+++ /dev/null
-From 19dfc1f5f2ef03a52aa30c8257c5745edef23f55 Mon Sep 17 00:00:00 2001
-From: Al Viro <viro@zeniv.linux.org.uk>
-Date: Thu, 3 Apr 2014 10:27:17 -0400
-Subject: cifs: fix the race in cifs_writev()
-
-From: Al Viro <viro@zeniv.linux.org.uk>
-
-commit 19dfc1f5f2ef03a52aa30c8257c5745edef23f55 upstream.
-
-O_APPEND handling there hadn't been completely fixed by Pavel's
-patch; it checks the right value, but it's racy - we can't really
-do that until i_mutex has been taken.
-
-Fix by switching to __generic_file_aio_write() (open-coding
-generic_file_aio_write(), actually) and pulling mutex_lock() above
-inode_size_read().
-
-Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- fs/cifs/file.c | 23 ++++++++++++++++++-----
- 1 file changed, 18 insertions(+), 5 deletions(-)
-
---- a/fs/cifs/file.c
-+++ b/fs/cifs/file.c
-@@ -2579,19 +2579,32 @@ cifs_writev(struct kiocb *iocb, const st
- struct cifsInodeInfo *cinode = CIFS_I(inode);
- struct TCP_Server_Info *server = tlink_tcon(cfile->tlink)->ses->server;
- ssize_t rc = -EACCES;
-- loff_t lock_pos = pos;
-+ loff_t lock_pos = iocb->ki_pos;
-
-- if (file->f_flags & O_APPEND)
-- lock_pos = i_size_read(inode);
- /*
- * We need to hold the sem to be sure nobody modifies lock list
- * with a brlock that prevents writing.
- */
- down_read(&cinode->lock_sem);
-+ mutex_lock(&inode->i_mutex);
-+ if (file->f_flags & O_APPEND)
-+ lock_pos = i_size_read(inode);
- if (!cifs_find_lock_conflict(cfile, lock_pos, iov_length(iov, nr_segs),
- server->vals->exclusive_lock_type, NULL,
-- CIFS_WRITE_OP))
-- rc = generic_file_aio_write(iocb, iov, nr_segs, pos);
-+ CIFS_WRITE_OP)) {
-+ rc = __generic_file_aio_write(iocb, iov, nr_segs);
-+ mutex_unlock(&inode->i_mutex);
-+
-+ if (rc > 0) {
-+ ssize_t err;
-+
-+ err = generic_write_sync(file, iocb->ki_pos - rc, rc);
-+ if (rc < 0)
-+ rc = err;
-+ }
-+ } else {
-+ mutex_unlock(&inode->i_mutex);
-+ }
- up_read(&cinode->lock_sem);
- return rc;
- }
extern int cifs_push_mandatory_locks(struct cifsFileInfo *cfile);
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
-@@ -2621,12 +2621,20 @@ cifs_strict_writev(struct kiocb *iocb, c
+@@ -2608,12 +2608,20 @@ cifs_strict_writev(struct kiocb *iocb, c
struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
ssize_t written;
}
/*
* For non-oplocked files in strict cache mode we need to write the data
-@@ -2646,6 +2654,8 @@ cifs_strict_writev(struct kiocb *iocb, c
+@@ -2633,6 +2641,8 @@ cifs_strict_writev(struct kiocb *iocb, c
inode);
cinode->oplock = 0;
}
return written;
}
-@@ -3657,6 +3667,13 @@ static int cifs_launder_page(struct page
+@@ -3644,6 +3654,13 @@ static int cifs_launder_page(struct page
return rc;
}
void cifs_oplock_break(struct work_struct *work)
{
struct cifsFileInfo *cfile = container_of(work, struct cifsFileInfo,
-@@ -3664,8 +3681,15 @@ void cifs_oplock_break(struct work_struc
+@@ -3651,8 +3668,15 @@ void cifs_oplock_break(struct work_struc
struct inode *inode = cfile->dentry->d_inode;
struct cifsInodeInfo *cinode = CIFS_I(inode);
struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
if (!CIFS_CACHE_WRITE(cinode) && CIFS_CACHE_READ(cinode) &&
cifs_has_mand_locks(cinode)) {
cifs_dbg(FYI, "Reset oplock to None for inode=%p due to mand locks\n",
-@@ -3702,6 +3726,7 @@ void cifs_oplock_break(struct work_struc
+@@ -3689,6 +3713,7 @@ void cifs_oplock_break(struct work_struc
cinode);
cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
}
--- /dev/null
+From 2f433083e854ec72c19dc9b0e1cebcc8e230fd75 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 2 May 2014 19:48:13 +0200
+Subject: HID: add NO_INIT_REPORTS quirk for Synaptics Touch Pad V 103S
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 2f433083e854ec72c19dc9b0e1cebcc8e230fd75 upstream.
