42 Commits

Author SHA1 Message Date
Wilson Sung
67711e47f3 Merge android-4.9-q (4.9.292) into android-msm-pixel-4.9-sc-lts
Merge 4.9.292 into android-4.9-q
Linux 4.9.292
  * serial: core: fix transmit-buffer reset and memleak
      drivers/tty/serial/serial_core.c
  * serial: pl011: Add ACPI SBSA UART match id
      drivers/tty/serial/amba-pl011.c
  * tty: serial: msm_serial: Deactivate RX DMA for polling support
      drivers/tty/serial/msm_serial.c
  * vgacon: Propagate console boot parameters before calling `vc_resize'
      drivers/video/console/vgacon.c
  * parisc: Fix "make install" on newer debian releases
      arch/parisc/install.sh
  * net/rds: correct socket tunable error in rds_tcp_tune()
      net/rds/tcp.c
  * siphash: use _unaligned version by default
      include/linux/siphash.h
      lib/siphash.c
  * net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
      drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
  * natsemi: xtensa: fix section mismatch warnings
      drivers/net/ethernet/natsemi/xtsonic.c
  * fget: check that the fd still exists after getting a ref to it
      fs/file.c
  * fs: add fget_many() and fput_many()
      fs/file.c
      fs/file_table.c
      include/linux/file.h
      include/linux/fs.h
  * sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl
      drivers/ata/sata_fsl.c
  * sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
      drivers/ata/sata_fsl.c
  * kprobes: Limit max data_size of the kretprobe instances
      include/linux/kprobes.h
      kernel/kprobes.c
  * vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
      drivers/net/vrf.c
  * net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()
      drivers/net/ethernet/dec/tulip/de4x5.c
  * net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound
      drivers/net/ethernet/dec/tulip/de4x5.c
  * ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()
      drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
  * scsi: iscsi: Unblock session then wake up error handler
      drivers/scsi/scsi_transport_iscsi.c
  * thermal: core: Reset previous low and high trip during thermal zone init
      drivers/thermal/thermal_core.c
  * s390/setup: avoid using memblock_enforce_memory_limit
      arch/s390/kernel/setup.c
  * platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep
      drivers/platform/x86/thinkpad_acpi.c
  * net: return correct error code
      net/ipv4/devinet.c
  * hugetlb: take PMD sharing into account when flushing tlb/caches
      mm/hugetlb.c
  * NFSv42: Fix pagecache invalidation after COPY/CLONE
      fs/nfs/nfs42proc.c
  * shm: extend forced shm destroy to support objects from several IPC nses
      include/linux/ipc_namespace.h
      include/linux/sched.h
      include/linux/shm.h
      ipc/shm.c
  * tty: hvc: replace BUG_ON() with negative return value
      drivers/tty/hvc/hvc_xen.c
  * xen/netfront: don't trust the backend response data blindly
      drivers/net/xen-netfront.c
  * xen/netfront: disentangle tx_skb_freelist
      drivers/net/xen-netfront.c
  * xen/netfront: don't read data from request on the ring page
      drivers/net/xen-netfront.c
  * xen/netfront: read response from backend only once
      drivers/net/xen-netfront.c
  * xen/blkfront: don't trust the backend response data blindly
      drivers/block/xen-blkfront.c
  * xen/blkfront: don't take local copy of a request from the ring page
      drivers/block/xen-blkfront.c
  * xen/blkfront: read response from backend only once
      drivers/block/xen-blkfront.c
  * xen: sync include/xen/interface/io/ring.h with Xen's newest version
      include/xen/interface/io/ring.h
  * fuse: release pipe buf after last use
      fs/fuse/dev.c
  * NFC: add NCI_UNREG flag to eliminate the race
      include/net/nfc/nci_core.h
      net/nfc/nci/core.c
  * proc/vmcore: fix clearing user buffer by properly using clear_user()
      fs/proc/vmcore.c
  * vhost/vsock: fix incorrect used length reported to the guest
      drivers/vhost/vsock.c
  * hugetlbfs: flush TLBs correctly after huge_pmd_unshare
      arch/arm/include/asm/tlb.h
      arch/ia64/include/asm/tlb.h
      arch/s390/include/asm/tlb.h
      arch/sh/include/asm/tlb.h
      arch/um/include/asm/tlb.h
      include/asm-generic/tlb.h
      mm/hugetlb.c
      mm/memory.c
  * tracing: Check pid filtering when creating events
      kernel/trace/trace_events.c
  * tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows
      net/ipv4/tcp_cubic.c
  * PM: hibernate: use correct mode for swsusp_close()
      kernel/power/hibernate.c
  * drm/vc4: fix error code in vc4_create_object()
      drivers/gpu/drm/vc4/vc4_bo.c
  * scsi: mpt3sas: Fix kernel panic during drive powercycle test
      drivers/scsi/mpt3sas/mpt3sas_scsih.c
  * ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
      arch/arm/mach-socfpga/core.h
      arch/arm/mach-socfpga/platsmp.c
  * NFSv42: Don't fail clone() unless the OP_CLONE operation failed
      fs/nfs/nfs42xdr.c
  * net: ieee802154: handle iftypes as u32
      include/net/nl802154.h
  * ASoC: topology: Add missing rwsem around snd_ctl_remove() calls
      sound/soc/soc-topology.c
  * ARM: dts: BCM5301X: Add interrupt properties to GPIO node
      arch/arm/boot/dts/bcm5301x.dtsi
  * tracing: Fix pid filtering when triggers are attached
      kernel/trace/trace.h
  * xen: detect uninitialized xenbus in xenbus_init
      drivers/xen/xenbus/xenbus_probe.c
  * xen: don't continue xenstore initialization in case of errors
      drivers/xen/xenbus/xenbus_probe.c
  * fuse: fix page stealing
      fs/fuse/dev.c
  * staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
      drivers/staging/rtl8192e/rtl8192e/rtl_core.c
  * ALSA: ctxfi: Fix out-of-range access
      sound/pci/ctxfi/ctamixer.c
      sound/pci/ctxfi/ctdaio.c
      sound/pci/ctxfi/ctresource.c
      sound/pci/ctxfi/ctresource.h
      sound/pci/ctxfi/ctsrc.c
  * binder: fix test regression due to sender_euid change
      drivers/android/binder.c
  * usb: hub: Fix locking issues with address0_mutex
