OSDN Git Service
Zhang Yanfei [Tue, 12 Mar 2013 05:27:29 +0000 (13:27 +0800)]
driver: tty: serial: remove cast for kzalloc return value
remove cast for kzalloc return value.
Signed-off-by: Zhang Yanfei <zhangyanfei@cn.fujitsu.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Wed, 13 Mar 2013 23:30:34 +0000 (00:30 +0100)]
TTY: serial, stop accessing potential NULLs
The following commits:
*
6732c8bb8671acbdac6cdc93dd72ddd581dd5e25 (TTY: switch
tty_schedule_flip)
*
2e124b4a390ca85325fae75764bef92f0547fa25 (TTY: switch
tty_flip_buffer_push)
*
05c7cd39907184328f48d3e7899f9cdd653ad336 (TTY: switch
tty_insert_flip_string)
*
92a19f9cec9a80ad93c06e115822deb729e2c6ad (TTY: switch
tty_insert_flip_char)
*
227434f8986c3827a1faedd1feb437acd6285315 (TTY: switch
tty_buffer_request_room to tty_port)
introduced a potential NULL dereference to some drivers. In
particular, when the device is used as a console, incoming bytes can
kill the box. This is caused by removed checks for TTY against NULL.
It happened because it was unclear to me why the checks were there. I
assumed them superfluous because the interrupts were unbound or
otherwise stopped. But this is not the case for consoles for these
drivers, as was pointed out by David Miller.
Now, this patch re-introduces the checks (at this point we check
port->state, not the tty proper, as we do not care about tty pointers
anymore). For both of the drivers, we place the check below the
handling of break signal so that sysrq can actually work. (One needs
to issue a break and then sysrq key within the following 5 seconds.)
We do not change sc26xx, sunhv, and sunsu here because they behave the
same as before. People having that hardware should fix the driver
eventually, however. They always could unconditionally dereference tty
in receive_chars, port->state in uart_handle_dcd_change, and
up->port.state->port.tty.
There is perhaps more to fix in all those drivers, but they are at
least in a state they were before.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Grant Likely <grant.likely@secretlab.ca>
Cc: Rob Herring <rob.herring@calxeda.com>
Cc: sparclinux@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:45 +0000 (16:44 -0400)]
tty: Fix recursive deadlock in tty_perform_flush()
tty_perform_flush() can deadlock when called while holding
a line discipline reference. By definition, all ldisc drivers
hold a ldisc reference, so calls originating from ldisc drivers
must not block for a ldisc reference.
The deadlock can occur when:
CPU 0 | CPU 1
|
tty_ldisc_ref(tty) |
.... | <line discipline halted>
tty_ldisc_ref_wait(tty) |
|
CPU 0 cannot progess because it cannot obtain an ldisc reference
with the line discipline has been halted (thus no new references
are granted).
CPU 1 cannot progress because an outstanding ldisc reference
has not been released.
An in-tree call-tree audit of tty_perform_flush() [1] shows 5
ldisc drivers calling tty_perform_flush() indirectly via
n_tty_ioctl_helper() and 2 ldisc drivers calling directly.
A single tty driver safely uses the function.
[1]
Recursive usage:
/* These functions are line discipline ioctls and thus
* recursive wrt line discipline references */
tty_perform_flush() - ./drivers/tty/tty_ioctl.c
n_tty_ioctl_helper()
hci_uart_tty_ioctl(default) - drivers/bluetooth/hci_ldisc.c (N_HCI)
n_hdlc_tty_ioctl(default) - drivers/tty/n_hdlc.c (N_HDLC)
gsmld_ioctl(default) - drivers/tty/n_gsm.c (N_GSM0710)
n_tty_ioctl(default) - drivers/tty/n_tty.c (N_TTY)
gigaset_tty_ioctl(default) - drivers/isdn/gigaset/ser-gigaset.c (N_GIGASET_M101)
ppp_synctty_ioctl(TCFLSH) - drivers/net/ppp/pps_synctty.c
ppp_asynctty_ioctl(TCFLSH) - drivers/net/ppp/ppp_async.c
Non-recursive use:
tty_perform_flush() - drivers/tty/tty_ioctl.c
ipw_ioctl(TCFLSH) - drivers/tty/ipwireless/tty.c
/* This function is a tty i/o ioctl method, which
* is invoked by tty_ioctl() */
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:44 +0000 (16:44 -0400)]
tty: Remove redundant tty_wait_until_sent()
tty_ioctl() already waits until sent.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:43 +0000 (16:44 -0400)]
tty: Locate get/put ldisc functions together
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:42 +0000 (16:44 -0400)]
tty: Fold one-line assign function into callers
Now that tty_ldisc_assign() is a one-line file-scoped function,
remove it and perform the simple assignment at its call sites.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:41 +0000 (16:44 -0400)]
tty: Document unsafe ldisc reference acquire
Merge get_ldisc() into its only call site.
Note how, after merging, the unsafe acquire of an ldisc reference
is obvious.
CPU 0 in tty_ldisc_try() | CPU 1 in tty_ldisc_halt()
|
test_bit(TTY_LDISC, &tty_flags) |
if (true) | clear_bit(TTY_LDISC, &tty_flags)
tty->ldisc != 0? | atomic_read(&tty->ldisc->users)
if (true) | ret_val == 1?
atomic_inc(&tty->ldisc->users) | if (false)
| wait
|
<goes on assuming safe ldisc use> | <doesn't wait - proceeds w/ close>
|
The spin lock in tty_ldisc_try() does nothing wrt synchronizing
the ldisc halt since it's not acquired as part of halting.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:40 +0000 (16:44 -0400)]
tty: Separate release semantics of ldisc reference
tty_ldisc_ref()/tty_ldisc_unref() have usage semantics
equivalent to down_read_trylock()/up_read(). Only
callers of tty_ldisc_put() are performing the additional
operations necessary for proper ldisc teardown, and then only
after ensuring no outstanding 'read lock' remains.
Thus, tty_ldisc_unref() should never be the last reference;
WARN if it is. Conversely, tty_ldisc_put() should never be
destructing if the use count != 1.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:39 +0000 (16:44 -0400)]
tty: Don't protect atomic operation with mutex
test_bit() is already atomic; drop mutex lock/unlock.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:38 +0000 (16:44 -0400)]
tty: Add ldisc hangup debug messages
Expected typical debug log:
[ 582.721965] tty_open: opening pts3...
[ 582.721970] tty_open: opening pts3...
[ 582.721977] tty_release: pts3 (tty count=3)...
[ 582.721980] tty_release: ptm3 (tty count=1)...
[ 582.722015] pts3 vhangup...
[ 582.722020] tty_ldisc_hangup: pts3: closing ldisc:
ffff88007a920540
[ 582.724128] tty_release: pts3 (tty count=2)...
[ 582.724217] tty_ldisc_hangup: pts3: re-opened ldisc:
ffff88007a920580
[ 582.724221] tty_release: ptm3: final close
[ 582.724234] tty_ldisc_release: ptm3: closing ldisc:
ffff88007a920a80
[ 582.724238] tty_ldisc_release: ptm3: ldisc closed
[ 582.724241] tty_release: ptm3: freeing structure...
[ 582.724741] tty_open: opening pts3...
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:37 +0000 (16:44 -0400)]
tty: Bracket ldisc release with TTY_DEBUG_HANGUP messages
Expected typical log output:
[ 2.437211] tty_open: opening pts1...
[ 2.443376] tty_open: opening pts5...
[ 2.447830] tty_release: ptm0 (tty count=1)...
[ 2.447849] pts0 vhangup...
[ 2.447865] tty_release: ptm0: final close
[ 2.447876] tty_release: ptm0: freeing structure...
[ 2.451634] tty_release: tty1 (tty count=1)...
[ 2.451638] tty_release: tty1: final close
[ 2.451654] tty_release: tty1: freeing structure...
[ 2.452505] tty_release: pts5 (tty count=2)...
[ 2.453029] tty_open: opening pts0...
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:36 +0000 (16:44 -0400)]
tty: Fix 'deferred reopen' ldisc comment
This comment is a victim of code migration from
"tty: Fix the ldisc hangup race"; re-parent it.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:35 +0000 (16:44 -0400)]
tty: Make core responsible for synchronizing its work
The tty core relies on the ldisc layer for synchronizing destruction
of the tty. Instead, the final tty release must wait for any pending tty
work to complete prior to tty destruction.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:34 +0000 (16:44 -0400)]
tty: Complete ownership transfer of flip buffers
Waiting for buffer work to complete is not required for safely
performing changes to the line discipline, once the line discipline
is halted. The buffer work routine, flush_to_ldisc(), will be
unable to acquire an ldisc ref and all existing references were
waited until released (so it can't already have one).
