1. 11 Aug, 2016 2 commits
    • Linus Torvalds's avatar
      Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost · 6da7e953
      Linus Torvalds authored
      Pull virtio/vhost fixes and cleanups from Michael Tsirkin:
       "Misc fixes and cleanups all over the place"
      * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
        virtio/s390: deprecate old transport
        virtio/s390: keep early_put_chars
        virtio_blk: Fix a slient kernel panic
        virtio-vsock: fix include guard typo
        vhost/vsock: fix vhost virtio_vsock_pkt use-after-free
        9p/trans_virtio: use kvfree() for iov_iter_get_pages_alloc()
        virtio: fix error handling for debug builds
        virtio: fix memory leak in virtqueue_add()
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-4.8-rc2' of https://github.com/ceph/ceph-client · 3b3ce01a
      Linus Torvalds authored
      Pull ceph fixes from Ilya Dryomov:
       "A patch for a NULL dereference bug introduced in 4.8-rc1 and a handful
        of static checker fixes"
      * tag 'ceph-for-4.8-rc2' of https://github.com/ceph/ceph-client:
        ceph: initialize pathbase in the !dentry case in encode_caps_cb()
        rbd: nuke the 32-bit pool id check
        rbd: destroy header_oloc in rbd_dev_release()
        ceph: fix null pointer dereference in ceph_flush_snaps()
        libceph: using kfree_rcu() to simplify the code
        libceph: make cancel_generic_request() static
        libceph: fix return value check in alloc_msg_with_page_vector()
  2. 10 Aug, 2016 13 commits
  3. 09 Aug, 2016 19 commits
    • Linus Torvalds's avatar
      Revert "printk: create pr_<level> functions" · a0cba217
      Linus Torvalds authored
      This reverts commit 874f9c7d.
      Geert Uytterhoeven reports:
       "This change seems to have an (unintendent?) side-effect.
        Before, pr_*() calls without a trailing newline characters would be
        printed with a newline character appended, both on the console and in
        the output of the dmesg command.
        After this commit, no new line character is appended, and the output
        of the next pr_*() call of the same type may be appended, like in:
          - Truncating RAM at 0x0000000040000000-0x00000000c0000000 to -0x0000000070000000
          - Ignoring RAM at 0x0000000200000000-0x0000000240000000 (!CONFIG_HIGHMEM)
          + Truncating RAM at 0x0000000040000000-0x00000000c0000000 to -0x0000000070000000Ignoring RAM at 0x0000000200000000-0x0000000240000000 (!CONFIG_HIGHMEM)"
      Joe Perches says:
       "No, that is not intentional.
        The newline handling code inside vprintk_emit is a bit involved and
        for now I suggest a revert until this has all the same behavior as
      Reported-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
      Requested-by: default avatarJoe Perches <joe@perches.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 84bd8d33
      Linus Torvalds authored
      Pull tracing fix from Steven Rostedt:
       "Fix tick_stop tracepoint symbols for user export.
        Luiz Capitulino noticed that the tick_stop tracepoint wasn't being
        parsed properly by the tracing user space tools.
        This was due to the TRACE_DEFINE_ENUM() being set to a define, when it
        should have been set to the enum itself.  The define was of the MASK
        that used the BIT to shift.  The BIT was the enum and by adding that,
        everything gets converted nicely.  The MASK is still kept just in case
        it gets converted to an enum in the future"
      * tag 'trace-v4.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Fix tick_stop tracepoint symbols for user export
    • Linus Torvalds's avatar
      Merge tag 'gcc-plugin-infrastructure-v4.8-rc2' of... · b79f34d6
      Linus Torvalds authored
      Merge tag 'gcc-plugin-infrastructure-v4.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
      Pull gcc plugin improvements from Kees Cook:
       "Several fixes/improvements for the gcc plugin infrastructure:
         - fix a problem with gcc plugins interfering with cc-option tests.
         - abort more gracefully when gcc plugin headers or compiler support
           is missing.
