<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/fs, branch v4.4-rc2</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>Merge branch 'akpm' (patches from Andrew)</title>
<updated>2015-11-21T18:49:13+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2015-11-21T18:49:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3ad5d7e06a96d54a55acb5ab25938a06814605c8'/>
<id>3ad5d7e06a96d54a55acb5ab25938a06814605c8</id>
<content type='text'>
Merge misc fixes from Andrew Morton:
 "A bunch of fixes"

* emailed patches from Andrew Morton &lt;akpm@linux-foundation.org&gt;:
  slub: mark the dangling ifdef #else of CONFIG_SLUB_DEBUG
  slub: avoid irqoff/on in bulk allocation
  slub: create new ___slab_alloc function that can be called with irqs disabled
  mm: fix up sparse warning in gfpflags_allow_blocking
  ocfs2: fix umask ignored issue
  PM/OPP: add entry in MAINTAINERS
  kernel/panic.c: turn off locks debug before releasing console lock
  kernel/signal.c: unexport sigsuspend()
  kasan: fix kmemleak false-positive in kasan_module_alloc()
  fat: fix fake_offset handling on error path
  mm/hugetlbfs: fix bugs in fallocate hole punch of areas with holes
  mm/page-writeback.c: initialize m_dirty to avoid compile warning
  various: fix pci_set_dma_mask return value checking
  mm: loosen MADV_NOHUGEPAGE to enable Qemu postcopy on s390
  mm: vmalloc: don't remove inexistent guard hole in remove_vm_area()
  tools/vm/page-types.c: support KPF_IDLE
  ncpfs: don't allow negative timeouts
  configfs: allow dynamic group creation
  MAINTAINERS: add Moritz as reviewer for FPGA Manager Framework
  slab.h: sprinkle __assume_aligned attributes
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Merge misc fixes from Andrew Morton:
 "A bunch of fixes"

* emailed patches from Andrew Morton &lt;akpm@linux-foundation.org&gt;:
  slub: mark the dangling ifdef #else of CONFIG_SLUB_DEBUG
  slub: avoid irqoff/on in bulk allocation
  slub: create new ___slab_alloc function that can be called with irqs disabled
  mm: fix up sparse warning in gfpflags_allow_blocking
  ocfs2: fix umask ignored issue
  PM/OPP: add entry in MAINTAINERS
  kernel/panic.c: turn off locks debug before releasing console lock
  kernel/signal.c: unexport sigsuspend()
  kasan: fix kmemleak false-positive in kasan_module_alloc()
  fat: fix fake_offset handling on error path
  mm/hugetlbfs: fix bugs in fallocate hole punch of areas with holes
  mm/page-writeback.c: initialize m_dirty to avoid compile warning
  various: fix pci_set_dma_mask return value checking
  mm: loosen MADV_NOHUGEPAGE to enable Qemu postcopy on s390
  mm: vmalloc: don't remove inexistent guard hole in remove_vm_area()
  tools/vm/page-types.c: support KPF_IDLE
  ncpfs: don't allow negative timeouts
  configfs: allow dynamic group creation
  MAINTAINERS: add Moritz as reviewer for FPGA Manager Framework
  slab.h: sprinkle __assume_aligned attributes
</pre>
</div>
</content>
</entry>
<entry>
<title>ocfs2: fix umask ignored issue</title>
<updated>2015-11-21T00:17:32+00:00</updated>
<author>
<name>Junxiao Bi</name>
<email>junxiao.bi@oracle.com</email>
</author>
<published>2015-11-20T23:57:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8f1eb48758aacf6c1ffce18179295adbf3bd7640'/>
<id>8f1eb48758aacf6c1ffce18179295adbf3bd7640</id>
<content type='text'>
New created file's mode is not masked with umask, and this makes umask not
work for ocfs2 volume.

Fixes: 702e5bc ("ocfs2: use generic posix ACL infrastructure")
Signed-off-by: Junxiao Bi &lt;junxiao.bi@oracle.com&gt;
Cc: Gang He &lt;ghe@suse.com&gt;
Cc: Mark Fasheh &lt;mfasheh@suse.de&gt;
Cc: Joel Becker &lt;jlbec@evilplan.org&gt;
Cc: &lt;stable@vger.kernel.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
New created file's mode is not masked with umask, and this makes umask not
work for ocfs2 volume.

