From: Greg Kroah-Hartman Date: Fri, 31 Jul 2015 00:20:44 +0000 (-0700) Subject: 4.1-stable patches X-Git-Tag: v4.1.4~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f47c618f57ad793bd757eed6ef7a9b25cd96b525;p=thirdparty%2Fkernel%2Fstable-queue.git 4.1-stable patches added patches: arm-dts-mx23-fix-iio-hwmon-support.patch btrfs-don-t-invalidate-root-dentry-when-subvolume-deletion-fails.patch dmaengine-mv_xor-bug-fix-for-racing-condition-in-descriptors-cleanup.patch hwmon-mcp3021-fix-broken-output-scaling.patch hwmon-nct7802-fix-visibility-of-temp3.patch md-clear-mddev-private-when-it-has-been-freed.patch md-fix-a-build-warning.patch md-skip-cluster-setup-for-dm-raid.patch md-unlock-mddev_lock-on-an-error-path.patch tracing-filter-do-not-allow-infix-to-exceed-end-of-string.patch tracing-filter-do-not-warn-on-operand-count-going-below-zero.patch tracing-fix-sample-output-of-dynamic-arrays.patch tracing-fix-typo-from-static-inlin-to-static-inline.patch tracing-have-branch-tracer-use-recursive-field-of-task-struct.patch --- diff --git a/queue-4.1/arm-dts-mx23-fix-iio-hwmon-support.patch b/queue-4.1/arm-dts-mx23-fix-iio-hwmon-support.patch new file mode 100644 index 00000000000..4283ac001b5 --- /dev/null +++ b/queue-4.1/arm-dts-mx23-fix-iio-hwmon-support.patch @@ -0,0 +1,33 @@ +From e8e94ed6285428ab780cd7b0df4622f71eceb39e Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Tue, 2 Jun 2015 22:03:28 +0000 +Subject: ARM: dts: mx23: fix iio-hwmon support + +From: Stefan Wahren + +commit e8e94ed6285428ab780cd7b0df4622f71eceb39e upstream. + +In order to get iio-hwmon support, the lradc must be declared as an +iio provider. So fix this issue by adding the #io-channel-cells property. + +Signed-off-by: Stefan Wahren +Fixes: bd798f9c7b30 ("ARM: dts: mxs: Add iio-hwmon to mx23 soc") +Reviewed-by: Marek Vasut +Reviewed-by: Alexandre Belloni +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx23.dtsi | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/boot/dts/imx23.dtsi ++++ b/arch/arm/boot/dts/imx23.dtsi +@@ -435,6 +435,7 @@ + interrupts = <36 37 38 39 40 41 42 43 44>; + status = "disabled"; + clocks = <&clks 26>; ++ #io-channel-cells = <1>; + }; + + spdif@80054000 { diff --git a/queue-4.1/btrfs-don-t-invalidate-root-dentry-when-subvolume-deletion-fails.patch b/queue-4.1/btrfs-don-t-invalidate-root-dentry-when-subvolume-deletion-fails.patch new file mode 100644 index 00000000000..3740d5994de --- /dev/null +++ b/queue-4.1/btrfs-don-t-invalidate-root-dentry-when-subvolume-deletion-fails.patch @@ -0,0 +1,69 @@ +From 64ad6c488975d7516230cf7849190a991fd615ae Mon Sep 17 00:00:00 2001 +From: Omar Sandoval +Date: Tue, 2 Jun 2015 17:31:00 -0700 +Subject: Btrfs: don't invalidate root dentry when subvolume deletion fails + +From: Omar Sandoval + +commit 64ad6c488975d7516230cf7849190a991fd615ae upstream. + +Since commit bafc9b754f75 ("vfs: More precise tests in d_invalidate"), +mounted subvolumes can be deleted because d_invalidate() won't fail. +However, we run into problems when we attempt to delete the default +subvolume while it is mounted as the root filesystem: + + # btrfs subvol list / + ID 257 gen 306 top level 5 path rootvol + ID 267 gen 334 top level 5 path snap1 + # btrfs subvol get-default / + ID 267 gen 334 top level 5 path snap1 + # btrfs inspect-internal rootid / + 267 + # mount -o subvol=/ /dev/vda1 /mnt + # btrfs subvol del /mnt/snap1 + Delete subvolume (no-commit): '/mnt/snap1' + ERROR: cannot delete '/mnt/snap1' - Operation not permitted + # findmnt / + findmnt: can't read /proc/mounts: No such file or directory + # ls /proc + # + +Markus reported that this same scenario simply led to a kernel oops. + +This happens because in btrfs_ioctl_snap_destroy(), we call +d_invalidate() before we check may_destroy_subvol(), which means that we +detach the submounts and drop the dentry before erroring out. Instead, +we should only invalidate the dentry once the deletion has succeeded. +Additionally, the shrink_dcache_sb() isn't necessary; d_invalidate() +will prune the dcache for the deleted subvolume. + +Fixes: bafc9b754f75 ("vfs: More precise tests in d_invalidate") +Reported-by: Markus Schauler +Signed-off-by: Omar Sandoval +Signed-off-by: Chris Mason +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/ioctl.