+
+This touchpad seriously dislikes init reports, not only timeing out, but
+also refusing to work after this.
+
+Reported-and-tested-by: Vincent Fortier <th0ma7@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/usbhid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -828,6 +828,7 @@
+ #define USB_DEVICE_ID_SYNAPTICS_LTS2 0x1d10
+ #define USB_DEVICE_ID_SYNAPTICS_HD 0x0ac3
+ #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD 0x1ac3
++#define USB_DEVICE_ID_SYNAPTICS_TP_V103 0x5710
+
+ #define USB_VENDOR_ID_THINGM 0x27b8
+ #define USB_DEVICE_ID_BLINK1 0x01ed
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -119,6 +119,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD, HID_QUIRK_NO_INIT_REPORTS },
++ { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103, HID_QUIRK_NO_INIT_REPORTS },
+
+ { 0, 0 }
+ };
--- /dev/null
+From e24d0d399b2fce71b627043e900ef28283850482 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Mon, 31 Mar 2014 13:27:10 -0400
+Subject: HID: core: do not scan constant input report
+
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+
+commit e24d0d399b2fce71b627043e900ef28283850482 upstream.
+
+The Microsoft Surface Type/Touch Cover 2 is a fancy device which advertised
+itself as a multitouch device but with constant input reports.
+This way, hid_scan_report() gives the group MULTITOUCH to it, but
+hid-multitouch can not handle it due to the constant collection ignored
+by hid-input.
+
+To prevent such crap in the future, and while we do not fix this particular
+device, make the scan_report coherent with hid-input.c, and ignore constant
+input reports.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -718,6 +718,9 @@ static int hid_scan_main(struct hid_pars
+ case HID_MAIN_ITEM_TAG_END_COLLECTION:
+ break;
+ case HID_MAIN_ITEM_TAG_INPUT:
++ /* ignore constant inputs, they will be ignored by hid-input */
++ if (data & HID_MAIN_ITEM_CONSTANT)
++ break;
+ for (i = 0; i < parser->local.usage_index; i++)
+ hid_scan_input_usage(parser, parser->local.usage[i]);
+ break;
--- /dev/null
+From 82c04ff89eba09d0e46e3f3649c6d3aa18e764a0 Mon Sep 17 00:00:00 2001
+From: Peter Foley <pefoley2@pefoley.com>
+Date: Fri, 18 Apr 2014 15:07:11 -0700
+Subject: init/Kconfig: move the trusted keyring config option to general setup
+
+From: Peter Foley <pefoley2@pefoley.com>
+
+commit 82c04ff89eba09d0e46e3f3649c6d3aa18e764a0 upstream.
+
+The SYSTEM_TRUSTED_KEYRING config option is not in any menu, causing it
+to show up in the toplevel of the kernel configuration. Fix this by
+moving it under the General Setup menu.
+
+Signed-off-by: Peter Foley <pefoley2@pefoley.com>
+Cc: David Howells <dhowells@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ init/Kconfig | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1621,6 +1621,18 @@ config MMAP_ALLOW_UNINITIALIZED
+
+ See Documentation/nommu-mmap.txt for more information.
+
++config SYSTEM_TRUSTED_KEYRING
++ bool "Provide system-wide ring of trusted keys"
++ depends on KEYS
++ help
++ Provide a system keyring to which trusted keys can be added. Keys in
++ the keyring are considered to be trusted. Keys may be added at will
++ by the kernel from compiled-in data and from hardware key stores, but
++ userspace may only add extra keys if those keys can be verified by
++ keys already in the keyring.