Fixes: 702e5bc ("ocfs2: use generic posix ACL infrastructure")
Signed-off-by: Junxiao Bi &lt;junxiao.bi@oracle.com&gt;
Cc: Gang He &lt;ghe@suse.com&gt;
Cc: Mark Fasheh &lt;mfasheh@suse.de&gt;
Cc: Joel Becker &lt;jlbec@evilplan.org&gt;
Cc: &lt;stable@vger.kernel.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>fat: fix fake_offset handling on error path</title>
<updated>2015-11-21T00:17:32+00:00</updated>
<author>
<name>OGAWA Hirofumi</name>
<email>hirofumi@mail.parknet.co.jp</email>
</author>
<published>2015-11-20T23:57:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=928a477102c4fc6739883415b66987207e3502f4'/>
<id>928a477102c4fc6739883415b66987207e3502f4</id>
<content type='text'>
For the root directory, .  and ..  are faked (using dir_emit_dots()) and
ctx-&gt;pos is reset from 2 to 0.

A corrupted root directory could cause fat_get_entry() to fail, but
-&gt;iterate() (fat_readdir()) reports progress to the VFS (with ctx-&gt;pos
rewound to 0), so any following calls to -&gt;iterate() continue to return
the same entries again and again.

The result is that userspace will never see the end of the directory,
causing e.g.  'ls' to hang in a getdents() loop.

[hirofumi@mail.parknet.co.jp: cleanup and make sure to correct fake_offset]
Reported-by: Vegard Nossum &lt;vegard.nossum@oracle.com&gt;
Tested-by: Vegard Nossum &lt;vegard.nossum@oracle.com&gt;
Signed-off-by: Richard Weinberger &lt;richard.weinberger@gmail.com&gt;
Signed-off-by: OGAWA Hirofumi &lt;hirofumi@mail.parknet.co.jp&gt;
Cc: &lt;stable@vger.kernel.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
For the root directory, .  and ..  are faked (using dir_emit_dots()) and
ctx-&gt;pos is reset from 2 to 0.

A corrupted root directory could cause fat_get_entry() to fail, but
-&gt;iterate() (fat_readdir()) reports progress to the VFS (with ctx-&gt;pos
rewound to 0), so any following calls to -&gt;iterate() continue to return
the same entries again and again.

The result is that userspace will never see the end of the directory,
causing e.g.  'ls' to hang in a getdents() loop.

[hirofumi@mail.parknet.co.jp: cleanup and make sure to correct fake_offset]
Reported-by: Vegard Nossum &lt;vegard.nossum@oracle.com&gt;
Tested-by: Vegard Nossum &lt;vegard.nossum@oracle.com&gt;
Signed-off-by: Richard Weinberger &lt;richard.weinberger@gmail.com&gt;
Signed-off-by: OGAWA Hirofumi &lt;hirofumi@mail.parknet.co.jp&gt;
Cc: &lt;stable@vger.kernel.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>mm/hugetlbfs: fix bugs in fallocate hole punch of areas with holes</title>
<updated>2015-11-21T00:17:32+00:00</updated>
<author>
<name>Mike Kravetz</name>
<email>mike.kravetz@oracle.com</email>
</author>
<published>2015-11-20T23:57:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=1817889e3b2cc1db8abb595712095129ff9156c1'/>
<id>1817889e3b2cc1db8abb595712095129ff9156c1</id>
<content type='text'>
Hugh Dickins pointed out problems with the new hugetlbfs fallocate hole
punch code.  These problems are in the routine remove_inode_hugepages and
mostly occur in the case where there are holes in the range of pages to be
removed.  These holes could be the result of a previous hole punch or
simply sparse allocation.  The current code could access pages outside the
specified range.

remove_inode_hugepages handles both hole punch and truncate operations.
Page index handling was fixed/cleaned up so that the loop index always
matches the page being processed.  The code now only makes a single pass
through the range of pages as it was determined page faults could not race
with truncate.  A cond_resched() was added after removing up to
PAGEVEC_SIZE pages.

Some totally unnecessary code in hugetlbfs_fallocate() that remained from
early development was also removed.

