acked-by: NHillf Danton <hillf.zj@alibaba-inc.com>
      Cc: Mike Kravetz <mike.kravetz@oracle.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      86613628
    • A
      memremap: check pfn validity before passing to pfn_to_page() · ac343e88
      Ard Biesheuvel 提交于
      In memremap's helper function try_ram_remap(), we dereference a struct
      page pointer that was derived from a PFN that is known to be covered by
      a 'System RAM' iomem region, and is thus assumed to be a 'valid' PFN,
      i.e., a PFN that has a struct page associated with it and is covered by
      the kernel direct mapping.
      
      However, the assumption that there is a 1:1 relation between the System
      RAM iomem region and the kernel direct mapping is not universally valid
      on all architectures, and on ARM and arm64, 'System RAM' may include
      regions for which pfn_valid() returns false.
      
      Generally speaking, both __va() and pfn_to_page() should only ever be
      called on PFNs/physical addresses for which pfn_valid() returns true, so
      add that check to try_ram_remap().
      Signed-off-by: NArd Biesheuvel <ard.biesheuvel@linaro.org>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      ac343e88
    • K
      mm, thp: fix migration of PTE-mapped transparent huge pages · 0a2e280b
      Kirill A. Shutemov 提交于
      We don't have native support of THP migration, so we have to split huge
      page into small pages in order to migrate it to different node.  This
      includes PTE-mapped huge pages.
      
      I made mistake in refcounting patchset: we don't actually split
      PTE-mapped huge page in queue_pages_pte_range(), if we step on head
      page.
      
      The result is that the head page is queued for migration, but none of
      tail pages: putting head page on queue takes pin on the page and any
      subsequent attempts of split_huge_pages() would fail and we skip queuing
      tail pages.
      
      unmap_and_move_huge_page() will eventually split the huge pages, but
      only one of 512 pages would get migrated.
      
      Let's fix the situation.
      
      Fixes: 248db92d ("migrate_pages: try to split pages on queuing")
      Signed-off-by: NKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      0a2e280b
    • R
      dax: check return value of dax_radix_entry() · 30f471fd
      Ross Zwisler 提交于
      dax_pfn_mkwrite() previously wasn't checking the return value of the
      call to dax_radix_entry(), which was a mistake.
      
      Instead, capture this return value and return the appropriate VM_FAULT_
      value.
      Signed-off-by: NRoss Zwisler <ross.zwisler@linux.intel.com>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Cc: Matthew Wilcox <willy@linux.intel.com>
      Cc: Dave Chinner <david@fromorbit.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      30f471fd
    • J
      ocfs2: fix return value from ocfs2_page_mkwrite() · 566e8dfd
      Jan Kara 提交于
      ocfs2_page_mkwrite() could mistakenly return error code instead of
      mkwrite status value.  Fix it.
      Signed-off-by: NJan Kara <jack@suse.cz>
      Cc: Mark Fasheh <mfasheh@suse.de>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Junxiao Bi <junxiao.bi@oracle.com>
      Cc: Joseph Qi <joseph.qi@huawei.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      566e8dfd
    • M
      arm64: kasan: clear stale stack poison · 0d97e6d8
      Mark Rutland 提交于
      Functions which the compiler has instrumented for KASAN place poison on
      the stack shadow upon entry and remove this poison prior to returning.
      
      In the case of cpuidle, CPUs exit the kernel a number of levels deep in
      C code.  Any instrumented functions on this critical path will leave
      portions of the stack shadow poisoned.
      
      If CPUs lose context and return to the kernel via a cold path, we
      restore a prior context saved in __cpu_suspend_enter are forgotten, and
      we never remove the poison they placed in the stack shadow area by
      functions calls between this and the actual exit of the kernel.
      
      Thus, (depending on stackframe layout) subsequent calls to instrumented
      functions may hit this stale poison, resulting in (spurious) KASAN
      splats to the console.
      
      To avoid this, clear any stale poison from the idle thread for a CPU
      prior to bringing a CPU online.
      Signed-off-by: NMark Rutland <mark.rutland@arm.com>
      Acked-by: NCatalin Marinas <catalin.marinas@arm.com>
      Reviewed-by: NAndrey Ryabinin <aryabinin@virtuozzo.com>
      Reviewed-by: NLorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      Cc: Alexander Potapenko <glider@google.com>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Ingo Molnar <mingo@kernel.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      0d97e6d8
    • M
      sched/kasan: remove stale KASAN poison after hotplug · e1b77c92
      Mark Rutland 提交于
      Functions which the compiler has instrumented for KASAN place poison on
      the stack shadow upon entry and remove this poision prior to returning.
      