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2413,8 +2413,6 @@ static noinline int btrfs_ioctl_snap_des + goto out_unlock_inode; + } + +- d_invalidate(dentry); +- + down_write(&root->fs_info->subvol_sem); + + err = may_destroy_subvol(dest); +@@ -2508,7 +2506,7 @@ out_up_write: + out_unlock_inode: + mutex_unlock(&inode->i_mutex); + if (!err) { +- shrink_dcache_sb(root->fs_info->sb); ++ d_invalidate(dentry); + btrfs_invalidate_inodes(dest); + d_delete(dentry); + ASSERT(dest->send_in_progress == 0); diff --git a/queue-4.1/dmaengine-mv_xor-bug-fix-for-racing-condition-in-descriptors-cleanup.patch b/queue-4.1/dmaengine-mv_xor-bug-fix-for-racing-condition-in-descriptors-cleanup.patch new file mode 100644 index 00000000000..83c8529a66a --- /dev/null +++ b/queue-4.1/dmaengine-mv_xor-bug-fix-for-racing-condition-in-descriptors-cleanup.patch @@ -0,0 +1,134 @@ +From 9136291f1dbc1d4d1cacd2840fb35f4f3ce16c46 Mon Sep 17 00:00:00 2001 +From: Lior Amsalem +Date: Tue, 26 May 2015 15:07:32 +0200 +Subject: dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup + +From: Lior Amsalem + +commit 9136291f1dbc1d4d1cacd2840fb35f4f3ce16c46 upstream. + +This patch fixes a bug in the XOR driver where the cleanup function can be +called and free descriptors that never been processed by the engine (which +result in data errors). + +The cleanup function will free descriptors based on the ownership bit in +the descriptors. + +Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine") +Signed-off-by: Lior Amsalem +Signed-off-by: Maxime Ripard +Reviewed-by: Ofer Heifetz +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/mv_xor.c | 74 ++++++++++++++++++++++++++++++++------------------- + drivers/dma/mv_xor.h | 1 + 2 files changed, 48 insertions(+), 27 deletions(-) + +--- a/drivers/dma/mv_xor.c ++++ b/drivers/dma/mv_xor.c +@@ -273,7 +273,8 @@ static void mv_xor_slot_cleanup(struct m + dma_cookie_t cookie = 0; + int busy = mv_chan_is_busy(mv_chan); + u32 current_desc = mv_chan_get_current_desc(mv_chan); +- int seen_current = 0; ++ int current_cleaned = 0; ++ struct mv_xor_desc *hw_desc; + + dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__); + dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc); +@@ -285,38 +286,57 @@ static void mv_xor_slot_cleanup(struct m + + list_for_each_entry_safe(iter, _iter, &mv_chan->chain, + chain_node) { +- prefetch(_iter); +- prefetch(&_iter->async_tx); + +- /* do not advance past the current descriptor loaded into the +- * hardware channel, subsequent descriptors are either in +- * process or have not been submitted +- */ +- if (seen_current) +- break; +- +- /* stop the search if we reach the current descriptor and the +- * channel is busy +- */ +- if (iter->async_tx.phys == current_desc) { +- seen_current = 1; +- if (busy) ++ /* clean finished descriptors */ ++ hw_desc = iter->hw_desc; ++ if (hw_desc->status & XOR_DESC_SUCCESS) { ++ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, ++ cookie); ++ ++ /* done processing desc, clean slot */ ++ mv_xor_clean_slot(iter, mv_chan); ++ ++ /* break if we did cleaned the current */ ++ if (iter->async_tx.phys == current_desc) { ++ current_cleaned = 1; + break; ++ } ++ } else { ++ if (iter->async_tx.phys == current_desc) { ++ current_cleaned = 0; ++ break; ++ } + } +- +- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie); +- +- if (mv_xor_clean_slot(iter, mv_chan)) +- break; + } + + if ((busy == 0) && !list_empty(&mv_chan->chain)) { +- struct mv_xor_desc_slot *chain_head; +- chain_head = list_entry(mv_chan->chain.next, +- struct mv_xor_desc_slot, +- chain_node); +- +- mv_xor_start_new_chain(mv_chan, chain_head); ++ if (current_cleaned) { ++ /* ++ * current descriptor cleaned and removed, run ++ * from list head ++ */ ++ iter = list_entry(mv_chan->chain.next, ++ struct mv_xor_desc_slot, ++ chain_node); ++ mv_xor_start_new_chain(mv_chan, iter); ++ } else { ++ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) { ++ /* ++ * descriptors are still waiting after ++ * current, trigger them ++ */ ++ iter = list_entry(iter->chain_node.next, ++ struct mv_xor_desc_slot, ++ chain_node); ++ mv_xor_start_new_chain(mv_chan, iter); ++ } else { ++ /* ++ * some descriptors are still waiting ++ * to be cleaned ++ */ ++ tasklet_schedule(&mv_chan->irq_tasklet); ++ } ++ } + } + + if (cookie > 0) +--- a/drivers/dma/mv_xor.h ++++ b/drivers/dma/mv_xor.h +@@ -31,6 +31,7 @@ + #define XOR_OPERATION_MODE_XOR 0 + #define XOR_OPERATION_MODE_MEMCPY 2 + #define XOR_DESCRIPTOR_SWAP BIT(14) ++#define XOR_DESC_SUCCESS 0x40000000 + + #define XOR_DESC_DMA_OWNED BIT(31) + #define XOR_DESC_EOD_INT_EN BIT(31) diff --git a/queue-4.1/hwmon-mcp3021-fix-broken-output-scaling.patch b/queue-4.1/hwmon-mcp3021-fix-broken-output-scaling.patch new file mode 100644 index 00000000000..0f212fb4512 --- /dev/null +++ b/queue-4.1/hwmon-mcp3021-fix-broken-output-scaling.patch @@ -0,0 +1,83 @@ +From 347d7e45bd09ce09cbc30d5cea9de377eb22f55c Mon Sep 17 00:00:00 2001 +From: "Stevens, Nick" +Date: Wed, 1 Jul 2015 16:07:41 +0000 +Subject: hwmon: (mcp3021) Fix broken output scaling + +From: "Stevens, Nick" + +commit 347d7e45bd09ce09cbc30d5cea9de377eb22f55c upstream. + +The mcp3021 scaling code is dividing the VDD (full-scale) value in +millivolts by the A2D resolution to obtain the scaling factor. When VDD +is 3300mV (the standard value) and the resolution is 12-bit (4096 +divisions), the result is a scale factor of 3300/4096, which is always +one. Effectively, the raw A2D reading is always being returned because +no scaling is applied. + +This patch fixes the issue and simplifies the register-to-volts +calculation, removing the unneeded "output_scale" struct member. + +Signed-off-by: Nick Stevens +[Guenter Roeck: Dropped unnecessary value check] +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/mcp3021.c | 14 +------------- + 1 file changed, 1 insertion(+), 13 deletions(-) + +--- a/drivers/hwmon/mcp3021.c ++++ b/drivers/hwmon/mcp3021.c +@@ -31,14 +31,11 @@ + /* output format */ + #define MCP3021_SAR_SHIFT 2 + #define MCP3021_SAR_MASK 0x3ff +- + #define MCP3021_OUTPUT_RES 10 /* 10-bit resolution */ +-#define MCP3021_OUTPUT_SCALE 4 + + #define MCP3221_SAR_SHIFT 0 + #define MCP3221_SAR_MASK 0xfff + #define MCP3221_OUTPUT_RES 12 /* 12-bit resolution */ +-#define MCP3221_OUTPUT_SCALE 1 + + enum chips { + mcp3021, +@@ -54,7 +51,6 @@ struct mcp3021_data { + u16 sar_shift; + u16 sar_mask; + u8 output_res; +- u8 output_scale; + }; + + static int mcp3021_read16(struct i2c_client *client) +@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_cli + + static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val) + { +- if (val == 0) +- return 0; +- +- val = val * data->output_scale - data->output_scale / 2; +- +- return val * DIV_ROUND_CLOSEST(data->vdd, +- (1 << data->output_res) * data->output_scale); ++ return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res); + } + + static ssize_t show_in_input(struct device *dev, struct device_attribute *attr, +@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_clie + data->sar_shift = MCP3021_SAR_SHIFT; + data->sar_mask = MCP3021_SAR_MASK; + data->output_res = MCP3021_OUTPUT_RES; +- data->output_scale = MCP3021_OUTPUT_SCALE; + break; + + case mcp3221: + data->sar_shift = MCP3221_SAR_SHIFT; + data->sar_mask = MCP3221_SAR_MASK; + data->output_res = MCP3221_OUTPUT_RES; +- data->output_scale = MCP3221_OUTPUT_SCALE; + break; + } + diff --git a/queue-4.1/hwmon-nct7802-fix-visibility-of-temp3.patch b/queue-4.1/hwmon-nct7802-fix-visibility-of-temp3.patch new file mode 100644 index 00000000000..bf5be642158 --- /dev/null +++ b/queue-4.1/hwmon-nct7802-fix-visibility-of-temp3.patch @@ -0,0 +1,34 @@ +From 56172d81a9bc37a69b95dd627b8d48135c9c7b31 Mon Sep 17 00:00:00 2001 +From: Constantine Shulyupin +Date: Fri, 26 Jun 2015 17:47:44 +0300 +Subject: hwmon: (nct7802) fix visibility of temp3 + +From: Constantine Shulyupin + +commit 56172d81a9bc37a69b95dd627b8d48135c9c7b31 upstream. + +Excerpt from datasheet: +7.2.32 Mode Selection Register +RTD3_MD : 00=Closed , 01=Reserved , 10=Thermistor mode , 11=Voltage sense + +Show temp3 only in Thermistor mode + +Signed-off-by: Constantine Shulyupin +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/nct7802.