++
++ Keys in this keyring are used by module signature checking.
++
+ config PROFILING
+ bool "Profiling support"
+ help
+@@ -1656,18 +1668,6 @@ config BASE_SMALL
+ default 0 if BASE_FULL
+ default 1 if !BASE_FULL
+
+-config SYSTEM_TRUSTED_KEYRING
+- bool "Provide system-wide ring of trusted keys"
+- depends on KEYS
+- help
+- Provide a system keyring to which trusted keys can be added. Keys in
+- the keyring are considered to be trusted. Keys may be added at will
+- by the kernel from compiled-in data and from hardware key stores, but
+- userspace may only add extra keys if those keys can be verified by
+- keys already in the keyring.
+-
+- Keys in this keyring are used by module signature checking.
+-
+ menuconfig MODULES
+ bool "Enable loadable module support"
+ option modules
--- /dev/null
+From da1aab3dca9aa88ae34ca392470b8943159e25fe Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Wed, 9 Apr 2014 12:25:43 +1000
+Subject: md/raid1: r1buf_pool_alloc: free allocate pages when subsequent allocation fails.
+
+From: NeilBrown <neilb@suse.de>
+
+commit da1aab3dca9aa88ae34ca392470b8943159e25fe upstream.
+
+When performing a user-request check/repair (MD_RECOVERY_REQUEST is set)
+on a raid1, we allocate multiple bios each with their own set of pages.
+
+If the page allocations for one bio fails, we currently do *not* free
+the pages allocated for the previous bios, nor do we free the bio itself.
+
+This patch frees all the already-allocate pages, and makes sure that
+all the bios are freed as well.
+
+This bug can cause a memory leak which can ultimately OOM a machine.
+It was introduced in 3.10-rc1.
+
+Fixes: a07876064a0b73ab5ef1ebcf14b1cf0231c07858
+Cc: Kent Overstreet <koverstreet@google.com>
+Reported-by: Russell King - ARM Linux <linux@arm.linux.org.uk>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid1.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -97,6 +97,7 @@ static void * r1buf_pool_alloc(gfp_t gfp
+ struct pool_info *pi = data;
+ struct r1bio *r1_bio;
+ struct bio *bio;
++ int need_pages;
+ int i, j;
+
+ r1_bio = r1bio_pool_alloc(gfp_flags, pi);
+@@ -119,15 +120,15 @@ static void * r1buf_pool_alloc(gfp_t gfp
+ * RESYNC_PAGES for each bio.
+ */
+ if (test_bit(MD_RECOVERY_REQUESTED, &pi->mddev->recovery))
+- j = pi->raid_disks;
++ need_pages = pi->raid_disks;
+ else
+- j = 1;
+- while(j--) {
++ need_pages = 1;
++ for (j = 0; j < need_pages; j++) {
+ bio = r1_bio->bios[j];
+ bio->bi_vcnt = RESYNC_PAGES;
+
+ if (bio_alloc_pages(bio, gfp_flags))
+- goto out_free_bio;
++ goto out_free_pages;
+ }
+ /* If not user-requests, copy the page pointers to all bios */
+ if (!test_bit(MD_RECOVERY_REQUESTED, &pi->mddev->recovery)) {
+@@ -141,6 +142,14 @@ static void * r1buf_pool_alloc(gfp_t gfp
+
+ return r1_bio;
+
++out_free_pages:
++ while (--j >= 0) {
++ struct bio_vec *bv;
++
++ bio_for_each_segment_all(bv, r1_bio->bios[j], i)
++ __free_page(bv->bv_page);
++ }
++
+ out_free_bio:
+ while (++j < pi->raid_disks)
+ bio_put(r1_bio->bios[j]);
--- /dev/null
+From 7848a4bf51b34f41fcc9bd77e837126d99ae84e3 Mon Sep 17 00:00:00 2001
+From: "Mizuma, Masayoshi" <m.mizuma@jp.fujitsu.com>
+Date: Fri, 18 Apr 2014 15:07:18 -0700
+Subject: mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()
+
+From: "Mizuma, Masayoshi" <m.mizuma@jp.fujitsu.com>
+
+commit 7848a4bf51b34f41fcc9bd77e837126d99ae84e3 upstream.
