Commit f5252e00 ("mm: avoid null pointer access in vm_struct via
/proc/vmallocinfo") adds newly allocated vm_structs to the vmlist after
it is fully initialised. Unfortunately, it did not check that
__vmalloc_area_node() successfully populated the area. In the event of
allocation failure, the vmalloc area is freed but the pointer to freed
memory is inserted into the vmlist leading to a a crash later in
get_vmalloc_info().
This patch adds a check for ____vmalloc_area_node() failure within
__vmalloc_node_range. It does not use "goto fail" as in the previous
error path as a warning was already displayed by __vmalloc_area_node()
before it called vfree in its failure path.
Credit goes to Luciano Chavez for doing all the real work of identifying
exactly where the problem was.
setup_zone_migrate_reserve() expects that zone->start_pfn starts at
pageblock_nr_pages aligned pfn otherwise we could access beyond an
existing memblock resulting in the following panic if
CONFIG_HOLES_IN_ZONE is not configured and we do not check pfn_valid:
We crashed in pageblock_is_reserved() when accessing pfn 0xc0000 because
highstart_pfn = 0x36ffe.
The issue was introduced in 3.0-rc1 by 6d3163ce ("mm: check if any page
in a pageblock is reserved before marking it MIGRATE_RESERVE").
Make sure that start_pfn is always aligned to pageblock_nr_pages to
ensure that pfn_valid s always called at the start of each pageblock.
Architectures with holes in pageblocks will be correctly handled by
pfn_valid_within in pageblock_is_reserved.
Signed-off-by: Michal Hocko <mhocko@suse.cz> Signed-off-by: Mel Gorman <mgorman@suse.de> Tested-by: Dang Bo <bdang@vmware.com> Reviewed-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: David Rientjes <rientjes@google.com> Cc: Arve Hjnnevg <arve@android.com> Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Cc: John Stultz <john.stultz@linaro.org> Cc: Dave Hansen <dave@linux.vnet.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Commit 70b50f94f1644 ("mm: thp: tail page refcounting fix") keeps all
page_tail->_count zero at all times. But the current kernel does not
set page_tail->_count to zero if a 1GB page is utilized. So when an
IOMMU 1GB page is used by KVM, it wil result in a kernel oops because a
tail page's _count does not equal zero.
With the 3.2-rc kernel, IOMMU 2M pages in KVM works. But when I tried
to use IOMMU 1GB pages in KVM, I encountered an oops and the 1GB page
failed to be used.
The root cause is that 1GB page allocation calls gup_huge_pud() while 2M
page calls gup_huge_pmd. If compound pages are used and the page is a
tail page, gup_huge_pmd() increases _mapcount to record tail page are
mapped while gup_huge_pud does not do that.
So when the mapped page is relesed, it will result in kernel oops
because the page is not marked mapped.
This patch add tail process for compound page in 1GB huge page which
keeps the same process as 2M page.
Allow userspace applications to do more parameter setting by providing a
more complete stub DMA driver specifying a wildcard set of formats and
channels and essentially random values for the DMA parameters. This is
required for useful runtime operation of the dummy DMA driver until we
are able to figure out how to power up links and do hw_params() from DAPM.
Sending to stable as without this the dummy driver is not terribly
useful.
Reported-by: Kyung-Kwee Ryu <Kyung-Kwee.Ryu@wolfsonmicro.com> Tested-by: Kyung-Kwee Ryu <Kyung-Kwee.Ryu@wolfsonmicro.com> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The function setup_vpif_input_channel_mode() used the VSCLKDIS register
instead of VIDCLKCTL. This meant that when in HD mode videoport channel 0
used a different clock from channel 1.
Clearly a copy-and-paste error.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Manjunath Hadli <manjunath.hadli@ti.com> Signed-off-by: Sekhar Nori <nsekhar@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
On OMAP-L138 platform, EDMA event queue 0 should be used for audio
transfers so that they are not starved by video data moving on event queue 1.
Commit 48519f0ae03bc7e86b3dc93e56f1334d53803770 (ASoC: davinci: let platform
data define edma queue numbers) had a side-effect of changing this behavior
by making the driver actually honor the platform data passed.
Fix this now by passing event queue 0 as the queue to be used for audio
transfers.
The expiry function compares the timer against current time and does
not expire the timer when the expiry time is >= now. That's wrong. If
the timer is set for now, then it must expire.
Make the condition expiry > now for breaking out the loop.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
When no imux is available (e.g. a single capture source),
alc_auto_init_input_src() may trigger an Oops due to the access to -1.
Add a proper zero-check to avoid it.
There are some AC97 codec and board combinations that have been observed
to take a very long time to respond after the cold reset has completed.