      drivers/usb/core/hub.c
  * usb: hub: Fix usb enumeration issue due to address0 race
      drivers/usb/core/hub.c
  * USB: serial: option: add Fibocom FM101-GL variants
      drivers/usb/serial/option.c
  * USB: serial: option: add Telit LE910S1 0x9200 composition
      drivers/usb/serial/option.c
  * staging: ion: Prevent incorrect reference counting behavour
      drivers/staging/android/ion/ion.c
    Merge 4.9.291 into android-4.9-q
Linux 4.9.291
  * soc/tegra: pmc: Fix imbalanced clock disabling in error code path
      drivers/soc/tegra/pmc.c
  * usb: max-3421: Use driver data instead of maintaining a list of bound devices
      drivers/usb/host/max3421-hcd.c
  * ASoC: DAPM: Cover regression by kctl change notification fix
      sound/soc/soc-dapm.c
  * batman-adv: Don't always reallocate the fragmentation skb head
      net/batman-adv/fragmentation.c
  * batman-adv: Reserve needed_*room for fragments
      net/batman-adv/fragmentation.c
  * batman-adv: Consider fragmentation for needed_headroom
      net/batman-adv/hard-interface.c
  * batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
      net/batman-adv/bridge_loop_avoidance.c
  * batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN
      net/batman-adv/multicast.c
      net/batman-adv/multicast.h
      net/batman-adv/soft-interface.c
  * batman-adv: Fix own OGM check in aggregated OGMs
      net/batman-adv/bat_v_ogm.c
  * batman-adv: Keep fragments equally sized
      net/batman-adv/fragmentation.c
  * drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors
      drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
  * drm/udl: fix control-message timeout
      drivers/gpu/drm/udl/udl_connector.c
  * cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
      net/wireless/util.c
  * parisc/sticon: fix reverse colors
      drivers/video/console/sticon.c
  * btrfs: fix memory ordering between normal and ordered work functions
      fs/btrfs/async-thread.c
  * mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
      mm/slab.h
  * hexagon: export raw I/O routines for modules
      arch/hexagon/lib/io.c
  * tun: fix bonding active backup with arp monitoring
      drivers/net/tun.c
  * perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
      arch/x86/events/intel/uncore_snbep.c
  * perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server
      arch/x86/events/intel/uncore_snbep.c
  * NFC: reorder the logic in nfc_{un,}register_device
      net/nfc/core.c
  * NFC: reorganize the functions in nci_request
      net/nfc/nci/core.c
  * platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()'
      drivers/platform/x86/hp_accel.c
  * mips: bcm63xx: add support for clk_get_parent()
      arch/mips/bcm63xx/clk.c
  * iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
      drivers/net/ethernet/intel/i40evf/i40evf_main.c
  * net: bnx2x: fix variable dereferenced before check
      drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h
  * sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
      kernel/sched/core.c
  * mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
      arch/mips/Kconfig
  * sh: define __BIG_ENDIAN for math-emu
      arch/sh/include/asm/sfp-machine.h
  * sh: fix kconfig unmet dependency warning for FRAME_POINTER
      arch/sh/Kconfig.debug
  * maple: fix wrong return value of maple_bus_init().
      drivers/sh/maple/maple.c
  * sh: check return code of request_irq
      arch/sh/kernel/cpu/sh4a/smp-shx3.c
  * powerpc/dcr: Use cmplwi instead of 3-argument cmpli
      arch/powerpc/sysdev/dcr-low.S
  * ALSA: gus: fix null pointer dereference on pointer block
      sound/isa/gus/gus_dma.c
  * powerpc/5200: dts: fix memory node unit name
      arch/powerpc/boot/dts/charon.dts
      arch/powerpc/boot/dts/digsy_mtc.dts
      arch/powerpc/boot/dts/lite5200.dts
      arch/powerpc/boot/dts/lite5200b.dts
      arch/powerpc/boot/dts/media5200.dts
      arch/powerpc/boot/dts/mpc5200b.dtsi
      arch/powerpc/boot/dts/o2d.dts
      arch/powerpc/boot/dts/o2d.dtsi
      arch/powerpc/boot/dts/o2dnt2.dts
      arch/powerpc/boot/dts/o3dnt.dts
      arch/powerpc/boot/dts/pcm032.dts
      arch/powerpc/boot/dts/tqm5200.dts
  * scsi: target: Fix alua_tg_pt_gps_count tracking
      drivers/target/target_core_alua.c
  * scsi: target: Fix ordered tag handling
      drivers/target/target_core_device.c
      drivers/target/target_core_internal.h
      drivers/target/target_core_transport.c
      include/target/target_core_base.h
  * MIPS: sni: Fix the build
      arch/mips/sni/time.c
  * tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
      drivers/tty/tty_buffer.c
  * usb: host: ohci-tmio: check return value after calling platform_get_resource()
      drivers/usb/host/ohci-tmio.c
  * ARM: dts: omap: fix gpmc,mux-add-data type
      arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi
      arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
  * scsi: advansys: Fix kernel pointer leak
      drivers/scsi/advansys.c
  * usb: musb: tusb6010: check return value after calling platform_get_resource()
      drivers/usb/musb/tusb6010.c
  * scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
      drivers/scsi/lpfc/lpfc_sli.c
  * PCI/MSI: Destroy sysfs before freeing entries
      drivers/pci/msi.c
  * parisc/entry: fix trace test in syscall exit path
      arch/parisc/kernel/entry.S
  * net: mdio-mux: fix unbalanced put_device
      drivers/net/phy/mdio-mux.c
  * PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
      include/uapi/linux/pci_regs.h
  * mm, oom: do not trigger out_of_memory from the #PF
      mm/oom_kill.c
  * mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
      mm/oom_kill.c
  * powerpc/bpf: Fix BPF_SUB when imm == 0x80000000
      arch/powerpc/net/bpf_jit_comp64.c
  * powerpc/bpf: Validate branch ranges
      arch/powerpc/net/bpf_jit.h
      arch/powerpc/net/bpf_jit_comp64.c
  * ARM: 9156/1: drop cc-option fallbacks for architecture selection
