From: Greg Kroah-Hartman Date: Mon, 8 Oct 2012 17:38:03 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.0.46~51 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e6cf7d4735969395cb9891f4849606b40aa6892b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: jbd2-don-t-write-superblock-when-if-its-empty.patch lguest-fix-occasional-crash-in-example-launcher.patch localmodconfig-fix-localyesconfig-to-set-to-y-not-m.patch pm-sleep-use-resume-event-when-call-dpm_resume_early.patch powerpc-eeh-fix-crash-on-converting-of-node-to-edev.patch rapidio-rionet-fix-multicast-packet-transmit-logic.patch workqueue-add-missing-smp_wmb-in-process_one_work.patch --- diff --git a/queue-3.4/jbd2-don-t-write-superblock-when-if-its-empty.patch b/queue-3.4/jbd2-don-t-write-superblock-when-if-its-empty.patch new file mode 100644 index 00000000000..c33c62dc335 --- /dev/null +++ b/queue-3.4/jbd2-don-t-write-superblock-when-if-its-empty.patch @@ -0,0 +1,48 @@ +From eeecef0af5ea4efd763c9554cf2bd80fc4a0efd3 Mon Sep 17 00:00:00 2001 +From: Eric Sandeen +Date: Sat, 18 Aug 2012 22:29:40 -0400 +Subject: jbd2: don't write superblock when if its empty + +From: Eric Sandeen + +commit eeecef0af5ea4efd763c9554cf2bd80fc4a0efd3 upstream. + +This sequence: + +# truncate --size=1g fsfile +# mkfs.ext4 -F fsfile +# mount -o loop,ro fsfile /mnt +# umount /mnt +# dmesg | tail + +results in an IO error when unmounting the RO filesystem: + +[ 318.020828] Buffer I/O error on device loop1, logical block 196608 +[ 318.027024] lost page write due to I/O error on loop1 +[ 318.032088] JBD2: Error -5 detected when updating journal superblock for loop1-8. + +This was a regression introduced by commit 24bcc89c7e7c: "jbd2: split +updating of journal superblock and marking journal empty". + +Signed-off-by: Eric Sandeen +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/journal.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1317,6 +1317,11 @@ static void jbd2_mark_journal_empty(jour + + BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); + read_lock(&journal->j_state_lock); ++ /* Is it already empty? */ ++ if (sb->s_start == 0) { ++ read_unlock(&journal->j_state_lock); ++ return; ++ } + jbd_debug(1, "JBD2: Marking journal as empty (seq %d)\n", + journal->j_tail_sequence); + diff --git a/queue-3.4/lguest-fix-occasional-crash-in-example-launcher.patch b/queue-3.4/lguest-fix-occasional-crash-in-example-launcher.patch new file mode 100644 index 00000000000..8c6e01d6cfe --- /dev/null +++ b/queue-3.4/lguest-fix-occasional-crash-in-example-launcher.patch @@ -0,0 +1,29 @@ +From ca16f580a5db7e60bfafe59a50bb133bd3347491 Mon Sep 17 00:00:00 2001 +From: Rusty Russell +Date: Thu, 4 Oct 2012 12:03:25 +0930 +Subject: lguest: fix occasional crash in example launcher. + +From: Rusty Russell + +commit ca16f580a5db7e60bfafe59a50bb133bd3347491 upstream. + +We usually got away with ->next on the final entry being NULL, but it +finally bit me. + +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + tools/lguest/lguest.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/tools/lguest/lguest.c ++++ b/tools/lguest/lguest.c +@@ -1299,6 +1299,7 @@ static struct device *new_device(const c + dev->feature_len = 0; + dev->num_vq = 0; + dev->running = false; ++ dev->next = NULL; + + /* + * Append to device list. Prepending to a single-linked list is diff --git a/queue-3.4/localmodconfig-fix-localyesconfig-to-set-to-y-not-m.patch b/queue-3.4/localmodconfig-fix-localyesconfig-to-set-to-y-not-m.patch new file mode 100644 index 00000000000..ddee9b9f62a --- /dev/null +++ b/queue-3.4/localmodconfig-fix-localyesconfig-to-set-to-y-not-m.patch @@ -0,0 +1,38 @@ +From 4eae518d4b01b0cbf2f0d8edb5a6f3d6245ee8fb Mon Sep 17 00:00:00 2001 +From: Yuta Ando +Date: Mon, 1 Oct 2012 23:24:30 +0900 +Subject: localmodconfig: Fix localyesconfig to set to 'y' not 'm' + +From: Yuta Ando + +commit 4eae518d4b01b0cbf2f0d8edb5a6f3d6245ee8fb