      In the case of CPU hotplug, CPUs exit the kernel a number of levels deep
      in C code.  Any instrumented functions on this critical path will leave
      portions of the stack shadow poisoned.
      
      When a CPU is subsequently brought back into the kernel via a different
      path, depending on stackframe, layout calls to instrumented functions
      may hit this stale poison, resulting in (spurious) KASAN splats to the
      console.
      
      To avoid this, clear any stale poison from the idle thread for a CPU
      prior to bringing a CPU online.
      Signed-off-by: NMark Rutland <mark.rutland@arm.com>
      Acked-by: NCatalin Marinas <catalin.marinas@arm.com>
      Reviewed-by: NAndrey Ryabinin <aryabinin@virtuozzo.com>
      Reviewed-by: NIngo Molnar <mingo@kernel.org>
      Cc: Alexander Potapenko <glider@google.com>
      Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Will Deacon <will.deacon@arm.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      e1b77c92
    • M
      kasan: add functions to clear stack poison · e3ae1163
      Mark Rutland 提交于
      Functions which the compiler has instrumented for ASAN place poison on
      the stack shadow upon entry and remove this poison prior to returning.
      
      In some cases (e.g. hotplug and idle), CPUs may exit the kernel a
      number of levels deep in C code.  If there are any instrumented
      functions on this critical path, these will leave portions of the idle
      thread stack shadow poisoned.
      
      If a CPU returns to the kernel via a different path (e.g. a cold
      entry), then depending on stack frame layout subsequent calls to
      instrumented functions may use regions of the stack with stale poison,
      resulting in (spurious) KASAN splats to the console.
      
      Contemporary GCCs always add stack shadow poisoning when ASAN is
      enabled, even when asked to not instrument a function [1], so we can't
      simply annotate functions on the critical path to avoid poisoning.
      
      Instead, this series explicitly removes any stale poison before it can
      be hit.  In the common hotplug case we clear the entire stack shadow in
      common code, before a CPU is brought online.
      
      On architectures which perform a cold return as part of cpu idle may
      retain an architecture-specific amount of stack contents.  To retain the
      poison for this retained context, the arch code must call the core KASAN
      code, passing a "watermark" stack pointer value beyond which shadow will
      be cleared.  Architectures which don't perform a cold return as part of
      idle do not need any additional code.
      
      This patch (of 3):
      
      Functions which the compiler has instrumented for KASAN place poison on
      the stack shadow upon entry and remove this poision prior to returning.
      
      In some cases (e.g.  hotplug and idle), CPUs may exit the kernel a number
      of levels deep in C code.  If there are any instrumented functions on this
      critical path, these will leave portions of the stack shadow poisoned.
      
      If a CPU returns to the kernel via a different path (e.g.  a cold entry),
      then depending on stack frame layout subsequent calls to instrumented
      functions may use regions of the stack with stale poison, resulting in
      (spurious) KASAN splats to the console.
      
      To avoid this, we must clear stale poison from the stack prior to
      instrumented functions being called.  This patch adds functions to the
      KASAN core for removing poison from (portions of) a task's stack.  These
      will be used by subsequent patches to avoid problems with hotplug and
      idle.
      Signed-off-by: NMark Rutland <mark.rutland@arm.com>
      Acked-by: NCatalin Marinas <catalin.marinas@arm.com>
      Reviewed-by: NAndrey Ryabinin <aryabinin@virtuozzo.com>
      Cc: Alexander Potapenko <glider@google.com>
      Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      e3ae1163
    • D
      mm: fix mixed zone detection in devm_memremap_pages · 5f29a77c
      Dan Williams 提交于
      The check for whether we overlap "System RAM" needs to be done at
      section granularity.  For example a system with the following mapping:
      
          100000000-37bffffff : System RAM
          37c000000-837ffffff : Persistent Memory
      
      ...is unable to use devm_memremap_pages() as it would result in two
      zones colliding within a given section.
      Signed-off-by: NDan Williams <dan.j.williams@intel.com>
      Cc: Ross Zwisler <ross.zwisler@linux.intel.com>
      Reviewed-by: NToshi Kani <toshi.kani@hpe.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      5f29a77c
    • D
      list: kill list_force_poison() · d77a117e
      Dan Williams 提交于
      Given we have uninitialized list_heads being passed to list_add() it
      will always be the case that those uninitialized values randomly trigger
      the poison value.  Especially since a list_add() operation will seed the
      stack with the poison value for later stack allocations to trip over.
      