In one case, more than 350 ms was required. To allow users to have sound
on those platforms, we'll wait up to 500ms for the codec to become
ready.
As a board may have multiple codecs, with some faster than others to
reset, we add a module parameter to inform the driver which codecs
should be present.
Petr Holasek [Thu, 8 Dec 2011 12:16:41 +0000 (13:16 +0100)]
x86/numa: Add constraints check for nid parameters
Orabug: 13522802
This patch adds constraint checks to the numa_set_distance()
function.
When the check triggers (this should not happen normally) it
emits a warning and avoids a store to a negative index in
numa_distance[] array - i.e. avoids memory corruption.
Negative ids can be passed when the pxm-to-nids mapping is not
properly filled while parsing the SRAT.
This patch fixes a situation when wrb was not being memset to zero
before being used
---
be_cmds.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com>
This patch fixes wrong dmsg setting when we send out wrb.
If the ttt is not ISCSI_RESERVED_TAG then we should be setting
dmsg=1 so that the completion is done without waiting for a
iscsi level response from the target
---
be_main.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com>
This patch fixes the Kdump failure reported by Redhat wich was caused by
be2iscsi resetting the Chip when be2iscsi detects it is in crashdump mode. If
be2net was loaded before be2iscsi then this leaves be2net driver hanging on to
resources that the chip stopped recognising after the reset.
This patch replaces chip reset with Function reset so that only the
particular function and not the whole chip is affected
---
be_cmds.c | 19 +++++++++++++++++++
be_cmds.h | 2 ++
be_main.c | 2 +-
3 files changed, 22 insertions(+), 1 deletions(-)
Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com>
This patch adds call to pci_disable_device during
rmmod and shutdown. The lack of this call was causing hang in
insmod - rmmod loop test
---
be_main.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com>
This patch adds a shutdown routine. It fixes a bug where when be2net
and be2iscsi are both used be2iscsi was not cleaning up its resources
properly causing be2net to fail to get loaded when the system is
rebooted.
---
be_main.c | 38 ++++++++++++++++++++++++++++++--------
1 files changed, 30 insertions(+), 8 deletions(-)
Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com>
[SCSI] be2iscsi: Fixing the /proc/interrupts problem V3
Fix be2iscsi driver to use a separate pointer for each irq action->name
field and avoid display corruption in /proc/interrupts. The be2iscsi driver
was using a single static array in a function for the irq action->name field.
This results in garbage output from /proc/interrupts
The pointer for action->name is garbage and scribbles the output on the screen.
iscsi_session_to_shost is a macro around dev_to_shost which returns a
Scsi_Host so there is no need to cast.
iscsi_session_to_shost is a macro around shost_priv which
returns a void pointer so no need to cast.
---
be_iscsi.c | 7 +++----
1 files changed, 3 insertions(+), 4 deletions(-)
Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com>
Andrew Vasquez [Fri, 23 Sep 2011 22:09:46 +0000 (15:09 -0700)]
qla2xxx: Ensure there's enough request-queue space for passthru IOCBs.
The driver should ensure there's a sufficient number of IOCBs
to satisfy the number of scatter-gather entries specified in the
command. Add a 'count' to the control structure, srb_ctx, to use
in qla2x00_alloc_iocbs().
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Chad Dupuis [Fri, 16 Dec 2011 08:49:42 +0000 (00:49 -0800)]
qla2xxx: Update to dynamic logging.
This patch contains minor fixes to our new logging infrastructure:
- Remove extranous messages.
- Re-add 'nexus' and 'hdl' information.
- Adjusted the message ids to fill up the holes.
- Display FCP_CMND priority on update.
- Log only mail box error conditions.
- Do not print "Firmware ready **** FAILED ****" if cable is unplugged.
- Drop noisy 'fw_state...curr time...' message.
- Correct nexus display during abort.
- Add a special case error-logging set to '1'.
- Catagorize I/O exception display handling.
- Correct the bsg msg code printing.
- Dont use dynamic logging after host is removed.
Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com> Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Joe Perches [Tue, 2 Aug 2011 12:54:22 +0000 (05:54 -0700)]
qla2xxx: Use less stack to emit logging messages.
Return early when logging level too low.
Use normal kernel codeing style for function braces.
Add const where appropriate to logging functions.
Remove now unused #define QL_DBG_BUF_LEN.
Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
This function can wait for 5min under certain scenarios. One of them is when
the port is down from switch and bus reset is issued. The bus reset used to
wait for 5 minutes for the loop and upper layer callers used to hang and give
stack trace because of getting stuck for 120 sec. Its legacy code that was used
when the driver used to do queuing of the commands.
Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Andrew Vasquez [Wed, 26 Oct 2011 21:20:13 +0000 (14:20 -0700)]
qla2xxx: Correct inadvertent clearing of RISC_INTR status.
During heavy I/O (CPU-affinity mode enabled) and CLI/Agent
interactions, the driver would report periodic mailbox command
timeout statuses. Within the CPU-affinity ISR handler, the
driver should check the 'disable-msix-handshake' flag in deciding
whether or not to clear HCCRX_CLR_RISC_INT. The mode is not
specific to a dedicated queue, instead, applies to the current
'ha' context.
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Roland Dreier [Thu, 22 Sep 2011 07:06:05 +0000 (00:06 -0700)]
qla2xxx: Fix crash in qla2x00_abort_all_cmds() on unload
I hit a crash in qla2x00_abort_all_cmds() if the qla2xxx module is
unloaded right after it is loaded. I debugged this down to the abort
handling improperly treating a command of type SRB_ADISC_CMD as if it
had a bsg_job to complete when that command actually uses the iocb_cmd
part of the union. (I guess to hit this one has to unload the module
while the async FC initialization is still in progress)
It seems we should only look for a bsg_job if type is SRB_ELS_CMD_RPT,
SRB_ELS_CMD_HST or SRB_CT_CMD, so switch the test to make that explicit.
Signed-off-by: Roland Dreier <roland@purestorage.com> Acked-by: Chad Dupuis <chad.dupuis@qlogic.com> Cc: stable@kernel.org Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Chad Dupuis [Tue, 16 Aug 2011 18:31:55 +0000 (11:31 -0700)]
qla2xxx: Fix "active_mask" may be used uninitialized warning.
Since active_mask is first assigned in an "else" block, the compiler throws
a warning saying that the active_mask variable may be used uninitialized in
a print statement later. Initialize active_mask to 0 in the declaration to
stop the warning.
Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Joe Carnuccio [Tue, 16 Aug 2011 18:31:53 +0000 (11:31 -0700)]
qla2xxx: Return sysfs error codes appropriate to conditions.
Return sysfs error codes that match the conditions encountered.
This prevents sysfs from retrying a request which is conditioned
to fail under the current circumstance.
Signed-off-by: Joe Carnuccio <joe.carnuccio@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Joe Carnuccio [Tue, 16 Aug 2011 18:31:52 +0000 (11:31 -0700)]
qla2xxx: Provide method for updating I2C attached VPD.
Provide bsg interface for updating VPD attached on the I2C serial bus.
Signed-off-by: Joe Carnuccio <joe.carnuccio@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Joe Carnuccio [Tue, 16 Aug 2011 18:31:51 +0000 (11:31 -0700)]
qla2xxx: Correction to sysfs edc interface.
Corrects the return value for the cases where read/write edc fails;
this prevents sysfs from retrying the operation until forever.
Corrects the printk width specifier for the first byte of buf.
Signed-off-by: Joe Carnuccio <joe.carnuccio@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Chad Dupuis [Tue, 16 Aug 2011 18:29:24 +0000 (11:29 -0700)]
qla2xxx: Fix qla24xx revision check while enabling interrupts.
Since we enable interrupts before initializing the firmware, use the chip
revision from PCI config space directly to perform the chip revision check.
Also remove the unnecessary firmware attributes test.
Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Arun Easi [Tue, 16 Aug 2011 18:29:23 +0000 (11:29 -0700)]
qla2xxx: T10 DIF - Fix incorrect error reporting.
This fix:
- Disables app tag peeking; correct tag check will be added when the
SCSI API is available.
- Always derive ref_tag from scsi_get_lba()
- Removes incorrect swap of FCP_LUN in FCP_CMND
- Moves app-tag error check before ref-tag check. The reason being,
currently there is no interface in SCSI to retrieve the app-tag
for protection I/Os, so driver puts zero for app-tag in the
firmware interface, but requests not to validate it, but when a
ref-tag error is detected by firmware, it would put
expected/actual tags for all the protection tags (guard/app/ref).
As driver checks for app tag error first, a ref-tag error is
incorrectly flagged as app-tag error.
- Convert HBA specific checks to capability based.
Signed-off-by: Arun Easi <arun.easi@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
qla2xxx: Code changes to support new dynamic logging infrastructure.
The code is changed to support the new dynamic logging infrastructure.
Following are the levels added.
Default is 0 - no logging. 0x40000000 - Module Init & Probe.
0x20000000 - Mailbox Cmnds. 0x10000000 - Device Discovery.
0x08000000 - IO tracing. 0x04000000 - DPC Thread.
0x02000000 - Async events. 0x01000000 - Timer routines.
0x00800000 - User space. 0x00400000 - Task Management.