Ensure running buffer work which may reference the soon-to-be-gone
tty completes and any buffer work running after this point retrieves
a NULL tty.
Also, ensure all buffer work is cancelled on port destruction.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:33 +0000 (16:44 -0400)]
tty: Don't reenable already enabled ldisc
tty_ldisc_hangup() guarantees the ldisc is enabled (or that there
is no ldisc). Since __tty_hangup() was the only user, re-define
tty_ldisc_enable() in file-scope.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:32 +0000 (16:44 -0400)]
n_tty: Fully initialize ldisc before restarting buffer work
Buffer work may already be pending when the n_tty ldisc is re-opened,
eg., when setting the ldisc (via TIOCSETD ioctl) and when hanging up
the tty. Since n_tty_set_room() may restart buffer work, first ensure
the ldisc is completely initialized.
Factor n_tty_set_room() out of reset_buffer_flags() (only 2 callers)
and reorganize n_tty_open() to set termios last; buffer work will
be restarted there if necessary, after the char_map is properly
initialized.
Fixes this WARNING:
[ 549.561769] ------------[ cut here ]------------
[ 549.598755] WARNING: at drivers/tty/n_tty.c:160 n_tty_set_room+0xff/0x130()
[ 549.604058] scheduling buffer work for halted ldisc
[ 549.607741] Pid: 9417, comm: trinity-child28 Tainted: G D W
3.7.0-next-20121217-sasha-00023-g8689ef9 #219
[ 549.652580] Call Trace:
[ 549.662754] [<
ffffffff81c432cf>] ? n_tty_set_room+0xff/0x130
[ 549.665458] [<
ffffffff8110cae7>] warn_slowpath_common+0x87/0xb0
[ 549.668257] [<
ffffffff8110cb71>] warn_slowpath_fmt+0x41/0x50
[ 549.671007] [<
ffffffff81c432cf>] n_tty_set_room+0xff/0x130
[ 549.673268] [<
ffffffff81c44597>] reset_buffer_flags+0x137/0x150
[ 549.675607] [<
ffffffff81c45b71>] n_tty_open+0x131/0x1c0
[ 549.677699] [<
ffffffff81c47824>] tty_ldisc_open.isra.5+0x54/0x70
[ 549.680147] [<
ffffffff81c482bf>] tty_ldisc_hangup+0x11f/0x1e0
[ 549.682409] [<
ffffffff81c3fa17>] __tty_hangup+0x137/0x440
[ 549.684634] [<
ffffffff81c3fd49>] tty_vhangup+0x9/0x10
[ 549.686443] [<
ffffffff81c4a42c>] pty_close+0x14c/0x160
[ 549.688446] [<
ffffffff81c41225>] tty_release+0xd5/0x490
[ 549.690460] [<
ffffffff8127d8a2>] __fput+0x122/0x250
[ 549.692577] [<
ffffffff8127d9d9>] ____fput+0x9/0x10
[ 549.694534] [<
ffffffff811348c2>] task_work_run+0xb2/0xf0
[ 549.696349] [<
ffffffff81113c6d>] do_exit+0x36d/0x580
[ 549.698286] [<
ffffffff8107d964>] ? syscall_trace_enter+0x24/0x2e0
[ 549.702729] [<
ffffffff81113f4a>] do_group_exit+0x8a/0xc0
[ 549.706775] [<
ffffffff81113f92>] sys_exit_group+0x12/0x20
[ 549.711088] [<
ffffffff83cfab18>] tracesys+0xe1/0xe6
[ 549.728001] ---[ end trace
73eb41728f11f87e ]---
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:31 +0000 (16:44 -0400)]
n_tty: Correct unthrottle-with-buffer-flush comments
The driver is no longer unthrottled on buffer reset, so remove
comments that claim it is.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:30 +0000 (16:44 -0400)]
tty: Wait for SAK work before waiting for hangup work
SAK work may schedule hangup work (if TTY_SOFT_SAK is defined), thus
SAK work must be flushed before hangup work.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:29 +0000 (16:44 -0400)]
tty: Halt both ldiscs concurrently
The pty driver does not obtain an ldisc reference to the linked
tty when writing. When the ldiscs are sequentially halted, it
is possible for one ldisc to be halted, and before the second
ldisc can be halted, a concurrent write schedules buffer work on
the first ldisc. This can lead to an access-after-free error when
the scheduled buffer work starts on the closed ldisc.
Prevent subsequent use after halt by performing each stage
of the halt on both ttys.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:28 +0000 (16:44 -0400)]
tty: Strengthen no-subsequent-use guarantee of tty_ldisc_halt()
In preparation for destructing and freeing the tty, the line discipline
must first be brought to an inactive state before it can be destructed.
This line discipline shutdown must:
- disallow new users of the ldisc
- wait for existing ldisc users to finish
- only then, cancel/flush their pending/running work
Factor tty_ldisc_wait_idle() from tty_set_ldisc() and tty_ldisc_kill()
to ensure this shutdown order.
Failure to provide this guarantee can result in scheduled work
running after the tty has already been freed, as indicated in the
following log message:
[ 88.331234] WARNING: at drivers/tty/tty_buffer.c:435 flush_to_ldisc+0x194/0x1d0()
[ 88.334505] Hardware name: Bochs
[ 88.335618] tty is bad=-1
[ 88.335703] Modules linked in: netconsole configfs bnep rfcomm bluetooth ......
[ 88.345272] Pid: 39, comm: kworker/1:1 Tainted: G W 3.7.0-next-
20121129+ttydebug-xeon #
20121129+ttydebug
[ 88.347736] Call Trace:
[ 88.349024] [<
ffffffff81058aff>] warn_slowpath_common+0x7f/0xc0
[ 88.350383] [<
ffffffff81058bf6>] warn_slowpath_fmt+0x46/0x50
[ 88.351745] [<
ffffffff81432bd4>] flush_to_ldisc+0x194/0x1d0
[ 88.353047] [<
ffffffff816f7fe1>] ? _raw_spin_unlock_irq+0x21/0x50
[ 88.354190] [<
ffffffff8108a809>] ? finish_task_switch+0x49/0xe0
[ 88.355436] [<
ffffffff81077ad1>] process_one_work+0x121/0x490
[ 88.357674] [<
ffffffff81432a40>] ? __tty_buffer_flush+0x90/0x90
[ 88.358954] [<
ffffffff81078c84>] worker_thread+0x164/0x3e0
[ 88.360247] [<
ffffffff81078b20>] ? manage_workers+0x120/0x120
[ 88.361282] [<
ffffffff8107e230>] kthread+0xc0/0xd0
[ 88.362284] [<
ffffffff816f0000>] ? cmos_do_probe+0x2eb/0x3bf
[ 88.363391] [<
ffffffff8107e170>] ? flush_kthread_worker+0xb0/0xb0
[ 88.364797] [<
ffffffff816fff6c>] ret_from_fork+0x7c/0xb0
[ 88.366087] [<
ffffffff8107e170>] ? flush_kthread_worker+0xb0/0xb0
[ 88.367266] ---[ end trace
453a7c9f38fbfec0 ]---
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:27 +0000 (16:44 -0400)]
tty: Relocate tty_ldisc_halt() to avoid forward declaration
tty_ldisc_halt() will use the file-scoped function, tty_ldisc_wait_idle(),
in the following patch.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:26 +0000 (16:44 -0400)]
tty: Fix ldisc halt sequence on hangup
Flip buffer work cannot be cancelled until all outstanding ldisc
references have been released. Convert the ldisc ref wait into
a full ldisc halt with buffer work cancellation.