      For example, see these two false positive reports:
      
        list_add attempted on force-poisoned entry
        WARNING: at lib/list_debug.c:34
        [..]
        NIP [c00000000043c390] __list_add+0xb0/0x150
        LR [c00000000043c38c] __list_add+0xac/0x150
        Call Trace:
          __list_add+0xac/0x150 (unreliable)
          __down+0x4c/0xf8
          down+0x68/0x70
          xfs_buf_lock+0x4c/0x150 [xfs]
      
        list_add attempted on force-poisoned entry(0000000000000500),
         new->next == d0000000059ecdb0, new->prev == 0000000000000500
        WARNING: at lib/list_debug.c:33
        [..]
        NIP [c00000000042db78] __list_add+0xa8/0x140
        LR [c00000000042db74] __list_add+0xa4/0x140
        Call Trace:
          __list_add+0xa4/0x140 (unreliable)
          rwsem_down_read_failed+0x6c/0x1a0
          down_read+0x58/0x60
          xfs_log_commit_cil+0x7c/0x600 [xfs]
      
      Fixes: commit 5c2c2587 ("mm, dax, pmem: introduce {get|put}_dev_pagemap() for dax-gup")
      Signed-off-by: NDan Williams <dan.j.williams@intel.com>
      Reported-by: NEryu Guan <eguan@redhat.com>
      Tested-by: NEryu Guan <eguan@redhat.com>
      Cc: Ross Zwisler <ross.zwisler@linux.intel.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      d77a117e
    • H
      mm: __delete_from_page_cache show Bad page if mapped · 06b241f3
      Hugh Dickins 提交于
      Commit e1534ae9 ("mm: differentiate page_mapped() from
      page_mapcount() for compound pages") changed the famous
      BUG_ON(page_mapped(page)) in __delete_from_page_cache() to
      VM_BUG_ON_PAGE(page_mapped(page)): which gives us more info when
      CONFIG_DEBUG_VM=y, but nothing at all when not.
      
      Although it has not usually been very helpul, being hit long after the
      error in question, we do need to know if it actually happens on users'
      systems; but reinstating a crash there is likely to be opposed :)
      
      In the non-debug case, pr_alert("BUG: Bad page cache") plus dump_page(),
      dump_stack(), add_taint() - I don't really believe LOCKDEP_NOW_UNRELIABLE,
      but that seems to be the standard procedure now.  Move that, or the
      VM_BUG_ON_PAGE(), up before the deletion from tree: so that the
      unNULLified page->mapping gives a little more information.
      
      If the inode is being evicted (rather than truncated), it won't have any
      vmas left, so it's safe(ish) to assume that the raised mapcount is
      erroneous, and we can discount it from page_count to avoid leaking the
      page (I'm less worried by leaking the occasional 4kB, than losing a
      potential 2MB page with each 4kB page leaked).
      Signed-off-by: NHugh Dickins <hughd@google.com>
      Acked-by: NKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Cc: Sasha Levin <sasha.levin@oracle.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      06b241f3
    • G
      mm/hugetlb: hugetlb_no_page: rate-limit warning message · 910154d5
      Geoffrey Thomas 提交于
      The warning message "killed due to inadequate hugepage pool" simply
      indicates that SIGBUS was sent, not that the process was forcibly killed.
      If the process has a signal handler installed does not fix the problem,
      this message can rapidly spam the kernel log.
      
      On my amd64 dev machine that does not have hugepages configured, I can
      reproduce the repeated warnings easily by setting vm.nr_hugepages=2 (i.e.,
      4 megabytes of huge pages) and running something that sets a signal
      handler and forks, like
      
        #include <sys/mman.h>
        #include <signal.h>
        #include <stdlib.h>
        #include <unistd.h>
      
        sig_atomic_t counter = 10;
        void handler(int signal)
        {
            if (counter-- == 0)
               exit(0);
        }
      
        int main(void)
        {
            int status;
            char *addr = mmap(NULL, 4 * 1048576, PROT_READ | PROT_WRITE,
                    MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0);
            if (addr == MAP_FAILED) {perror("mmap"); return 1;}
            *addr = 'x';
            switch (fork()) {
               case -1:
                  perror("fork"); return 1;
               case 0:
                  signal(SIGBUS, handler);
                  *addr = 'x';
                  break;
               default:
                  *addr = 'x';
                  wait(&status);
                  if (WIFSIGNALED(status)) {
                     psignal(WTERMSIG(status), "child");
                  }
                  break;
            }
        }
      Signed-off-by: NGeoffrey Thomas <geofft@ldpreload.com>
      Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Cc: Hillf Danton <hillf.zj@alibaba-inc.com>
      Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      910154d5
    • L
      Merge tag 'pci-v4.5-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · 2f0d94ea
      Linus Torvalds 提交于
      Pull PCI fix from Bjorn Helgaas:
       "Here's another fix for v4.5.  It fixes an ARM regression in v4.0 that
        causes many boxes to crash on boot, including cns3xxx, dove,
        footbridge, iopl13xx, ip32x, iop33x, ixp4xx, ks8695, mv78xx0, orion5x,
        pxa, sa1100, etc.
      
