From: Greg Kroah-Hartman Date: Fri, 28 Sep 2012 00:13:41 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.0.44~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bfbc4be6635238efb63de88710b61cb5fb0a9c77;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: irq_remap-disable-irq-remapping-if-any-ioapic-lacks-an-iommu.patch mm-avoid-swapping-out-with-swappiness-0.patch nfsd-introduce-nfsd_destroy-helper.patch nfsd-set-nfsd_serv-to-null-after-service-destruction.patch ubi-fix-a-horrible-memory-deallocation-bug.patch --- diff --git a/queue-3.4/irq_remap-disable-irq-remapping-if-any-ioapic-lacks-an-iommu.patch b/queue-3.4/irq_remap-disable-irq-remapping-if-any-ioapic-lacks-an-iommu.patch new file mode 100644 index 00000000000..5ada025f0a6 --- /dev/null +++ b/queue-3.4/irq_remap-disable-irq-remapping-if-any-ioapic-lacks-an-iommu.patch @@ -0,0 +1,69 @@ +From 32ab31e01e2def6f48294d872d9bb42573aae00f Mon Sep 17 00:00:00 2001 +From: Seth Forshee +Date: Wed, 8 Aug 2012 08:27:03 -0500 +Subject: irq_remap: disable IRQ remapping if any IOAPIC lacks an IOMMU + +From: Seth Forshee + +commit 32ab31e01e2def6f48294d872d9bb42573aae00f upstream. + +The ACPI tables in the Macbook Air 5,1 define a single IOAPIC with id 2, +but the only remapping unit described in the DMAR table matches id 0. +Interrupt remapping fails as a result, and the kernel panics with the +message "timer doesn't work through Interrupt-remapped IO-APIC." + +To fix this, check each IOAPIC for a corresponding IOMMU. If an IOMMU is +not found, do not allow IRQ remapping to be enabled. + +v2: Move check to parse_ioapics_under_ir(), raise log level to KERN_ERR, + and add FW_BUG to the log message +v3: Skip check if IOMMU doesn't support interrupt remapping and remove + existing check that the IOMMU count equals the IOAPIC count + +Acked-by: Suresh Siddha +Signed-off-by: Seth Forshee +Acked-by: Yinghai Lu +Signed-off-by: Joerg Roedel +Acked-by: Cho, Yu-Chen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/intr_remapping.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +--- a/drivers/iommu/intr_remapping.c ++++ b/drivers/iommu/intr_remapping.c +@@ -752,6 +752,7 @@ int __init parse_ioapics_under_ir(void) + { + struct dmar_drhd_unit *drhd; + int ir_supported = 0; ++ int ioapic_idx; + + for_each_drhd_unit(drhd) { + struct intel_iommu *iommu = drhd->iommu; +@@ -764,13 +765,20 @@ int __init parse_ioapics_under_ir(void) + } + } + +- if (ir_supported && ir_ioapic_num != nr_ioapics) { +- printk(KERN_WARNING +- "Not all IO-APIC's listed under remapping hardware\n"); +- return -1; ++ if (!ir_supported) ++ return 0; ++ ++ for (ioapic_idx = 0; ioapic_idx < nr_ioapics; ioapic_idx++) { ++ int ioapic_id = mpc_ioapic_id(ioapic_idx); ++ if (!map_ioapic_to_ir(ioapic_id)) { ++ pr_err(FW_BUG "ioapic %d has no mapping iommu, " ++ "interrupt remapping will be disabled\n", ++ ioapic_id); ++ return -1; ++ } + } + +- return ir_supported; ++ return 1; + } + + int __init ir_dev_scope_init(void) diff --git a/queue-3.4/mm-avoid-swapping-out-with-swappiness-0.patch b/queue-3.4/mm-avoid-swapping-out-with-swappiness-0.patch new file mode 100644 index 00000000000..1aaa58963e4 --- /dev/null +++ b/queue-3.4/mm-avoid-swapping-out-with-swappiness-0.patch @@ -0,0 +1,63 @@ +From