Tested with fallocate tests submitted here:
http://librelist.com/browser//libhugetlbfs/2015/6/25/patch-tests-add-tests-for-fallocate-system-call/
And, some ftruncate tests under development

Fixes: b5cec28d36f5 ("hugetlbfs: truncate_hugepages() takes a range of pages")
Signed-off-by: Mike Kravetz &lt;mike.kravetz@oracle.com&gt;
Acked-by: Hugh Dickins &lt;hughd@google.com&gt;
Cc: Dave Hansen &lt;dave.hansen@linux.intel.com&gt;
Cc: Naoya Horiguchi &lt;n-horiguchi@ah.jp.nec.com&gt;
Cc: Davidlohr Bueso &lt;dave@stgolabs.net&gt;
Cc: "Hillf Danton" &lt;hillf.zj@alibaba-inc.com&gt;
Cc: &lt;stable@vger.kernel.org&gt;	[4.3]
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Hugh Dickins pointed out problems with the new hugetlbfs fallocate hole
punch code.  These problems are in the routine remove_inode_hugepages and
mostly occur in the case where there are holes in the range of pages to be
removed.  These holes could be the result of a previous hole punch or
simply sparse allocation.  The current code could access pages outside the
specified range.

remove_inode_hugepages handles both hole punch and truncate operations.
Page index handling was fixed/cleaned up so that the loop index always
matches the page being processed.  The code now only makes a single pass
through the range of pages as it was determined page faults could not race
with truncate.  A cond_resched() was added after removing up to
PAGEVEC_SIZE pages.

Some totally unnecessary code in hugetlbfs_fallocate() that remained from
early development was also removed.

Tested with fallocate tests submitted here:
http://librelist.com/browser//libhugetlbfs/2015/6/25/patch-tests-add-tests-for-fallocate-system-call/
And, some ftruncate tests under development

Fixes: b5cec28d36f5 ("hugetlbfs: truncate_hugepages() takes a range of pages")
Signed-off-by: Mike Kravetz &lt;mike.kravetz@oracle.com&gt;
Acked-by: Hugh Dickins &lt;hughd@google.com&gt;
Cc: Dave Hansen &lt;dave.hansen@linux.intel.com&gt;
Cc: Naoya Horiguchi &lt;n-horiguchi@ah.jp.nec.com&gt;
Cc: Davidlohr Bueso &lt;dave@stgolabs.net&gt;
Cc: "Hillf Danton" &lt;hillf.zj@alibaba-inc.com&gt;
Cc: &lt;stable@vger.kernel.org&gt;	[4.3]
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ncpfs: don't allow negative timeouts</title>
<updated>2015-11-21T00:17:32+00:00</updated>
<author>
<name>Dan Carpenter</name>
<email>dan.carpenter@oracle.com</email>
</author>
<published>2015-11-20T23:56:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=1491e30ed1a741009d1d38f9285f7a29e6c05c78'/>
<id>1491e30ed1a741009d1d38f9285f7a29e6c05c78</id>
<content type='text'>
This code causes a static checker warning because it's a user controlled
variable where we cap the upper bound but not the lower bound.  Let's
return an -EINVAL for negative timeouts.

[akpm@linux-foundation.org: remove unneeded `else']
Signed-off-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Reviewed-by: Jan Kara &lt;jack@suse.com&gt;
Cc: Petr Vandrovec &lt;petr@vandrovec.name&gt;
Cc: David Howells &lt;dhowells@redhat.com&gt;
Cc: Jan Kara &lt;jack@suse.cz&gt;
Cc: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This code causes a static checker warning because it's a user controlled
variable where we cap the upper bound but not the lower bound.  Let's
return an -EINVAL for negative timeouts.

[akpm@linux-foundation.org: remove unneeded `else']
Signed-off-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Reviewed-by: Jan Kara &lt;jack@suse.com&gt;
Cc: Petr Vandrovec &lt;petr@vandrovec.name&gt;
Cc: David Howells &lt;dhowells@redhat.com&gt;
Cc: Jan Kara &lt;jack@suse.cz&gt;
Cc: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>configfs: allow dynamic group creation</title>
<updated>2015-11-21T00:17:32+00:00</updated>
<author>
<name>Daniel Baluta</name>
<email>daniel.baluta@intel.com</email>
</author>
<published>2015-11-20T23:56:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=5cf6a51e6062afe7cc507f32f1e5f7e6497ae844'/>
<id>5cf6a51e6062afe7cc507f32f1e5f7e6497ae844</id>
<content type='text'>
This patchset introduces IIO software triggers, offers a way of configuring
them via configfs and adds the IIO hrtimer based interrupt source to be used
with software triggers.

