From: Greg Kroah-Hartman Date: Tue, 3 Sep 2013 18:13:24 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.0.95~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=226ba0ba1ec9177626b4ef1539e0eba2e92b7027;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: drivers-base-memory.c-fix-show_mem_removable-to-handle-missing-sections.patch ipc-bugfix-for-msgrcv-with-msgtyp-0.patch timer_list-correct-the-iterator-for-timer_list.patch --- diff --git a/queue-3.10/drivers-base-memory.c-fix-show_mem_removable-to-handle-missing-sections.patch b/queue-3.10/drivers-base-memory.c-fix-show_mem_removable-to-handle-missing-sections.patch new file mode 100644 index 00000000000..70df0b301cb --- /dev/null +++ b/queue-3.10/drivers-base-memory.c-fix-show_mem_removable-to-handle-missing-sections.patch @@ -0,0 +1,88 @@ +From 21ea9f5ace3a7317cc3ba1fbc749758021a83136 Mon Sep 17 00:00:00 2001 +From: Russ Anderson +Date: Wed, 28 Aug 2013 16:35:18 -0700 +Subject: drivers/base/memory.c: fix show_mem_removable() to handle missing sections + +From: Russ Anderson + +commit 21ea9f5ace3a7317cc3ba1fbc749758021a83136 upstream. + +"cat /sys/devices/system/memory/memory*/removable" crashed the system. + +The problem is that show_mem_removable() is passing a +bad pfn to is_mem_section_removable(), which causes + + if (!node_online(page_to_nid(page))) + +to blow up. Why is it passing in a bad pfn? + +The reason is that show_mem_removable() will loop sections_per_block +times. sections_per_block is 16, but mem->section_count is 8, +indicating holes in this memory block. Checking that the memory section +is present before checking to see if the memory section is removable +fixes the problem. + + harp5-sys:~ # cat /sys/devices/system/memory/memory*/removable + 0 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + BUG: unable to handle kernel paging request at ffffea00c3200000 + IP: [] is_pageblock_removable_nolock+0x1/0x90 + PGD 83ffd4067 PUD 37bdfce067 PMD 0 + Oops: 0000 [#1] SMP + Modules linked in: autofs4 binfmt_misc rdma_ucm rdma_cm iw_cm ib_addr ib_srp scsi_transport_srp scsi_tgt ib_ipoib ib_cm ib_uverbs ib_umad iw_cxgb3 cxgb3 mdio mlx4_en mlx4_ib ib_sa mlx4_core ib_mthca ib_mad ib_core fuse nls_iso8859_1 nls_cp437 vfat fat joydev loop hid_generic usbhid hid hwperf(O) numatools(O) dm_mod iTCO_wdt ipv6 iTCO_vendor_support igb i2c_i801 ioatdma i2c_algo_bit ehci_pci pcspkr lpc_ich i2c_core ehci_hcd ptp sg mfd_core dca rtc_cmos pps_core mperf button xhci_hcd sd_mod crc_t10dif usbcore usb_common scsi_dh_emc scsi_dh_hp_sw scsi_dh_alua scsi_dh_rdac scsi_dh gru(O) xvma(O) xfs crc32c libcrc32c thermal sata_nv processor piix mptsas mptscsih scsi_transport_sas mptbase megaraid_sas fan thermal_sys hwmon ext3 jbd ata_piix ahci libahci libata scsi_mod + CPU: 4 PID: 5991 Comm: cat Tainted: G O 3.11.0-rc5-rja-uv+ #10 + Hardware name: SGI UV2000/ROMLEY, BIOS SGI UV 2000/3000 series BIOS 01/15/2013 + task: ffff88081f034580 ti: ffff880820022000 task.ti: ffff880820022000 + RIP: 0010:[] [] is_pageblock_removable_nolock+0x1/0x90 + RSP: 0018:ffff880820023df8 EFLAGS: 00010287 + RAX: 0000000000040000 RBX: ffffea00c3200000 RCX: 0000000000000004 + RDX: ffffea00c30b0000 RSI: 00000000001c0000 RDI: ffffea00c3200000 + RBP: ffff880820023e38 R08: 0000000000000000 R09: 0000000000000001 + R10: 0000000000000000 R11: 0000000000000001 R12: ffffea00c33c0000 + R13: 0000160000000000 