upstream. + +The kbuild target 'localyesconfig' has been same as 'localmodconfig' +since the commit 50bce3e "kconfig/streamline_config.pl: merge +local{mod,yes}config". The commit expects this script generates +different configure depending on target, but it was not yet implemented. + +So I added code that sets to 'yes' when target is 'localyesconfig'. + +Link: http://lkml.kernel.org/r/1349101470-12243-1-git-send-email-yuta.and@gmail.com + +Signed-off-by: Yuta Ando +Cc: linux-kbuild@vger.kernel.org +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/kconfig/streamline_config.pl | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/scripts/kconfig/streamline_config.pl ++++ b/scripts/kconfig/streamline_config.pl +@@ -463,6 +463,8 @@ while() { + if (defined($configs{$1})) { + if ($localyesconfig) { + $setconfigs{$1} = 'y'; ++ print "$1=y\n"; ++ next; + } else { + $setconfigs{$1} = $2; + } diff --git a/queue-3.4/pm-sleep-use-resume-event-when-call-dpm_resume_early.patch b/queue-3.4/pm-sleep-use-resume-event-when-call-dpm_resume_early.patch new file mode 100644 index 00000000000..c6fa2a13a77 --- /dev/null +++ b/queue-3.4/pm-sleep-use-resume-event-when-call-dpm_resume_early.patch @@ -0,0 +1,33 @@ +From 997a031107ec962967ce36db9bc500f1fad491c1 Mon Sep 17 00:00:00 2001 +From: Feng Hong +Date: Wed, 19 Sep 2012 14:16:00 +0200 +Subject: PM / Sleep: use resume event when call dpm_resume_early + +From: Feng Hong + +commit 997a031107ec962967ce36db9bc500f1fad491c1 upstream. + +When dpm_suspend_noirq fail, state is PMSG_SUSPEND, +should change to PMSG_RESUME when dpm_resume_early is called + +Signed-off-by: Feng Hong +Signed-off-by: Raul Xiong +Signed-off-by: Neil Zhang +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/power/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -984,7 +984,7 @@ int dpm_suspend_end(pm_message_t state) + + error = dpm_suspend_noirq(state); + if (error) { +- dpm_resume_early(state); ++ dpm_resume_early(resume_event(state)); + return error; + } + diff --git a/queue-3.4/powerpc-eeh-fix-crash-on-converting-of-node-to-edev.patch b/queue-3.4/powerpc-eeh-fix-crash-on-converting-of-node-to-edev.patch new file mode 100644 index 00000000000..f3766d066e6 --- /dev/null +++ b/queue-3.4/powerpc-eeh-fix-crash-on-converting-of-node-to-edev.patch @@ -0,0 +1,93 @@ +From 1e38b7140185e384da216aff66a711df09b5afc9 Mon Sep 17 00:00:00 2001 +From: Gavin Shan +Date: Mon, 17 Sep 2012 04:34:28 +0000 +Subject: powerpc/eeh: Fix crash on converting OF node to edev + +From: Gavin Shan + +commit 1e38b7140185e384da216aff66a711df09b5afc9 upstream. + +The kernel crash was reported by Alexy. He was testing some feature +with private kernel, in which Alexy added some code in pci_pm_reset() +to read the CSR after writting it. The bug could be reproduced on +Fiber Channel card (Fibre Channel: Emulex Corporation Saturn-X: +LightPulse Fibre Channel Host Adapter (rev 03)) by the following +commands. + + # echo 1 > /sys/devices/pci0004:01/0004:01:00.0/reset + # rmmod lpfc + # modprobe lpfc + +The history behind the test case is that those additional config +space reading operations in pci_pm_reset() would cause EEH error, +but we didn't detect EEH error until "modprobe lpfc". For the case, +all the PCI devices on PCI bus (0004:01) were removed and added after +PE reset. Then the EEH devices would be figured out again based on +the OF nodes. Unfortunately, there were some child OF nodes under +PCI device (0004:01:00.0), but they didn't have attached PCI_DN since +they're invisible from PCI domain. However, we were still trying to +convert OF node to EEH device without checking on the attached PCI_DN. +Eventually, it caused the kernel crash as follows: + +Unable to handle kernel paging request for data at address 0x00000030 +Faulting instruction address: 0xc00000000004d888 +cpu 0x0: Vector: 300 (Data Access) at [c000000fc797b950] + pc: c00000000004d888: .eeh_add_device_tree_early+0x78/0x140 + lr: c00000000004d880: .eeh_add_device_tree_early+0x70/0x140 + sp: c000000fc797bbd0 + msr: 8000000000009032 + dar: 30 + dsisr: 40000000 + current = 0xc000000fc78d9f70 + paca = 0xc00000000edb0000 softe: 0 irq_happened: 0x00 + pid = 2951, comm = eehd +enter ? for help +[c000000fc797bc50] c00000000004d848 .eeh_add_device_tree_early+0x38/0x140 +[c000000fc797bcd0] c00000000004d848 .eeh_add_device_tree_early+0x38/0x140 +[c000000fc797bd50] c000000000051b54 .pcibios_add_pci_devices+0x34/0x190 +[c000000fc797bde0] c00000000004fb10 .eeh_reset_device+0x100/0x160 +[c000000fc797be70] c0000000000502dc .eeh_handle_event+0x19c/0x300 +[c000000fc797bf00] c000000000050570 .eeh_event_handler+0x130/0x1a0 +[c000000fc797bf90] c000000000020138 .kernel_thread+0x54/0x70 + +The patch changes of_node_to_eeh_dev() and just returns NULL if the +passed OF node doesn't have attached PCI_DN. + +Reported-by: Alexey Kardashevskiy +Signed-off-by: Gavin Shan +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/pci-bridge.h | 8 ++++++++ + arch/powerpc/platforms/pseries/eeh.c | 2 +- + 2 files changed, 9 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/include/asm/pci-bridge.h ++++ b/arch/powerpc/include/asm/pci-bridge.h +@@ -181,6 +181,14 @@ static inline int pci_device_from_OF_nod + #if defined(CONFIG_EEH) + static inline struct eeh_dev *of_node_to_eeh_dev(struct device_node *dn) + { ++ /* ++ * For those OF nodes whose parent isn't PCI bridge, they ++ * don't have PCI_DN actually. So we have to skip them for ++ * any EEH operations. ++ */ ++ if (!dn || !PCI_DN(dn)) ++ return NULL; ++ + return PCI_DN(dn)->edev; + } + #endif +--- a/arch/powerpc/platforms/pseries/eeh.c ++++ b/arch/powerpc/platforms/pseries/eeh.c +@@ -1029,7 +1029,7 @@ static void eeh_add_device_early(struct + { + struct pci_controller *phb; + +- if (!dn || !of_node_to_eeh_dev(dn)) ++ if (!of_node_to_eeh_dev(dn)) + return; + phb = of_node_to_eeh_dev(dn)->phb; + diff --git a/queue-3.4/rapidio-rionet-fix-multicast-packet-transmit-logic.patch b/queue-3.4/rapidio-rionet-fix-multicast-packet-transmit-logic.patch new file mode 100644 index 00000000000..51b11222421 --- /dev/null +++ b/queue-3.4/rapidio-rionet-fix-multicast-packet-transmit-logic.patch @@ -0,0 +1,103 @@ +From 7c4a6106d6451fc03c491e61df37c044505d843a Mon Sep 17 00:00:00 2001 +From: Alexandre Bounine +Date: Thu, 4 Oct 2012 17:15:48 -0700 +Subject: rapidio/rionet: fix multicast packet transmit logic + +From: Alexandre Bounine + +commit 7c4a6106d6451fc03c491e61df37c044505d843a upstream. + +Fix multicast packet transmit logic to account for repetitive transmission +of single skb: +- correct check for available buffers (this bug may produce NULL pointer + crash dump in case of heavy traffic); +- update skb user count (incorrect user counter causes a warning dump from + net_tx_action routine during multicast transfers in systems with three or + more rionet participants). + +Signed-off-by: Alexandre Bounine +Cc: Matt Porter +Cc: David S. Miller +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/rionet.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +--- a/drivers/net/rionet.c ++++ b/drivers/net/rionet.c +@@ -79,6 +79,7 @@ static int rionet_capable = 1; + * on system trade-offs. + */ + static struct rio_dev **rionet_active; ++static int nact; /* total number of active rionet peers */ + + #define is_rionet_capable(src_ops, dst_ops) \ + ((src_ops & RIO_SRC_OPS_DATA_MSG) && \ +@@ -175,6 +176,7 @@ static int rionet_start_xmit(struct sk_b + struct ethhdr *eth = (struct ethhdr *)skb->data; + u16 destid; + unsigned long flags; ++ int add_num = 1; + + local_irq_save(flags); + if (!spin_trylock(&rnet->tx_lock)) { +@@ -182,7 +184,10 @@ static int rionet_start_xmit(struct sk_b + return NETDEV_TX_LOCKED; + } + +- if ((rnet->tx_cnt + 1) > RIONET_TX_RING_SIZE) { ++ if (is_multicast_ether_addr(eth->h_dest)) ++ add_num = nact; ++ ++ if ((rnet->tx_cnt + add_num) > RIONET_TX_RING_SIZE) { + netif_stop_queue(ndev); + spin_unlock_irqrestore(&rnet->tx_lock, flags); + printk(KERN_ERR "%s: BUG! Tx Ring full when queue awake!