         - improve the gcc plugin rule generation to be more dynamic, pass
           arguments, and build from subdirectories"
      * tag 'gcc-plugin-infrastructure-v4.8-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        gcc-plugins: Add support for plugin subdirectories
        gcc-plugins: Automate make rule generation
        gcc-plugins: Add support for passing plugin arguments
        gcc-plugins: abort builds cleanly when not supported
        kbuild: no gcc-plugins during cc-option tests
    • Linus Torvalds's avatar
      Merge tag 'platform-drivers-x86-v4.8-3' of... · e1d009ea
      Linus Torvalds authored
      Merge tag 'platform-drivers-x86-v4.8-3' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86
      Pull x86 platform driver update from Darren Hart:
       "dell-wmi: ignore battery remove/insert event"
      * tag 'platform-drivers-x86-v4.8-3' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86:
        dell-wmi: Ignore WMI event 0xe00e
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-4.8-rc2' of git://people.freedesktop.org/~airlied/linux · cb0d93aa
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This contains a bunch of amdgpu fixes, and some i915 regression fixes.
        It also contains some fixes for an older regression with some EDID
        changes and some 6bpc panels.
        Then there are the lockdep, cirrus and rcar-du regression fixes from
        this window"
      * tag 'drm-fixes-for-4.8-rc2' of git://people.freedesktop.org/~airlied/linux:
        drm/cirrus: Fix NULL pointer dereference when registering the fbdev
        drm/edid: Set 8 bpc color depth for displays with "DFP 1.x compliant TMDS".
        drm/i915/dp: Revert "drm/i915/dp: fall back to 18 bpp when sink capability is unknown"
        drm/edid: Add 6 bpc quirk for display AEO model 0.
        drm: Paper over locking inversion after registration rework
        drm: rcar-du: Link HDMI encoder with bridge
        drm/ttm: Wait for a BO to become idle before unbinding it from GTT
        drm/i915/fbdev: Check for the framebuffer before use
        drm/amdgpu: update golden setting of polaris10
        drm/amdgpu: update golden setting of stoney
        drm/amdgpu: update golden setting of polaris11
        drm/amdgpu: update golden setting of carrizo
        drm/amdgpu: update golden setting of iceland
        drm/amd/amdgpu: change pptable output format from ASCII to binary
        drm/amdgpu/ci: add mullins to default case for smc ucode
        drm/amdgpu/gmc7: add missing mullins case
        drm/i915: Never fully mask the the EI up rps interrupt on SNB/IVB
        drm/i915: Wait up to 3ms for the pcu to ack the cdclk change request on SKL
    • Brian King's avatar
      ipr: Fix sync scsi scan · a3d1ddd9
      Brian King authored
      Commit b195d5e2 ("ipr: Wait to do async scan until scsi host is
      initialized") fixed async scan for ipr, but broke sync scan for ipr.
      This fixes sync scan back up.
      Signed-off-by: default avatarBrian King <brking@linux.vnet.ibm.com>
      Reported-and-tested-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    • Vladimir Davydov's avatar
      mm: memcontrol: only mark charged pages with PageKmemcg · c4159a75
      Vladimir Davydov authored
      To distinguish non-slab pages charged to kmemcg we mark them PageKmemcg,
      which sets page->_mapcount to -512.  Currently, we set/clear PageKmemcg
      in __alloc_pages_nodemask()/free_pages_prepare() for any page allocated
      with __GFP_ACCOUNT, including those that aren't actually charged to any
      cgroup, i.e. allocated from the root cgroup context.  To avoid overhead
      in case cgroups are not used, we only do that if memcg_kmem_enabled() is
      true.  The latter is set iff there are kmem-enabled memory cgroups
      (online or offline).  The root cgroup is not considered kmem-enabled.
      As a result, if a page is allocated with __GFP_ACCOUNT for the root
      cgroup when there are kmem-enabled memory cgroups and is freed after all
      kmem-enabled memory cgroups were removed, e.g.
