From: Greg Kroah-Hartman Date: Tue, 20 May 2014 03:43:57 +0000 (+0900) Subject: 3.14-stable patches X-Git-Tag: v3.10.41~12 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=86707ce8729256b9ac35c08b55cbe50fe646cf8c;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: hid-add-no_init_reports-quirk-for-synaptics-touch-pad-v-103s.patch hid-core-do-not-scan-constant-input-report.patch init-kconfig-move-the-trusted-keyring-config-option-to-general-setup.patch md-raid1-r1buf_pool_alloc-free-allocate-pages-when-subsequent-allocation-fails.patch mm-hugetlb.c-add-cond_resched_lock-in-return_unused_surplus_pages.patch mm-use-paravirt-friendly-ops-for-numa-hinting-ptes.patch revert-hid-microsoft-add-id-s-for-surface-type-touch-cover-2.patch thp-close-race-between-split-and-zap-huge-pages.patch tracing-uprobes-fix-uprobe_cpu_buffer-memory-leak.patch tracing-use-rcu_dereference_sched-for-trace-event-triggers.patch --- diff --git a/queue-3.14/cifs-fix-the-race-in-cifs_writev.patch b/queue-3.14/cifs-fix-the-race-in-cifs_writev.patch deleted file mode 100644 index 6889ee4863b..00000000000 --- a/queue-3.14/cifs-fix-the-race-in-cifs_writev.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 19dfc1f5f2ef03a52aa30c8257c5745edef23f55 Mon Sep 17 00:00:00 2001 -From: Al Viro -Date: Thu, 3 Apr 2014 10:27:17 -0400 -Subject: cifs: fix the race in cifs_writev() - -From: Al Viro - -commit 19dfc1f5f2ef03a52aa30c8257c5745edef23f55 upstream. - -O_APPEND handling there hadn't been completely fixed by Pavel's -patch; it checks the right value, but it's racy - we can't really -do that until i_mutex has been taken. - -Fix by switching to __generic_file_aio_write() (open-coding -generic_file_aio_write(), actually) and pulling mutex_lock() above -inode_size_read(). - -Signed-off-by: Al Viro -Signed-off-by: Greg Kroah-Hartman - ---- - fs/cifs/file.c | 23 ++++++++++++++++++----- - 1 file changed, 18 insertions(+), 5 deletions(-) - ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -2579,19 +2579,32 @@ cifs_writev(struct kiocb *iocb, const st - struct cifsInodeInfo *cinode = CIFS_I(inode); - struct TCP_Server_Info *server = tlink_tcon(cfile->tlink)->ses->server; - ssize_t rc = -EACCES; -- loff_t lock_pos = pos; -+ loff_t lock_pos = iocb->ki_pos; - -- if (file->f_flags & O_APPEND) -- lock_pos = i_size_read(inode); - /* - * We need to hold the sem to be sure nobody modifies lock list - * with a brlock that prevents writing. - */ - down_read(&cinode->lock_sem); -+ mutex_lock(&inode->i_mutex); -+ if (file->f_flags & O_APPEND) -+ lock_pos = i_size_read(inode); - if (!cifs_find_lock_conflict(cfile, lock_pos, iov_length(iov, nr_segs), - server->vals->exclusive_lock_type, NULL, -- CIFS_WRITE_OP)) -- rc = generic_file_aio_write(iocb, iov, nr_segs, pos); -+ CIFS_WRITE_OP)) { -+ rc = __generic_file_aio_write(iocb, iov, nr_segs); -+ mutex_unlock(&inode->i_mutex); -+ -+ if (rc > 0) { -+ ssize_t err; -+ -+ err = generic_write_sync(file, iocb->ki_pos - rc, rc); -+ if (rc < 0) -+ rc = err; -+ } -+ } else { -+ mutex_unlock(&inode->i_mutex); -+ } - up_read(&cinode->lock_sem); - return rc; - } diff --git a/queue-3.14/cifs-wait-for-writebacks-to-complete-before-attempting-write.patch b/queue-3.14/cifs-wait-for-writebacks-to-complete-before-attempting-write.patch index a0b22939d83..a8a3903cb9b 100644 --- a/queue-3.14/cifs-wait-for-writebacks-to-complete-before-attempting-write.patch +++ b/queue-3.14/cifs-wait-for-writebacks-to-complete-before-attempting-write.patch @@ -136,7 +136,7 @@ Signed-off-by: Greg Kroah-Hartman extern int cifs_push_mandatory_locks(struct cifsFileInfo *cfile); --- a/fs/cifs/file.c +++ b/fs/cifs/file.c -@@ -2621,12 +2621,20 @@ cifs_strict_writev(struct kiocb *iocb, c +@@ -2608,12 +2608,20 @@ cifs_strict_writev(struct kiocb *iocb, c struct cifs_tcon *tcon = tlink_tcon(cfile->tlink); ssize_t written; @@ -160,7 +160,7 @@ Signed-off-by: Greg Kroah-Hartman } /* * For non-oplocked files in strict cache mode we need to write the data -@@ -2646,6 +2654,8 @@ cifs_strict_writev(struct kiocb *iocb, c +@@ -2633,6 +2641,8 @@ cifs_strict_writev(struct kiocb *iocb, c inode); cinode->oplock = 0; } @@ -169,7 +169,7 @@ Signed-off-by: Greg Kroah-Hartman return written; } -@@ -3657,6 +3667,13 @@ static int cifs_launder_page(struct page +@@ -3644,6 +3654,13 @@ static int cifs_launder_page(struct page return rc; } @@ -183,7 +183,7 @@ Signed-off-by: Greg Kroah-Hartman void cifs_oplock_break(struct work_struct *work) { struct cifsFileInfo *cfile = container_of(work, struct cifsFileInfo, -@@ -3664,8 +3681,15 @@ void cifs_oplock_break(struct work_struc +@@ -3651,8 +3668,15 @@ void cifs_oplock_break(struct work_struc struct inode *inode = cfile->dentry->d_inode; struct cifsInodeInfo *cinode = CIFS_I(inode); struct cifs_tcon *tcon = tlink_tcon(cfile->tlink); @@ -199,7 +199,7 @@ Signed-off-by: Greg Kroah-Hartman if (!CIFS_CACHE_WRITE(cinode) && CIFS_CACHE_READ(cinode) && cifs_has_mand_locks(cinode)) { cifs_dbg(FYI, "Reset oplock to None for inode=%p due to mand locks\n", -@@ -3702,6 +3726,7 @@ void cifs_oplock_break(struct work_struc +@@ -3689,6 +3713,7 @@ void cifs_oplock_break(struct work_struc cinode); cifs_dbg(FYI, "Oplock release rc = %d\n", rc); } diff --git a/queue-3.14/hid-add-no_init_reports-quirk-for-synaptics-touch-pad-v-103s.patch b/queue-3.14/hid-add-no_init_reports-quirk-for-synaptics-touch-pad-v-103s.patch new file mode 100644 index 00000000000..364498582b9 --- /dev/null +++ b/queue-3.14/hid-add-no_init_reports-quirk-for-synaptics-touch-pad-v-103s.patch @@ -0,0 +1,43 @@ +From 2f433083e854ec72c19dc9b0e1cebcc8e230fd75 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 2 May 2014 19:48:13 +0200 +Subject: HID: add NO_INIT_REPORTS quirk for Synaptics Touch Pad V 103S + +From: Hans de Goede + +commit 2f433083e854ec72c19dc9b0e1cebcc8e230fd75 upstream. + +This touchpad seriously dislikes init reports, not only timeing out, but +also refusing to work after this. + +Reported-and-tested-by: Vincent Fortier +Signed-off-by: Hans de Goede +Reviewed-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/usbhid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -828,6 +828,7 @@ + #define USB_DEVICE_ID_SYNAPTICS_LTS2 0x1d10 + #define USB_DEVICE_ID_SYNAPTICS_HD 0x0ac3 + #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD 0x1ac3 ++#define USB_DEVICE_ID_SYNAPTICS_TP_V103 0x5710 + + #define USB_VENDOR_ID_THINGM 0x27b8 + #define USB_DEVICE_ID_BLINK1 0x01ed +--- a/drivers/hid/usbhid/hid-quirks.c ++++ b/drivers/hid/usbhid/hid-quirks.c +@@ -119,6 +119,7 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD, HID_QUIRK_NO_INIT_REPORTS }, ++ { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103, HID_QUIRK_NO_INIT_REPORTS }, + + { 0, 0 } + }; diff --git a/queue-3.14/hid-core-do-not-scan-constant-input-report.patch b/queue-3.14/hid-core-do-not-scan-constant-input-report.patch new file mode 100644 index 00000000000..53921984657 --- /dev/null +++ b/queue-3.14/hid-core-do-not-scan-constant-input-report.patch @@ -0,0 +1,39 @@ +From e24d0d399b2fce71b627043e900ef28283850482 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Mon, 31 Mar 2014 13:27:10 -0400 +Subject: HID: core: do not scan constant input report + +From: Benjamin Tissoires + +commit e24d0d399b2fce71b627043e900ef28283850482 upstream. + +The Microsoft Surface Type/Touch Cover 2 is a fancy device which advertised +itself as a multitouch device but with constant input reports. +This way, hid_scan_report() gives the group MULTITOUCH to it, but +hid-multitouch can not handle it due to the constant collection ignored +by hid-input. + +To prevent such crap in the future, and while we do not fix this particular +device, make the scan_report coherent with hid-input.c, and ignore constant +input reports. + +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -718,6 +718,9 @@ static int hid_scan_main(struct hid_pars + case HID_MAIN_ITEM_TAG_END_COLLECTION: + break; + case HID_MAIN_ITEM_TAG_INPUT: ++ /* ignore constant inputs, they will be ignored by hid-input */ ++ if (data & HID_MAIN_ITEM_CONSTANT) ++ break; + for (i = 0; i < parser->local.usage_index; i++) + hid_scan_input_usage(parser, parser->local.usage[i]); + break; diff --git a/queue-3.14/init-kconfig-move-the-trusted-keyring-config-option-to-general-setup.patch b/queue-3.14/init-kconfig-move-the-trusted-keyring-config-option-to-general-setup.patch new file mode 100644 index 00000000000..25b0df29f09 --- /dev/null +++ b/queue-3.14/init-kconfig-move-the-trusted-keyring-config-option-to-general-setup.patch @@ -0,0 +1,63 @@ +From 82c04ff89eba09d0e46e3f3649c6d3aa18e764a0 Mon Sep 17 00:00:00 2001 +From: Peter Foley +Date: Fri, 18 Apr 2014 15:07:11 -0700 +Subject: init/Kconfig: move the trusted keyring config option to general setup + +From: Peter Foley + +commit 82c04ff89eba09d0e46e3f3649c6d3aa18e764a0 upstream. + +The SYSTEM_TRUSTED_KEYRING config option is not in any menu, causing it +to show up in the toplevel of the kernel configuration. Fix this by +moving it under the General Setup menu. + +Signed-off-by: Peter Foley +Cc: David Howells +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + init/Kconfig | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1621,6 +1621,18 @@ config MMAP_ALLOW_UNINITIALIZED + + See Documentation/nommu-mmap.txt for more information. + ++config SYSTEM_TRUSTED_KEYRING ++ bool "Provide system-wide ring of trusted keys" ++ depends on KEYS ++ help ++ Provide a system keyring to which trusted keys can be added. Keys in ++ the keyring are considered to be trusted. Keys may be added at will ++ by the kernel from compiled-in data and from hardware key stores, but ++ userspace may only add extra keys if those keys can be verified by ++ keys already in the keyring. ++ ++ Keys in this keyring are used by module signature checking. ++ + config PROFILING + bool "Profiling support" + help +@@ -1656,18 +1668,6 @@ config BASE_SMALL + default 0 if BASE_FULL + default 1 if !BASE_FULL + +-config SYSTEM_TRUSTED_KEYRING +- bool "Provide system-wide ring of trusted keys" +- depends on KEYS +- help +- Provide a system keyring to which trusted keys can be added. Keys in +- the keyring are considered to be trusted. Keys may be added at will +- by the kernel from compiled-in data and from hardware key stores, but +- userspace may only add extra keys if those keys can be verified by +- keys already in the keyring. +- +- Keys in this keyring are used by module signature checking. +- + menuconfig MODULES + bool "Enable loadable module support" + option modules diff --git a/queue-3.14/md-raid1-r1buf_pool_alloc-free-allocate-pages-when-subsequent-allocation-fails.patch b/queue-3.14/md-raid1-r1buf_pool_alloc-free-allocate-pages-when-subsequent-allocation-fails.patch new file mode 100644 index 00000000000..c115417781f --- /dev/null +++ b/queue-3.14/md-raid1-r1buf_pool_alloc-free-allocate-pages-when-subsequent-allocation-fails.patch @@ -0,0 +1,76 @@ +From da1aab3dca9aa88ae34ca392470b8943159e25fe Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Wed, 9 Apr 2014 12:25:43 +1000 +Subject: md/raid1: r1buf_pool_alloc: free allocate pages when subsequent allocation fails. + +From: NeilBrown + +commit da1aab3dca9aa88ae34ca392470b8943159e25fe upstream. + +When performing a user-request check/repair (MD_RECOVERY_REQUEST is set) +on a raid1, we allocate multiple bios each with their own set of pages. + +If the page allocations for one bio fails, we currently do *not* free +the pages allocated for the previous bios, nor do we free the bio itself. + +This patch frees all the already-allocate pages, and makes sure that +all the bios are freed as well. + +This bug can cause a memory leak which can ultimately OOM a machine. +It was introduced in 3.10-rc1. + +Fixes: a07876064a0b73ab5ef1ebcf14b1cf0231c07858 +Cc: Kent Overstreet +Reported-by: Russell King - ARM Linux +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid1.