The architecture is now split in 3 parts, to remove all IIO trigger specific
parts from IIO configfs core:

(1) IIO configfs - creates the root of the IIO configfs subsys.
(2) IIO software triggers - software trigger implementation, dynamically
    creating /config/iio/triggers group.
(3) IIO hrtimer trigger - is the first interrupt source for software triggers
    (with syfs to follow). Each trigger type can implement its own set of
    attributes.

Lockdep seems to be happy with the locking in configfs patch.

This patch (of 5):

We don't want to hardcode default groups at subsystem
creation time. We export:
	* configfs_register_group
	* configfs_unregister_group
to allow drivers to programatically create/destroy groups
later, after module init time.

This is needed for IIO configfs support.

(akpm: the other 4 patches to be merged via the IIO tree)

Signed-off-by: Daniel Baluta &lt;daniel.baluta@intel.com&gt;
Suggested-by: Lars-Peter Clausen &lt;lars@metafoo.de&gt;
Reviewed-by: Christoph Hellwig &lt;hch@lst.de&gt;
Acked-by: Joel Becker &lt;jlbec@evilplan.org&gt;
Cc: Hartmut Knaack &lt;knaack.h@gmx.de&gt;
Cc: Octavian Purdila &lt;octavian.purdila@intel.com&gt;
Cc: Paul Bolle &lt;pebolle@tiscali.nl&gt;
Cc: Adriana Reus &lt;adriana.reus@intel.com&gt;
Cc: Cristina Opriceana &lt;cristina.opriceana@gmail.com&gt;
Cc: Peter Meerwald &lt;pmeerw@pmeerw.net&gt;
Cc: Alexander Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This patchset introduces IIO software triggers, offers a way of configuring
them via configfs and adds the IIO hrtimer based interrupt source to be used
with software triggers.

The architecture is now split in 3 parts, to remove all IIO trigger specific
parts from IIO configfs core:

(1) IIO configfs - creates the root of the IIO configfs subsys.
(2) IIO software triggers - software trigger implementation, dynamically
    creating /config/iio/triggers group.
(3) IIO hrtimer trigger - is the first interrupt source for software triggers
    (with syfs to follow). Each trigger type can implement its own set of
    attributes.

Lockdep seems to be happy with the locking in configfs patch.

This patch (of 5):

We don't want to hardcode default groups at subsystem
creation time. We export:
	* configfs_register_group
	* configfs_unregister_group
to allow drivers to programatically create/destroy groups
later, after module init time.

This is needed for IIO configfs support.

(akpm: the other 4 patches to be merged via the IIO tree)

Signed-off-by: Daniel Baluta &lt;daniel.baluta@intel.com&gt;
Suggested-by: Lars-Peter Clausen &lt;lars@metafoo.de&gt;
Reviewed-by: Christoph Hellwig &lt;hch@lst.de&gt;
Acked-by: Joel Becker &lt;jlbec@evilplan.org&gt;
Cc: Hartmut Knaack &lt;knaack.h@gmx.de&gt;
Cc: Octavian Purdila &lt;octavian.purdila@intel.com&gt;
Cc: Paul Bolle &lt;pebolle@tiscali.nl&gt;
Cc: Adriana Reus &lt;adriana.reus@intel.com&gt;
Cc: Cristina Opriceana &lt;cristina.opriceana@gmail.com&gt;
Cc: Peter Meerwald &lt;pmeerw@pmeerw.net&gt;
Cc: Alexander Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm</title>
<updated>2015-11-20T23:00:50+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2015-11-20T23:00:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=95803066c697d40798a5db861f6152e533736a25'/>
<id>95803066c697d40798a5db861f6152e533736a25</id>
<content type='text'>
Pull libnvdimm fixes from Dan Williams:

 - A collection of crash and deadlock fixes for DAX that are also tagged
   for -stable.  We will look to re-enable DAX pmd mappings in 4.5, but
   for now 4.4 and -stable should disable it by default.