        The change is in code that's only built for ARM and ARM64.
      
        Summary:
      
        Enumeration:
          Allow generic PCI domains without bridge "parent" pointer (Krzysztof Hałasa)"
      
      * tag 'pci-v4.5-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        PCI: Allow a NULL "parent" pointer in pci_bus_assign_domain_nr()
      2f0d94ea
    • S
      tracing: Fix check for cpu online when event is disabled · dc17147d
      Steven Rostedt (Red Hat) 提交于
      Commit f3775549 ("tracepoints: Do not trace when cpu is offline") added
      a check to make sure that tracepoints only get called when the cpu is
      online, as it uses rcu_read_lock_sched() for protection.
      
      Commit 3a630178 ("tracing: generate RCU warnings even when tracepoints
      are disabled") added lockdep checks (including rcu checks) for events that
      are not enabled to catch possible RCU issues that would only be triggered if
      a trace event was enabled. Commit f3775549 only stopped the warnings
      when the trace event was enabled but did not prevent warnings if the trace
      event was called when disabled.
      
      To fix this, the cpu online check is moved to where the condition is added
      to the trace event. This will place the cpu online check in all places that
      it may be used now and in the future.
      
      Cc: stable@vger.kernel.org # v3.18+
      Fixes: f3775549 ("tracepoints: Do not trace when cpu is offline")
      Fixes: 3a630178 ("tracing: generate RCU warnings even when tracepoints are disabled")
      Reported-by: NSudeep Holla <sudeep.holla@arm.com>
      Tested-by: NSudeep Holla <sudeep.holla@arm.com>
      Signed-off-by: NSteven Rostedt <rostedt@goodmis.org>
      dc17147d
  3. 09 3月, 2016 9 次提交
  4. 08 3月, 2016 5 次提交
    • C
      s390/cpumf: Fix lpp detection · 7a76aa95
      Christian Borntraeger 提交于
      we have to check bit 40 of the facility list before issuing LPP
      and not bit 48. Otherwise a guest running on a system with
      "The decimal-floating-point zoned-conversion facility" and without
      the "The set-program-parameters facility" might crash on an lpp
      instruction.
      Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
      Cc: stable@vger.kernel.org # v4.4+
      Fixes: e22cf8ca ("s390/cpumf: rework program parameter setting to detect guest samples")
      Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
      7a76aa95
    • J
      drm/i2c: tda998x: Choose between atomic or non atomic dpms helper · dad82ea3
      Jyri Sarha 提交于
      Choose between atomic or non atomic connector dpms helper. If tda998x
      is connected to a drm driver that does not support atomic modeset
      calling drm_atomic_helper_connector_dpms() causes a crash when the
      connectors atomic state is not initialized. The patch implements a
      driver specific connector dpms helper that calls
      drm_atomic_helper_connector_dpms() if driver supports DRIVER_ATOMIC
      and otherwise it calls the legacy drm_helper_connector_dpms().
      
      Fixes commit 9736e988 ("drm/i2c: tda998x: Add support for atomic
      modesetting").
      Signed-off-by: NJyri Sarha <jsarha@ti.com>
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      dad82ea3
    • T
      drm/vmwgfx: Add back ->detect() and ->fill_modes() · d17e67de
      Thierry Reding 提交于
      This partially reverts commit d56f57ac ("drm/gma500: Move to private
      save/restore hooks") which removed these lines by mistake.
      Reported-by: NSebastian Herbszt <herbszt@gmx.de>
      Acked-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
      Signed-off-by: NThierry Reding <treding@nvidia.com>
      Tested-by: NThomas Hellstrom <thellstrom@vmware.com>
      Tested-by: NSebastian Herbszt <herbszt@gmx.de>
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      d17e67de
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · e2857b8f
      Linus Torvalds 提交于
      Pull networking fixes from David Miller:
      
       1) Fix ordering of WEXT netlink messages so we don't see a newlink
          after a dellink, from Johannes Berg.
      