Note that the legacy mutex is not held while cancelling.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:25 +0000 (16:44 -0400)]
tty: Remove unnecessary re-test of ldisc ref count
Since the tty->ldisc is prevented from being changed by tty_set_ldisc()
when a tty is being hung up, re-testing the ldisc user count is
unnecessary -- ie, it cannot be a different ldisc and the user count
cannot have increased (assuming the caller meets the precondition that
TTY_LDISC flag is cleared)
Removal of the 'early-out' locking optimization is necessary for
the subsequent patch 'tty: Fix ldisc halt sequence on hangup'.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:24 +0000 (16:44 -0400)]
tty: Refactor wait for ldisc refs out of tty_ldisc_hangup()
Refactor tty_ldisc_hangup() to extract standalone function,
tty_ldisc_hangup_wait_idle(), to wait for ldisc references
to be released.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:23 +0000 (16:44 -0400)]
n_tty: Don't flush buffer when closing ldisc
A buffer flush is both undesirable and unnecessary when the ldisc
is closing. A buffer flush performs the following:
1. resets ldisc data fields to their initial state
2. resets tty->receive_room to indicate more data can be sent
3. schedules buffer work to receive more data
4. signals a buffer flush has happened to linked pty in packet mode
Since the ldisc has been halted and the tty may soon be destructed,
buffer work must not be scheduled as that work might access
an invalid tty and ldisc state. Also, the ldisc read buffer is about
to be freed, so that's pointless.
Resetting the ldisc data fields is pointless as well since that
structure is about to be freed.
Resetting tty->receive_room is unnecessary, as it will be properly
reset if a new ldisc is reopened. Besides, resetting the original
receive_room value would be wrong since the read buffer will be
gone.
Since the packet mode flush is observable from userspace, this
behavior has been preserved.
The test jig originally authored by Ilya Zykov <ilya@ilyx.ru> and
signed off by him is included below. The test jig prompts the
following warnings which this patch fixes.
[ 38.051111] ------------[ cut here ]------------
[ 38.052113] WARNING: at drivers/tty/n_tty.c:160 n_tty_set_room.part.6+0x8b/0xa0()
[ 38.053916] Hardware name: Bochs
[ 38.054819] Modules linked in: netconsole configfs bnep rfcomm bluetooth parport_pc ppdev snd_hda_intel snd_hda_codec
snd_hwdep snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq psmouse snd_timer serio_raw mac_hid snd_seq_device
snd microcode lp parport virtio_balloon soundcore i2c_piix4 snd_page_alloc floppy 8139too 8139cp
[ 38.059704] Pid: 1564, comm: pty_kill Tainted: G W 3.7.0-next-
20121130+ttydebug-xeon #
20121130+ttydebug
[ 38.061578] Call Trace:
[ 38.062491] [<
ffffffff81058b4f>] warn_slowpath_common+0x7f/0xc0
[ 38.063448] [<
ffffffff81058baa>] warn_slowpath_null+0x1a/0x20
[ 38.064439] [<
ffffffff8142dc2b>] n_tty_set_room.part.6+0x8b/0xa0
[ 38.065381] [<
ffffffff8142dc82>] n_tty_set_room+0x42/0x80
[ 38.066323] [<
ffffffff8142e6f2>] reset_buffer_flags+0x102/0x160
[ 38.077508] [<
ffffffff8142e76d>] n_tty_flush_buffer+0x1d/0x90
[ 38.078782] [<
ffffffff81046569>] ? default_spin_lock_flags+0x9/0x10
[ 38.079734] [<
ffffffff8142e804>] n_tty_close+0x24/0x60
[ 38.080730] [<
ffffffff81431b61>] tty_ldisc_close.isra.2+0x41/0x60
[ 38.081680] [<
ffffffff81431bbb>] tty_ldisc_kill+0x3b/0x80
[ 38.082618] [<
ffffffff81432a07>] tty_ldisc_release+0x77/0xe0
[ 38.083549] [<
ffffffff8142b781>] tty_release+0x451/0x4d0
[ 38.084525] [<
ffffffff811950be>] __fput+0xae/0x230
[ 38.085472] [<
ffffffff8119524e>] ____fput+0xe/0x10
[ 38.086401] [<
ffffffff8107aa88>] task_work_run+0xc8/0xf0
[ 38.087334] [<
ffffffff8105ea56>] do_exit+0x196/0x4b0
[ 38.088304] [<
ffffffff8106c77b>] ? __dequeue_signal+0x6b/0xb0
[ 38.089240] [<
ffffffff8105ef34>] do_group_exit+0x44/0xa0
[ 38.090182] [<
ffffffff8106f43d>] get_signal_to_deliver+0x20d/0x4e0
[ 38.091125] [<
ffffffff81016979>] do_signal+0x29/0x130
[ 38.092096] [<
ffffffff81431a9e>] ? tty_ldisc_deref+0xe/0x10
[ 38.093030] [<
ffffffff8142a317>] ? tty_write+0xb7/0xf0
[ 38.093976] [<
ffffffff81193f53>] ? vfs_write+0xb3/0x180
[ 38.094904] [<
ffffffff81016b20>] do_notify_resume+0x80/0xc0
[ 38.095830] [<
ffffffff81700492>] int_signal+0x12/0x17
[ 38.096788] ---[ end trace
5f6f7a9651cd999b ]---
[ 2730.570602] ------------[ cut here ]------------
[ 2730.572130] WARNING: at drivers/tty/n_tty.c:160 n_tty_set_room+0x107/0x140()
[ 2730.574904] scheduling buffer work for halted ldisc
[ 2730.578303] Pid: 9691, comm: trinity-child15 Tainted: G W
3.7.0-rc8-next-20121205-sasha-00023-g59f0d85 #207
[ 2730.588694] Call Trace:
[ 2730.590486] [<
ffffffff81c41d77>] ? n_tty_set_room+0x107/0x140
[ 2730.592559] [<
ffffffff8110c827>] warn_slowpath_common+0x87/0xb0
[ 2730.595317] [<
ffffffff8110c8b1>] warn_slowpath_fmt+0x41/0x50
[ 2730.599186] [<
ffffffff81c41d77>] n_tty_set_room+0x107/0x140
[ 2730.603141] [<
ffffffff81c42fe7>] reset_buffer_flags+0x137/0x150
[ 2730.607166] [<
ffffffff81c43018>] n_tty_flush_buffer+0x18/0x90
[ 2730.610123] [<
ffffffff81c430af>] n_tty_close+0x1f/0x60
[ 2730.612068] [<
ffffffff81c461f2>] tty_ldisc_close.isra.4+0x52/0x60
[ 2730.614078] [<
ffffffff81c462ab>] tty_ldisc_reinit+0x3b/0x70
[ 2730.615891] [<
ffffffff81c46db2>] tty_ldisc_hangup+0x102/0x1e0
[ 2730.617780] [<
ffffffff81c3e537>] __tty_hangup+0x137/0x440
[ 2730.619547] [<
ffffffff81c3e869>] tty_vhangup+0x9/0x10
[ 2730.621266] [<
ffffffff81c48f1c>] pty_close+0x14c/0x160
[ 2730.622952] [<
ffffffff81c3fd45>] tty_release+0xd5/0x490
[ 2730.624674] [<
ffffffff8127fbe2>] __fput+0x122/0x250
[ 2730.626195] [<
ffffffff8127fd19>] ____fput+0x9/0x10
[ 2730.627758] [<
ffffffff81134602>] task_work_run+0xb2/0xf0
[ 2730.629491] [<
ffffffff811139ad>] do_exit+0x36d/0x580
[ 2730.631159] [<
ffffffff81113c8a>] do_group_exit+0x8a/0xc0
[ 2730.632819] [<
ffffffff81127351>] get_signal_to_deliver+0x501/0x5b0
[ 2730.634758] [<
ffffffff8106de34>] do_signal+0x24/0x100
[ 2730.636412] [<
ffffffff81204865>] ? user_exit+0xa5/0xd0
[ 2730.638078] [<
ffffffff81183cd8>] ? trace_hardirqs_on_caller+0x118/0x140
[ 2730.640279] [<
ffffffff81183d0d>] ? trace_hardirqs_on+0xd/0x10
[ 2730.642164] [<
ffffffff8106df78>] do_notify_resume+0x48/0xa0
[ 2730.643966] [<
ffffffff83cdff6a>] int_signal+0x12/0x17
[ 2730.645672] ---[ end trace
a40d53149c07fce0 ]---
/*
* pty_thrash.c
*
* Based on original test jig by Ilya Zykov <ilya@ilyx.ru>
*
* Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
* Signed-off-by: Ilya Zykov <ilya@ilyx.ru>
*/
static int fd;
static void error_exit(char *f, ...)