+
+soft lockup in freeing gigantic hugepage fixed in commit 55f67141a892 "mm:
+hugetlb: fix softlockup when a large number of hugepages are freed." can
+happen in return_unused_surplus_pages(), so let's fix it.
+
+Signed-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Cc: Michal Hocko <mhocko@suse.cz>
+Cc: Aneesh Kumar <aneesh.kumar@linux.vnet.ibm.com>
+Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/hugetlb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1134,6 +1134,7 @@ static void return_unused_surplus_pages(
+ while (nr_pages--) {
+ if (!free_pool_huge_page(h, &node_states[N_MEMORY], 1))
+ break;
++ cond_resched_lock(&hugetlb_lock);
+ }
+ }
+
--- /dev/null
+From 29c7787075c92ca8af353acd5301481e6f37082f Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@suse.de>
+Date: Fri, 18 Apr 2014 15:07:21 -0700
+Subject: mm: use paravirt friendly ops for NUMA hinting ptes
+
+From: Mel Gorman <mgorman@suse.de>
+
+commit 29c7787075c92ca8af353acd5301481e6f37082f upstream.
+
+David Vrabel identified a regression when using automatic NUMA balancing
+under Xen whereby page table entries were getting corrupted due to the
+use of native PTE operations. Quoting him
+
+ Xen PV guest page tables require that their entries use machine
+ addresses if the preset bit (_PAGE_PRESENT) is set, and (for
+ successful migration) non-present PTEs must use pseudo-physical
+ addresses. This is because on migration MFNs in present PTEs are
+ translated to PFNs (canonicalised) so they may be translated back
+ to the new MFN in the destination domain (uncanonicalised).
+
+ pte_mknonnuma(), pmd_mknonnuma(), pte_mknuma() and pmd_mknuma()
+ set and clear the _PAGE_PRESENT bit using pte_set_flags(),
+ pte_clear_flags(), etc.
+
+ In a Xen PV guest, these functions must translate MFNs to PFNs
+ when clearing _PAGE_PRESENT and translate PFNs to MFNs when setting
+ _PAGE_PRESENT.
+
+His suggested fix converted p[te|md]_[set|clear]_flags to using
+paravirt-friendly ops but this is overkill. He suggested an alternative
+of using p[te|md]_modify in the NUMA page table operations but this is
+does more work than necessary and would require looking up a VMA for
+protections.
+
+This patch modifies the NUMA page table operations to use paravirt
+friendly operations to set/clear the flags of interest. Unfortunately
+this will take a performance hit when updating the PTEs on
+CONFIG_PARAVIRT but I do not see a way around it that does not break
+Xen.
+
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Acked-by: David Vrabel <david.vrabel@citrix.com>
+Tested-by: David Vrabel <david.vrabel@citrix.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Anvin <hpa@zytor.com>
+Cc: Fengguang Wu <fengguang.wu@intel.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Steven Noonan <steven@uplinklabs.net>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Cc: Cyrill Gorcunov <gorcunov@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/asm-generic/pgtable.h | 31 +++++++++++++++++++++++--------
+ 1 file changed, 23 insertions(+), 8 deletions(-)
+
+--- a/include/asm-generic/pgtable.h
++++ b/include/asm-generic/pgtable.h
+@@ -680,24 +680,35 @@ static inline int pmd_numa(pmd_t pmd)
+ #ifndef pte_mknonnuma
+ static inline pte_t pte_mknonnuma(pte_t pte)
+ {
+- pte = pte_clear_flags(pte, _PAGE_NUMA);
+- return pte_set_flags(pte, _PAGE_PRESENT|_PAGE_ACCESSED);
++ pteval_t val = pte_val(pte);