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -97,6 +97,7 @@ static void * r1buf_pool_alloc(gfp_t gfp + struct pool_info *pi = data; + struct r1bio *r1_bio; + struct bio *bio; ++ int need_pages; + int i, j; + + r1_bio = r1bio_pool_alloc(gfp_flags, pi); +@@ -119,15 +120,15 @@ static void * r1buf_pool_alloc(gfp_t gfp + * RESYNC_PAGES for each bio. + */ + if (test_bit(MD_RECOVERY_REQUESTED, &pi->mddev->recovery)) +- j = pi->raid_disks; ++ need_pages = pi->raid_disks; + else +- j = 1; +- while(j--) { ++ need_pages = 1; ++ for (j = 0; j < need_pages; j++) { + bio = r1_bio->bios[j]; + bio->bi_vcnt = RESYNC_PAGES; + + if (bio_alloc_pages(bio, gfp_flags)) +- goto out_free_bio; ++ goto out_free_pages; + } + /* If not user-requests, copy the page pointers to all bios */ + if (!test_bit(MD_RECOVERY_REQUESTED, &pi->mddev->recovery)) { +@@ -141,6 +142,14 @@ static void * r1buf_pool_alloc(gfp_t gfp + + return r1_bio; + ++out_free_pages: ++ while (--j >= 0) { ++ struct bio_vec *bv; ++ ++ bio_for_each_segment_all(bv, r1_bio->bios[j], i) ++ __free_page(bv->bv_page); ++ } ++ + out_free_bio: + while (++j < pi->raid_disks) + bio_put(r1_bio->bios[j]); diff --git a/queue-3.14/mm-hugetlb.c-add-cond_resched_lock-in-return_unused_surplus_pages.patch b/queue-3.14/mm-hugetlb.c-add-cond_resched_lock-in-return_unused_surplus_pages.patch new file mode 100644 index 00000000000..59e59fa45fa --- /dev/null +++ b/queue-3.14/mm-hugetlb.c-add-cond_resched_lock-in-return_unused_surplus_pages.patch @@ -0,0 +1,37 @@ +From 7848a4bf51b34f41fcc9bd77e837126d99ae84e3 Mon Sep 17 00:00:00 2001 +From: "Mizuma, Masayoshi" +Date: Fri, 18 Apr 2014 15:07:18 -0700 +Subject: mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages() + +From: "Mizuma, Masayoshi" + +commit 7848a4bf51b34f41fcc9bd77e837126d99ae84e3 upstream. + +soft lockup in freeing gigantic hugepage fixed in commit 55f67141a892 "mm: +hugetlb: fix softlockup when a large number of hugepages are freed." can +happen in return_unused_surplus_pages(), so let's fix it. + +Signed-off-by: Masayoshi Mizuma +Signed-off-by: Naoya Horiguchi +Cc: Joonsoo Kim +Cc: Michal Hocko +Cc: Aneesh Kumar +Cc: KOSAKI Motohiro +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -1134,6 +1134,7 @@ static void return_unused_surplus_pages( + while (nr_pages--) { + if (!free_pool_huge_page(h, &node_states[N_MEMORY], 1)) + break; ++ cond_resched_lock(&hugetlb_lock); + } + } + diff --git a/queue-3.14/mm-use-paravirt-friendly-ops-for-numa-hinting-ptes.patch b/queue-3.14/mm-use-paravirt-friendly-ops-for-numa-hinting-ptes.patch new file mode 100644 index 00000000000..5fddc0b4dab --- /dev/null +++ b/queue-3.14/mm-use-paravirt-friendly-ops-for-numa-hinting-ptes.patch @@ -0,0 +1,121 @@ +From 29c7787075c92ca8af353acd5301481e6f37082f Mon Sep 17 00:00:00 2001 +From: Mel Gorman +Date: Fri, 18 Apr 2014 15:07:21 -0700 +Subject: mm: use paravirt friendly ops for NUMA hinting ptes + +From: Mel Gorman + +commit 29c7787075c92ca8af353acd5301481e6f37082f upstream. + +David Vrabel identified a regression when using automatic NUMA balancing +under Xen whereby page table entries were getting corrupted due to the +use of native PTE operations. Quoting him + + Xen PV guest page tables require that their entries use machine + addresses if the preset bit (_PAGE_PRESENT) is set, and (for + successful migration) non-present PTEs must use pseudo-physical + addresses. This is because on migration MFNs in present PTEs are + translated to PFNs (canonicalised) so they may be translated back + to the new MFN in the destination domain (uncanonicalised). + + pte_mknonnuma(), pmd_mknonnuma(), pte_mknuma() and pmd_mknuma() + set and clear the _PAGE_PRESENT