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/nct7802.c ++++ b/drivers/hwmon/nct7802.c +@@ -547,7 +547,7 @@ static umode_t nct7802_temp_is_visible(s + if (index >= 9 && index < 18 && + (reg & 0x0c) != 0x04 && (reg & 0x0c) != 0x08) /* RD2 */ + return 0; +- if (index >= 18 && index < 27 && (reg & 0x30) != 0x10) /* RD3 */ ++ if (index >= 18 && index < 27 && (reg & 0x30) != 0x20) /* RD3 */ + return 0; + if (index >= 27 && index < 35) /* local */ + return attr->mode; diff --git a/queue-4.1/md-clear-mddev-private-when-it-has-been-freed.patch b/queue-4.1/md-clear-mddev-private-when-it-has-been-freed.patch new file mode 100644 index 00000000000..fb6b80cbba2 --- /dev/null +++ b/queue-4.1/md-clear-mddev-private-when-it-has-been-freed.patch @@ -0,0 +1,56 @@ +From bd6919228d7e1867ae9e24ab27e3e4a366c87d21 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Thu, 25 Jun 2015 17:01:40 +1000 +Subject: md: clear mddev->private when it has been freed. + +From: NeilBrown + +commit bd6919228d7e1867ae9e24ab27e3e4a366c87d21 upstream. + +If ->private is set when ->run is called, it is assumed to be +a 'config' prepared as part of 'reshape'. + +So it is important when we free that config, that we also clear ->private. +This is not often a problem as the mddev will normally be discarded +shortly after the config us freed. +However if an 'assemble' races with a final close, the assemble can use +the old mddev which has a stale ->private. This leads to any of +various sorts of crashes. + +So clear ->private after calling ->free(). + +Reported-by: Nate Clark +Fixes: afa0f557cb15 ("md: rename ->stop to ->free") +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -5159,6 +5159,7 @@ int md_run(struct mddev *mddev) + mddev_detach(mddev); + if (mddev->private) + pers->free(mddev, mddev->private); ++ mddev->private = NULL; + module_put(pers->owner); + bitmap_destroy(mddev); + return err; +@@ -5294,6 +5295,7 @@ static void md_clean(struct mddev *mddev + mddev->changed = 0; + mddev->degraded = 0; + mddev->safemode = 0; ++ mddev->private = NULL; + mddev->merge_check_needed = 0; + mddev->bitmap_info.offset = 0; + mddev->bitmap_info.default_offset = 0; +@@ -5366,6 +5368,7 @@ static void __md_stop(struct mddev *mdde + mddev->pers = NULL; + spin_unlock(&mddev->lock); + pers->free(mddev, mddev->private); ++ mddev->private = NULL; + if (pers->sync_request && mddev->to_remove == NULL) + mddev->to_remove = &md_redundancy_group; + module_put(pers->owner); diff --git a/queue-4.1/md-fix-a-build-warning.patch b/queue-4.1/md-fix-a-build-warning.patch new file mode 100644 index 00000000000..383c7288e18 --- /dev/null +++ b/queue-4.1/md-fix-a-build-warning.patch @@ -0,0 +1,38 @@ +From 4e023612325a9034a542bfab79f78b1fe5ebb841 Mon Sep 17 00:00:00 2001 +From: Firo Yang +Date: Thu, 11 Jun 2015 09:41:10 +0800 +Subject: md: fix a build warning + +From: Firo Yang + +commit 4e023612325a9034a542bfab79f78b1fe5ebb841 upstream. + +Warning like this: + +drivers/md/md.c: In function "update_array_info": +drivers/md/md.c:6394:26: warning: logical not is only applied +to the left hand side of comparison [-Wlogical-not-parentheses] + !mddev->persistent != info->not_persistent|| + +Fix it as Neil Brown said: +mddev->persistent != !info->not_persistent || + +Signed-off-by: Firo Yang +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -6380,7 +6380,7 @@ static int update_array_info(struct mdde + mddev->ctime != info->ctime || + mddev->level != info->level || + /* mddev->layout != info->layout || */ +- !mddev->persistent != info->not_persistent|| ++ mddev->persistent != !info->not_persistent || + mddev->chunk_sectors != info->chunk_size >> 9 || + /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */ + ((state^info->state) & 0xfffffe00) diff --git a/queue-4.1/md-skip-cluster-setup-for-dm-raid.patch b/queue-4.1/md-skip-cluster-setup-for-dm-raid.patch