        # no memory cgroups has been created yet, create one
        mkdir /sys/fs/cgroup/memory/test
        # run something allocating pages with __GFP_ACCOUNT, e.g.
        # a program using pipe
        dmesg | tail
        # remove the memory cgroup
        rmdir /sys/fs/cgroup/memory/test
      we'll get bad page state bug complaining about page->_mapcount != -1:
        BUG: Bad page state in process swapper/0  pfn:1fd945c
        page:ffffea007f651700 count:0 mapcount:-511 mapping:          (null) index:0x0
        flags: 0x1000000000000000()
      To avoid that, let's mark with PageKmemcg only those pages that are
      actually charged to and hence pin a non-root memory cgroup.
      Fixes: 4949148a ("mm: charge/uncharge kmemcg from generic page allocator paths")
      Reported-and-tested-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
      Signed-off-by: default avatarVladimir Davydov <vdavydov@virtuozzo.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    • Ilya Dryomov's avatar
      ceph: initialize pathbase in the !dentry case in encode_caps_cb() · 4eacd4cb
      Ilya Dryomov authored
      pathbase is the base inode; set it to 0 if we've got no path.
      Coverity-id: 146348
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Reviewed-by: default avatarAlex Elder <elder@linaro.org>
    • Ilya Dryomov's avatar
      rbd: nuke the 32-bit pool id check · d8734849
      Ilya Dryomov authored
      ceph_file_layout::pool_id is now s64.  rbd_add_get_pool_id() and
      ceph_pg_poolid_by_name() both return an int, so it's bogus anyway.
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Reviewed-by: default avatarAlex Elder <elder@linaro.org>
    • Steven Rostedt (Red Hat)'s avatar
      tracing: Fix tick_stop tracepoint symbols for user export · c87edb36
      Steven Rostedt (Red Hat) authored
      The symbols used in the tick_stop tracepoint were not being converted
      properly into integers in the trace_stop format file. Instead we had this:
      print fmt: "success=%d dependency=%s", REC->success,
          __print_symbolic(REC->dependency, { 0, "NONE" },
           { (1 << TICK_DEP_BIT_POSIX_TIMER), "POSIX_TIMER" },
           { (1 << TICK_DEP_BIT_PERF_EVENTS), "PERF_EVENTS" },
           { (1 << TICK_DEP_BIT_SCHED), "SCHED" },
      User space tools have no idea how to parse "TICK_DEP_BIT_SCHED" or the other
      symbols used to do the bit shifting. The reason is that the conversion was
      done with using the TICK_DEP_MASK_* symbols which are just macros that
      convert to the BIT shift itself (with the exception of NONE, which was
      converted properly, because it doesn't use bits, and is defined as zero).
      The TICK_DEP_BIT_* needs to be denoted by TRACE_DEFINE_ENUM() in order to
      have this properly converted for user space tools to parse this event.
      Cc: stable@vger.kernel.org
      Cc: Frederic Weisbecker <fweisbec@gmail.com>
      Fixes: e6e6cc22 ("nohz: Use enum code for tick stop failure tracing message")
      Reported-by: default avatarLuiz Capitulino <lcapitulino@redhat.com>
      Tested-by: default avatarLuiz Capitulino <lcapitulino@redhat.com>
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
    • James Hogan's avatar
      metag: Drop show_mem() from mem_init() · 97b1d23f
      James Hogan authored
      The recent commit 599d0c95 ("mm, vmscan: move LRU lists to node"),
      changed memory management code so that show_mem() is no longer safe to
      call prior to setup_per_cpu_pageset(), as pgdat->per_cpu_nodestats will
      still be NULL. This causes an oops on metag due to the call to
      show_mem() from mem_init():
        node_page_state_snapshot(...) + 0x48
        pgdat_reclaimable(struct pglist_data * pgdat = 0x402517a0)
        show_free_areas(unsigned int filter = 0) + 0x2cc
        show_mem(unsigned int filter = 0) + 0x18
        start_kernel() + 0x204
      This wasn't a problem before with zone_reclaimable() as zone_pcp_init()
      was already setting zone->pageset to &boot_pageset, via setup_arch() and
      paging_init(), which happens before mm_init():
        free_area_init_core(...) + 0x138
        free_area_init_node(int nid = 0, ...) + 0x1a0
        free_area_init_nodes(...) + 0x440
        paging_init(unsigned long mem_end = 0x4fe00000) + 0x378
        setup_arch(char ** cmdline_p = 0x4024e038) + 0x2b8
        start_kernel() + 0x54
      No other arches appear to call show_mem() during boot, and it doesn't
      really add much value to the log, so lets just drop it from mem_init().