      arch/arm/Makefile
  * USB: chipidea: fix interrupt deadlock
      drivers/usb/chipidea/core.c
  * vsock: prevent unnecessary refcnt inc for nonblocking connect
      net/vmw_vsock/af_vsock.c
  * nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
      drivers/nfc/pn533/pn533.c
  * llc: fix out-of-bound array index in llc_sk_dev_hash()
      include/net/llc.h
  * mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()
      mm/zsmalloc.c
  * bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
      drivers/net/bonding/bond_sysfs_slave.c
  * ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
      drivers/acpi/pmic/intel_pmic.c
  * net: davinci_emac: Fix interrupt pacing disable
      drivers/net/ethernet/ti/davinci_emac.c
  * xen-pciback: Fix return in pm_ctrl_init()
      drivers/xen/xen-pciback/conf_space_capability.c
  * i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()'
      drivers/i2c/busses/i2c-xlr.c
  * scsi: qla2xxx: Turn off target reset during issue_lip
      drivers/scsi/qla2xxx/qla_gbl.h
      drivers/scsi/qla2xxx/qla_mr.c
      drivers/scsi/qla2xxx/qla_os.c
  * watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
      drivers/watchdog/f71808e_wdt.c
  * m68k: set a default value for MEMORY_RESERVE
      arch/m68k/Kconfig.machine
  * dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
      drivers/dma/dmaengine.h
  * netfilter: nfnetlink_queue: fix OOB when mac header was cleared
      net/netfilter/nfnetlink_queue.c
  * auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
      drivers/auxdisplay/img-ascii-lcd.c
  * dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
      drivers/dma/at_xdmac.c
  * mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
      drivers/mtd/spi-nor/hisi-sfc.c
  * fs: orangefs: fix error return code of orangefs_revalidate_lookup()
      fs/orangefs/dcache.c
  * PCI: aardvark: Don't spam about PIO Response Status
      drivers/pci/host/pci-aardvark.c
  * drm/plane-helper: fix uninitialized variable reference
      drivers/gpu/drm/drm_plane_helper.c
  * pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
      fs/nfs/flexfilelayout/flexfilelayoutdev.c
      fs/nfs/pnfs_nfs.c
  * power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
      drivers/power/supply/bq27xxx_battery_i2c.c
  * serial: xilinx_uartps: Fix race condition causing stuck TX
      drivers/tty/serial/xilinx_uartps.c
  * RDMA/mlx4: Return missed an error if device doesn't support steering
      drivers/infiniband/hw/mlx4/qp.c
  * scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
      drivers/scsi/csiostor/csio_lnode.c
  * power: supply: rt5033_battery: Change voltage values to µV
      drivers/power/supply/rt5033_battery.c
  * usb: gadget: hid: fix error code in do_config()
      drivers/usb/gadget/legacy/hid.c
  * serial: 8250_dw: Drop wrong use of ACPI_PTR()
      drivers/tty/serial/8250/8250_dw.c
  * video: fbdev: chipsfb: use memset_io() instead of memset()
      drivers/video/fbdev/chipsfb.c
  * memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
      drivers/memory/fsl_ifc.c
  * soc/tegra: Fix an error handling path in tegra_powergate_power_up()
      drivers/soc/tegra/pmc.c
  * arm: dts: omap3-gta04a4: accelerometer irq fix
      arch/arm/boot/dts/omap3-gta04.dtsi
  * JFS: fix memleak in jfs_mount
      fs/jfs/jfs_mount.c
  * MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
      arch/mips/Kconfig
  * scsi: dc395: Fix error case unwinding
      drivers/scsi/dc395x.c
  * ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
      drivers/irqchip/irq-s3c24xx.c
  * RDMA/rxe: Fix wrong port_cap_flags
      drivers/infiniband/sw/rxe/rxe_param.h
  * crypto: pcrypt - Delay write to padata->info
      crypto/pcrypt.c
  * libertas: Fix possible memory leak in probe and disconnect
      drivers/net/wireless/marvell/libertas/if_usb.c
  * libertas_tf: Fix possible memory leak in probe and disconnect
      drivers/net/wireless/marvell/libertas_tf/if_usb.c
  * samples/kretprobes: Fix return value if register_kretprobe() failed
      samples/kprobes/kretprobe_example.c
  * irq: mips: avoid nested irq_enter()
      drivers/irqchip/irq-bcm6345-l1.c
  * s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
      arch/s390/mm/gmap.c
  * smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
      security/smack/smackfs.c
  * phy: micrel: ksz8041nl: do not use power down mode
      drivers/net/phy/micrel.c
  * mwifiex: Send DELBA requests according to spec
      drivers/net/wireless/marvell/mwifiex/11n.c
  * platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
      drivers/platform/x86/thinkpad_acpi.c
  * mmc: mxs-mmc: disable regulator on error and in the remove function
      drivers/mmc/host/mxs-mmc.c
  * net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
      net/core/stream.c
  * drm/msm: uninitialized variable in msm_gem_import()
      drivers/gpu/drm/msm/msm_gem.c
  * ath10k: fix max antenna gain unit
      drivers/net/wireless/ath/ath10k/mac.c
      drivers/net/wireless/ath/ath10k/wmi.h
  * hwmon: Fix possible memleak in __hwmon_device_register()
      drivers/hwmon/hwmon.c
  * memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
      drivers/memstick/host/jmb38x_ms.c
  * memstick: avoid out-of-range warning
      drivers/memstick/core/ms_block.c
  * b43: fix a lower bounds test
      drivers/net/wireless/broadcom/b43/phy_g.c
  * b43legacy: fix a lower bounds test
      drivers/net/wireless/broadcom/b43legacy/radio.c
  * crypto: qat - disregard spurious PFVF interrupts
      drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
      drivers/crypto/qat/qat_common/adf_vf_isr.c
  * crypto: qat - detect PFVF collision after ACK
      drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
  * ath9k: Fix potential interrupt storm on queue reset
      drivers/net/wireless/ath/ath9k/main.c
  * cpuidle: Fix kobject memory leaks in error paths
      drivers/cpuidle/sysfs.c
  * media: si470x: Avoid card name truncation