       2) Out of bounds access in minstrel_ht_set_best_prob_rage, from
          Konstantin Khlebnikov.
      
       3) Paging buffer memory leak in iwlwifi, from Matti Gottlieb.
      
       4) Wrong units used to set initial TCP rto from cached metrics, also
          from Konstantin Khlebnikov.
      
       5) Fix stale IP options data in the SKB control block from leaking
          through layers of encapsulation, from Bernie Harris.
      
       6) Zero padding len miscalculated in bnxt_en, from Michael Chan.
      
       7) Only CHECKSUM_PARTIAL packets should be passed down through GSO, fix
          from Hannes Frederic Sowa.
      
       8) Fix suspend/resume with JME networking devices, from Diego Violat
          and Guo-Fu Tseng.
      
       9) Checksums not validated properly in bridge multicast support due to
          the placement of the SKB header pointers at the time of the check,
          fix from Álvaro Fernández Rojas.
      
      10) Fix hang/tiemout with r8169 if a stats fetch is done while the
          device is runtime suspended.  From Chun-Hao Lin.
      
      11) The forwarding database netlink dump facilities don't track the
          state of the dump properly, resulting in skipped/missed entries.
          From Minoura Makoto.
      
      12) Fix regression from a recent 3c59x bug fix, from Neil Horman.
      
      13) Fix list corruption in bna driver, from Ivan Vecera.
      
      14) Big endian machines crash on vlan add in bnx2x, fix from Michal
          Schmidt.
      
      15) Ethtool RSS configuration not propagated properly in mlx5 driver,
          from Tariq Toukan.
      
      16) Fix regression in PHY probing in stmmac driver, from Gabriel
          Fernandez.
      
      17) Fix SKB tailroom calculation in igmp/mld code, from Benjamin
          Poirier.
      
      18) A past change to skip empty routing headers in ipv6 extention header
          parsing accidently caused fragment headers to not be matched any
          longer.  Fix from Florian Westphal.
      
      19) eTSEC-106 erratum needs to be applied to more gianfar chips, from
          Atsushi Nemoto.
      
      20) Fix netdev reference after free via workqueues in usb networking
          drivers, from Oliver Neukum and Bjørn Mork.
      
      21) mdio->irq is now an array rather than a pointer to dynamic memory,
          but several drivers were still trying to free it :-/ Fixes from
          Colin Ian King.
      
      22) act_ipt iptables action forgets to set the family field, thus LOG
          netfilter targets don't work with it.  Fix from Phil Sutter.
      
      23) SKB leak in ibmveth when skb_linearize() fails, from Thomas Falcon.
      
      24) pskb_may_pull() cannot be called with interrupts disabled, fix code
          that tries to do this in vmxnet3 driver, from Neil Horman.
      
      25) be2net driver leaks iomap'd memory on removal, fix from Douglas
          Miller.
      
      26) Forgotton RTNL mutex unlock in ppp_create_interface() error paths,
          from Guillaume Nault.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (97 commits)
        ppp: release rtnl mutex when interface creation fails
        cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind
        tcp: fix tcpi_segs_in after connection establishment
        net: hns: fix the bug about loopback
        jme: Fix device PM wakeup API usage
        jme: Do not enable NIC WoL functions on S0
        udp6: fix UDP/IPv6 encap resubmit path
        be2net: Don't leak iomapped memory on removal.
        vmxnet3: avoid calling pskb_may_pull with interrupts disabled
        net: ethernet: Add missing MFD_SYSCON dependency on HAS_IOMEM
        ibmveth: check return of skb_linearize in ibmveth_start_xmit
        cdc_ncm: toggle altsetting to force reset before setup
        usbnet: cleanup after bind() in probe()
        mlxsw: pci: Correctly determine if descriptor queue is full
        mlxsw: spectrum: Always decrement bridge's ref count
        tipc: fix nullptr crash during subscription cancel
        net: eth: altera: do not free array priv->mdio->irq
        net/ethoc: do not free array priv->mdio->irq
        net: sched: fix act_ipt for LOG target
        asix: do not free array priv->mdio->irq
        ...
      e2857b8f
    • L
      Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs · 01ffa3df
      Linus Torvalds 提交于
      Pull overlayfs fixes from Miklos Szeredi:
       "Overlayfs bug fixes.  All marked as -stable material"
      
      * 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
        ovl: copy new uid/gid into overlayfs runtime inode
        ovl: ignore lower entries when checking purity of non-directory entries
        ovl: fix getcwd() failure after unsuccessful rmdir
        ovl: fix working on distributed fs as lower layer
      01ffa3df