3.10-stable patches

added patches:
	drivers-base-memory.c-fix-show_mem_removable-to-handle-missing-sections.patch
	ipc-bugfix-for-msgrcv-with-msgtyp-0.patch
	timer_list-correct-the-iterator-for-timer_list.patch

diff --git a/queue-3.10/drivers-base-memory.c-fix-show_mem_removable-to-handle-missing-sections.patch b/queue-3.10/drivers-base-memory.c-fix-show_mem_removable-to-handle-missing-sections.patch
new file mode 100644 (file)
index 0000000..70df0b3
--- /dev/null
+++ b/queue-3.10/drivers-base-memory.c-fix-show_mem_removable-to-handle-missing-sections.patch
@@ -0,0 +1,88 @@
+From 21ea9f5ace3a7317cc3ba1fbc749758021a83136 Mon Sep 17 00:00:00 2001
+From: Russ Anderson <rja@sgi.com>
+Date: Wed, 28 Aug 2013 16:35:18 -0700
+Subject: drivers/base/memory.c: fix show_mem_removable() to handle missing sections
+
+From: Russ Anderson <rja@sgi.com>
+
+commit 21ea9f5ace3a7317cc3ba1fbc749758021a83136 upstream.
+
+"cat /sys/devices/system/memory/memory*/removable" crashed the system.
+
+The problem is that show_mem_removable() is passing a
+bad pfn to is_mem_section_removable(), which causes
+
+    if (!node_online(page_to_nid(page)))
+
+to blow up.  Why is it passing in a bad pfn?
+
+The reason is that show_mem_removable() will loop sections_per_block
+times.  sections_per_block is 16, but mem->section_count is 8,
+indicating holes in this memory block.  Checking that the memory section
+is present before checking to see if the memory section is removable
+fixes the problem.
+
+   harp5-sys:~ # cat /sys/devices/system/memory/memory*/removable
+   0
+   1
+   1
+   1
+   1
+   1
+   1
+   1
+   1
+   1
+   1
+   1
+   1
+   1
+   BUG: unable to handle kernel paging request at ffffea00c3200000
+   IP: [<ffffffff81117ed1>] is_pageblock_removable_nolock+0x1/0x90
+   PGD 83ffd4067 PUD 37bdfce067 PMD 0
+   Oops: 0000 [#1] SMP
+   Modules linked in: autofs4 binfmt_misc rdma_ucm rdma_cm iw_cm ib_addr ib_srp scsi_transport_srp scsi_tgt ib_ipoib ib_cm ib_uverbs ib_umad iw_cxgb3 cxgb3 mdio mlx4_en mlx4_ib ib_sa mlx4_core ib_mthca ib_mad ib_core fuse nls_iso8859_1 nls_cp437 vfat fat joydev loop hid_generic usbhid hid hwperf(O) numatools(O) dm_mod iTCO_wdt ipv6 iTCO_vendor_support igb i2c_i801 ioatdma i2c_algo_bit ehci_pci pcspkr lpc_ich i2c_core ehci_hcd ptp sg mfd_core dca rtc_cmos pps_core mperf button xhci_hcd sd_mod crc_t10dif usbcore usb_common scsi_dh_emc scsi_dh_hp_sw scsi_dh_alua scsi_dh_rdac scsi_dh gru(O) xvma(O) xfs crc32c libcrc32c thermal sata_nv processor piix mptsas mptscsih scsi_transport_sas mptbase megaraid_sas fan thermal_sys hwmon ext3 jbd ata_piix ahci libahci libata scsi_mod
+   CPU: 4 PID: 5991 Comm: cat Tainted: G           O 3.11.0-rc5-rja-uv+ #10
+   Hardware name: SGI UV2000/ROMLEY, BIOS SGI UV 2000/3000 series BIOS 01/15/2013
+   task: ffff88081f034580 ti: ffff880820022000 task.ti: ffff880820022000
+   RIP: 0010:[<ffffffff81117ed1>]  [<ffffffff81117ed1>] is_pageblock_removable_nolock+0x1/0x90
+   RSP: 0018:ffff880820023df8  EFLAGS: 00010287
+   RAX: 0000000000040000 RBX: ffffea00c3200000 RCX: 0000000000000004
+   RDX: ffffea00c30b0000 RSI: 00000000001c0000 RDI: ffffea00c3200000
+   RBP: ffff880820023e38 R08: 0000000000000000 R09: 0000000000000001
+   R10: 0000000000000000 R11: 0000000000000001 R12: ffffea00c33c0000
+   R13: 0000160000000000 R14: 6db6db6db6db6db7 R15: 0000000000000001
+   FS:  00007ffff7fb2700(0000) GS:ffff88083fc80000(0000) knlGS:0000000000000000
+   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+   CR2: ffffea00c3200000 CR3: 000000081b954000 CR4: 00000000000407e0
+   Call Trace:
+     show_mem_removable+0x41/0x70
+     dev_attr_show+0x2a/0x60
+     sysfs_read_file+0xf7/0x1c0
+     vfs_read+0xc8/0x130
+     SyS_read+0x5d/0xa0
+     system_call_fastpath+0x16/0x1b
+
+Signed-off-by: Russ Anderson <rja@sgi.com>
+Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Cc: Yinghai Lu <yinghai@kernel.org>
+Reviewed-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/memory.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -152,6 +152,8 @@ static ssize_t show_mem_removable(struct
+               container_of(dev, struct memory_block, dev);
+ 
+       for (i = 0; i < sections_per_block; i++) {
++              if (!present_section_nr(mem->start_section_nr + i))
++                      continue;
+               pfn = section_nr_to_pfn(mem->start_section_nr + i);
+               ret &= is_mem_section_removable(pfn, PAGES_PER_SECTION);
+       }