new file mode 100644 index 00000000000..370fe3baa9a --- /dev/null +++ b/queue-4.1/md-skip-cluster-setup-for-dm-raid.patch @@ -0,0 +1,71 @@ +From d3b178adb3a3adf54ecf77758138b654c3ee7f09 Mon Sep 17 00:00:00 2001 +From: Goldwyn Rodrigues +Date: Wed, 22 Jul 2015 12:09:17 -0500 +Subject: md: Skip cluster setup for dm-raid + +From: Goldwyn Rodrigues + +commit d3b178adb3a3adf54ecf77758138b654c3ee7f09 upstream. + +There is a bug that the bitmap superblock isn't initialised properly for +dm-raid, so a new field can have garbage in new fields. +(dm-raid does initialisation in the kernel - md initialised the + superblock in mdadm). + +This means that for dm-raid we cannot currently trust the new ->nodes +field. So: + - use __GFP_ZERO to initialise the superblock properly for all new + arrays + - initialise all fields in bitmap_info in bitmap_new_disk_sb + - ignore ->nodes for dm arrays (yes, this is a hack) + +This bug exposes dm-raid to bug in the (still experimental) md-cluster +code, so it is suitable for -stable. It does cause crashes. + +References: https://bugzilla.kernel.org/show_bug.cgi?id=100491 +Signed-off-By: Goldwyn Rodrigues +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bitmap.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/drivers/md/bitmap.c ++++ b/drivers/md/bitmap.c +@@ -494,7 +494,7 @@ static int bitmap_new_disk_sb(struct bit + bitmap_super_t *sb; + unsigned long chunksize, daemon_sleep, write_behind; + +- bitmap->storage.sb_page = alloc_page(GFP_KERNEL); ++ bitmap->storage.sb_page = alloc_page(GFP_KERNEL | __GFP_ZERO); + if (bitmap->storage.sb_page == NULL) + return -ENOMEM; + bitmap->storage.sb_page->index = 0; +@@ -541,6 +541,7 @@ static int bitmap_new_disk_sb(struct bit + sb->state = cpu_to_le32(bitmap->flags); + bitmap->events_cleared = bitmap->mddev->events; + sb->events_cleared = cpu_to_le64(bitmap->mddev->events); ++ bitmap->mddev->bitmap_info.nodes = 0; + + kunmap_atomic(sb); + +@@ -611,8 +612,16 @@ re_read: + daemon_sleep = le32_to_cpu(sb->daemon_sleep) * HZ; + write_behind = le32_to_cpu(sb->write_behind); + sectors_reserved = le32_to_cpu(sb->sectors_reserved); +- nodes = le32_to_cpu(sb->nodes); +- strlcpy(bitmap->mddev->bitmap_info.cluster_name, sb->cluster_name, 64); ++ /* XXX: This is a hack to ensure that we don't use clustering ++ * in case: ++ * - dm-raid is in use and ++ * - the nodes written in bitmap_sb is erroneous. ++ */ ++ if (!bitmap->mddev->sync_super) { ++ nodes = le32_to_cpu(sb->nodes); ++ strlcpy(bitmap->mddev->bitmap_info.cluster_name, ++ sb->cluster_name, 64); ++ } + + /* verify that the bitmap-specific fields are valid */ + if (sb->magic != cpu_to_le32(BITMAP_MAGIC)) diff --git a/queue-4.1/md-unlock-mddev_lock-on-an-error-path.patch b/queue-4.1/md-unlock-mddev_lock-on-an-error-path.patch new file mode 100644 index 00000000000..8b2f166135e --- /dev/null +++ b/queue-4.1/md-unlock-mddev_lock-on-an-error-path.patch @@ -0,0 +1,33 @@ +From 9a8c0fa861e4db60409b4dda254cef5e17e4d43c Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Thu, 25 Jun 2015 17:06:40 +1000 +Subject: md: unlock mddev_lock on an error path. + +From: NeilBrown + +commit 9a8c0fa861e4db60409b4dda254cef5e17e4d43c upstream. + +This error path retuns while still holding the lock - bad. + +Fixes: 6791875e2e53 ("md: make reconfig_mutex optional for writes to md sysfs files.") +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -4005,8 +4005,10 @@ new_dev_store(struct mddev *mddev, const + else + rdev = md_import_device(dev, -1, -1); + +- if (IS_ERR(rdev)) ++ if (IS_ERR(rdev)) { ++ mddev_unlock(mddev); + return PTR_ERR(rdev); ++ } + err = bind_rdev_to_array(rdev, mddev); + out: + if (err) diff --git a/queue-4.1/series b/queue-4.1/series index 98bdfd264b1..c3ace8d5a81 100644 --- a/queue-4.1/series +++ b/queue-4.1/series @@ -179,3 +179,17 @@ ima-fix-ima_show_template_data_ascii.patch ima-add-support-for-new-euid-policy-condition.patch ima-extend-mask-policy-matching-support.patch ima-update-builtin-policies.patch +tracing-filter-do-not-warn-on-operand-count-going-below-zero.patch +tracing-filter-do-not-allow-infix-to-exceed-end-of-string.patch +tracing-fix-typo-from-static-inlin-to-static-inline.patch +tracing-have-branch-tracer-use-recursive-field-of-task-struct.patch +tracing-fix-sample-output-of-dynamic-arrays.patch +dmaengine-mv_xor-bug-fix-for-racing-condition-in-descriptors-cleanup.patch +md-clear-mddev-private-when-it-has-been-freed.patch +md-unlock-mddev_lock-on-an-error-path.patch +md-skip-cluster-setup-for-dm-raid.patch +hwmon-mcp3021-fix-broken-output-scaling.patch +hwmon-nct7802-fix-visibility-of-temp3.patch +arm-dts-mx23-fix-iio-hwmon-support.patch +btrfs-don-t-invalidate-root-dentry-when-subvolume-deletion-fails.patch +md-fix-a-build-warning.patch diff --git a/queue-4.1/tracing-filter-do-not-allow-infix-to-exceed-end-of-string.patch b/queue-4.1/tracing-filter-do-not-allow-infix-to-exceed-end-of-string.patch new file mode 100644 index 00000000000..c3aba8733a1 --- /dev/null +++ b/queue-4.1/tracing-filter-do-not-allow-infix-to-exceed-end-of-string.patch @@ -0,0 +1,61 @@ +From 6b88f44e161b9ee2a803e5b2b1fbcf4e20e8b980 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Thu, 25 Jun 2015 18:10:09 -0400 +Subject: tracing/filter: Do not allow infix to exceed end of string + +From: "Steven Rostedt (Red Hat)" + +commit 6b88f44e161b9ee2a803e5b2b1fbcf4e20e8b980 upstream. + +While debugging a WARN_ON() for filtering, I found that it is possible +for the filter string to be referenced after its end. With the filter: + + # echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter + +The filter_parse() function can call infix_get_op() which calls +infix_advance() that updates the infix filter pointers for the cnt +and tail without checking if the filter is already at the end, which +will put the cnt to zero and the tail beyond the end. The loop then calls +infix_next() that has + + ps->infix.cnt--; + return ps->infix.string[ps->infix.tail++]; + +The cnt will now be below zero, and the tail that is returned is +already passed the end of the filter string. So far the allocation +of the filter string usually has some buffer that is zeroed out, but +if the filter string is of the exact size of the allocated buffer +there's no guarantee that the charater after the nul terminating +character will be zero. + +Luckily, only root can write to the filter. + +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_events_filter.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1056,6 +1056,9 @@ static void parse_init(struct filter_par + + static char infix_next(struct filter_parse_state *ps) + { ++ if (!ps->infix.cnt) ++ return 0; ++ + ps->infix.cnt--; + + return ps->infix.string[ps->infix.tail++]; +@@ -1071,6 +1074,9 @@ static char infix_peek(struct filter_par + + static void infix_advance(struct filter_parse_state *ps) + { ++ if (!ps->infix.cnt) ++ return; ++ + ps->infix.cnt--; + ps->infix.tail++; + } diff --git a/queue-4.1/tracing-filter-do-not-warn-on-operand-count-going-below-zero.patch b/queue-4.1/tracing-filter-do-not-warn-on-operand-count-going-below-zero.patch new file mode 100644 index 00000000000..ae107e2eb4b --- /dev/null +++ b/queue-4.1/tracing-filter-do-not-warn-on-operand-count-going-below-zero.patch @@ -0,0 +1,46 @@ +From b4875bbe7e68f139bd3383828ae8e994a0df6d28 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Thu, 25 Jun 2015 18:02:29 -0400 +Subject: tracing/filter: Do not WARN on operand count going below zero + +From: "Steven Rostedt (Red Hat)" + +commit b4875bbe7e68f139bd3383828ae8e994a0df6d28 upstream. + +When testing the fix for the trace filter, I could not come up with +a scenario where the operand count goes below zero, so I added a +WARN_ON_ONCE(cnt < 0) to the logic. But there is legitimate case +that it can happen (although the filter would be wrong). + + # echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter + +That is, a single operation without any operands will hit the path +where the WARN_ON_ONCE() can trigger. Although this is harmless, +and the filter is reported as a error. But instead of spitting out +a warning to the kernel dmesg, just fail nicely and report it via +the proper channels. + +Link: http://lkml.kernel.org/r/558C6082.90608@oracle.com + +Reported-by: Vince Weaver +Reported-by: Sasha Levin +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_events_filter.