{
va_list va;
va_start(va, f);
vprintf(f, va);
printf(": %s\n", strerror(errno));
va_end(va);
if (fd >= 0)
close(fd);
exit(EXIT_FAILURE);
}
int main(int argc, char *argv[]) {
int parent;
char pts_name[24];
int ptn, unlock;
while (1) {
fd = open("/dev/ptmx", O_RDWR);
if (fd < 0)
error_exit("opening pty master");
unlock = 0;
if (ioctl(fd, TIOCSPTLCK, &unlock) < 0)
error_exit("unlocking pty pair");
if (ioctl(fd, TIOCGPTN, &ptn) < 0)
error_exit("getting pty #");
snprintf(pts_name, sizeof(pts_name), "/dev/pts/%d", ptn);
child_id = fork();
if (child_id == -1)
error_exit("forking child");
if (parent) {
int err, id, status;
char buf[128];
int n;
n = read(fd, buf, sizeof(buf));
if (n < 0)
error_exit("master reading");
printf("%.*s\n", n-1, buf);
close(fd);
err = kill(child_id, SIGKILL);
if (err < 0)
error_exit("killing child");
id = waitpid(child_id, &status, 0);
if (id < 0 || id != child_id)
error_exit("waiting for child");
} else { /* Child */
close(fd);
printf("Test cycle on slave pty %s\n", pts_name);
fd = open(pts_name, O_RDWR);
if (fd < 0)
error_exit("opening pty slave");
while (1) {
char pattern[] = "test\n";
if (write(fd, pattern, strlen(pattern)) < 0)
error_exit("slave writing");
}
}
}
/* never gets here */
return 0;
}
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:22 +0000 (16:44 -0400)]
n_tty: Factor packet mode status change for reuse
Factor the packet mode status change from n_tty_flush_buffer
for use by follow-on patch.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Mon, 11 Mar 2013 20:44:21 +0000 (16:44 -0400)]
tty: Add diagnostic for halted line discipline
Flip buffer work must not be scheduled by the line discipline
after the line discipline has been halted; issue warning.
Note: drivers can still schedule flip buffer work.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Lars-Peter Clausen [Mon, 11 Mar 2013 17:44:52 +0000 (18:44 +0100)]
tty: ifx6x60: Remove unused suspend/resume callbacks
The ifx6x60 driver implements both legacy suspend/resume callbacks and
dev_pm_ops. The SPI core is going to ignore legacy suspend/resume
callbacks if a driver implements dev_pm_ops. Since the legacy suspend/resume
callbacks are empty in this case it is safe to just remove them.
Cc: Bi Chao <chao.bi@intel.com>
Cc: Chen Jun <jun.d.chen@intel.com>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Lars-Peter Clausen [Mon, 11 Mar 2013 17:44:51 +0000 (18:44 +0100)]
tty: mrst_max3110: Use dev_pm_ops
Use dev_pm_ops instead of the deprecated legacy suspend/resume for the
mrst_max3110 driver.
Cc: Alan Cox <alan@linux.intel.com>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Lars-Peter Clausen [Mon, 11 Mar 2013 17:44:50 +0000 (18:44 +0100)]
tty: max310x: Use dev_pm_ops
Use dev_pm_ops instead of the deprecated legacy suspend/resume for the
max310x driver.
Cc: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Lars-Peter Clausen [Mon, 11 Mar 2013 17:44:49 +0000 (18:44 +0100)]
tty: max3100: Use dev_pm_ops
Use dev_pm_ops instead of the deprecated legacy suspend/resume for the
max3100 driver.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johan Hovold [Thu, 7 Mar 2013 14:55:53 +0000 (15:55 +0100)]
TTY: fix close of uninitialised ports
Make sure we do not make tty-driver callbacks or wait for port to drain
on uninitialised ports (e.g. when open failed) in
tty_port_close_start().
No callback, such as flush_buffer or wait_until_sent, needs to be made
on a port that has never been opened. Neither does it make much sense to
add drain delay for an uninitialised port.
Currently a drain delay of up to two seconds could be added when a tty
fails to open.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johan Hovold [Thu, 7 Mar 2013 14:55:52 +0000 (15:55 +0100)]
TTY: clean up port drain-delay handling
Move port drain-delay handling to a separate function.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johan Hovold [Thu, 7 Mar 2013 14:55:51 +0000 (15:55 +0100)]
TTY: fix DTR not being dropped on hang up
Move HUPCL handling to port shutdown so that DTR is dropped also on hang
up (tty_port_close is a noop for hung-up ports).
Also do not try to drop DTR for uninitialised ports where it has never
been raised (e.g. after a failed open).
Note that this is also the current behaviour of serial-core.
Nine drivers currently call tty_port_close_start directly (rather than
through tty_port_close) and seven of them lower DTR as part of their
close (if the port has been initialised). Fixup the remaining two
drivers so that it continues to be lowered also on normal (non-HUP)
close. [ Note that most of those other seven drivers did not expect DTR
to have been dropped by tty_port_close_start in the first place. ]
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johan Hovold [Thu, 7 Mar 2013 14:55:50 +0000 (15:55 +0100)]
TTY: fix DTR being raised on hang up
Make sure to check ASYNC_INITIALISED before raising DTR when waking up
from blocked open in tty_port_block_til_ready.
Currently DTR could get raised at hang up as a blocked process would
raise DTR unconditionally before checking for hang up and returning.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johan Hovold [Thu, 7 Mar 2013 14:55:49 +0000 (15:55 +0100)]
TTY: wake up processes last at hangup
Move wake up of processes on blocked-open and modem-status wait queues
to after port shutdown at hangup.
This way the woken up processes can use the ASYNC_INITIALIZED flag to
detect port shutdown.
Note that this is the order currently used by serial-core.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Johan Hovold [Thu, 7 Mar 2013 14:55:48 +0000 (15:55 +0100)]
TTY: clean up port shutdown
Untangle port-shutdown logic and make sure the initialised flag is
always cleared for non-console ports.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:40 +0000 (13:12 +0100)]
crisv10: use counts from tty_port
The same as flags, convert to using open/close counts from tty_port.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:39 +0000 (13:12 +0100)]
crisv10: use *_wait from tty_port
The same as flags, convert to using *_wait queues from tty_port.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:38 +0000 (13:12 +0100)]
crisv10: use close delays from tty_port
The same as flags, convert to using close delays from tty_port.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:37 +0000 (13:12 +0100)]
crisv10: remove unused members
Well, all those are unused. They were perhaps copied from generic
serial structure ages ago. Remove them for good.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:35 +0000 (13:12 +0100)]
crisv10: stop returning info from handle_ser_rx_interrupt
The return value is not used anywhere, so no need to return anything.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:36 +0000 (13:12 +0100)]
crisv10: use flags from tty_port
First, remove STD_FLAGS as the value, or its subvalues
(ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST) is not tested anywhere --
there is no point to initialize flags to that. Second, use flags
member from tty_port when we have it now. So that we do not waste
space.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:34 +0000 (13:12 +0100)]
TTY: cleanup tty->hw_stopped uses
tty->hw_stopped is set only by drivers to remember HW state. If it is
never set to 1 in a particular driver, there is no need to check it in
the driver at all. Remove such checks.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:33 +0000 (13:12 +0100)]
TTY: serial/msm_serial_hs, remove unused tty
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:32 +0000 (13:12 +0100)]
TTY: serial/bfin_uart, unbreak build with KGDB enabled
There are no (and never were any) kgdb fields in uart_ops. Setting
them produces a build error:
drivers/tty/serial/bfin_uart.c:1054:2: error: unknown field 'kgdboc_port_startup' specified in initializer
drivers/tty/serial/bfin_uart.c:1054:2: warning: initialization from incompatible pointer type [enabled by default]
drivers/tty/serial/bfin_uart.c:1054:2: warning: (near initialization for 'bfin_serial_pops.ioctl') [enabled by default]
drivers/tty/serial/bfin_uart.c:1055:2: error: unknown field 'kgdboc_port_shutdown' specified in initializer
drivers/tty/serial/bfin_uart.c:1055:2: warning: initialization from incompatible pointer type [enabled by default]
drivers/tty/serial/bfin_uart.c:1055:2: warning: (near initialization for 'bfin_serial_pops.poll_init') [enabled by default]
Remove them.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:30 +0000 (13:12 +0100)]
TTY: add tty_port_tty_hangup helper
It allows for cleaning up on a considerable amount of places. They did
port_get, hangup, kref_put. Now the only thing needed is to call
tty_port_tty_hangup which does exactly that. And they can also decide
whether to consider CLOCAL or completely ignore that.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:31 +0000 (13:12 +0100)]
TTY: quatech2, remove unneeded is_open
tty->ops->break_ctl cannot be called outside the gap between open and
close. So there is no need to check whether the port is open in
break_ctl in quatech2. Remove the check and also that member
completely.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Bill Pemberton <wfp5p@virginia.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:29 +0000 (13:12 +0100)]
TTY: add tty_port_tty_wakeup helper
It allows for cleaning up on a considerable amount of places. They did
port_get, wakeup, kref_put. Now the only thing needed is to call
tty_port_tty_wakeup which does exactly that.