 - A fixup to ext2 and ext4 to mirror the same warning emitted by XFS
   when mounting with "-o dax"

* 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
  block: protect rw_page against device teardown
  mm, dax: fix DAX deadlocks (COW fault)
  dax: disable pmd mappings
  ext2, ext4: warn when mounting with dax enabled
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull libnvdimm fixes from Dan Williams:

 - A collection of crash and deadlock fixes for DAX that are also tagged
   for -stable.  We will look to re-enable DAX pmd mappings in 4.5, but
   for now 4.4 and -stable should disable it by default.

 - A fixup to ext2 and ext4 to mirror the same warning emitted by XFS
   when mounting with "-o dax"

* 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
  block: protect rw_page against device teardown
  mm, dax: fix DAX deadlocks (COW fault)
  dax: disable pmd mappings
  ext2, ext4: warn when mounting with dax enabled
</pre>
</div>
</content>
</entry>
<entry>
<title>block: protect rw_page against device teardown</title>
<updated>2015-11-19T21:47:10+00:00</updated>
<author>
<name>Dan Williams</name>
<email>dan.j.williams@intel.com</email>
</author>
<published>2015-11-19T21:29:28+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2e6edc95382cc36423aff18a237173ad62d5ab52'/>
<id>2e6edc95382cc36423aff18a237173ad62d5ab52</id>
<content type='text'>
Fix use after free crashes like the following:

 general protection fault: 0000 [#1] SMP
 Call Trace:
  [&lt;ffffffffa0050216&gt;] ? pmem_do_bvec.isra.12+0xa6/0xf0 [nd_pmem]
  [&lt;ffffffffa0050ba2&gt;] pmem_rw_page+0x42/0x80 [nd_pmem]
  [&lt;ffffffff8128fd90&gt;] bdev_read_page+0x50/0x60
  [&lt;ffffffff812972f0&gt;] do_mpage_readpage+0x510/0x770
  [&lt;ffffffff8128fd20&gt;] ? I_BDEV+0x20/0x20
  [&lt;ffffffff811d86dc&gt;] ? lru_cache_add+0x1c/0x50
  [&lt;ffffffff81297657&gt;] mpage_readpages+0x107/0x170
  [&lt;ffffffff8128fd20&gt;] ? I_BDEV+0x20/0x20
  [&lt;ffffffff8128fd20&gt;] ? I_BDEV+0x20/0x20
  [&lt;ffffffff8129058d&gt;] blkdev_readpages+0x1d/0x20
  [&lt;ffffffff811d615f&gt;] __do_page_cache_readahead+0x28f/0x310
  [&lt;ffffffff811d6039&gt;] ? __do_page_cache_readahead+0x169/0x310
  [&lt;ffffffff811c5abd&gt;] ? pagecache_get_page+0x2d/0x1d0
  [&lt;ffffffff811c76f6&gt;] filemap_fault+0x396/0x530
  [&lt;ffffffff811f816e&gt;] __do_fault+0x4e/0xf0
  [&lt;ffffffff811fce7d&gt;] handle_mm_fault+0x11bd/0x1b50

Cc: &lt;stable@vger.kernel.org&gt;
Cc: Jens Axboe &lt;axboe@fb.com&gt;
Cc: Alexander Viro &lt;viro@zeniv.linux.org.uk&gt;
Reported-by: kbuild test robot &lt;lkp@intel.com&gt;
Acked-by: Matthew Wilcox &lt;willy@linux.intel.com&gt;
[willy: symmetry fixups]
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Fix use after free crashes like the following:

 general protection fault: 0000 [#1] SMP
 Call Trace:
  [&lt;ffffffffa0050216&gt;] ? pmem_do_bvec.isra.12+0xa6/0xf0 [nd_pmem]
  [&lt;ffffffffa0050ba2&gt;] pmem_rw_page+0x42/0x80 [nd_pmem]
  [&lt;ffffffff8128fd90&gt;] bdev_read_page+0x50/0x60
  [&lt;ffffffff812972f0&gt;] do_mpage_readpage+0x510/0x770
  [&lt;ffffffff8128fd20&gt;] ? I_BDEV+0x20/0x20
  [&lt;ffffffff811d86dc&gt;] ? lru_cache_add+0x1c/0x50
  [&lt;ffffffff81297657&gt;] mpage_readpages+0x107/0x170
  [&lt;ffffffff8128fd20&gt;] ? I_BDEV+0x20/0x20
  [&lt;ffffffff8128fd20&gt;] ? I_BDEV+0x20/0x20
  [&lt;ffffffff8129058d&gt;] blkdev_readpages+0x1d/0x20
  [&lt;ffffffff811d615f&gt;] __do_page_cache_readahead+0x28f/0x310
  [&lt;ffffffff811d6039&gt;] ? __do_page_cache_readahead+0x169/0x310
  [&lt;ffffffff811c5abd&gt;] ? pagecache_get_page+0x2d/0x1d0
  [&lt;ffffffff811c76f6&gt;] filemap_fault+0x396/0x530
  [&lt;ffffffff811f816e&gt;] __do_fault+0x4e/0xf0
  [&lt;ffffffff811fce7d&gt;] handle_mm_fault+0x11bd/0x1b50

Cc: &lt;stable@vger.kernel.org&gt;
Cc: Jens Axboe &lt;axboe@fb.com&gt;
Cc: Alexander Viro &lt;viro@zeniv.linux.org.uk&gt;
Reported-by: kbuild test robot &lt;lkp@intel.com&gt;
Acked-by: Matthew Wilcox &lt;willy@linux.intel.com&gt;
[willy: symmetry fixups]
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>dax: disable pmd mappings</title>
<updated>2015-11-17T07:54:45+00:00</updated>
<author>
<name>Dan Williams</name>
<email>dan.j.williams@intel.com</email>
</author>
<published>2015-11-16T00:06:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ee82c9ed41e896bd47e121d87e4628de0f2656a3'/>
<id>ee82c9ed41e896bd47e121d87e4628de0f2656a3</id>
<content type='text'>
While dax pmd mappings are functional in the nominal path they trigger
kernel crashes in the following paths:

 BUG: unable to handle kernel paging request at ffffea0004098000
 IP: [&lt;ffffffff812362f7&gt;] follow_trans_huge_pmd+0x117/0x3b0
 [..]
 Call Trace:
  [&lt;ffffffff811f6573&gt;] follow_page_mask+0x2d3/0x380
  [&lt;ffffffff811f6708&gt;] __get_user_pages+0xe8/0x6f0
  [&lt;ffffffff811f7045&gt;] get_user_pages_unlocked+0x165/0x1e0
  [&lt;ffffffff8106f5b1&gt;] get_user_pages_fast+0xa1/0x1b0

 kernel BUG at arch/x86/mm/gup.c:131!
 [..]
 Call Trace:
  [&lt;ffffffff8106f34c&gt;] gup_pud_range+0x1bc/0x220
  [&lt;ffffffff8106f634&gt;] get_user_pages_fast+0x124/0x1b0

 BUG: unable to handle kernel paging request at ffffea0004088000
 IP: [&lt;ffffffff81235f49&gt;] copy_huge_pmd+0x159/0x350
 [..]
 Call Trace:
  [&lt;ffffffff811fad3c&gt;] copy_page_range+0x34c/0x9f0
  [&lt;ffffffff810a0daf&gt;] copy_process+0x1b7f/0x1e10
  [&lt;ffffffff810a11c1&gt;] _do_fork+0x91/0x590

All of these paths are interpreting a dax pmd mapping as a transparent
huge page and making the assumption that the pfn is covered by the
memmap, i.e. that the pfn has an associated struct page.  PTE mappings
do not suffer the same fate since they have the _PAGE_SPECIAL flag to
cause the gup path to fault.  We can do something similar for the PMD
path, or otherwise defer pmd support for cases where a struct page is
available.  For now, 4.4-rc and -stable need to disable dax pmd support
by default.

For development the "depends on BROKEN" line can be removed from
CONFIG_FS_DAX_PMD.