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1385,7 +1385,9 @@ static int check_preds(struct filter_par + if (elt->op != OP_NOT) + cnt--; + n_normal_preds++; +- WARN_ON_ONCE(cnt < 0); ++ /* all ops should have operands */ ++ if (cnt < 0) ++ break; + } + + if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { diff --git a/queue-4.1/tracing-fix-sample-output-of-dynamic-arrays.patch b/queue-4.1/tracing-fix-sample-output-of-dynamic-arrays.patch new file mode 100644 index 00000000000..1e40f15f4b1 --- /dev/null +++ b/queue-4.1/tracing-fix-sample-output-of-dynamic-arrays.patch @@ -0,0 +1,76 @@ +From d6726c8145290bef950ae2538ea6ae1d96a1944b Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Fri, 17 Jul 2015 14:03:26 -0400 +Subject: tracing: Fix sample output of dynamic arrays + +From: "Steven Rostedt (Red Hat)" + +commit d6726c8145290bef950ae2538ea6ae1d96a1944b upstream. + +He Kuang noticed that the trace event samples for arrays was broken: + +"The output result of trace_foo_bar event in traceevent samples is + wrong. This problem can be reproduced as following: + + (Build kernel with SAMPLE_TRACE_EVENTS=m) + + $ insmod trace-events-sample.ko + + $ echo 1 > /sys/kernel/debug/tracing/events/sample-trace/foo_bar/enable + + $ cat /sys/kernel/debug/tracing/trace + + event-sample-980 [000] .... 43.649559: foo_bar: foo hello 21 0x15 + BIT1|BIT3|0x10 {0x1,0x6f6f6e53,0xff007970,0xffffffff} Snoopy + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + The array length is not right, should be {0x1}. + (ffffffff,ffffffff) + + event-sample-980 [000] .... 44.653827: foo_bar: foo hello 22 0x16 + BIT2|BIT3|0x10 + {0x1,0x2,0x646e6147,0x666c61,0xffffffff,0xffffffff,0x750aeffe,0x7} + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + The array length is not right, should be {0x1,0x2}. + Gandalf (ffffffff,ffffffff)" + +This was caused by an update to have __print_array()'s second parameter +be the count of items in the array and not the size of the array. + +As there is already users of __print_array(), it can not change. But +the sample code can and we can also improve on the documentation about +__print_array() and __get_dynamic_array_len(). + +Link: http://lkml.kernel.org/r/1436839171-31527-2-git-send-email-hekuang@huawei.com + +Fixes: ac01ce1410fc2 ("tracing: Make ftrace_print_array_seq compute buf_len") +Reported-by: He Kuang +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + samples/trace_events/trace-events-sample.h | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/samples/trace_events/trace-events-sample.h ++++ b/samples/trace_events/trace-events-sample.h +@@ -168,7 +168,10 @@ + * + * For __dynamic_array(int, foo, bar) use __get_dynamic_array(foo) + * Use __get_dynamic_array_len(foo) to get the length of the array +- * saved. ++ * saved. Note, __get_dynamic_array_len() returns the total allocated ++ * length of the dynamic array; __print_array() expects the second ++ * parameter to be the number of elements. To get that, the array length ++ * needs to be divided by the element size. + * + * For __string(foo, bar) use __get_str(foo) + * +@@ -288,7 +291,7 @@ TRACE_EVENT(foo_bar, + * This prints out the array that is defined by __array in a nice format. + */ + __print_array(__get_dynamic_array(list), +- __get_dynamic_array_len(list), ++ __get_dynamic_array_len(list) / sizeof(int), + sizeof(int)), + __get_str(str), __get_bitmask(cpus)) + ); diff --git a/queue-4.1/tracing-fix-typo-from-static-inlin-to-static-inline.patch b/queue-4.1/tracing-fix-typo-from-static-inlin-to-static-inline.patch new file mode 100644 index 00000000000..51eb1792006 --- /dev/null +++ b/queue-4.1/tracing-fix-typo-from-static-inlin-to-static-inline.patch @@ -0,0 +1,31 @@ +From cc9e4bde03f2b4cfba52406c021364cbd2a4a0f3 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Thu, 25 Jun 2015 18:19:37 -0400 +Subject: tracing: Fix typo from "static