One exception is ifx6x60 where tty_wakeup was open-coded. We now call
tty_wakeup properly there.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:28 +0000 (13:12 +0100)]
TTY: msm_smd_tty, clean up activate/shutdown
Do not dig struct smd_tty_info out of tty_struct using
tty_port_tty_get. It is unnecessarily too complicated, use simple
container_of instead.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:27 +0000 (13:12 +0100)]
TTY: do not warn about setting speed via SPD_*
The warning is there since 2.1.69 and we have not seen anybody
reporting it in the past decade. Remove the warning now.
tty_get_baud_rate can now be inline. This gives us one less
EXPORT_SYMBOL.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:26 +0000 (13:12 +0100)]
TTY: synclink, remove superfluous check
info is obtained by container_of. It can never be NULL. So do not test
that.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jiri Slaby [Thu, 7 Mar 2013 12:12:25 +0000 (13:12 +0100)]
TTY: jsm, remove superfluous check
data_len in jsm_input cannot be zero as we would jump out early in the
function. It also cannot be negative because it is an int and we do
bitwise and with 8192. So remove the check.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Lucas Tavares <lucaskt@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Wed, 6 Mar 2013 13:38:21 +0000 (08:38 -0500)]
tty: Fix checkpatch errors in tty_ldisc.h
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Wed, 6 Mar 2013 13:38:20 +0000 (08:38 -0500)]
n_tty: Lock access to tty->pgrp for POSIX job control
Concurrent access to tty->pgrp must be protected with tty->ctrl_lock.
Also, as noted in the comments, reading current->signal->tty is
safe because either,
1) current->signal->tty is assigned by current, or
2) current->signal->tty is set to NULL.
NB: for reference, tty_check_change() implements a similar POSIX
check for the ioctls corresponding to tcflush(), tcdrain(),
tcsetattr(), tcsetpgrp(), tcflow() and tcsendbreak().
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Wed, 6 Mar 2013 13:38:19 +0000 (08:38 -0500)]
n_tty: Fix unsafe driver-side signals
An ldisc reference is insufficient guarantee the foreground process
group is not in the process of being signalled from a hangup.
1) Reads of tty->pgrp must be locked with ctrl_lock
2) The group pid must be referenced for the duration of signalling.
Because the driver-side is not process-context, a pid reference
must be acquired.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Wed, 6 Mar 2013 13:20:53 +0000 (08:20 -0500)]
n_tty: Fix stuck throttled driver
As noted in the following comment:
/* FIXME: there is a tiny race here if the receive room check runs
before the other work executes and empties the buffer (upping
the receiving room and unthrottling. We then throttle and get
stuck. This has been observed and traced down by Vincent Pillet/
We need to address this when we sort out out the rx path locking */
Use new safe throttle/unthrottle functions to re-evaluate conditions
if interrupted by the complement flow control function.
Reported-by: Vincent Pillet <vincentx.pillet@intel.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Wed, 6 Mar 2013 13:20:52 +0000 (08:20 -0500)]
tty: Add safe tty throttle/unthrottle functions
The tty driver can become stuck throttled due to race conditions
between throttle and unthrottle, when the decision to throttle
or unthrottle is conditional. The following example helps to
illustrate the race:
CPU 0 | CPU 1
|
if (condition A) |
| <processing such that A not true>
| if (!condition A)
| unthrottle()
throttle() |
|
Note the converse is also possible; ie.,
CPU 0 | CPU 1
|
| if (!condition A)
<processing such that A true> |
if (condition A) |
throttle() |
| unthrottle()
|
Add new throttle/unthrottle functions based on the familiar model
of task state and schedule/wake. For example,
while (1) {
tty_set_flow_change(tty, TTY_THROTTLE_SAFE);
if (!condition)
break;
if (!tty_throttle_safe(tty))
break;
}
__tty_set_flow_change(tty, 0);
In this example, if an unthrottle occurs after the condition is
evaluated but before tty_throttle_safe(), then tty_throttle_safe()
will return non-zero, looping and forcing the re-evaluation of
condition.
Reported-by: Vincent Pillet <vincentx.pillet@intel.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Wed, 6 Mar 2013 13:20:51 +0000 (08:20 -0500)]
n_tty: Inline check_unthrottle() at lone call site
2-line function check_unthrottle() is now only called from
n_tty_read(); merge into caller.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
zhangwei(Jovi) [Thu, 7 Mar 2013 09:00:02 +0000 (17:00 +0800)]
sysrq: fix inconstistent help message of sysrq key
Currently help message of /proc/sysrq-trigger highlight its
upper-case characters, like below:
SysRq : HELP : loglevel(0-9) reBoot Crash terminate-all-tasks(E)
memory-full-oom-kill(F) kill-all-tasks(I) ...
this would confuse user trigger sysrq by upper-case character, which is
inconsistent with the real lower-case character registed key.
This inconsistent help message will also lead more confused when
26 upper-case letters put into use in future.
This patch fix it.
Thanks the comments from Andrew and Randy.
Signed-off-by: zhangwei(Jovi) <jovi.zhangwei@huawei.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Wed, 6 Mar 2013 12:20:57 +0000 (07:20 -0500)]
tty: Signal SIGHUP before hanging up ldisc
An exiting session leader can hang if a foreground process is
blocking for line discipline i/o, eg. in n_tty_read(). This happens
because the blocking reader is holding an ldisc reference (indicating
the line discipline is in-use) which prevents __tty_hangup() from
recycling the line discipline. Although waiters are woken before
attempting to gain exclusive access for changing the ldisc, the
blocking reader in this case will not exit the i/o loop since it
has not yet received SIGHUP (because it has not been sent).
Instead, perform signalling first, then recycle the line discipline.
Fixes:
INFO: task init:1 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
init D
00000000001d7180 2688 1 0 0x00000002
ffff8800b9acfba8 0000000000000002 00000000001d7180 ffff8800b9b10048
ffff8800b94cb000 ffff8800b9b10000 00000000001d7180 00000000001d7180
ffff8800b9b10000 ffff8800b9acffd8 00000000001d7180 00000000001d7180
Call Trace:
[<
ffffffff83db9909>] __schedule+0x2e9/0x3b0
[<
ffffffff83db9b35>] schedule+0x55/0x60
[<
ffffffff83db74ba>] schedule_timeout+0x3a/0x370
[<
ffffffff81182349>] ? mark_held_locks+0xf9/0x130
[<
ffffffff83dbab38>] ? down_failed+0x108/0x200
[<
ffffffff83dbb7ab>] ? _raw_spin_unlock_irq+0x2b/0x80
[<
ffffffff81182608>] ? trace_hardirqs_on_caller+0x128/0x160
[<
ffffffff83dbab61>] down_failed+0x131/0x200
[<
ffffffff83dbbfad>] ? tty_ldisc_lock_pair_timeout+0xcd/0x120
[<
ffffffff83dbae03>] ldsem_down_write+0xd3/0x113
[<
ffffffff83dbbfad>] ? tty_ldisc_lock_pair_timeout+0xcd/0x120
[<
ffffffff8118264d>] ? trace_hardirqs_on+0xd/0x10
[<
ffffffff83dbbfad>] tty_ldisc_lock_pair_timeout+0xcd/0x120
[<
ffffffff81c3df60>] tty_ldisc_hangup+0xd0/0x220
[<
ffffffff81c35bd7>] __tty_hangup+0x137/0x4f0
[<
ffffffff81c37c7c>] disassociate_ctty+0x6c/0x230
[<
ffffffff8111290c>] do_exit+0x41c/0x590
[<
ffffffff8107ad34>] ? syscall_trace_enter+0x24/0x2e0
[<
ffffffff81112b4a>] do_group_exit+0x8a/0xc0
[<
ffffffff81112b92>] sys_exit_group+0x12/0x20
[<
ffffffff83dc49d8>] tracesys+0xe1/0xe6
1 lock held by init/1:
#0: (&tty->ldisc_sem){++++++}, at: [<
ffffffff83dbbfad>] tty_ldisc_lock_pair_timeout+0xcd/0x120
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Acked-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Wed, 6 Mar 2013 12:20:56 +0000 (07:20 -0500)]
tty: Signal foreground group processes in hangup
When the session leader is exiting, signal the foreground group
processes as part of the hangup sequence, instead of after the
hangup is complete. This prepares for hanging up the
line discipline _after_ signalling processes which
may be blocking on ldisc i/o.