      drivers/media/radio/si470x/radio-si470x-i2c.c
      drivers/media/radio/si470x/radio-si470x-usb.c
  * media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()'
      drivers/media/platform/mtk-vpu/mtk_vpu.c
  * media: dvb-usb: fix ununit-value in az6027_rc_query
      drivers/media/usb/dvb-usb/az6027.c
  * cgroup: Make rebind_subsystems() disable v2 controllers all at once
      kernel/cgroup.c
  * parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
      arch/parisc/kernel/smp.c
  * parisc: fix warning in flush_tlb_all
      arch/parisc/mm/init.c
  * spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()
      drivers/spi/spi-bcm-qspi.c
  * ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
      arch/arm/mm/Kconfig
  * ARM: clang: Do not rely on lr register for stacktrace
      arch/arm/kernel/stacktrace.c
  * smackfs: use __GFP_NOFAIL for smk_cipso_doi()
      security/smack/smackfs.c
  * iwlwifi: mvm: disable RX-diversity in powersave
      drivers/net/wireless/intel/iwlwifi/mvm/utils.c
  * PM: hibernate: Get block device exclusively in swsusp_check()
      kernel/power/swap.c
  * mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
      drivers/net/wireless/marvell/mwl8k.c
  * tracing/cfi: Fix cmp_entries_* functions signature mismatch
      kernel/trace/tracing_map.c
  * lib/xz: Validate the value before assigning it to an enum variable
      lib/xz/xz_dec_stream.c
  * lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
      lib/decompress_unxz.c
      lib/xz/xz_dec_lzma2.c
  * memstick: r592: Fix a UAF bug when removing the driver
      drivers/memstick/host/r592.c
  * ACPI: battery: Accept charges over the design capacity as full
      drivers/acpi/battery.c
  * ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
      drivers/net/wireless/ath/dfs_pattern_detector.c
  * tracefs: Have tracefs directories not set OTH permission bits by default
      fs/tracefs/inode.c
  * media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
      drivers/media/usb/dvb-usb/dibusb-common.c
  * ACPICA: Avoid evaluating methods too early during system resume
      drivers/acpi/acpica/acglobal.h
      drivers/acpi/acpica/hwesleep.c
      drivers/acpi/acpica/hwsleep.c
      drivers/acpi/acpica/hwxfsleep.c
  * ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
      arch/ia64/Kconfig.debug
  * media: mceusb: return without resubmitting URB in case of -EPROTO error.
      drivers/media/rc/mceusb.c
  * media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
      drivers/media/platform/s5p-mfc/s5p_mfc.c
  * media: uvcvideo: Set capability in s_param
      drivers/media/usb/uvc/uvc_v4l2.c
  * media: netup_unidvb: handle interrupt properly according to the firmware
      drivers/media/pci/netup_unidvb/netup_unidvb_core.c
  * media: mt9p031: Fix corrupted frame after restarting stream
      drivers/media/i2c/mt9p031.c
  * x86: Increase exception stack sizes
      arch/x86/include/asm/page_64_types.h
  * smackfs: Fix use-after-free in netlbl_catmap_walk()
      security/smack/smackfs.c
  * locking/lockdep: Avoid RCU-induced noinstr fail
      kernel/locking/lockdep.c
  * MIPS: lantiq: dma: reset correct number of channel
      arch/mips/lantiq/xway/dma.c
  * MIPS: lantiq: dma: add small delay after reset
      arch/mips/lantiq/xway/dma.c
  * platform/x86: wmi: do not fail if disabling fails
      drivers/platform/x86/wmi.c
  * Bluetooth: fix use-after-free error in lock_sock_nested()
      net/bluetooth/l2cap_sock.c
  * Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
      net/bluetooth/sco.c
  * USB: iowarrior: fix control-message timeouts
      drivers/usb/misc/iowarrior.c
  * USB: serial: keyspan: fix memleak on probe errors
      drivers/usb/serial/keyspan.c
  * iio: dac: ad5446: Fix ad5622_write() return value
      drivers/iio/dac/ad5446.c
  * quota: correct error number in free_dqentry()
      fs/quota/quota_tree.c
  * quota: check block number when reading the block in quota file
      fs/quota/quota_tree.c
  * PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
      drivers/pci/host/pci-aardvark.c
  * ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
      sound/core/oss/mixer_oss.c
  * ALSA: mixer: oss: Fix racy access to slots
      sound/core/oss/mixer_oss.c
  * serial: core: Fix initializing and restoring termios speed
      drivers/tty/serial/serial_core.c
      include/linux/console.h
  * powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
      arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
  * power: supply: max17042_battery: use VFSOC for capacity when no rsns
      drivers/power/supply/max17042_battery.c
  * power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
      drivers/power/supply/max17042_battery.c
  * signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
      arch/mips/kernel/r2300_fpu.S
      arch/mips/kernel/syscall.c
  * signal: Remove the bogus sigkill_pending in ptrace_stop
      kernel/signal.c
  * RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
      drivers/infiniband/hw/qedr/verbs.c
  * wcn36xx: handle connection loss indication
      drivers/net/wireless/ath/wcn36xx/smd.c
  * mwifiex: Read a PCI register after writing the TX ring write pointer
      drivers/net/wireless/marvell/mwifiex/pcie.c
  * wcn36xx: Fix HT40 capability for 2Ghz band
      drivers/net/wireless/ath/wcn36xx/main.c
  * evm: mark evm_fixmode as __ro_after_init
      security/integrity/evm/evm_main.c
  * rtl8187: fix control-message timeouts
      drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c
  * PCI: Mark Atheros QCA6174 to avoid bus reset
      drivers/pci/quirks.c
  * ath6kl: fix control-message timeout
      drivers/net/wireless/ath/ath6kl/usb.c
  * ath6kl: fix division by zero in send path
      drivers/net/wireless/ath/ath6kl/usb.c
  * mwifiex: fix division by zero in fw download path
      drivers/net/wireless/marvell/mwifiex/usb.c
  * EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
      drivers/edac/sb_edac.c
  * regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property
      Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
  * regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
      Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
      drivers/regulator/s5m8767.c
  * hwmon: (pmbus/lm25066) Add offset coefficients
      drivers/hwmon/pmbus/lm25066.c
  * btrfs: fix lost error handling when replaying directory deletes
      fs/btrfs/tree-log.c
  * vmxnet3: do not stop tx queues after netif_device_detach()
      drivers/net/vmxnet3/vmxnet3_drv.c
  * watchdog: Fix OMAP watchdog early handling
      drivers/watchdog/omap_wdt.c
  * spi: spl022: fix Microwire full duplex mode
      drivers/spi/spi-pl022.c
  * xen/netfront: stop tx queues during live migration
      drivers/net/xen-netfront.c
  * bpf: Prevent increasing bpf_jit_limit above max
      include/linux/filter.h
      kernel/bpf/core.c
      net/core/sysctl_net_core.c
  * mmc: winbond: don't build on M68K
      drivers/mmc/host/Kconfig
  * hyperv/vmbus: include linux/bitops.h
      drivers/hv/hyperv_vmbus.h
  * sfc: Don't use netif_info before net_device setup
      drivers/net/ethernet/sfc/ptp.c
      drivers/net/ethernet/sfc/siena_sriov.c
  * x86/irq: Ensure PI wakeup handler is unregistered before module unload
      arch/x86/kernel/irq.c
  * ALSA: timer: Unconditionally unlink slave instances, too
      sound/core/timer.c
  * ALSA: timer: Fix use-after-free problem
      sound/core/timer.c
  * ALSA: synth: missing check for possible NULL after the call to kstrdup
      sound/synth/emux/emux.c
  * ALSA: line6: fix control and interrupt message timeouts
      sound/usb/line6/driver.c
      sound/usb/line6/driver.h
      sound/usb/line6/podhd.c
      sound/usb/line6/toneport.c
  * ALSA: 6fire: fix control and bulk message timeouts
      sound/usb/6fire/comm.c
      sound/usb/6fire/firmware.c
  * ALSA: ua101: fix division by zero at probe
      sound/usb/misc/ua101.c
  * media: ite-cir: IR receiver stop working after receive overflow
      drivers/media/rc/ite-cir.c
  * parisc: Fix ptrace check on syscall return
      arch/parisc/kernel/entry.S
  * mmc: dw_mmc: Dont wait for DRTO on Write RSP error
      drivers/mmc/host/dw_mmc.c
  * ocfs2: fix data corruption on truncate
      fs/ocfs2/file.c
  * libata: fix read log timeout value
      drivers/ata/libata-eh.c
      include/linux/libata.h
  * Input: i8042 - Add quirk for Fujitsu Lifebook T725
      drivers/input/serio/i8042-x86ia64io.h
  * Input: elantench - fix misreporting trackpoint coordinates
      drivers/input/mouse/elantech.c
  * xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
      drivers/usb/host/xhci-hub.c
  * binder: use cred instead of task for selinux checks
      drivers/android/binder.c
      include/linux/lsm_hooks.h
      include/linux/security.h
      security/security.c
      security/selinux/hooks.c
  * binder: use euid from cred instead of using task
      drivers/android/binder.c
  * ANDROID: arm64: process: Match upstream formatting when dumping memory areas
      arch/arm64/kernel/process.c
  * FROMGIT: binder: fix test regression due to sender_euid change
      drivers/android/binder.c
  * BACKPORT: binder: use cred instead of task for selinux checks
      drivers/android/binder.c
      include/linux/lsm_hooks.h
      include/linux/security.h
      security/security.c
      security/selinux/hooks.c
  * UPSTREAM: binder: use euid from cred instead of using task
      drivers/android/binder.c
    Merge 4.9.290 into android-4.9-q
Linux 4.9.290
  * rsi: fix control-message timeout
      drivers/net/wireless/rsi/rsi_91x_usb.c
  * staging: rtl8192u: fix control-message timeouts
      drivers/staging/rtl8192u/r8192U_core.c
  * staging: r8712u: fix control-message timeout
      drivers/staging/rtl8712/usb_ops_linux.c
  * comedi: vmk80xx: fix bulk and interrupt message timeouts
      drivers/staging/comedi/drivers/vmk80xx.c
  * comedi: vmk80xx: fix bulk-buffer overflow
      drivers/staging/comedi/drivers/vmk80xx.c
  * comedi: vmk80xx: fix transfer-buffer overflows
      drivers/staging/comedi/drivers/vmk80xx.c
  * comedi: ni_usb6501: fix NULL-deref in command paths
      drivers/staging/comedi/drivers/ni_usb6501.c
  * comedi: dt9812: fix DMA buffers on stack
      drivers/staging/comedi/drivers/dt9812.c
  * isofs: Fix out of bound access for corrupted isofs image
      fs/isofs/inode.c
  * printk/console: Allow to disable console output by using console="" or console=null
      kernel/printk/printk.c
  * usb-storage: Add compatibility quirk flags for iODD 2531/2541
      drivers/usb/storage/unusual_devs.h
  * usb: musb: Balance list entry in musb_gadget_queue
      drivers/usb/musb/musb_gadget.c
  * usb: gadget: Mark USB_FSL_QE broken on 64-bit
      drivers/usb/gadget/udc/Kconfig
  * IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
      drivers/infiniband/hw/qib/qib_user_sdma.c
  * IB/qib: Use struct_size() helper
      drivers/infiniband/hw/qib/qib_user_sdma.c
  * Revert "x86/kvm: fix vcpu-id indexed array sizes"
      arch/x86/kvm/ioapic.c
      arch/x86/kvm/ioapic.h
  * usb: hso: fix error handling code of hso_create_net_device
      drivers/net/usb/hso.c
  * net: hso: register netdev later to avoid a race condition
      drivers/net/usb/hso.c
  * ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
      drivers/amba/bus.c
  * arch: pgtable: define MAX_POSSIBLE_PHYSMEM_BITS where needed
      arch/arc/include/asm/pgtable.h
      arch/arm/include/asm/pgtable-2level.h
      arch/arm/include/asm/pgtable-3level.h
      arch/mips/include/asm/pgtable-32.h
      arch/powerpc/include/asm/pte-common.h
      include/asm-generic/pgtable.h
  * mm/zsmalloc: Prepare to variable MAX_PHYSMEM_BITS
      arch/x86/include/asm/pgtable-3level_types.h
      mm/zsmalloc.c
  * scsi: core: Put LLD module refcnt after SCSI device is released
      drivers/scsi/scsi.c
      drivers/scsi/scsi_sysfs.c
  * UPSTREAM: security: selinux: allow per-file labeling for bpffs
      security/selinux/hooks.c