      Signed-off-by: default avatarJames Hogan <james.hogan@imgtec.com>
      Acked-by: default avatarMel Gorman <mgorman@techsingularity.net>
      Cc: linux-metag@vger.kernel.org
    • Cornelia Huck's avatar
      virtio/s390: deprecate old transport · 3b2fbb3f
      Cornelia Huck authored
      There only ever have been two host implementations of the old
      s390-virtio (pre-ccw) transport: the experimental kuli userspace,
      and qemu. As qemu switched its default to ccw with 2.4 (with most
      users having used ccw well before that) and removed the old transport
      entirely in 2.6, s390-virtio probably hasn't been in active use for
      quite some time and is therefore likely to bitrot.
      Let's start the slow march towards removing the code by deprecating
      Note that this also deprecates the early virtio console code, which
      has been causing trouble in the guest without being wired up in any
      relevant hypervisor code.
      Acked-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
      Reviewed-by: default avatarDong Jia Shi <bjsdjshi@linux.vnet.ibm.com>
      Reviewed-by: default avatarSascha Silbe <silbe@linux.vnet.ibm.com>
      Signed-off-by: default avatarCornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
    • Christian Borntraeger's avatar
      virtio/s390: keep early_put_chars · 2ab0d56a
      Christian Borntraeger authored
      In case the registration of the hvc tty never happens AND the kernel
      thinks that hvc0 is the preferred console we should keep the early
      printk function to avoid a kernel panic due to code being removed.
      Signed-off-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
      Signed-off-by: default avatarJing Liu <liujbjl@linux.vnet.ibm.com>
      Signed-off-by: default avatarCornelia Huck <cornelia.huck@de.ibm.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
    • Minfei Huang's avatar
      virtio_blk: Fix a slient kernel panic · 347a5293
      Minfei Huang authored
      We do a lot of memory allocation in function init_vq, and don't handle
      the allocation failure properly. Then this function will return 0,
      although initialization fails due to lacking memory. At that moment,
      kernel will panic in guest machine, if virtio is used to drive disk.
      To fix this bug, we should take care of allocation failure, and return
      correct value to let caller know what happen.
      Tested-by: default avatarChao Fan <fanc.fnst@cn.fujitsu.com>
      Signed-off-by: default avatarMinfei Huang <mnghuan@gmail.com>
      Signed-off-by: default avatarMinfei Huang <minfei.hmf@alibaba-inc.com>
      Reviewed-by: default avatarCornelia Huck <cornelia.huck@de.ibm.com>
      Reviewed-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
    • Stefan Hajnoczi's avatar
    • Stefan Hajnoczi's avatar
      vhost/vsock: fix vhost virtio_vsock_pkt use-after-free · 3fda5d6e
      Stefan Hajnoczi authored
      Stash the packet length in a local variable before handing over
      ownership of the packet to virtio_transport_recv_pkt() or
      This patch solves the use-after-free since pkt is no longer guaranteed
      to be alive.
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
    • Vegard Nossum's avatar
      9p/trans_virtio: use kvfree() for iov_iter_get_pages_alloc() · 1b8553c0
      Vegard Nossum authored
      The memory allocated by iov_iter_get_pages_alloc() can be allocated with
      vmalloc() if kmalloc() failed -- see get_pages_array().
      In that case we need to free it with vfree(), so let's use kvfree().