diff --git a/queue-3.10/ipc-bugfix-for-msgrcv-with-msgtyp-0.patch b/queue-3.10/ipc-bugfix-for-msgrcv-with-msgtyp-0.patch
new file mode 100644 (file)
index 0000000..e97b428
--- /dev/null
+++ b/queue-3.10/ipc-bugfix-for-msgrcv-with-msgtyp-0.patch
@@ -0,0 +1,60 @@
+From 368ae537e056acd3f751fa276f48423f06803922 Mon Sep 17 00:00:00 2001
+From: Svenning Soerensen <sss@secomea.dk>
+Date: Wed, 28 Aug 2013 16:35:17 -0700
+Subject: IPC: bugfix for msgrcv with msgtyp < 0
+
+From: Svenning Soerensen <sss@secomea.dk>
+
+commit 368ae537e056acd3f751fa276f48423f06803922 upstream.
+
+According to 'man msgrcv': "If msgtyp is less than 0, the first message of
+the lowest type that is less than or equal to the absolute value of msgtyp
+shall be received."
+
+Bug: The kernel only returns a message if its type is 1; other messages
+with type < abs(msgtype) will never get returned.
+
+Fix: After having traversed the list to find the first message with the
+lowest type, we need to actually return that message.
+
+This regression was introduced by commit daaf74cf0867 ("ipc: refactor
+msg list search into separate function")
+
+Signed-off-by: Svenning Soerensen <sss@secomea.dk>
+Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ ipc/msg.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -795,7 +795,7 @@ static inline void free_copy(struct msg_
+ 
+ static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode)
+ {
+-      struct msg_msg *msg;
++      struct msg_msg *msg, *found = NULL;
+       long count = 0;
+ 
+       list_for_each_entry(msg, &msq->q_messages, m_list) {
+@@ -804,6 +804,7 @@ static struct msg_msg *find_msg(struct m
+                                              *msgtyp, mode)) {
+                       if (mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
+                               *msgtyp = msg->m_type - 1;
++                              found = msg;
+                       } else if (mode == SEARCH_NUMBER) {
+                               if (*msgtyp == count)
+                                       return msg;
+@@ -813,7 +814,7 @@ static struct msg_msg *find_msg(struct m
+               }
+       }
+ 
+-      return ERR_PTR(-EAGAIN);
++      return found ?: ERR_PTR(-EAGAIN);
+ }
+ 
+ 

diff --git a/queue-3.10/series b/queue-3.10/series
index f10139380835b177a848498496e43b43e5c05d52..e8841c860f7ac54e505aca1d5a187fbdc9a7c376 100644 (file)
--- a/queue-3.10/series
+++ b/queue-3.10/series
@@ -8,3 +8,6 @@ powerpc-don-t-oops-when-accessing-proc-powerpc-lparcfg-without-hypervisor.patch
 powerpc-hvsi-increase-handshake-timeout-from-200ms-to-400ms.patch
 scsi-pm80xx-fix-adaptec-71605h-hang.patch
 regmap-add-another-missing-header-for-config_regmap-stubs.patch
+timer_list-correct-the-iterator-for-timer_list.patch
+ipc-bugfix-for-msgrcv-with-msgtyp-0.patch
+drivers-base-memory.c-fix-show_mem_removable-to-handle-missing-sections.patch