bit using pte_set_flags(), + pte_clear_flags(), etc. + + In a Xen PV guest, these functions must translate MFNs to PFNs + when clearing _PAGE_PRESENT and translate PFNs to MFNs when setting + _PAGE_PRESENT. + +His suggested fix converted p[te|md]_[set|clear]_flags to using +paravirt-friendly ops but this is overkill. He suggested an alternative +of using p[te|md]_modify in the NUMA page table operations but this is +does more work than necessary and would require looking up a VMA for +protections. + +This patch modifies the NUMA page table operations to use paravirt +friendly operations to set/clear the flags of interest. Unfortunately +this will take a performance hit when updating the PTEs on +CONFIG_PARAVIRT but I do not see a way around it that does not break +Xen. + +Signed-off-by: Mel Gorman +Acked-by: David Vrabel +Tested-by: David Vrabel +Cc: Ingo Molnar +Cc: Peter Anvin +Cc: Fengguang Wu +Cc: Linus Torvalds +Cc: Steven Noonan +Cc: Rik van Riel +Cc: Peter Zijlstra +Cc: Andrea Arcangeli +Cc: Dave Hansen +Cc: Srikar Dronamraju +Cc: Cyrill Gorcunov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-generic/pgtable.h | 31 +++++++++++++++++++++++-------- + 1 file changed, 23 insertions(+), 8 deletions(-) + +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -680,24 +680,35 @@ static inline int pmd_numa(pmd_t pmd) + #ifndef pte_mknonnuma + static inline pte_t pte_mknonnuma(pte_t pte) + { +- pte = pte_clear_flags(pte, _PAGE_NUMA); +- return pte_set_flags(pte, _PAGE_PRESENT|_PAGE_ACCESSED); ++ pteval_t val = pte_val(pte); ++ ++ val &= ~_PAGE_NUMA; ++ val |= (_PAGE_PRESENT|_PAGE_ACCESSED); ++ return __pte(val); + } + #endif + + #ifndef pmd_mknonnuma + static inline pmd_t pmd_mknonnuma(pmd_t pmd) + { +- pmd = pmd_clear_flags(pmd, _PAGE_NUMA); +- return pmd_set_flags(pmd, _PAGE_PRESENT|_PAGE_ACCESSED); ++ pmdval_t val = pmd_val(pmd); ++ ++ val &= ~_PAGE_NUMA; ++ val |= (_PAGE_PRESENT|_PAGE_ACCESSED); ++ ++ return __pmd(val); + } + #endif + + #ifndef pte_mknuma + static inline pte_t pte_mknuma(pte_t pte) + { +- pte = pte_set_flags(pte, _PAGE_NUMA); +- return pte_clear_flags(pte, _PAGE_PRESENT); ++ pteval_t val = pte_val(pte); ++ ++ val &= ~_PAGE_PRESENT; ++ val |= _PAGE_NUMA; ++ ++ return __pte(val); + } + #endif + +@@ -716,8 +727,12 @@ static inline void ptep_set_numa(struct + #ifndef pmd_mknuma + static inline pmd_t pmd_mknuma(pmd_t pmd) + { +- pmd = pmd_set_flags(pmd, _PAGE_NUMA); +- return pmd_clear_flags(pmd, _PAGE_PRESENT); ++ pmdval_t val = pmd_val(pmd); ++ ++ val &= ~_PAGE_PRESENT; ++ val |= _PAGE_NUMA; ++ ++ return __pmd(val); + } + #endif + diff --git a/queue-3.14/revert-hid-microsoft-add-id-s-for-surface-type-touch-cover-2.patch b/queue-3.14/revert-hid-microsoft-add-id-s-for-surface-type-touch-cover-2.patch new file mode 100644 index 00000000000..81213efa954 --- /dev/null +++ b/queue-3.14/revert-hid-microsoft-add-id-s-for-surface-type-touch-cover-2.patch @@ -0,0 +1,68 @@ +From f3b0cbce01cd5c242b420d986b208d306bdc5083 Mon Sep 17 00:00:00 2001 +From: Derya +Date: Mon, 31 Mar 2014 13:27:09 -0400 +Subject: Revert "HID: microsoft: Add ID's for Surface Type/Touch Cover 2" + +From: Derya + +commit f3b0cbce01cd5c242b420d986b208d306bdc5083 upstream. + +This reverts commit 117309c51dca42121f70cacec801511b76acf75c. + +The MS Surface Pro 2 has an USB composite device with 3 interfaces +- interface 0 - sensor hub +- interface 1 - wacom digitizer +- interface 2 - the keyboard cover, if one is attached +This USB composite device changes it product id dependent on if and which +keyboard cover is attached. Adding the covers to hid_have_special_driver +prevents loading the right hid drivers for the other two interfaces, all 3 +get loaded with hid-microsoft. We don't even need hid-microsoft for the +keyboards. We have to revert this to load the right hid modules for each +interface. + +Signed-off-by: Derya +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-core.c | 2 -- + drivers/hid/hid-ids.h | 2 -- + drivers/hid/hid-microsoft.c | 4 ---- + 3 files changed, 8 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1780,8 +1780,6 @@ static const struct hid_device_id hid_ha + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) }, + { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) }, + { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1) }, +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -624,8 +624,6 @@ + #define USB_DEVICE_ID_MS_PRESENTER_8K_USB 0x0713 + #define USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K 0x0730 + #define USB_DEVICE_ID_MS_COMFORT_MOUSE_4500 0x076c +-#define USB_DEVICE_ID_MS_TOUCH_COVER_2 0x07a7 +-#define USB_DEVICE_ID_MS_TYPE_COVER_2 0x07a9 + + #define USB_VENDOR_ID_MOJO 0x8282 + #define USB_DEVICE_ID_RETRO_ADAPTER 0x3201 +--- a/drivers/hid/hid-microsoft.c ++++ b/drivers/hid/hid-microsoft.c +@@ -208,10 +208,6 @@ static const struct hid_device_id ms_dev + .driver_data = MS_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500), + .driver_data = MS_DUPLICATE_USAGES }, +- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2), +- .driver_data = 0 }, +- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2), +- .driver_data = 0 }, + + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT), + .driver_data = MS_PRESENTER }, diff --git a/queue-3.14/series b/queue-3.14/series index 625d4a25045..fc0257e436d 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -21,7 +21,16 @@ parisc-change-value-of-shmlba-from-0x00400000-to-page_size.patch parisc-fix-epoll_pwait-syscall-on-compat-kernel.patch parisc-remove-_stk_lim_max-override.patch don-t-bother-with-get-put-_write_access-on-non-regular-files.patch -cifs-fix-the-race-in-cifs_writev.patch cifs-wait-for-writebacks-to-complete-before-attempting-write.patch xen-spinlock-don-t-enable-them-unconditionally.patch xen-events-fifo-correctly-align-bitops.patch +revert-hid-microsoft-add-id-s-for-surface-type-touch-cover-2.patch +hid-core-do-not-scan-constant-input-report.patch +hid-add-no_init_reports-quirk-for-synaptics-touch-pad-v-103s.patch +md-raid1-r1buf_pool_alloc-free-allocate-pages-when-subsequent-allocation-fails.patch +tracing-uprobes-fix-uprobe_cpu_buffer-memory-leak.patch +tracing-use-rcu_dereference_sched-for-trace-event-triggers.patch +init-kconfig-move-the-trusted-keyring-config-option-to-general-setup.patch +thp-close-race-between-split-and-zap-huge-pages.patch +mm-hugetlb.c-add-cond_resched_lock-in-return_unused_surplus_pages.patch +mm-use-paravirt-friendly-ops-for-numa-hinting-ptes.patch diff --git a/queue-3.14/thp-close-race-between-split-and-zap-huge-pages.patch b/queue-3.14/thp-close-race-between-split-and-zap-huge-pages.patch new file mode 100644 index 00000000000..2a9fef0201c --- /dev/null +++ b/queue-3.14/thp-close-race-between-split-and-zap-huge-pages.patch @@ -0,0 +1,136 @@ +From b5a8cad376eebbd8598642697e92a27983aee802 Mon Sep 17 00:00:00 2001 +From: "Kirill A. Shutemov" +Date: Fri, 18 Apr 2014 15:07:25 -0700 +Subject: thp: close race between split and zap huge pages + +From: "Kirill A. Shutemov" + +commit b5a8cad376eebbd8598642697e92a27983aee802 upstream. + +Sasha Levin has reported two THP BUGs[1][2]. I believe both of them +have the same root cause. Let's look to them one by one. + +The first bug[1] is "kernel BUG at mm/huge_memory.c:1829!". It's +BUG_ON(mapcount != page_mapcount(page)) in __split_huge_page(). From my +testing I see that page_mapcount() is higher than mapcount here. + +I think it happens due to race between zap_huge_pmd() and +page_check_address_pmd(). page_check_address_pmd() misses PMD which is +under zap: + + CPU0 CPU1 + zap_huge_pmd() + pmdp_get_and_clear() +__split_huge_page() + anon_vma_interval_tree_foreach() + __split_huge_page_splitting() + page_check_address_pmd() + mm_find_pmd() + /* + * We