++
++ val &= ~_PAGE_NUMA;
++ val |= (_PAGE_PRESENT|_PAGE_ACCESSED);
++ return __pte(val);
+ }
+ #endif
+
+ #ifndef pmd_mknonnuma
+ static inline pmd_t pmd_mknonnuma(pmd_t pmd)
+ {
+- pmd = pmd_clear_flags(pmd, _PAGE_NUMA);
+- return pmd_set_flags(pmd, _PAGE_PRESENT|_PAGE_ACCESSED);
++ pmdval_t val = pmd_val(pmd);
++
++ val &= ~_PAGE_NUMA;
++ val |= (_PAGE_PRESENT|_PAGE_ACCESSED);
++
++ return __pmd(val);
+ }
+ #endif
+
+ #ifndef pte_mknuma
+ static inline pte_t pte_mknuma(pte_t pte)
+ {
+- pte = pte_set_flags(pte, _PAGE_NUMA);
+- return pte_clear_flags(pte, _PAGE_PRESENT);
++ pteval_t val = pte_val(pte);
++
++ val &= ~_PAGE_PRESENT;
++ val |= _PAGE_NUMA;
++
++ return __pte(val);
+ }
+ #endif
+
+@@ -716,8 +727,12 @@ static inline void ptep_set_numa(struct
+ #ifndef pmd_mknuma
+ static inline pmd_t pmd_mknuma(pmd_t pmd)
+ {
+- pmd = pmd_set_flags(pmd, _PAGE_NUMA);
+- return pmd_clear_flags(pmd, _PAGE_PRESENT);
++ pmdval_t val = pmd_val(pmd);
++
++ val &= ~_PAGE_PRESENT;
++ val |= _PAGE_NUMA;
++
++ return __pmd(val);
+ }
+ #endif
+
--- /dev/null
+From f3b0cbce01cd5c242b420d986b208d306bdc5083 Mon Sep 17 00:00:00 2001
+From: Derya <derya.kiran@yahoo.de>
+Date: Mon, 31 Mar 2014 13:27:09 -0400
+Subject: Revert "HID: microsoft: Add ID's for Surface Type/Touch Cover 2"
+
+From: Derya <derya.kiran@yahoo.de>
+
+commit f3b0cbce01cd5c242b420d986b208d306bdc5083 upstream.
+
+This reverts commit 117309c51dca42121f70cacec801511b76acf75c.
+
+The MS Surface Pro 2 has an USB composite device with 3 interfaces
+- interface 0 - sensor hub
+- interface 1 - wacom digitizer
+- interface 2 - the keyboard cover, if one is attached
+This USB composite device changes it product id dependent on if and which
+keyboard cover is attached. Adding the covers to hid_have_special_driver
+prevents loading the right hid drivers for the other two interfaces, all 3
+get loaded with hid-microsoft. We don't even need hid-microsoft for the
+keyboards. We have to revert this to load the right hid modules for each
+interface.
+
+Signed-off-by: Derya <derya.kiran@yahoo.de>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-core.c | 2 --
+ drivers/hid/hid-ids.h | 2 --
+ drivers/hid/hid-microsoft.c | 4 ----
+ 3 files changed, 8 deletions(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1780,8 +1780,6 @@ static const struct hid_device_id hid_ha
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1) },
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -624,8 +624,6 @@
+ #define USB_DEVICE_ID_MS_PRESENTER_8K_USB 0x0713
+ #define USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K 0x0730
+ #define USB_DEVICE_ID_MS_COMFORT_MOUSE_4500 0x076c
+-#define USB_DEVICE_ID_MS_TOUCH_COVER_2 0x07a7
+-#define USB_DEVICE_ID_MS_TYPE_COVER_2 0x07a9
+
+ #define USB_VENDOR_ID_MOJO 0x8282
+ #define USB_DEVICE_ID_RETRO_ADAPTER 0x3201
+--- a/drivers/hid/hid-microsoft.c
++++ b/drivers/hid/hid-microsoft.c
+@@ -208,10 +208,6 @@ static const struct hid_device_id ms_dev
+ .driver_data = MS_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500),
+ .driver_data = MS_DUPLICATE_USAGES },
+- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2),
+- .driver_data = 0 },
+- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2),
+- .driver_data = 0 },
+
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT),
+ .driver_data = MS_PRESENTER },
parisc-fix-epoll_pwait-syscall-on-compat-kernel.patch