R14: 6db6db6db6db6db7 R15: 0000000000000001 + FS: 00007ffff7fb2700(0000) GS:ffff88083fc80000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffea00c3200000 CR3: 000000081b954000 CR4: 00000000000407e0 + Call Trace: + show_mem_removable+0x41/0x70 + dev_attr_show+0x2a/0x60 + sysfs_read_file+0xf7/0x1c0 + vfs_read+0xc8/0x130 + SyS_read+0x5d/0xa0 + system_call_fastpath+0x16/0x1b + +Signed-off-by: Russ Anderson +Cc: "Rafael J. Wysocki" +Cc: Yinghai Lu +Reviewed-by: Yasuaki Ishimatsu +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/memory.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/base/memory.c ++++ b/drivers/base/memory.c +@@ -152,6 +152,8 @@ static ssize_t show_mem_removable(struct + container_of(dev, struct memory_block, dev); + + for (i = 0; i < sections_per_block; i++) { ++ if (!present_section_nr(mem->start_section_nr + i)) ++ continue; + pfn = section_nr_to_pfn(mem->start_section_nr + i); + ret &= is_mem_section_removable(pfn, PAGES_PER_SECTION); + } diff --git a/queue-3.10/ipc-bugfix-for-msgrcv-with-msgtyp-0.patch b/queue-3.10/ipc-bugfix-for-msgrcv-with-msgtyp-0.patch new file mode 100644 index 00000000000..e97b428bffe --- /dev/null +++ b/queue-3.10/ipc-bugfix-for-msgrcv-with-msgtyp-0.patch @@ -0,0 +1,60 @@ +From 368ae537e056acd3f751fa276f48423f06803922 Mon Sep 17 00:00:00 2001 +From: Svenning Soerensen +Date: Wed, 28 Aug 2013 16:35:17 -0700 +Subject: IPC: bugfix for msgrcv with msgtyp < 0 + +From: Svenning Soerensen + +commit 368ae537e056acd3f751fa276f48423f06803922 upstream. + +According to 'man msgrcv': "If msgtyp is less than 0, the first message of +the lowest type that is less than or equal to the absolute value of msgtyp +shall be received." + +Bug: The kernel only returns a message if its type is 1; other messages +with type < abs(msgtype) will never get returned. + +Fix: After having traversed the list to find the first message with the +lowest type, we need to actually return that message. + +This regression was introduced by commit daaf74cf0867 ("ipc: refactor +msg list search into separate function") + +Signed-off-by: Svenning Soerensen +Reviewed-by: Peter Hurley +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + ipc/msg.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/ipc/msg.c ++++ b/ipc/msg.c +@@ -795,7 +795,7 @@ static inline void free_copy(struct msg_ + + static struct msg_msg *find_msg(struct msg_queue *msq, long *msgtyp, int mode) + { +- struct msg_msg *msg; ++ struct msg_msg *msg, *found = NULL; + long count = 0; + + list_for_each_entry(msg, &msq->q_messages, m_list) { +@@ -804,6 +804,7 @@ static struct msg_msg *find_msg(struct m + *msgtyp, mode)) { + if (mode == SEARCH_LESSEQUAL && msg->m_type != 1) { + *msgtyp = msg->m_type - 1; ++ found = msg; + } else if (mode == SEARCH_NUMBER) { + if (*msgtyp == count) + return msg; +@@ -813,7 +814,7 @@ static struct msg_msg *find_msg(struct m + } + } + +- return ERR_PTR(-EAGAIN); ++ return found ?: ERR_PTR(-EAGAIN); + } + + diff --git a/queue-3.10/series b/queue-3.10/series index f1013938083..e8841c860f7 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -8,3 +8,6 @@ powerpc-don-t-oops-when-accessing-proc-powerpc-lparcfg-without-hypervisor.patch powerpc-hvsi-increase-handshake-timeout-from-200ms-to-400ms.patch scsi-pm80xx-fix-adaptec-71605h-hang.patch regmap-add-another-missing-header-for-config_regmap-stubs.patch +timer_list-correct-the-iterator-for-timer_list.patch +ipc-bugfix-for-msgrcv-with-msgtyp-0.patch +drivers-base-memory.c-fix-show_mem_removable-to-handle-missing-sections.patch diff --git a/queue-3.10/timer_list-correct-the-iterator-for-timer_list.patch b/queue-3.10/timer_list-correct-the-iterator-for-timer_list.patch new file mode 100644 index 00000000000..2c5abf1d8f0 --- /dev/null +++ b/queue-3.10/timer_list-correct-the-iterator-for-timer_list.patch @@ -0,0 +1,104 @@ +From 84a78a6504f5c5394a8e558702e5b54131f01d14 Mon Sep 17 00:00:00 2001 +From: Nathan Zimmer +Date: Wed, 28 Aug 2013 16:35:14 -0700 +Subject: timer_list: correct the iterator for timer_list + +From: Nathan Zimmer + +commit 84a78a6504f5c5394a8e558702e5b54131f01d14 upstream. + +Correct an issue with /proc/timer_list reported by Holger. + +When reading from the proc file with a sufficiently small buffer, 2k so +not really that small, there was one could get hung trying to read the +file a chunk at a time. + +The timer_list_start function failed to account for the possibility that +the offset was adjusted outside the timer_list_next. + +Signed-off-by: Nathan Zimmer +Reported-by: Holger Hans Peter Freyther +Cc: John Stultz +Cc: Thomas Gleixner +Cc: Berke Durak +Cc: Jeff Layton +Tested-by: Al Viro +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/timer_list.c | 41 ++++++++++++++++++++++++----------------- + 1 file changed, 24 insertions(+), 17 deletions(-) + +--- a/kernel/time/timer_list.c ++++ b/kernel/time/timer_list.c +@@ -265,10 +265,9 @@ static inline void timer_list_header(str + static int timer_list_show(struct seq_file *m, void *v) + { + struct timer_list_iter *iter = v; +- u64 now = ktime_to_ns(ktime_get()); + + if (iter->cpu == -1 && !iter->second_pass) +- timer_list_header(m, now); ++ timer_list_header(m, iter->now); + else if (!iter->second_pass) + print_cpu(m, iter->cpu, iter->now); + #ifdef CONFIG_GENERIC_CLOCKEVENTS +@@ -298,33 +297,41 @@ void sysrq_timer_list_show(void) + return; + } + +-static void *timer_list_start(struct seq_file *file, loff_t *offset) ++static void *move_iter(struct timer_list_iter *iter, loff_t offset) + { +- struct timer_list_iter *iter = file->private; +- +- if (!*offset) { +- iter->cpu = -1; +- iter->now = ktime_to_ns(ktime_get()); +- } else if (iter->cpu >= nr_cpu_ids) { ++ for (; offset; offset--) { ++ iter->cpu = cpumask_next(iter->cpu, cpu_online_mask); ++ if (iter->cpu >= nr_cpu_ids) { + #ifdef CONFIG_GENERIC_CLOCKEVENTS +- if (!iter->second_pass) { +- iter->cpu = -1; +- iter->second_pass = true; +- } else +- return NULL; ++ if (!iter->second_pass) { ++ iter->cpu = -1; ++ iter->second_pass = true; ++ } else ++ return NULL; + #else +- return NULL; ++ return NULL; + #endif ++ } + } + return iter; + } + ++static void *timer_list_start(struct seq_file *file, loff_t *offset) ++{ ++ struct timer_list_iter *iter = file->private; ++ ++ if (!*offset) ++ iter->now = ktime_to_ns(ktime_get()); ++ iter->cpu = -1; ++ iter->second_pass = false; ++ return move_iter(iter, *offset); ++} ++ + static void *timer_list_next(struct seq_file *file, void *v, loff_t *offset) + { + struct timer_list_iter *iter = file->private; +- iter->cpu = cpumask_next(iter->cpu, cpu_online_mask); + ++*offset; +- return timer_list_start(file, offset); ++ return move_iter(iter, 1); + } + + static void timer_list_stop(struct seq_file *seq, void *v)