Parameterize __tty_hangup() to distinguish between when the
session leader is exiting and all other hangups; signal the
foreground group after signalling the session leader and its
process group, which preserves the original signal order.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Acked-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Wed, 6 Mar 2013 12:20:55 +0000 (07:20 -0500)]
tty: Use spin_lock() inside existing critical region
The interrupt state does not need to be saved, disabled and
restored here; interrupts are already off because this lock
is bracketed by spin_lock_irq/spin_unlock_irq.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Acked-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Wed, 6 Mar 2013 12:20:54 +0000 (07:20 -0500)]
tty: Fix spinlock flavor in non-atomic __tty_hangup()
__tty_hangup() and tty_vhangup() cannot be called from atomic context,
so locks do not need to preserve the interrupt state (although,
still disable interrupts).
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Acked-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Wed, 6 Mar 2013 12:20:53 +0000 (07:20 -0500)]
tty: Refactor session leader SIGHUP from __tty_hangup()
Reduce complexity of __tty_hangup(); separate SIGHUP signalling
into tty_signal_session_leader().
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Acked-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Syam Sidhardhan [Tue, 5 Mar 2013 19:33:22 +0000 (01:03 +0530)]
tty: ipwireless: Remove redundant NULL check before kfree
kfree on NULL pointer is a no-op.
Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Liang Li [Tue, 5 Mar 2013 14:30:38 +0000 (22:30 +0800)]
serial: pch_uart: add console poll support
Implement console poll for pch_uart, this could enable KGDBoC when
on pch-uart console.
Signed-off-by: Liang Li <liang.li@windriver.com>
Acked-by: Jason Wessel <jason.wessel@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jingoo Han [Tue, 5 Mar 2013 03:29:20 +0000 (12:29 +0900)]
TTY: amiserial, use module_platform_driver_probe()
This patch uses module_platform_driver_probe() macro which makes
the code smaller and simpler.
Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Sachin Kamat [Mon, 4 Mar 2013 08:54:39 +0000 (14:24 +0530)]
serial: vt8500_serial: Convert to devm_ioremap_resource()
Use the newly introduced devm_ioremap_resource() instead of
devm_request_and_ioremap() which provides more consistent error handling.
Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Acked-by: Tony Prisk <linux@prisktech.co.nz>
Reviewed-by: Thierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Sachin Kamat [Mon, 4 Mar 2013 04:29:00 +0000 (09:59 +0530)]
serial: tegra: Convert to devm_ioremap_resource()
Use the newly introduced devm_ioremap_resource() instead of
devm_request_and_ioremap() which provides more consistent error handling.
devm_ioremap_resource() provides its own error messages; so all explicit
error messages can be removed from the failure code paths.
Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Reviewed-by: Thierry Reding <thierry.reding@avionic-design.de>
Cc: Laxman Dewangan <ldewangan@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Peter Hurley [Tue, 5 Feb 2013 21:08:50 +0000 (16:08 -0500)]
pty: Remove redundant itty reset
port->itty has already been reset by release_tty() before
pty_cleanup() is called.
Call stack:
release_tty()
tty_kref_put()
queue_release_one_tty()
release_one_tty() : workqueue
tty->ops->cleanup()
pty_cleanup()
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linus Torvalds [Sun, 10 Mar 2013 23:54:19 +0000 (16:54 -0700)]
Linux 3.9-rc2
Linus Torvalds [Sun, 10 Mar 2013 00:51:13 +0000 (16:51 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/ebiederm/user-namespace
Pull namespace bugfixes from Eric Biederman:
"This is three simple fixes against 3.9-rc1. I have tested each of
these fixes and verified they work correctly.
The userns oops in key_change_session_keyring and the BUG_ON triggered
by proc_ns_follow_link were found by Dave Jones.
I am including the enhancement for mount to only trigger requests of
filesystem modules here instead of delaying this for the 3.10 merge
window because it is both trivial and the kind of change that tends to
bit-rot if left untouched for two months."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
proc: Use nd_jump_link in proc_ns_follow_link
fs: Limit sys_mount to only request filesystem modules (Part 2).
fs: Limit sys_mount to only request filesystem modules.
userns: Stop oopsing in key_change_session_keyring
Linus Torvalds [Sat, 9 Mar 2013 18:31:01 +0000 (10:31 -0800)]
Atmel MXT touchscreen: increase reset timeouts
There is a more complete atmel patch-series out by Nick Dyer that fixes
this and other things, but in the meantime this is the minimal thing to
get the touchscreen going on (at least my) Pixel Chromebook.
Not that I want my dirty fingers near that beautiful screen, but it
seems that a non-initialized touchscreen will also end up being a
constant wakeup source, so you have to disable it to go to sleep. And
it's easier to just fix the initialization sequence.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Eric W. Biederman [Sat, 9 Mar 2013 08:14:45 +0000 (00:14 -0800)]
proc: Use nd_jump_link in proc_ns_follow_link
Update proc_ns_follow_link to use nd_jump_link instead of just
manually updating nd.path.dentry.
This fixes the BUG_ON(nd->inode != parent->d_inode) reported by Dave
Jones and reproduced trivially with mkdir /proc/self/ns/uts/a.
Sigh it looks like the VFS change to require use of nd_jump_link
happend while proc_ns_follow_link was baking and since the common case
of proc_ns_follow_link continued to work without problems the need for
making this change was overlooked.
Cc: stable@vger.kernel.org
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Linus Torvalds [Sat, 9 Mar 2013 01:33:20 +0000 (17:33 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/mason/linux-btrfs
Pull btrfs fixes from Chris Mason:
"These are scattered fixes and one performance improvement. The
biggest functional change is in how we throttle metadata changes. The
new code bumps our average file creation rate up by ~13% in fs_mark,
and lowers CPU usage.
Stefan bisected out a regression in our allocation code that made
balance loop on extents larger than 256MB."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
Btrfs: improve the delayed inode throttling
Btrfs: fix a mismerge in btrfs_balance()
Btrfs: enforce min_bytes parameter during extent allocation
Btrfs: allow running defrag in parallel to administrative tasks
Btrfs: avoid deadlock on transaction waiting list
Btrfs: do not BUG_ON on aborted situation
Btrfs: do not BUG_ON in prepare_to_reloc
Btrfs: free all recorded tree blocks on error
Btrfs: build up error handling for merge_reloc_roots
Btrfs: check for NULL pointer in updating reloc roots
Btrfs: fix unclosed transaction handler when the async transaction commitment fails
Btrfs: fix wrong handle at error path of create_snapshot() when the commit fails
Btrfs: use set_nlink if our i_nlink is 0
Benson Leung [Fri, 8 Mar 2013 03:43:34 +0000 (19:43 -0800)]
Platform: x86: chromeos_laptop : Add basic platform data for atmel devices
Add basic platform data to get the current upstream driver working
with the 224s touchpad and 1664s touchscreen.
We will be using NULL config so we will use the settings from the
devices' NVRAMs.
Signed-off-by: Benson Leung <bleung@chromium.org>
Tested-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Daniel Kurtz [Fri, 8 Mar 2013 03:43:33 +0000 (19:43 -0800)]
Input: atmel_mxt_ts - Support for touchpad variant
This same driver can be used by atmel based touchscreens and touchpads
(buttonpads). Platform data may specify a device is a touchpad
using the is_tp flag.
This will cause the driver to perform some touchpad specific
initializations, such as:
* register input device name "Atmel maXTouch Touchpad" instead of
Touchscreen.
* register BTN_LEFT & BTN_TOOL_* event types.
* register axis resolution (as a fixed constant, for now)
* register BUTTONPAD property
* process GPIO buttons using reportid T19
Input event GPIO mapping is done by the platform data key_map array.
key_map[x] should contain the KEY or BTN code to send when processing
GPIOx from T19. To specify a GPIO as not an input source, populate
with KEY_RESERVED, or 0.
Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Signed-off-by: Benson Leung <bleung@chromium.org>
Signed-off-by: Nick Dyer <nick.dyer@itdev.co.uk>
Tested-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Fri, 8 Mar 2013 23:22:08 +0000 (15:22 -0800)]
Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6
Pull CIFS fixes from Steve French:
"A small set of cifs fixes which includes one for a recent regression
in the write path (pointed out by Anton), some fixes for rename
problems and as promised for 3.9 removing the obsolete sockopt mount
option (and the accompanying deprecation warning)."