parisc-remove-_stk_lim_max-override.patch
don-t-bother-with-get-put-_write_access-on-non-regular-files.patch
-cifs-fix-the-race-in-cifs_writev.patch
cifs-wait-for-writebacks-to-complete-before-attempting-write.patch
xen-spinlock-don-t-enable-them-unconditionally.patch
xen-events-fifo-correctly-align-bitops.patch
+revert-hid-microsoft-add-id-s-for-surface-type-touch-cover-2.patch
+hid-core-do-not-scan-constant-input-report.patch
+hid-add-no_init_reports-quirk-for-synaptics-touch-pad-v-103s.patch
+md-raid1-r1buf_pool_alloc-free-allocate-pages-when-subsequent-allocation-fails.patch
+tracing-uprobes-fix-uprobe_cpu_buffer-memory-leak.patch
+tracing-use-rcu_dereference_sched-for-trace-event-triggers.patch
+init-kconfig-move-the-trusted-keyring-config-option-to-general-setup.patch
+thp-close-race-between-split-and-zap-huge-pages.patch
+mm-hugetlb.c-add-cond_resched_lock-in-return_unused_surplus_pages.patch
+mm-use-paravirt-friendly-ops-for-numa-hinting-ptes.patch
--- /dev/null
+From b5a8cad376eebbd8598642697e92a27983aee802 Mon Sep 17 00:00:00 2001
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Fri, 18 Apr 2014 15:07:25 -0700
+Subject: thp: close race between split and zap huge pages
+
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+
+commit b5a8cad376eebbd8598642697e92a27983aee802 upstream.
+
+Sasha Levin has reported two THP BUGs[1][2]. I believe both of them
+have the same root cause. Let's look to them one by one.
+
+The first bug[1] is "kernel BUG at mm/huge_memory.c:1829!". It's
+BUG_ON(mapcount != page_mapcount(page)) in __split_huge_page(). From my
+testing I see that page_mapcount() is higher than mapcount here.
+
+I think it happens due to race between zap_huge_pmd() and
+page_check_address_pmd(). page_check_address_pmd() misses PMD which is
+under zap:
+
+ CPU0 CPU1
+ zap_huge_pmd()
+ pmdp_get_and_clear()
+__split_huge_page()
+ anon_vma_interval_tree_foreach()
+ __split_huge_page_splitting()
+ page_check_address_pmd()
+ mm_find_pmd()
+ /*
+ * We check if PMD present without taking ptl: no
+ * serialization against zap_huge_pmd(). We miss this PMD,
+ * it's not accounted to 'mapcount' in __split_huge_page().
+ */
+ pmd_present(pmd) == 0
+
+ BUG_ON(mapcount != page_mapcount(page)) // CRASH!!!
+
+ page_remove_rmap(page)
+ atomic_add_negative(-1, &page->_mapcount)
+
+The second bug[2] is "kernel BUG at mm/huge_memory.c:1371!".
+It's VM_BUG_ON_PAGE(!PageHead(page), page) in zap_huge_pmd().
+
+This happens in similar way:
+
+ CPU0 CPU1
+ zap_huge_pmd()
+ pmdp_get_and_clear()
+ page_remove_rmap(page)
+ atomic_add_negative(-1, &page->_mapcount)
+__split_huge_page()
+ anon_vma_interval_tree_foreach()
+ __split_huge_page_splitting()
+ page_check_address_pmd()
+ mm_find_pmd()
+ pmd_present(pmd) == 0 /* The same comment as above */
+ /*
+ * No crash this time since we already decremented page->_mapcount in
+ * zap_huge_pmd().
+ */
+ BUG_ON(mapcount != page_mapcount(page))
+
+ /*
+ * We split the compound page here into small pages without
+ * serialization against zap_huge_pmd()
+ */
+ __split_huge_page_refcount()
+ VM_BUG_ON_PAGE(!PageHead(page), page); // CRASH!!!
+
+So my understanding the problem is pmd_present() check in mm_find_pmd()
+without taking page table lock.
+
+The bug was introduced by me commit with commit 117b0791ac42. Sorry for
+that. :(
+
+Let's open code mm_find_pmd() in page_check_address_pmd() and do the
+check under page table lock.