Cc: &lt;stable@vger.kernel.org&gt;
Cc: Jan Kara &lt;jack@suse.com&gt;
Cc: Dave Chinner &lt;david@fromorbit.com&gt;
Cc: Matthew Wilcox &lt;willy@linux.intel.com&gt;
Cc: Kirill A. Shutemov &lt;kirill.shutemov@linux.intel.com&gt;
Reported-by: Ross Zwisler &lt;ross.zwisler@linux.intel.com&gt;
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
While dax pmd mappings are functional in the nominal path they trigger
kernel crashes in the following paths:

 BUG: unable to handle kernel paging request at ffffea0004098000
 IP: [&lt;ffffffff812362f7&gt;] follow_trans_huge_pmd+0x117/0x3b0
 [..]
 Call Trace:
  [&lt;ffffffff811f6573&gt;] follow_page_mask+0x2d3/0x380
  [&lt;ffffffff811f6708&gt;] __get_user_pages+0xe8/0x6f0
  [&lt;ffffffff811f7045&gt;] get_user_pages_unlocked+0x165/0x1e0
  [&lt;ffffffff8106f5b1&gt;] get_user_pages_fast+0xa1/0x1b0

 kernel BUG at arch/x86/mm/gup.c:131!
 [..]
 Call Trace:
  [&lt;ffffffff8106f34c&gt;] gup_pud_range+0x1bc/0x220
  [&lt;ffffffff8106f634&gt;] get_user_pages_fast+0x124/0x1b0

 BUG: unable to handle kernel paging request at ffffea0004088000
 IP: [&lt;ffffffff81235f49&gt;] copy_huge_pmd+0x159/0x350
 [..]
 Call Trace:
  [&lt;ffffffff811fad3c&gt;] copy_page_range+0x34c/0x9f0
  [&lt;ffffffff810a0daf&gt;] copy_process+0x1b7f/0x1e10
  [&lt;ffffffff810a11c1&gt;] _do_fork+0x91/0x590

All of these paths are interpreting a dax pmd mapping as a transparent
huge page and making the assumption that the pfn is covered by the
memmap, i.e. that the pfn has an associated struct page.  PTE mappings
do not suffer the same fate since they have the _PAGE_SPECIAL flag to
cause the gup path to fault.  We can do something similar for the PMD
path, or otherwise defer pmd support for cases where a struct page is
available.  For now, 4.4-rc and -stable need to disable dax pmd support
by default.

For development the "depends on BROKEN" line can be removed from
CONFIG_FS_DAX_PMD.

Cc: &lt;stable@vger.kernel.org&gt;
Cc: Jan Kara &lt;jack@suse.com&gt;
Cc: Dave Chinner &lt;david@fromorbit.com&gt;
Cc: Matthew Wilcox &lt;willy@linux.intel.com&gt;
Cc: Kirill A. Shutemov &lt;kirill.shutemov@linux.intel.com&gt;
Reported-by: Ross Zwisler &lt;ross.zwisler@linux.intel.com&gt;
Signed-off-by: Dan Williams &lt;dan.j.williams@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>FS-Cache: Add missing initialization of ret in cachefiles_write_page()</title>
<updated>2015-11-17T01:38:43+00:00</updated>
<author>
<name>Geert Uytterhoeven</name>
<email>geert@linux-m68k.org</email>
</author>
<published>2015-11-12T11:46:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=cf89752645e47d86ba8a4157f4b121fcb33434c5'/>
<id>cf89752645e47d86ba8a4157f4b121fcb33434c5</id>
<content type='text'>
fs/cachefiles/rdwr.c: In function ‘cachefiles_write_page’:
fs/cachefiles/rdwr.c:882: warning: ‘ret’ may be used uninitialized in
this function

If the jump to label "error" is taken, "ret" will indeed be
uninitialized, and random stack data may be printed by the debug code.

Fixes: 102f4d900c9c8f5e ("FS-Cache: Handle a write to the page immediately beyond the EOF marker")
Signed-off-by: Geert Uytterhoeven &lt;geert@linux-m68k.org&gt;
Signed-off-by: David Howells &lt;dhowells@redhat.com&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
fs/cachefiles/rdwr.c: In function ‘cachefiles_write_page’:
fs/cachefiles/rdwr.c:882: warning: ‘ret’ may be used uninitialized in
this function

If the jump to label "error" is taken, "ret" will indeed be
uninitialized, and random stack data may be printed by the debug code.

Fixes: 102f4d900c9c8f5e ("FS-Cache: Handle a write to the page immediately beyond the EOF marker")
Signed-off-by: Geert Uytterhoeven &lt;geert@linux-m68k.org&gt;
Signed-off-by: David Howells &lt;dhowells@redhat.com&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
</feed>