      The bug manifests like this:
      BUG: unable to handle kernel paging request at ffffeb0400072da0
      IP: [<ffffffff8139c67b>] kfree+0x4b/0x140
      PGD 0
      Oops: 0000 [#1] PREEMPT SMP KASAN
      CPU: 2 PID: 675 Comm: trinity-c2 Not tainted 4.7.0-rc7+ #14
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      task: ffff8800badef2c0 ti: ffff880069208000 task.ti: ffff880069208000
      RIP: 0010:[<ffffffff8139c67b>]  [<ffffffff8139c67b>] kfree+0x4b/0x140
      RSP: 0000:ffff88006920f3f0  EFLAGS: 00010282
      RAX: ffffea0000000000 RBX: ffffc90001cb6000 RCX: 0000000000000000
      RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffffc90001cb6000
      RBP: ffff88006920f410 R08: 0000000000000000 R09: dffffc0000000000
      R10: ffff8800badefa30 R11: 0000056a3d3b0d9f R12: ffff88006920f620
      R13: ffffeb0400072d80 R14: ffff8800baa94078 R15: 0000000000000000
      FS:  00007fbd2b437700(0000) GS:ffff88011af00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: ffffeb0400072da0 CR3: 000000006926d000 CR4: 00000000000006e0
       0000000000000001 ffff88006920f620 ffffed001755280f ffff8800baa94078
       ffff88006920f6a8 ffffffff8310442b dffffc0000000000 ffff8800badefa30
       ffff8800badefa28 ffff88011af1fba0 1ffff1000d241e98 ffff8800ba892150
      Call Trace:
       [<ffffffff8310442b>] p9_virtio_zc_request+0x72b/0xdb0
       [<ffffffff830f2116>] p9_client_zc_rpc.constprop.8+0x246/0xb10
       [<ffffffff830f5d79>] p9_client_read+0x4c9/0x750
       [<ffffffff8175ceac>] v9fs_fid_readpage+0x14c/0x320
       [<ffffffff8175d0b6>] v9fs_vfs_readpage+0x36/0x50
       [<ffffffff812c6f13>] filemap_fault+0x9a3/0xe60
       [<ffffffff81331878>] __do_fault+0x158/0x300
       [<ffffffff81339e01>] handle_mm_fault+0x1cf1/0x3c80
       [<ffffffff810c0aaa>] __do_page_fault+0x30a/0x8e0
       [<ffffffff810c10df>] do_page_fault+0x2f/0x80
       [<ffffffff810b5b07>] do_async_page_fault+0x27/0xa0
       [<ffffffff83296c48>] async_page_fault+0x28/0x30
      Code: 00 80 41 54 53 49 01 fd 48 0f 42 05 b0 39 67 02 48 89 fb 49 01 c5 48 b8 00 00 00 00 00 ea ff ff 49 c1 ed 0c 49 c1 e5 06 49 01 c5 <49> 8b 45 20 48 8d 50 ff a8 01 4c 0f 45 ea 49 8b 55 20 48 8d 42
      RIP  [<ffffffff8139c67b>] kfree+0x4b/0x140
       RSP <ffff88006920f3f0>
      CR2: ffffeb0400072da0
      ---[ end trace f3d59a04bafec038 ]---
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
    • Michael S. Tsirkin's avatar
      virtio: fix error handling for debug builds · 3cc36f6e
      Michael S. Tsirkin authored
      On error, virtqueue_add calls START_USE but not
      END_USE. Thankfully that's normally empty anyway,
      but might not be when debugging. Fix it up.
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
    • Wei Yongjun's avatar
      virtio: fix memory leak in virtqueue_add() · 58625edf
      Wei Yongjun authored
      When using the indirect buffers feature, 'desc' is allocated in
      virtqueue_add() but isn't freed before leaving on a ring full error,
      causing a memory leak.
      For example, it seems rather clear that this can trigger
      with virtio net if mergeable buffers are not used.
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarWei Yongjun <weiyj.lk@gmail.com>
      Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
  4. 08 Aug, 2016 6 commits