+
+Note that __page_check_address() does the same for PTE entires
+if sync != 0.
+
+I've stress tested split and zap code paths for 36+ hours by now and
+don't see crashes with the patch applied. Before it took <20 min to
+trigger the first bug and few hours for second one (if we ignore
+first).
+
+[1] https://lkml.kernel.org/g/<53440991.9090001@oracle.com>
+[2] https://lkml.kernel.org/g/<5310C56C.60709@oracle.com>
+
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Reported-by: Sasha Levin <sasha.levin@oracle.com>
+Tested-by: Sasha Levin <sasha.levin@oracle.com>
+Cc: Bob Liu <lliubbo@gmail.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Michel Lespinasse <walken@google.com>
+Cc: Dave Jones <davej@redhat.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/huge_memory.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1611,16 +1611,23 @@ pmd_t *page_check_address_pmd(struct pag
+ enum page_check_address_pmd_flag flag,
+ spinlock_t **ptl)
+ {
++ pgd_t *pgd;
++ pud_t *pud;
+ pmd_t *pmd;
+
+ if (address & ~HPAGE_PMD_MASK)
+ return NULL;
+
+- pmd = mm_find_pmd(mm, address);
+- if (!pmd)
++ pgd = pgd_offset(mm, address);
++ if (!pgd_present(*pgd))
+ return NULL;
++ pud = pud_offset(pgd, address);
++ if (!pud_present(*pud))
++ return NULL;
++ pmd = pmd_offset(pud, address);
++
+ *ptl = pmd_lock(mm, pmd);
+- if (pmd_none(*pmd))
++ if (!pmd_present(*pmd))
+ goto unlock;
+ if (pmd_page(*pmd) != page)
+ goto unlock;
--- /dev/null
+From 6ea6215fe394e320468589d9bba464a48f6d823a Mon Sep 17 00:00:00 2001
+From: "zhangwei(Jovi)" <jovi.zhangwei@huawei.com>
+Date: Thu, 17 Apr 2014 16:05:19 +0800
+Subject: tracing/uprobes: Fix uprobe_cpu_buffer memory leak
+
+From: "zhangwei(Jovi)" <jovi.zhangwei@huawei.com>
+
+commit 6ea6215fe394e320468589d9bba464a48f6d823a upstream.
+
+Forgot to free uprobe_cpu_buffer percpu page in uprobe_buffer_disable().
+
+Link: http://lkml.kernel.org/p/534F8B3F.1090407@huawei.com
+
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: zhangwei(Jovi) <jovi.zhangwei@huawei.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace_uprobe.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -728,9 +728,15 @@ static int uprobe_buffer_enable(void)
+
+ static void uprobe_buffer_disable(void)
+ {
++ int cpu;
++
+ BUG_ON(!mutex_is_locked(&event_mutex));
+
+ if (--uprobe_buffer_refcnt == 0) {
++ for_each_possible_cpu(cpu)
++ free_page((unsigned long)per_cpu_ptr(uprobe_cpu_buffer,
++ cpu)->buf);
++
+ free_percpu(uprobe_cpu_buffer);
+ uprobe_cpu_buffer = NULL;
+ }
--- /dev/null
+From 561a4fe851ccab9dd0d14989ab566f9392d9f8b5 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Fri, 2 May 2014 13:30:04 -0400
+Subject: tracing: Use rcu_dereference_sched() for trace event triggers
+
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+
+commit 561a4fe851ccab9dd0d14989ab566f9392d9f8b5 upstream.
+
+As trace event triggers are now part of the mainline kernel, I added
+my trace event trigger tests to my test suite I run on all my kernels.
+Now these tests get run under different config options, and one of
+those options is CONFIG_PROVE_RCU, which checks under lockdep that
+the rcu locking primitives are being used correctly. This triggered
+the following splat:
+
+===============================
+[ INFO: suspicious RCU usage. ]
+3.15.0-rc2-test+ #11 Not tainted
+-------------------------------
+kernel/trace/trace_events_trigger.c:80 suspicious rcu_dereference_check() usage!