fe35004fbf9eaf67482b074a2e032abb9c89b1dd Mon Sep 17 00:00:00 2001 +From: Satoru Moriya +Date: Tue, 29 May 2012 15:06:47 -0700 +Subject: mm: avoid swapping out with swappiness==0 + +From: Satoru Moriya + +commit fe35004fbf9eaf67482b074a2e032abb9c89b1dd upstream. + +Sometimes we'd like to avoid swapping out anonymous memory. In +particular, avoid swapping out pages of important process or process +groups while there is a reasonable amount of pagecache on RAM so that we +can satisfy our customers' requirements. + +OTOH, we can control how aggressive the kernel will swap memory pages with +/proc/sys/vm/swappiness for global and +/sys/fs/cgroup/memory/memory.swappiness for each memcg. + +But with current reclaim implementation, the kernel may swap out even if +we set swappiness=0 and there is pagecache in RAM. + +This patch changes the behavior with swappiness==0. If we set +swappiness==0, the kernel does not swap out completely (for global reclaim +until the amount of free pages and filebacked pages in a zone has been +reduced to something very very small (nr_free + nr_filebacked < high +watermark)). + +Signed-off-by: Satoru Moriya +Acked-by: Minchan Kim +Reviewed-by: Rik van Riel +Acked-by: Jerome Marchand +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/vmscan.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -1983,10 +1983,10 @@ static void get_scan_count(struct mem_cg + * proportional to the fraction of recently scanned pages on + * each list that were recently referenced and in active use. + */ +- ap = (anon_prio + 1) * (reclaim_stat->recent_scanned[0] + 1); ++ ap = anon_prio * (reclaim_stat->recent_scanned[0] + 1); + ap /= reclaim_stat->recent_rotated[0] + 1; + +- fp = (file_prio + 1) * (reclaim_stat->recent_scanned[1] + 1); ++ fp = file_prio * (reclaim_stat->recent_scanned[1] + 1); + fp /= reclaim_stat->recent_rotated[1] + 1; + spin_unlock_irq(&mz->zone->lru_lock); + +@@ -1999,7 +1999,7 @@ out: + unsigned long scan; + + scan = zone_nr_lru_pages(mz, lru); +- if (priority || noswap) { ++ if (priority || noswap || !vmscan_swappiness(mz, sc)) { + scan >>= priority; + if (!scan && force_scan) + scan = SWAP_CLUSTER_MAX; diff --git a/queue-3.4/nfsd-introduce-nfsd_destroy-helper.patch b/queue-3.4/nfsd-introduce-nfsd_destroy-helper.patch new file mode 100644 index 00000000000..1c9964bc72c --- /dev/null +++ b/queue-3.4/nfsd-introduce-nfsd_destroy-helper.patch @@ -0,0 +1,98 @@ +From 19f7e2ca44dfc3c1b3f499fc46801f98d403500f Mon Sep 17 00:00:00 2001 +From: Stanislav Kinsbursky +Date: Tue, 3 Jul 2012 16:46:41 +0400 +Subject: NFSd: introduce nfsd_destroy() helper + +From: Stanislav Kinsbursky + +commit 19f7e2ca44dfc3c1b3f499fc46801f98d403500f upstream. + +Signed-off-by: Stanislav Kinsbursky +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfsctl.c | 8 ++------ + fs/nfsd/nfsd.h | 9 +++++++++ + fs/nfsd/nfssvc.c | 14 +++----------- + 3 files changed, 14 insertions(+), 17 deletions(-) + +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -663,9 +663,7 @@ static ssize_t __write_ports_addfd(char + + err = svc_addsock(nfsd_serv, fd, buf, SIMPLE_TRANSACTION_LIMIT); + if (err < 0) { +- if (nfsd_serv->sv_nrthreads == 1) +- svc_shutdown_net(nfsd_serv, net); +- svc_destroy(nfsd_serv); ++ nfsd_destroy(net); + return err; + } + +@@ -734,9 +732,7 @@ out_close: + svc_xprt_put(xprt); + } + out_err: +- if (nfsd_serv->sv_nrthreads == 1) +- svc_shutdown_net(nfsd_serv, net); +- svc_destroy(nfsd_serv); ++ nfsd_destroy(net); + return err; + } + +--- a/fs/nfsd/nfsd.h ++++ b/fs/nfsd/nfsd.h +@@ -73,6 +73,15 @@ int nfsd_nrpools(void); + int nfsd_get_nrthreads(int n, int *); + int nfsd_set_nrthreads(int n, int *); + ++static inline void nfsd_destroy(struct net *net) ++{ ++ int destroy = (nfsd_serv->sv_nrthreads == 1); ++ ++ if (destroy) ++ svc_shutdown_net(nfsd_serv, net); ++ svc_destroy(nfsd_serv); ++} ++ + #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) + #ifdef CONFIG_NFSD_V2_ACL + extern struct svc_version nfsd_acl_version2; +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -427,11 +427,7 @@ int nfsd_set_nrthreads(int n, int *nthre + if (err) + break; + } +- +- if (nfsd_serv->sv_nrthreads == 1) +- svc_shutdown_net(nfsd_serv, net); +- svc_destroy(nfsd_serv); +- ++ nfsd_destroy(net); + return err; + } + +@@ -478,9 +474,7 @@ out_shutdown: + if (error < 0 && !nfsd_up_before) + nfsd_shutdown(); + out_destroy: +- if (nfsd_serv->sv_nrthreads == 1) +- svc_shutdown_net(nfsd_serv, net); +- svc_destroy(nfsd_serv); /* Release server */ ++ nfsd_destroy(net); /* Release server */ + out: + mutex_unlock(&nfsd_mutex); + return error; +@@ -682,9 +676,7 @@ int nfsd_pool_stats_release(struct inode + + mutex_lock(&nfsd_mutex); + /* this function really, really should have been called svc_put() */ +- if (nfsd_serv->sv_nrthreads == 1) +- svc_shutdown_net(nfsd_serv, net); +- svc_destroy(nfsd_serv); ++ nfsd_destroy(net); + mutex_unlock(&nfsd_mutex); + return ret; + } diff --git a/queue-3.4/nfsd-set-nfsd_serv-to-null-after-service-destruction.patch b/queue-3.4/nfsd-set-nfsd_serv-to-null-after-service-destruction.patch new file mode 100644 index 00000000000..e16ce37338b --- /dev/null +++ b/queue-3.4/nfsd-set-nfsd_serv-to-null-after-service-destruction.patch @@ -0,0 +1,82 @@ +From 57c8b13e3cd0f94944c9691ce7f58e5fcef8a12d Mon Sep 17 00:00:00 2001 +From: Stanislav Kinsbursky +Date: Tue, 3 Jul 2012 16:46:41 +0400 +Subject: NFSd: set nfsd_serv to NULL after service destruction + +From: Stanislav Kinsbursky + +commit 57c8b13e3cd0f94944c9691ce7f58e5fcef8a12d upstream. + +In nfsd_destroy(): + + if (destroy) + svc_shutdown_net(nfsd_serv, net); + svc_destroy(nfsd_server); + +svc_shutdown_net(nfsd_serv, net) calls nfsd_last_thread(), which sets +nfsd_serv to NULL, causing a NULL dereference on the following line. + +Signed-off-by: Stanislav Kinsbursky +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfsd.h | 2 ++ + fs/nfsd/nfssvc.c | 10 +++++----- + 2 files changed, 7 insertions(+), 5 deletions(-) + +--- a/fs/nfsd/nfsd.h ++++ b/fs/nfsd/nfsd.h +@@ -80,6 +80,8 @@ static inline void nfsd_destroy(struct n + if (destroy) + svc_shutdown_net(nfsd_serv, net); + svc_destroy(nfsd_serv); ++ if (destroy) ++ nfsd_serv = NULL; + } + + #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -254,8 +254,6 @@ static void nfsd_shutdown(void) + + static void nfsd_last_thread(struct svc_serv *serv, struct net *net) + { +- /* When last nfsd thread exits we need to do some clean-up */ +- nfsd_serv = NULL; + nfsd_shutdown(); + + svc_rpcb_cleanup(serv, net); +@@ -332,6 +330,7 @@ static int nfsd_get_default_max_blksize( + int