\n", +@@ -191,11 +196,16 @@ static int rionet_start_xmit(struct sk_b + } + + if (is_multicast_ether_addr(eth->h_dest)) { ++ int count = 0; + for (i = 0; i < RIO_MAX_ROUTE_ENTRIES(rnet->mport->sys_size); + i++) +- if (rionet_active[i]) ++ if (rionet_active[i]) { + rionet_queue_tx_msg(skb, ndev, + rionet_active[i]); ++ if (count) ++ atomic_inc(&skb->users); ++ count++; ++ } + } else if (RIONET_MAC_MATCH(eth->h_dest)) { + destid = RIONET_GET_DESTID(eth->h_dest); + if (rionet_active[destid]) +@@ -220,14 +230,17 @@ static void rionet_dbell_event(struct ri + if (info == RIONET_DOORBELL_JOIN) { + if (!rionet_active[sid]) { + list_for_each_entry(peer, &rionet_peers, node) { +- if (peer->rdev->destid == sid) ++ if (peer->rdev->destid == sid) { + rionet_active[sid] = peer->rdev; ++ nact++; ++ } + } + rio_mport_send_doorbell(mport, sid, + RIONET_DOORBELL_JOIN); + } + } else if (info == RIONET_DOORBELL_LEAVE) { + rionet_active[sid] = NULL; ++ nact--; + } else { + if (netif_msg_intr(rnet)) + printk(KERN_WARNING "%s: unhandled doorbell\n", +@@ -523,6 +536,7 @@ static int rionet_probe(struct rio_dev * + + rc = rionet_setup_netdev(rdev->net->hport, ndev); + rionet_check = 1; ++ nact = 0; + } + + /* diff --git a/queue-3.4/series b/queue-3.4/series index c72d0a3e7a0..99aabe5fa76 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -12,3 +12,10 @@ lib-gcd.c-prevent-possible-div-by-0.patch kernel-sys.c-call-disable_nonboot_cpus-in-kernel_restart.patch drivers-scsi-atp870u.c-fix-bad-use-of-udelay.patch drivers-dma-dmaengine.c-lower-the-priority-of-failed-to-get-dma-channel-message.patch +lguest-fix-occasional-crash-in-example-launcher.patch +powerpc-eeh-fix-crash-on-converting-of-node-to-edev.patch +rapidio-rionet-fix-multicast-packet-transmit-logic.patch +pm-sleep-use-resume-event-when-call-dpm_resume_early.patch +workqueue-add-missing-smp_wmb-in-process_one_work.patch +jbd2-don-t-write-superblock-when-if-its-empty.patch +localmodconfig-fix-localyesconfig-to-set-to-y-not-m.patch diff --git a/queue-3.4/workqueue-add-missing-smp_wmb-in-process_one_work.patch b/queue-3.4/workqueue-add-missing-smp_wmb-in-process_one_work.patch new file mode 100644 index 00000000000..c55cb7da406 --- /dev/null +++ b/queue-3.4/workqueue-add-missing-smp_wmb-in-process_one_work.patch @@ -0,0 +1,44 @@ +From 959d1af8cffc8fd38ed53e8be1cf4ab8782f9c00 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Fri, 3 Aug 2012 10:30:45 -0700 +Subject: workqueue: add missing smp_wmb() in process_one_work() + +From: Tejun Heo + +commit 959d1af8cffc8fd38ed53e8be1cf4ab8782f9c00 upstream. + +WORK_STRUCT_PENDING is used to claim ownership of a work item and +process_one_work() releases it before starting execution. When +someone else grabs PENDING, all pre-release updates to the work item +should be visible and all updates made by the new owner should happen +afterwards. + +Grabbing PENDING uses test_and_set_bit() and thus has a full barrier; +however, clearing doesn't have a matching wmb. Given the preceding +spin_unlock and use of clear_bit, I don't believe this can be a +problem on an actual machine and there hasn't been any related report +but it still is theretically possible for clear_pending to permeate +upwards and happen before work->entry update. + +Add an explicit smp_wmb() before work_clear_pending(). + +Signed-off-by: Tejun Heo +Cc: Oleg Nesterov +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/workqueue.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1864,7 +1864,9 @@ __acquires(&gcwq->lock) + + spin_unlock_irq(&gcwq->lock); + ++ smp_wmb(); /* paired with test_and_set_bit(PENDING) */ + work_clear_pending(work); ++ + lock_map_acquire_read(&cwq->wq->lockdep_map); + lock_map_acquire(&lockdep_map); + trace_workqueue_execute_start(work);