+
+other info that might help us debug this:
+
+rcu_scheduler_active = 1, debug_locks = 0
+4 locks held by swapper/1/0:
+ #0: ((&(&j_cdbs->work)->timer)){..-...}, at: [<ffffffff8104d2cc>] call_timer_fn+0x5/0x1be
+ #1: (&(&pool->lock)->rlock){-.-...}, at: [<ffffffff81059856>] __queue_work+0x140/0x283
+ #2: (&p->pi_lock){-.-.-.}, at: [<ffffffff8106e961>] try_to_wake_up+0x2e/0x1e8
+ #3: (&rq->lock){-.-.-.}, at: [<ffffffff8106ead3>] try_to_wake_up+0x1a0/0x1e8
+
+stack backtrace:
+CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.15.0-rc2-test+ #11
+Hardware name: /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006
+ 0000000000000001 ffff88007e083b98 ffffffff819f53a5 0000000000000006
+ ffff88007b0942c0 ffff88007e083bc8 ffffffff81081307 ffff88007ad96d20
+ 0000000000000000 ffff88007af2d840 ffff88007b2e701c ffff88007e083c18
+Call Trace:
+ <IRQ> [<ffffffff819f53a5>] dump_stack+0x4f/0x7c
+ [<ffffffff81081307>] lockdep_rcu_suspicious+0x107/0x110
+ [<ffffffff810ee51c>] event_triggers_call+0x99/0x108
+ [<ffffffff810e8174>] ftrace_event_buffer_commit+0x42/0xa4
+ [<ffffffff8106aadc>] ftrace_raw_event_sched_wakeup_template+0x71/0x7c
+ [<ffffffff8106bcbf>] ttwu_do_wakeup+0x7f/0xff
+ [<ffffffff8106bd9b>] ttwu_do_activate.constprop.126+0x5c/0x61
+ [<ffffffff8106eadf>] try_to_wake_up+0x1ac/0x1e8
+ [<ffffffff8106eb77>] wake_up_process+0x36/0x3b
+ [<ffffffff810575cc>] wake_up_worker+0x24/0x26
+ [<ffffffff810578bc>] insert_work+0x5c/0x65
+ [<ffffffff81059982>] __queue_work+0x26c/0x283
+ [<ffffffff81059999>] ? __queue_work+0x283/0x283
+ [<ffffffff810599b7>] delayed_work_timer_fn+0x1e/0x20
+ [<ffffffff8104d3a6>] call_timer_fn+0xdf/0x1be^M
+ [<ffffffff8104d2cc>] ? call_timer_fn+0x5/0x1be
+ [<ffffffff81059999>] ? __queue_work+0x283/0x283
+ [<ffffffff8104d823>] run_timer_softirq+0x1a4/0x22f^M
+ [<ffffffff8104696d>] __do_softirq+0x17b/0x31b^M
+ [<ffffffff81046d03>] irq_exit+0x42/0x97
+ [<ffffffff81a08db6>] smp_apic_timer_interrupt+0x37/0x44
+ [<ffffffff81a07a2f>] apic_timer_interrupt+0x6f/0x80
+ <EOI> [<ffffffff8100a5d8>] ? default_idle+0x21/0x32
+ [<ffffffff8100a5d6>] ? default_idle+0x1f/0x32
+ [<ffffffff8100ac10>] arch_cpu_idle+0xf/0x11
+ [<ffffffff8107b3a4>] cpu_startup_entry+0x1a3/0x213
+ [<ffffffff8102a23c>] start_secondary+0x212/0x219
+
+The cause is that the triggers are protected by rcu_read_lock_sched() but
+the data is dereferenced with rcu_dereference() which expects it to
+be protected with rcu_read_lock(). The proper reference should be
+rcu_dereference_sched().
+
+Cc: Tom Zanussi <tom.zanussi@linux.intel.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace_events_trigger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -77,7 +77,7 @@ event_triggers_call(struct ftrace_event_
+ data->ops->func(data);
+ continue;
+ }
+- filter = rcu_dereference(data->filter);
++ filter = rcu_dereference_sched(data->filter);
+ if (filter && !filter_match_preds(filter, rec))
+ continue;
+ if (data->cmd_ops->post_trigger) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