Bug: 210364486
Change-Id: Ia31d19943f4638a9b2ac8122a4c8728a56e8aa0a
Signed-off-by: JohnnLee <johnnlee@google.com>
2021-12-29 06:56:04 +00:00
Jens Axboe
0917c0b01f fs: add fget_many() and fput_many()
commit 091141a42e15fe47ada737f3996b317072afcefb upstream.

Some uses cases repeatedly get and put references to the same file, but
the only exposed interface is doing these one at the time. As each of
these entail an atomic inc or dec on a shared structure, that cost can
add up.

Add fget_many(), which works just like fget(), except it takes an
argument for how many references to get on the file. Ditto fput_many(),
which can drop an arbitrary number of references to a file.

Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-08 08:45:06 +01:00
Jaegeuk Kim
3a72d3a03b ANDROID: vfs/ext4,f2fs: finish umount(2) in time with filesystem work
This patch changes umount(2) flow to wait for delayed fput/mntput. Meanwhile,
we can still see unclosed name spaces which can trigger filesystem panic due
to released device illustrated below. (i.e., ext4 with errors=panic)

So, it introduces fs->umount_end() to change filesystem behavior like
error=remount-ro in ext4.

WARN: DO NOT upstream!

This is only related to Android reboot procedure, and resolves the below
issue where a kernel panic happens when a living filesystem tries to access
dead block device after device_shutdown done by kernel_restart.

Term: namespace(mnt_get_count())

1. create_new_namespaces() creates ns1 and ns2,

  /data(1)    ns1(1)    ns2(1)
    |          |          |
     ---------------------
               |
        sb->s_active = 3

2. after binder_proc_clear_zombies() for ns2 and ns1 triggers
  - delayed_fput()
    - delayed_mntput_work(ns2)

  /data(1)    ns1(1)
    |          |
     ----------
          |
    sb->s_active = 2

3. umount() for /data is successed.

  ns1(1)
    |
 sb->s_active = 1

4. device_shutdown() by init

5.  - delayed_mntput_work(ns1)
     - put_super(), since sb->s_active = 0
       - -EIO

Bug: 63981945
Bug: 65481582
Bug: 72236603
Change-Id: I7db02f480cc839bf9c245e078164a8168ea0d88b
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2018-02-24 04:49:34 +00:00
Al Viro
63b6df1413 give readdir(2)/getdents(2)/etc. uniform exclusion with lseek()
same as read() on regular files has, and for the same reason.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-05-02 19:49:28 -04:00
Yann Droneaud
f938612dd9 include/linux/file.h: remove get_unused_fd() macro
Macro get_unused_fd() is used to allocate a file descriptor with default
flags.  Those default flags (0) don't enable close-on-exec.

This can be seen as an unsafe default: in most case close-on-exec should
be enabled to not leak file descriptor across exec().

It would be better to have a "safer" default set of flags, eg.  O_CLOEXEC
must be used to enable close-on-exec.

Instead this patch removes get_unused_fd() so that out of tree modules
won't be affect by a runtime behavor change which might introduce other
kind of bugs: it's better to catch the change at build time, making it
easier to fix.

Removing the macro will also promote use of get_unused_fd_flags() (or
anon_inode_getfd()) with flags provided by userspace.  Or, if flags cannot
be given by userspace, with flags set to O_CLOEXEC by default.

Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-12-10 17:41:10 -08:00
Al Viro
bd2a31d522 get rid of fget_light()
instead of returning the flags by reference, we can just have the
low-level primitive return those in lower bits of unsigned long,
with struct file * derived from the rest.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-03-10 11:44:42 -04:00
Linus Torvalds
9c225f2655 vfs: atomic f_pos accesses as per POSIX
Our write() system call has always been atomic in the sense that you get
the expected thread-safe contiguous write, but we haven't actually
guaranteed that concurrent writes are serialized wrt f_pos accesses, so
threads (or processes) that share a file descriptor and use "write()"
concurrently would quite likely overwrite each others data.

This violates POSIX.1-2008/SUSv4 Section XSI 2.9.7 that says:

 "2.9.7 Thread Interactions with Regular File Operations

  All of the following functions shall be atomic with respect to each
  other in the effects specified in POSIX.1-2008 when they operate on
  regular files or symbolic links: [...]"

and one of the effects is the file position update.

This unprotected file position behavior is not new behavior, and nobody
has ever cared.  Until now.  Yongzhi Pan reported unexpected behavior to
Michael Kerrisk that was due to this.

This resolves the issue with a f_pos-specific lock that is taken by
read/write/lseek on file descriptors that may be shared across threads
or processes.

Reported-by: Yongzhi Pan <panyongzhi@gmail.com>
Reported-by: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2014-03-10 11:44:41 -04:00
Al Viro
2903ff019b switch simple cases of fget_light to fdget
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-09-26 22:20:08 -04:00
Al Viro
a5b470ba06 new helpers: fdget()/fdput()
Signed-off-bs: Al Viro <viro@zeniv.linux.org.uk>
2012-09-26 21:16:32 -04:00
Al Viro
ad47bd7252 make expand_files() and alloc_fd() static
no callers outside of fs/file.c left

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-09-26 21:09:58 -04:00
Al Viro
8280d16172 new helper: replace_fd()
analog of dup2(), except that it takes struct file * as source.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-09-26 21:09:57 -04:00
Al Viro
fe17f22d7f take purely descriptor-related stuff from fcntl.c to file.c
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-09-26 21:09:57 -04:00
Al Viro
1a7bd2265f make get_unused_fd_flags() a function
... and get_unused_fd() a macro around it

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-09-26 21:08:50 -04:00
Al Viro
4a9d4b024a switch fput to task_work_add
... and schedule_work() for interrupt/kernel_thread callers
(and yes, now it *is* OK to call from interrupt).