check if PMD present without taking ptl: no + * serialization against zap_huge_pmd(). We miss this PMD, + * it's not accounted to 'mapcount' in __split_huge_page(). + */ + pmd_present(pmd) == 0 + + BUG_ON(mapcount != page_mapcount(page)) // CRASH!!! + + page_remove_rmap(page) + atomic_add_negative(-1, &page->_mapcount) + +The second bug[2] is "kernel BUG at mm/huge_memory.c:1371!". +It's VM_BUG_ON_PAGE(!PageHead(page), page) in zap_huge_pmd(). + +This happens in similar way: + + CPU0 CPU1 + zap_huge_pmd() + pmdp_get_and_clear() + page_remove_rmap(page) + atomic_add_negative(-1, &page->_mapcount) +__split_huge_page() + anon_vma_interval_tree_foreach() + __split_huge_page_splitting() + page_check_address_pmd() + mm_find_pmd() + pmd_present(pmd) == 0 /* The same comment as above */ + /* + * No crash this time since we already decremented page->_mapcount in + * zap_huge_pmd(). + */ + BUG_ON(mapcount != page_mapcount(page)) + + /* + * We split the compound page here into small pages without + * serialization against zap_huge_pmd() + */ + __split_huge_page_refcount() + VM_BUG_ON_PAGE(!PageHead(page), page); // CRASH!!! + +So my understanding the problem is pmd_present() check in mm_find_pmd() +without taking page table lock. + +The bug was introduced by me commit with commit 117b0791ac42. Sorry for +that. :( + +Let's open code mm_find_pmd() in page_check_address_pmd() and do the +check under page table lock. + +Note that __page_check_address() does the same for PTE entires +if sync != 0. + +I've stress tested split and zap code paths for 36+ hours by now and +don't see crashes with the patch applied. Before it took <20 min to +trigger the first bug and few hours for second one (if we ignore +first). + +[1] https://lkml.kernel.org/g/<53440991.9090001@oracle.com> +[2] https://lkml.kernel.org/g/<5310C56C.60709@oracle.com> + +Signed-off-by: Kirill A. Shutemov +Reported-by: Sasha Levin +Tested-by: Sasha Levin +Cc: Bob Liu +Cc: Andrea Arcangeli +Cc: Rik van Riel +Cc: Mel Gorman +Cc: Michel Lespinasse +Cc: Dave Jones +Cc: Vlastimil Babka +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/huge_memory.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -1611,16 +1611,23 @@ pmd_t *page_check_address_pmd(struct pag + enum page_check_address_pmd_flag flag, + spinlock_t **ptl) + { ++ pgd_t *pgd; ++ pud_t *pud; + pmd_t *pmd; + + if (address & ~HPAGE_PMD_MASK) + return NULL; + +- pmd = mm_find_pmd(mm, address); +- if (!pmd) ++ pgd = pgd_offset(mm, address); ++ if (!pgd_present(*pgd)) + return NULL; ++ pud = pud_offset(pgd, address); ++ if (!pud_present(*pud)) ++ return NULL; ++ pmd = pmd_offset(pud, address); ++ + *ptl = pmd_lock(mm, pmd); +- if (pmd_none(*pmd)) ++ if (!pmd_present(*pmd)) + goto unlock; + if (pmd_page(*pmd) != page) + goto unlock; diff --git a/queue-3.14/tracing-uprobes-fix-uprobe_cpu_buffer-memory-leak.patch b/queue-3.14/tracing-uprobes-fix-uprobe_cpu_buffer-memory-leak.patch new file mode 100644 index 00000000000..86cf04953d5 --- /dev/null +++ b/queue-3.14/tracing-uprobes-fix-uprobe_cpu_buffer-memory-leak.patch @@ -0,0 +1,40 @@ +From 6ea6215fe394e320468589d9bba464a48f6d823a Mon Sep 17 00:00:00 2001 +From: "zhangwei(Jovi)" +Date: Thu, 17 Apr 2014 16:05:19 +0800 +Subject: tracing/uprobes: Fix uprobe_cpu_buffer memory leak + +From: "zhangwei(Jovi)" + +commit 6ea6215fe394e320468589d9bba464a48f6d823a upstream. + +Forgot to free uprobe_cpu_buffer percpu page in uprobe_buffer_disable(). + +Link: http://lkml.kernel.org/p/534F8B3F.1090407@huawei.com + +Acked-by: Namhyung Kim +Signed-off-by: zhangwei(Jovi) +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_uprobe.