0x00200000 - AER/EEH. 0x00100000 - Multi Q.
0x00080000 - P3P Specific. 0x00040000 - Virtual Port.
0x00020000 - Buffer Dump. 0x00010000 - Misc.
0x7fffffff - For enabling all logs, can be too many logs.
Setting ql2xextended_error_logging module parameter to any of the above
value, will enable the debug for that particular level.
Do LOGICAL OR of the value to enable more than one level.
Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com> Signed-off-by: Giridhar Malavali <giridhar.malavali@qlogic.com> Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com> Signed-off-by: Joe Carnuccio <joe.carnuccio@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: Madhuranath Iyengar <Madhu.Iyengar@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
qla2xxx: Basic infrastructure for dynamic logging.
This patch adds the dynamic logging framework to the qla2xxx driver.
The user will be able to change the logging levels on the fly i.e.
without load/unload of the driver. This also enables logging to be
enabled for a particular section of the driver such as initialization,
device discovery etc.
Josef Bacik [Tue, 13 Dec 2011 21:04:54 +0000 (16:04 -0500)]
Btrfs: only set cache_generation if we setup the block group
A user reported a problem booting into a new kernel with the old format inodes.
He was panicing in cow_file_range while writing out the inode cache. This is
because if the block group is not cached we'll just skip writing out the cache,
however if it gets dirtied again in the same transaction and it finished caching
we'd go ahead and write it out, but since we set cache_generation to the transid
we think we've already truncated it and will just carry on, running into
cow_file_range and blowing up. We need to make sure we only set
cache_generation if we've done the truncate. The user tested this patch and
verified that the panic no longer occured. Thanks,
Reported-and-Tested-by: Klaus Bitto <klaus.bitto@gmail.com> Signed-off-by: Josef Bacik <josef@redhat.com>
(cherry picked from commit e65cbb94e036058128a5dec6398be2fd64cf88ba)
Josef Bacik [Tue, 13 Dec 2011 17:55:58 +0000 (12:55 -0500)]
Btrfs: don't panic if orphan item already exists
I've been hitting this BUG_ON() in btrfs_orphan_add when running xfstest 269 in
a loop. This is because we will add an orphan item, do the truncate, the
truncate will fail for whatever reason (*cough*ENOSPC*cough*) and then we're
left with an orphan item still in the fs. Then we come back later to do another
truncate and it blows up because we already have an orphan item. This is ok so
just fix the BUG_ON() to only BUG() if ret is not EEXIST. Thanks,
Josef Bacik [Fri, 9 Dec 2011 18:26:22 +0000 (13:26 -0500)]
Btrfs: fix leaked space in truncate
We were occasionaly leaking space when running xfstest 269. This is because if
we failed to start the transaction in the truncate loop we'd just goto out, but
we need to break so that the inode is removed from the orphan list and the space
is properly freed. Thanks,
Josef Bacik [Fri, 9 Dec 2011 16:18:51 +0000 (11:18 -0500)]
Btrfs: fix how we do delalloc reservations and how we free reservations on error
Running xfstests 269 with some tracing my scripts kept spitting out errors about
releasing bytes that we didn't actually have reserved. This took me down a huge
rabbit hole and it turns out the way we deal with reserved_extents is wrong,
we need to only be setting it if the reservation succeeds, otherwise the free()
method will come in and unreserve space that isn't actually reserved yet, which
can lead to other warnings and such. The math was all working out right in the
end, but it caused all sorts of other issues in addition to making my scripts
yell and scream and generally make it impossible for me to track down the
original issue I was looking for. The other problem is with our error handling
in the reservation code. There are two cases that we need to deal with
1) We raced with free. In this case free won't free anything because csum_bytes
is modified before we dro the lock in our reservation path, so free rightly
doesn't release any space because the reservation code may be depending on that
reservation. However if we fail, we need the reservation side to do the free at
that point since that space is no longer in use. So as it stands the code was
doing this fine and it worked out, except in case #2
2) We don't race with free. Nobody comes in and changes anything, and our
reservation fails. In this case we didn't reserve anything anyway and we just
need to clean up csum_bytes but not free anything. So we keep track of
csum_bytes before we drop the lock and if it hasn't changed we know we can just
decrement csum_bytes and carry on.
Because of the case where we can race with free()'s since we have to drop our
spin_lock to do the reservation, I'm going to serialize all reservations with
the i_mutex. We already get this for free in the heavy use paths, truncate and
file write all hold the i_mutex, just needed to add it to page_mkwrite and
various ioctl/balance things. With this patch my space leak scripts no longer
scream bloody murder. Thanks,
projects / users / jedix / linux-maple.git / log