* 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
CIFS: Fix missing of oplock_read value in smb30_values structure
cifs: don't try to unlock pagecache page after releasing it
cifs: remove the sockopt= mount option
cifs: Check server capability before attempting silly rename
cifs: Fix bug when checking error condition in cifs_rename_pending_delete()
Linus Torvalds [Fri, 8 Mar 2013 23:05:42 +0000 (15:05 -0800)]
Merge branch 'akpm' (fixes from Andrew)
Merge misc fixes from Andrew Morton.
* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
alpha: boot: fix build breakage introduced by system.h disintegration
memcg: initialize kmem-cache destroying work earlier
Randy has moved
ksm: fix m68k build: only NUMA needs pfn_to_nid
dmi_scan: fix missing check for _DMI_ signature in smbios_present()
Revert parts of "hlist: drop the node parameter from iterators"
idr: remove WARN_ON_ONCE() on negative IDs
mm/mempolicy.c: fix sp_node_init() argument ordering
mm/mempolicy.c: fix wrong sp_node insertion
ipc: don't allocate a copy larger than max
ipc: fix potential oops when src msg > 4k w/ MSG_COPY
Will Deacon [Fri, 8 Mar 2013 20:43:37 +0000 (12:43 -0800)]
alpha: boot: fix build breakage introduced by system.h disintegration
Commit
ec2212088c42 ("Disintegrate asm/system.h for Alpha") removed the
system.h include from boot/head.S, which puts the PAL_* asm constants
out of scope.
Include <asm/pal.h> so we can get building again.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: David Rusling <david.rusling@linaro.org>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Konstantin Khlebnikov [Fri, 8 Mar 2013 20:43:36 +0000 (12:43 -0800)]
memcg: initialize kmem-cache destroying work earlier
Fix a warning from lockdep caused by calling cancel_work_sync() for
uninitialized struct work. This path has been triggered by destructon
kmem-cache hierarchy via destroying its root kmem-cache.
cache
ffff88003c072d80
obj
ffff88003b410000 cache
ffff88003c072d80
obj
ffff88003b924000 cache
ffff88003c20bd40
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
Pid: 2825, comm: insmod Tainted: G O 3.9.0-rc1-next-
20130307+ #611
Call Trace:
__lock_acquire+0x16a2/0x1cb0
lock_acquire+0x8a/0x120
flush_work+0x38/0x2a0
__cancel_work_timer+0x89/0xf0
cancel_work_sync+0xb/0x10
kmem_cache_destroy_memcg_children+0x81/0xb0
kmem_cache_destroy+0xf/0xe0
init_module+0xcb/0x1000 [kmem_test]
do_one_initcall+0x11a/0x170
load_module+0x19b0/0x2320
SyS_init_module+0xc6/0xf0
system_call_fastpath+0x16/0x1b
Example module to demonstrate:
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/mm.h>
#include <linux/workqueue.h>
int __init mod_init(void)
{
int size = 256;
struct kmem_cache *cache;
void *obj;
struct page *page;
cache = kmem_cache_create("kmem_cache_test", size, size, 0, NULL);
if (!cache)
return -ENOMEM;
printk("cache %p\n", cache);
obj = kmem_cache_alloc(cache, GFP_KERNEL);
if (obj) {
page = virt_to_head_page(obj);
printk("obj %p cache %p\n", obj, page->slab_cache);
kmem_cache_free(cache, obj);
}
flush_scheduled_work();
obj = kmem_cache_alloc(cache, GFP_KERNEL);
if (obj) {
page = virt_to_head_page(obj);
printk("obj %p cache %p\n", obj, page->slab_cache);
kmem_cache_free(cache, obj);
}
kmem_cache_destroy(cache);
return -EBUSY;
}
module_init(mod_init);
MODULE_LICENSE("GPL");
Signed-off-by: Konstantin Khlebnikov <khlebnikov@openvz.org>
Cc: Glauber Costa <glommer@parallels.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Randy Dunlap [Fri, 8 Mar 2013 20:43:35 +0000 (12:43 -0800)]
Randy has moved
Update email address and CREDITS info. xenotime.net is defunct.
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Harry Wei <harryxiyou@gmail.com>
Cc: Keiichi KII <k-keiichi@bx.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Hugh Dickins [Fri, 8 Mar 2013 20:43:34 +0000 (12:43 -0800)]
ksm: fix m68k build: only NUMA needs pfn_to_nid
A CONFIG_DISCONTIGMEM=y m68k config gave
mm/ksm.c: In function `get_kpfn_nid':
mm/ksm.c:492: error: implicit declaration of function `pfn_to_nid'
linux/mmzone.h declares it for CONFIG_SPARSEMEM and CONFIG_FLATMEM, but
expects the arch's asm/mmzone.h to declare it for CONFIG_DISCONTIGMEM
(see arch/mips/include/asm/mmzone.h for example).
Or perhaps it is only expected when CONFIG_NUMA=y: too much of a maze,
and m68k got away without it so far, so fix the build in mm/ksm.c.
Signed-off-by: Hugh Dickins <hughd@google.com>
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Petr Holasek <pholasek@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Ben Hutchings [Fri, 8 Mar 2013 20:43:32 +0000 (12:43 -0800)]
dmi_scan: fix missing check for _DMI_ signature in smbios_present()
Commit
9f9c9cbb6057 ("drivers/firmware/dmi_scan.c: fetch dmi version
from SMBIOS if it exists") hoisted the check for "_DMI_" into
dmi_scan_machine(), which means that we don't bother to check for
"_DMI_" at offset 16 in an SMBIOS entry. smbios_present() may also call
dmi_present() for an address where we found "_SM_", if it failed further
validation.
Check for "_DMI_" in smbios_present() before calling dmi_present().
[akpm@linux-foundation.org: fix build]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Reported-by: Tim McGrath <tmhikaru@gmail.com>
Tested-by: Tim Mcgrath <tmhikaru@gmail.com>
Cc: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Arnd Bergmann [Fri, 8 Mar 2013 20:43:31 +0000 (12:43 -0800)]
Revert parts of "hlist: drop the node parameter from iterators"
Commit
b67bfe0d42ca ("hlist: drop the node parameter from iterators")
did a lot of nice changes but also contains two small hunks that seem to
have slipped in accidentally and have no apparent connection to the
intent of the patch.
This reverts the two extraneous changes.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Peter Senna Tschudin <peter.senna@gmail.com>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tejun Heo [Fri, 8 Mar 2013 20:43:30 +0000 (12:43 -0800)]
idr: remove WARN_ON_ONCE() on negative IDs
idr_find(), idr_remove() and idr_replace() used to silently ignore the
sign bit and perform lookup with the rest of the bits. The weird behavior
has been changed such that negative IDs are treated as invalid. As the
behavior change was subtle, WARN_ON_ONCE() was added in the hope of
determining who's calling idr functions with negative IDs so that they can
be examined for problems.
Up until now, all two reported cases are ID number coming directly from
userland and getting fed into idr_find() and the warnings seem to cause
more problems than being helpful. Drop the WARN_ON_ONCE()s.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: <markus@trippelsdorf.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
KOSAKI Motohiro [Fri, 8 Mar 2013 20:43:29 +0000 (12:43 -0800)]
mm/mempolicy.c: fix sp_node_init() argument ordering
Currently, n_new is wrongly initialized. start and end parameter are
inverted. Let's fix it.
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Hillf Danton <dhillf@gmail.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Dave Jones <davej@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Hillf Danton [Fri, 8 Mar 2013 20:43:28 +0000 (12:43 -0800)]
mm/mempolicy.c: fix wrong sp_node insertion
n->end is accessed in sp_insert(). Thus it should be update
before calling sp_insert(). This mistake may make kernel panic.
Signed-off-by: Hillf Danton <dhillf@gmail.com>
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Dave Jones <davej@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Peter Hurley [Fri, 8 Mar 2013 20:43:27 +0000 (12:43 -0800)]
ipc: don't allocate a copy larger than max
When MSG_COPY is set, a duplicate message must be allocated for the copy
before locking the queue. However, the copy could not be larger than was
sent which is limited to msg_ctlmax.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Acked-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Peter Hurley [Fri, 8 Mar 2013 20:43:26 +0000 (12:43 -0800)]
ipc: fix potential oops when src msg > 4k w/ MSG_COPY
If the src msg is > 4k, then dest->next points to the
next allocated segment; resetting it just prior to dereferencing
is bad.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Acked-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Fri, 8 Mar 2013 22:46:04 +0000 (14:46 -0800)]
Merge branch 'stable' of git://git./linux/kernel/git/cmetcalf/linux-tile
Pull tile architecture fixes from Chris Metcalf:
"This fixes the bug that Al Viro spotted with the compat llseek code.