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/kernel/trace/trace_uprobe.c ++++ b/kernel/trace/trace_uprobe.c +@@ -728,9 +728,15 @@ static int uprobe_buffer_enable(void) + + static void uprobe_buffer_disable(void) + { ++ int cpu; ++ + BUG_ON(!mutex_is_locked(&event_mutex)); + + if (--uprobe_buffer_refcnt == 0) { ++ for_each_possible_cpu(cpu) ++ free_page((unsigned long)per_cpu_ptr(uprobe_cpu_buffer, ++ cpu)->buf); ++ + free_percpu(uprobe_cpu_buffer); + uprobe_cpu_buffer = NULL; + } diff --git a/queue-3.14/tracing-use-rcu_dereference_sched-for-trace-event-triggers.patch b/queue-3.14/tracing-use-rcu_dereference_sched-for-trace-event-triggers.patch new file mode 100644 index 00000000000..74f7e920dd2 --- /dev/null +++ b/queue-3.14/tracing-use-rcu_dereference_sched-for-trace-event-triggers.patch @@ -0,0 +1,90 @@ +From 561a4fe851ccab9dd0d14989ab566f9392d9f8b5 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Fri, 2 May 2014 13:30:04 -0400 +Subject: tracing: Use rcu_dereference_sched() for trace event triggers + +From: "Steven Rostedt (Red Hat)" + +commit 561a4fe851ccab9dd0d14989ab566f9392d9f8b5 upstream. + +As trace event triggers are now part of the mainline kernel, I added +my trace event trigger tests to my test suite I run on all my kernels. +Now these tests get run under different config options, and one of +those options is CONFIG_PROVE_RCU, which checks under lockdep that +the rcu locking primitives are being used correctly. This triggered +the following splat: + +=============================== +[ INFO: suspicious RCU usage. ] +3.15.0-rc2-test+ #11 Not tainted +------------------------------- +kernel/trace/trace_events_trigger.c:80 suspicious rcu_dereference_check() usage! + +other info that might help us debug this: + +rcu_scheduler_active = 1, debug_locks = 0 +4 locks held by swapper/1/0: + #0: ((&(&j_cdbs->work)->timer)){..-...}, at: [] call_timer_fn+0x5/0x1be + #1: (&(&pool->lock)->rlock){-.-...}, at: [] __queue_work+0x140/0x283 + #2: (&p->pi_lock){-.-.-.}, at: [] try_to_wake_up+0x2e/0x1e8 + #3: (&rq->lock){-.-.-.}, at: [] try_to_wake_up+0x1a0/0x1e8 + +stack backtrace: +CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.15.0-rc2-test+ #11 +Hardware name: /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006 + 0000000000000001 ffff88007e083b98 ffffffff819f53a5 0000000000000006 + ffff88007b0942c0 ffff88007e083bc8 ffffffff81081307 ffff88007ad96d20 + 0000000000000000 ffff88007af2d840 ffff88007b2e701c ffff88007e083c18 +Call Trace: + [] dump_stack+0x4f/0x7c + [] lockdep_rcu_suspicious+0x107/0x110 + [] event_triggers_call+0x99/0x108 + [] ftrace_event_buffer_commit+0x42/0xa4 + [] ftrace_raw_event_sched_wakeup_template+0x71/0x7c + [] ttwu_do_wakeup+0x7f/0xff + [] ttwu_do_activate.constprop.126+0x5c/0x61 + [] try_to_wake_up+0x1ac/0x1e8 + [] wake_up_process+0x36/0x3b + [] wake_up_worker+0x24/0x26 + [] insert_work+0x5c/0x65 + [] __queue_work+0x26c/0x283 + [] ? __queue_work+0x283/0x283 + [] delayed_work_timer_fn+0x1e/0x20 + [] call_timer_fn+0xdf/0x1be^M + [] ? call_timer_fn+0x5/0x1be + [] ? __queue_work+0x283/0x283 + [] run_timer_softirq+0x1a4/0x22f^M + [] __do_softirq+0x17b/0x31b^M + [] irq_exit+0x42/0x97 + [] smp_apic_timer_interrupt+0x37/0x44 + [] apic_timer_interrupt+0x6f/0x80 + [] ? default_idle+0x21/0x32 + [] ? default_idle+0x1f/0x32 + [] arch_cpu_idle+0xf/0x11 + [] cpu_startup_entry+0x1a3/0x213 + [] start_secondary+0x212/0x219 + +The cause is that the triggers are protected by rcu_read_lock_sched() but +the data is dereferenced with rcu_dereference() which expects it to +be protected with rcu_read_lock(). The proper reference should be +rcu_dereference_sched(). + +Cc: Tom Zanussi +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_events_trigger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/trace/trace_events_trigger.c ++++ b/kernel/trace/trace_events_trigger.c +@@ -77,7 +77,7 @@ event_triggers_call(struct ftrace_event_ + data->ops->func(data); + continue; + } +- filter = rcu_dereference(data->filter); ++ filter = rcu_dereference_sched(data->filter); + if (filter && !filter_match_preds(filter, rec)) + continue; + if (data->cmd_ops->post_trigger) {