nfsd_create_serv(void) + { + int error; ++ struct net *net = current->nsproxy->net_ns; + + WARN_ON(!mutex_is_locked(&nfsd_mutex)); + if (nfsd_serv) { +@@ -346,7 +345,7 @@ int nfsd_create_serv(void) + if (nfsd_serv == NULL) + return -ENOMEM; + +- error = svc_bind(nfsd_serv, current->nsproxy->net_ns); ++ error = svc_bind(nfsd_serv, net); + if (error < 0) { + svc_destroy(nfsd_serv); + return error; +@@ -557,12 +556,13 @@ nfsd(void *vrqstp) + nfsdstats.th_cnt --; + + out: +- if (rqstp->rq_server->sv_nrthreads == 1) +- svc_shutdown_net(rqstp->rq_server, &init_net); ++ rqstp->rq_server = NULL; + + /* Release the thread */ + svc_exit_thread(rqstp); + ++ nfsd_destroy(&init_net); ++ + /* Release module */ + mutex_unlock(&nfsd_mutex); + module_put_and_exit(0); diff --git a/queue-3.4/series b/queue-3.4/series index 3a3a70dbf2c..b40ec0f02e8 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -200,3 +200,8 @@ net-qmi_wwan-add-zte-mf60.patch net-qmi_wwan-add-zte-mf821d.patch net-qmi_wwan-add-sierra-wireless-devices.patch net-qmi_wwan-new-devices-uml290-and-k5006-z.patch +mm-avoid-swapping-out-with-swappiness-0.patch +irq_remap-disable-irq-remapping-if-any-ioapic-lacks-an-iommu.patch +ubi-fix-a-horrible-memory-deallocation-bug.patch +nfsd-introduce-nfsd_destroy-helper.patch +nfsd-set-nfsd_serv-to-null-after-service-destruction.patch diff --git a/queue-3.4/ubi-fix-a-horrible-memory-deallocation-bug.patch b/queue-3.4/ubi-fix-a-horrible-memory-deallocation-bug.patch new file mode 100644 index 00000000000..4dabdd45e04 --- /dev/null +++ b/queue-3.4/ubi-fix-a-horrible-memory-deallocation-bug.patch @@ -0,0 +1,53 @@ +From richard.genoud@gmail.com Thu Sep 27 17:05:58 2012 +From: Artem Bityutskiy +Date: Wed, 12 Sep 2012 09:05:22 +0200 +Subject: UBI: fix a horrible memory deallocation bug +To: stable@vger.kernel.org +Cc: Artem Bityutskiy , Richard Genoud +Message-ID: <1347433522-1243-1-git-send-email-richard.genoud@gmail.com> + +From: Artem Bityutskiy + +commit 78b495c39add820ab66ab897af9bd77a5f2e91f6 upstream + +UBI was mistakingly using 'kfree()' instead of 'kmem_cache_free()' when +freeing "attach eraseblock" structures in vtbl.c. Thankfully, this happened +only when we were doing auto-format, so many systems were unaffected. However, +there are still many users affected. + +It is strange, but the system did not crash and nothing bad happened when +the SLUB memory allocator was used. However, in case of SLOB we observed an +crash right away. + +This problem was introduced in 2.6.39 by commit +"6c1e875 UBI: add slab cache for ubi_scan_leb objects" + +Reported-by: Richard Genoud +Signed-off-by: Artem Bityutskiy +Signed-off-by: Richard Genoud +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/ubi/vtbl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/ubi/vtbl.c ++++ b/drivers/mtd/ubi/vtbl.c +@@ -346,7 +346,7 @@ retry: + */ + err = ubi_scan_add_used(ubi, si, new_seb->pnum, new_seb->ec, + vid_hdr, 0); +- kfree(new_seb); ++ kmem_cache_free(si->scan_leb_slab, new_seb); + ubi_free_vid_hdr(ubi, vid_hdr); + return err; + +@@ -359,7 +359,7 @@ write_error: + list_add(&new_seb->u.list, &si->erase); + goto retry; + } +- kfree(new_seb); ++ kmem_cache_free(si->scan_leb_slab, new_seb); + out_free: + ubi_free_vid_hdr(ubi, vid_hdr); + return err;