We are guaranteed that __fput() will be done before we return
to userland (or exit).  Note that for fput() from a kernel
thread we get an async behaviour; it's almost always OK, but
sometimes you might need to have __fput() completed before
you do anything else.  There are two mechanisms for that -
a general barrier (flush_delayed_fput()) and explicit
__fput_sync().  Both should be used with care (as was the
case for fput() from kernel threads all along).  See comments
in fs/file_table.c for details.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-07-22 23:57:58 +04:00
Al Viro
b57ce9694e vfs: drop_file_write_access() made static
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-03-20 21:29:32 -04:00
Al Viro
1abf0c718f New kind of open files - "location only".
New flag for open(2) - O_PATH.  Semantics:
	* pathname is resolved, but the file itself is _NOT_ opened
as far as filesystem is concerned.
	* almost all operations on the resulting descriptors shall
fail with -EBADF.  Exceptions are:
	1) operations on descriptors themselves (i.e.
		close(), dup(), dup2(), dup3(), fcntl(fd, F_DUPFD),
		fcntl(fd, F_DUPFD_CLOEXEC, ...), fcntl(fd, F_GETFD),
		fcntl(fd, F_SETFD, ...))
	2) fcntl(fd, F_GETFL), for a common non-destructive way to
		check if descriptor is open
	3) "dfd" arguments of ...at(2) syscalls, i.e. the starting
		points of pathname resolution
	* closing such descriptor does *NOT* affect dnotify or
posix locks.
	* permissions are checked as usual along the way to file;
no permission checks are applied to the file itself.  Of course,
giving such thing to syscall will result in permission checks (at
the moment it means checking that starting point of ....at() is
a directory and caller has exec permissions on it).

fget() and fget_light() return NULL on such descriptors; use of
fget_raw() and fget_raw_light() is needed to get them.  That protects
existing code from dealing with those things.

There are two things still missing (they come in the next commits):
one is handling of symlinks (right now we refuse to open them that
way; see the next commit for semantics related to those) and another
is descriptor passing via SCM_RIGHTS datagrams.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2011-03-15 02:21:45 -04:00
Steven Rostedt
c2b3e74b78 fs: Remove unlikely() from fput_light()
In fput_light(), there's an unlikely(fput_needed), which running on
my normal desktop doing firefox, xchat, evolution and part of my distcc farm,
and running the annotate branch profiler shows that the unlikely is not
very unlikely.

 correct incorrect  %        Function             File              Line
 ------- ---------  -        --------             ----              ----
       0       48 100 fput_light                file.h               26
115828710 897415279  88 fput_light              file.h               26
865271179 5286128445  85 fput_light             file.h               26
19568539  8923664  31 fput_light                file.h               26
12353677  3562279  22 fput_light                file.h               26
  267691    67062  20 fput_light                file.h               26
15014853   348172   2 fput_light                file.h               26
  209258      205   0 fput_light                file.h               26
 1364164        0   0 fput_light                file.h               26

Which gives 1032903812 times it was correct and 6203351846 times it was
incorrect, or 85% incorrect.

Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2011-01-17 03:26:26 -05:00
Al Viro
d7065da038 get rid of the magic around f_count in aio
__aio_put_req() plays sick games with file refcount.  What
it wants is fput() from atomic context; it's almost always
done with f_count > 1, so they only have to deal with delayed
work in rare cases when their reference happens to be the
last one.  Current code decrements f_count and if it hasn't
hit 0, everything is fine.  Otherwise it keeps a pointer
to struct file (with zero f_count!) around and has delayed
work do __fput() on it.

Better way to do it: use atomic_long_add_unless( , -1, 1)
instead of !atomic_long_dec_and_test().  IOW, decrement it
only if it's not the last reference, leave refcount alone
if it was.  And use normal fput() in delayed work.

I've made that atomic_long_add_unless call a new helper -
fput_atomic().  Drops a reference to file if it's safe to
do in atomic (i.e. if that's not the last one), tells if
it had been able to do that.  aio.c converted to it, __fput()
use is gone.  req->ki_file *always* contributes to refcount
now.  And __fput() became static.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2010-05-27 22:03:07 -04:00
Al Viro
2c48b9c455 switch alloc_file() to passing struct path
... and have the caller grab both mnt and dentry; kill
leak in infiniband, while we are at it.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2009-12-16 12:16:42 -05:00
Al Viro
3d1e463158 get rid of init_file()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2009-12-16 12:16:42 -05:00
Al Viro
aeb5d72706 [PATCH] introduce fmode_t, do annotations
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2008-10-21 07:47:06 -04:00
Al Viro
1027abe882 [PATCH] merge locate_fd() and get_unused_fd()
New primitive: alloc_fd(start, flags).  get_unused_fd() and
get_unused_fd_flags() become wrappers on top of it.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2008-08-01 11:25:23 -04:00
Al Viro
9f3acc3140 [PATCH] split linux/file.h
Initial splitoff of the low-level stuff; taken to fdtable.h

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2008-05-01 13:08:16 -04:00
Al Viro
3b1253880b [PATCH] sanitize unshare_files/reset_files_struct
* let unshare_files() give caller the displaced files_struct
* don't bother with grabbing reference only to drop it in the
  caller if it hadn't been shared in the first place
* in that form unshare_files() is trivially implemented via
  unshare_fd(), so we eliminate the duplicate logics in fork.c
* reset_files_struct() is not just only called for current;
  it will break the system if somebody ever calls it for anything
  else (we can't modify ->files of somebody else).  Lose the
  task_struct * argument.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2008-04-25 09:23:59 -04:00
Dave Hansen
aceaf78da9 [PATCH] r/o bind mounts: create helper to drop file write access
If someone decides to demote a file from r/w to just
r/o, they can use this same code as __fput().

NFS does just that, and will use this in the next
patch.

AV: drop write access in __fput() only after we evict from file list.

Signed-off-by: Dave Hansen <haveblue@us.ibm.com>
Cc: Erez Zadok <ezk@cs.sunysb.edu>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Cc: "J Bruce Fields" <bfields@fieldses.org>
Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2008-04-19 00:25:32 -04:00
Harvey Harrison
b3c9752868 include/linux: Remove all users of FASTCALL() macro
FASTCALL() is always expanded to empty, remove it.

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-02-13 16:21:18 -08:00
Dave Hansen
ce8d2cdf3d r/o bind mounts: filesystem helpers for custom 'struct file's
Why do we need r/o bind mounts?

This feature allows a read-only view into a read-write filesystem.  In the
process of doing that, it also provides infrastructure for keeping track of
the number of writers to any given mount.

This has a number of uses.  It allows chroots to have parts of filesystems
writable.  It will be useful for containers in the future because users may
have root inside a container, but should not be allowed to write to
somefilesystems.  This also replaces patches that vserver has had out of the
tree for several years.