diff --git a/queue-3.10/timer_list-correct-the-iterator-for-timer_list.patch b/queue-3.10/timer_list-correct-the-iterator-for-timer_list.patch
new file mode 100644 (file)
index 0000000..2c5abf1
--- /dev/null
+++ b/queue-3.10/timer_list-correct-the-iterator-for-timer_list.patch
@@ -0,0 +1,104 @@
+From 84a78a6504f5c5394a8e558702e5b54131f01d14 Mon Sep 17 00:00:00 2001
+From: Nathan Zimmer <nzimmer@sgi.com>
+Date: Wed, 28 Aug 2013 16:35:14 -0700
+Subject: timer_list: correct the iterator for timer_list
+
+From: Nathan Zimmer <nzimmer@sgi.com>
+
+commit 84a78a6504f5c5394a8e558702e5b54131f01d14 upstream.
+
+Correct an issue with /proc/timer_list reported by Holger.
+
+When reading from the proc file with a sufficiently small buffer, 2k so
+not really that small, there was one could get hung trying to read the
+file a chunk at a time.
+
+The timer_list_start function failed to account for the possibility that
+the offset was adjusted outside the timer_list_next.
+
+Signed-off-by: Nathan Zimmer <nzimmer@sgi.com>
+Reported-by: Holger Hans Peter Freyther <holger@freyther.de>
+Cc: John Stultz <john.stultz@linaro.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Berke Durak <berke.durak@xiphos.com>
+Cc: Jeff Layton <jlayton@redhat.com>
+Tested-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/timer_list.c |   41 ++++++++++++++++++++++++-----------------
+ 1 file changed, 24 insertions(+), 17 deletions(-)
+
+--- a/kernel/time/timer_list.c
++++ b/kernel/time/timer_list.c
+@@ -265,10 +265,9 @@ static inline void timer_list_header(str
+ static int timer_list_show(struct seq_file *m, void *v)
+ {
+       struct timer_list_iter *iter = v;
+-      u64 now = ktime_to_ns(ktime_get());
+ 
+       if (iter->cpu == -1 && !iter->second_pass)
+-              timer_list_header(m, now);
++              timer_list_header(m, iter->now);
+       else if (!iter->second_pass)
+               print_cpu(m, iter->cpu, iter->now);
+ #ifdef CONFIG_GENERIC_CLOCKEVENTS
+@@ -298,33 +297,41 @@ void sysrq_timer_list_show(void)
+       return;
+ }
+ 
+-static void *timer_list_start(struct seq_file *file, loff_t *offset)
++static void *move_iter(struct timer_list_iter *iter, loff_t offset)
+ {
+-      struct timer_list_iter *iter = file->private;
+-
+-      if (!*offset) {
+-              iter->cpu = -1;
+-              iter->now = ktime_to_ns(ktime_get());
+-      } else if (iter->cpu >= nr_cpu_ids) {
++      for (; offset; offset--) {
++              iter->cpu = cpumask_next(iter->cpu, cpu_online_mask);
++              if (iter->cpu >= nr_cpu_ids) {
+ #ifdef CONFIG_GENERIC_CLOCKEVENTS
+-              if (!iter->second_pass) {
+-                      iter->cpu = -1;
+-                      iter->second_pass = true;
+-              } else
+-                      return NULL;
++                      if (!iter->second_pass) {
++                              iter->cpu = -1;
++                              iter->second_pass = true;
++                      } else
++                              return NULL;
+ #else
+-              return NULL;
++                      return NULL;
+ #endif
++              }
+       }
+       return iter;
+ }
+ 
++static void *timer_list_start(struct seq_file *file, loff_t *offset)
++{
++      struct timer_list_iter *iter = file->private;
++
++      if (!*offset)
++              iter->now = ktime_to_ns(ktime_get());
++      iter->cpu = -1;
++      iter->second_pass = false;
++      return move_iter(iter, *offset);
++}
++
+ static void *timer_list_next(struct seq_file *file, void *v, loff_t *offset)
+ {
+       struct timer_list_iter *iter = file->private;
+-      iter->cpu = cpumask_next(iter->cpu, cpu_online_mask);
+       ++*offset;
+-      return timer_list_start(file, offset);
++      return move_iter(iter, 1);
+ }
+ 
+ static void timer_list_stop(struct seq_file *seq, void *v)