inlin" to "static inline" + +From: "Steven Rostedt (Red Hat)" + +commit cc9e4bde03f2b4cfba52406c021364cbd2a4a0f3 upstream. + +The trace.h header when called without CONFIG_EVENT_TRACING enabled +(seldom done), will not compile because of a typo in the protocol +of trace_event_enum_update(). + +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -1312,7 +1312,7 @@ void trace_event_init(void); + void trace_event_enum_update(struct trace_enum_map **map, int len); + #else + static inline void __init trace_event_init(void) { } +-static inlin void trace_event_enum_update(struct trace_enum_map **map, int len) { } ++static inline void trace_event_enum_update(struct trace_enum_map **map, int len) { } + #endif + + extern struct trace_iterator *tracepoint_print_iter; diff --git a/queue-4.1/tracing-have-branch-tracer-use-recursive-field-of-task-struct.patch b/queue-4.1/tracing-have-branch-tracer-use-recursive-field-of-task-struct.patch new file mode 100644 index 00000000000..015e43e916d --- /dev/null +++ b/queue-4.1/tracing-have-branch-tracer-use-recursive-field-of-task-struct.patch @@ -0,0 +1,94 @@ +From 6224beb12e190ff11f3c7d4bf50cb2922878f600 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Tue, 7 Jul 2015 15:05:03 -0400 +Subject: tracing: Have branch tracer use recursive field of task struct + +From: "Steven Rostedt (Red Hat)" + +commit 6224beb12e190ff11f3c7d4bf50cb2922878f600 upstream. + +Fengguang Wu's tests triggered a bug in the branch tracer's start up +test when CONFIG_DEBUG_PREEMPT set. This was because that config +adds some debug logic in the per cpu field, which calls back into +the branch tracer. + +The branch tracer has its own recursive checks, but uses a per cpu +variable to implement it. If retrieving the per cpu variable calls +back into the branch tracer, you can see how things will break. + +Instead of using a per cpu variable, use the trace_recursion field +of the current task struct. Simply set a bit when entering the +branch tracing and clear it when leaving. If the bit is set on +entry, just don't do the tracing. + +There's also the case with lockdep, as the local_irq_save() called +before the recursion can also trigger code that can call back into +the function. Changing that to a raw_local_irq_save() will protect +that as well. + +This prevents the recursion and the inevitable crash that follows. + +Link: http://lkml.kernel.org/r/20150630141803.GA28071@wfg-t540p.sh.intel.com + +Reported-by: Fengguang Wu +Tested-by: Fengguang Wu +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace.h | 1 + + kernel/trace/trace_branch.c | 17 ++++++++++------- + 2 files changed, 11 insertions(+), 7 deletions(-) + +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -444,6 +444,7 @@ enum { + + TRACE_CONTROL_BIT, + ++ TRACE_BRANCH_BIT, + /* + * Abuse of the trace_recursion. + * As we need a way to maintain state if we are tracing the function +--- a/kernel/trace/trace_branch.c ++++ b/kernel/trace/trace_branch.c +@@ -36,9 +36,12 @@ probe_likely_condition(struct ftrace_bra + struct trace_branch *entry; + struct ring_buffer *buffer; + unsigned long flags; +- int cpu, pc; ++ int pc; + const char *p; + ++ if (current->trace_recursion & TRACE_BRANCH_BIT) ++ return; ++ + /* + * I would love to save just the ftrace_likely_data pointer, but + * this code can also be used by modules. Ugly things can happen +@@ -49,10 +52,10 @@ probe_likely_condition(struct ftrace_bra + if (unlikely(!tr)) + return; + +- local_irq_save(flags); +- cpu = raw_smp_processor_id(); +- data = per_cpu_ptr(tr->trace_buffer.data, cpu); +- if (atomic_inc_return(&data->disabled) != 1) ++ raw_local_irq_save(flags); ++ current->trace_recursion |= TRACE_BRANCH_BIT; ++ data = this_cpu_ptr(tr->trace_buffer.data); ++ if (atomic_read(&data->disabled)) + goto out; + + pc = preempt_count(); +@@ -81,8 +84,8 @@ probe_likely_condition(struct ftrace_bra + __buffer_unlock_commit(buffer, event); + + out: +- atomic_dec(&data->disabled); +- local_irq_restore(flags); ++ current->trace_recursion &= ~TRACE_BRANCH_BIT; ++ raw_local_irq_restore(flags); + } + + static inline