I also fixed the compat syscall definitions to use the new syscall
define macros to properly sign-extend their arguments."
* 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
tile: properly use COMPAT_SYSCALL_DEFINEx
tile: work around bug in the generic sys_llseek
Linus Torvalds [Fri, 8 Mar 2013 22:45:17 +0000 (14:45 -0800)]
Merge tag 'metag-for-v3.9-rc2' of git://git./linux/kernel/git/jhogan/metag
Pull metag bugfixes from James Hogan:
"A couple of fairly minor arch/metag integration fixes from v3.9-rc1:
- remove SET_PERSONALITY(): use default definition like other arches
now do.
- inhibit NUMA balancing: like SH, NUMA is used for memories with
different latencies. ARCH_WANT_VARIABLE_LOCALITY has been added
for this purpose."
* tag 'metag-for-v3.9-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag:
metag: Inhibit NUMA balancing.
metag: remove SET_PERSONALITY()
Linus Torvalds [Fri, 8 Mar 2013 22:43:33 +0000 (14:43 -0800)]
Merge branch 'for-linus' of git://git./linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"All are boring small fixes in various parts:
- A few possible NULL-dereference or zero-division Oops fixes
- Fix vmaster slave volume notification
- Add codec ID for ALC233
- Various fixes in several ASoC WM codecs
- ASoC tegra i2c fix
Sorry if you wanted a thrilling adventure with huge sharks :)"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: ice1712: Initialize card->private_data properly
ALSA: hda - Add support of new codec ALC233
ALSA: hda/ca0132 - Avoid division by zero in dspxfr_one_seg()
ALSA: hda - check NULL pointer when creating SPDIF PCM switch
ALSA: hda - check NULL pointer when creating SPDIF controls
ASoC: wm5102: Apply a SYSCLK patch for later revs
ALSA: vmaster: Fix slave change notification
ASoC: tegra: fix I2S bit count mask
ALSA: seq: seq_oss_event: missing range checks
ASoC: wm8350: Use jiffies rather than msecs in schedule_delayed_work()
ASoC: wm5110: Correct OUT2/3 volume and switch names
ASoC: wm5102: Correct OUT2 volume and switch names
ASoC: wm8960: Fix ADC power bits
ASoC: wm8960: Correct register 0 and 1 defaults
Linus Torvalds [Fri, 8 Mar 2013 22:42:52 +0000 (14:42 -0800)]
Merge branch 'for-3.9/upstream-fixes' of git://git./linux/kernel/git/jikos/hid
Pull HID fix from Jiri Kosina:
"Bugfix for a long-standing bug in logitech-dj driver causing all sorts
of random initialization problems, finally debugged by Benjamin
Tissoires with help of Bob Bowles."
* 'for-3.9/upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: logitech-dj: do not directly call hid_output_raw_report() during probe
Linus Torvalds [Fri, 8 Mar 2013 22:42:16 +0000 (14:42 -0800)]
Merge tag 'random_for_linus' of git://git./linux/kernel/git/tytso/random
Pull random fixes from Ted Ts'o:
"Fix a circular locking dependency in random's collection of cputime
used by a thread when it exits."
* tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random:
random: fix locking dependency with the tasklist_lock
Linus Torvalds [Fri, 8 Mar 2013 17:03:07 +0000 (09:03 -0800)]
vfs: don't BUG_ON() if following a /proc fd pseudo-symlink results in a symlink
It's "normal" - it can happen if the file descriptor you followed was
opened with O_NOFOLLOW.
Reported-by: Dave Jones <davej@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Thu, 7 Mar 2013 23:57:38 +0000 (15:57 -0800)]
Merge branch 'x86-urgent-for-linus' of git://git./linux/kernel/git/tip/tip
Pull x86 fixes from Peter Anvin:
"Several boot fixes (MacBook, legacy EFI bootloaders), another
please-don't-brick fix, and some minor stuff."
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86: Do not try to sync identity map for non-mapped pages
x86, doc: Be explicit about what the x86 struct boot_params requires
x86: Don't clear efi_info even if the sentinel hits
x86, mm: Make sure to find a 2M free block for the first mapped area
x86: Fix 32-bit *_cpu_data initializers
efivarfs: return accurate error code in efivarfs_fill_super()
efivars: efivarfs_valid_name() should handle pstore syntax
efi: be more paranoid about available space when creating variables
iommu, x86: Add DMA remap fault reason
x86, smpboot: Remove unused variable
Linus Torvalds [Thu, 7 Mar 2013 22:55:54 +0000 (14:55 -0800)]
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
"Misc radeon, nouveau, mgag200 and intel fixes.
The intel fixes should contain the fix for the touchpad on the
Chromebook - hey I'm an input maintainer now!"
Hate to pee on your parade, Dave, but I don't think being an input
maintainer is necessarily something to strive for..
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (25 commits)
drm/tegra: drop "select DRM_HDMI"
drm: Documentation typo fixes
drm/mgag200: Bug fix: Renesas board now selects native resolution.
drm/mgag200: Reject modes that are too big for VRAM
drm/mgag200: 'fbdev_list' in 'struct mga_fbdev' is not used
drm/radeon: don't check mipmap alignment if MIP_ADDRESS is FMASK
drm/radeon: skip MC reset as it's probably not hung
drm/radeon: add primary dac adj quirk for R200 board
drm/radeon: don't set hpd, afmt interrupts when interrupts are disabled
drm/i915: Turn off hsync and vsync on ADPA when disabling crt
drm/i915: Fix incorrect definition of ADPA HSYNC and VSYNC bits
drm/i915: also disable south interrupts when handling them
drm/i915: enable irqs earlier when resuming
drm/i915: Increase the RC6p threshold.
DRM/i915: On G45 enable cursor plane briefly after enabling the display plane.
drm/nv50-: prevent some races between modesetting and page flipping
drm/nouveau/i2c: drop parent refcount when creating ports
drm/nv84: fix regression in page flipping
drm/nouveau: Fix typo in init_idx_addr_latched().
drm/nouveau: Disable AGP on PowerPC again.
...
Linus Torvalds [Thu, 7 Mar 2013 22:54:28 +0000 (14:54 -0800)]
Merge tag 'pm+acpi-3.9-rc2' of git://git./linux/kernel/git/rafael/linux-pm
Pull ACPI and power management fixes from Rafael J Wysocki:
- Two fixes for the new intel_pstate driver from Dirk Brandewie.
- Fix for incorrect usage of the .find_bridge() callback from struct
acpi_bus_type in the USB core and subsequent removal of that callback
from Rafael J Wysocki.
- ACPI processor driver cleanups from Chen Gang and Syam Sidhardhan.
- ACPI initialization and error messages fix from Joe Perches.
- Operating Performance Points documentation improvement from Nishanth
Menon.
- Fixes for memory leaks and potential concurrency issues and sysfs
attributes leaks during device removal in the core device PM QoS code
from Rafael J Wysocki.
- Calxeda Highbank cpufreq driver simplification from Emilio López.
- cpufreq comment cleanup from Namhyung Kim.
- Fix for a section mismatch in Calxeda Highbank interprocessor
communication code from Mark Langsdorf (this is not a PM fix strictly
speaking, but the code in question went in through the PM tree).
* tag 'pm+acpi-3.9-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
cpufreq / intel_pstate: Do not load on VM that does not report max P state.
cpufreq / intel_pstate: Fix intel_pstate_init() error path
ACPI / glue: Drop .find_bridge() callback from struct acpi_bus_type
ACPI / glue: Add .match() callback to struct acpi_bus_type
ACPI / porocessor: Beautify code, pr->id is u32 which is never < 0
ACPI / processor: Remove redundant NULL check before kfree
ACPI / Sleep: Avoid interleaved message on errors
PM / QoS: Remove device PM QoS sysfs attributes at the right place
PM / QoS: Fix concurrency issues and memory leaks in device PM QoS
cpufreq: highbank: do not initialize array with a loop
PM / OPP: improve introductory documentation
cpufreq: Fix a typo in comment
mailbox, pl320-ipc: remove __init from probe function