It allows security enhancement by making sure that parts of your filesystem
read-only (such as when you don't trust your FTP server), when you don't want
to have entire new filesystems mounted, or when you want atime selectively
updated.  I've been using the following script to test that the feature is
working as desired.  It takes a directory and makes a regular bind and a r/o
bind mount of it.  It then performs some normal filesystem operations on the
three directories, including ones that are expected to fail, like creating a
file on the r/o mount.

This patch:

Some filesystems forego the vfs and may_open() and create their own 'struct
file's.

This patch creates a couple of helper functions which can be used by these
filesystems, and will provide a unified place which the r/o bind mount code
may patch.

Also, rename an existing, static-scope init_file() to a less generic name.

Signed-off-by: Dave Hansen <haveblue@us.ibm.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 08:43:04 -07:00
Ulrich Drepper
4a19542e5f O_CLOEXEC for SCM_RIGHTS
Part two in the O_CLOEXEC saga: adding support for file descriptors received
through Unix domain sockets.

The patch is once again pretty minimal, it introduces a new flag for recvmsg
and passes it just like the existing MSG_CMSG_COMPAT flag.  I think this bit
is not used otherwise but the networking people will know better.

This new flag is not recognized by recvfrom and recv.  These functions cannot
be used for that purpose and the asymmetry this introduces is not worse than
the already existing MSG_CMSG_COMPAT situations.

The patch must be applied on the patch which introduced O_CLOEXEC.  It has to
remove static from the new get_unused_fd_flags function but since scm.c cannot
live in a module the function still hasn't to be exported.

Here's a test program to make sure the code works.  It's so much longer than
the actual patch...

#include <errno.h>
#include <error.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/un.h>

#ifndef O_CLOEXEC
# define O_CLOEXEC 02000000
#endif
#ifndef MSG_CMSG_CLOEXEC
# define MSG_CMSG_CLOEXEC 0x40000000
#endif

int
main (int argc, char *argv[])
{
  if (argc > 1)
    {
      int fd = atol (argv[1]);
      printf ("child: fd = %d\n", fd);
      if (fcntl (fd, F_GETFD) == 0 || errno != EBADF)
        {
          puts ("file descriptor valid in child");
          return 1;
        }
      return 0;

    }

  struct sockaddr_un sun;
  strcpy (sun.sun_path, "./testsocket");
  sun.sun_family = AF_UNIX;

  char databuf[] = "hello";
  struct iovec iov[1];
  iov[0].iov_base = databuf;
  iov[0].iov_len = sizeof (databuf);

  union
  {
    struct cmsghdr hdr;
    char bytes[CMSG_SPACE (sizeof (int))];
  } buf;
  struct msghdr msg = { .msg_iov = iov, .msg_iovlen = 1,
                        .msg_control = buf.bytes,
                        .msg_controllen = sizeof (buf) };
  struct cmsghdr *cmsg = CMSG_FIRSTHDR (&msg);

  cmsg->cmsg_level = SOL_SOCKET;
  cmsg->cmsg_type = SCM_RIGHTS;
  cmsg->cmsg_len = CMSG_LEN (sizeof (int));

  msg.msg_controllen = cmsg->cmsg_len;

  pid_t child = fork ();
  if (child == -1)
    error (1, errno, "fork");
  if (child == 0)
    {
      int sock = socket (PF_UNIX, SOCK_STREAM, 0);
      if (sock < 0)
        error (1, errno, "socket");

      if (bind (sock, (struct sockaddr *) &sun, sizeof (sun)) < 0)
        error (1, errno, "bind");
      if (listen (sock, SOMAXCONN) < 0)
        error (1, errno, "listen");

      int conn = accept (sock, NULL, NULL);
      if (conn == -1)
        error (1, errno, "accept");

      *(int *) CMSG_DATA (cmsg) = sock;
      if (sendmsg (conn, &msg, MSG_NOSIGNAL) < 0)
        error (1, errno, "sendmsg");

      return 0;
    }

  /* For a test suite this should be more robust like a
     barrier in shared memory.  */
  sleep (1);

  int sock = socket (PF_UNIX, SOCK_STREAM, 0);
  if (sock < 0)
    error (1, errno, "socket");

  if (connect (sock, (struct sockaddr *) &sun, sizeof (sun)) < 0)
    error (1, errno, "connect");
  unlink (sun.sun_path);

  *(int *) CMSG_DATA (cmsg) = -1;

  if (recvmsg (sock, &msg, MSG_CMSG_CLOEXEC) < 0)
    error (1, errno, "recvmsg");

  int fd = *(int *) CMSG_DATA (cmsg);
  if (fd == -1)
    error (1, 0, "no descriptor received");

  char fdname[20];
  snprintf (fdname, sizeof (fdname), "%d", fd);
  execl ("/proc/self/exe", argv[0], fdname, NULL);
  puts ("execl failed");
  return 1;
}

[akpm@linux-foundation.org: Fix fastcall inconsistency noted by Michael Buesch]
[akpm@linux-foundation.org: build fix]
Signed-off-by: Ulrich Drepper <drepper@redhat.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Michael Buesch <mb@bu3sch.de>
Cc: Michael Kerrisk <mtk-manpages@gmx.net>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 09:05:45 -07:00
Vadim Lobanov
01b2d93ca4 [PATCH] fdtable: Provide free_fdtable() wrapper
Christoph Hellwig has expressed concerns that the recent fdtable changes
expose the details of the RCU methodology used to release no-longer-used
fdtable structures to the rest of the kernel.  The trivial patch below
addresses these concerns by introducing the appropriate free_fdtable()
calls, which simply wrap the release RCU usage.  Since free_fdtable() is a
one-liner, it makes sense to promote it to an inline helper.

Signed-off-by: Vadim Lobanov <vlobanov@speakeasy.net>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-12-22 08:55:50 -08:00
Vadim Lobanov
5466b456ed [PATCH] fdtable: Implement new pagesize-based fdtable allocator
This patch provides an improved fdtable allocation scheme, useful for
expanding fdtable file descriptor entries.  The main focus is on the fdarray,
as its memory usage grows 128 times faster than that of an fdset.

The allocation algorithm sizes the fdarray in such a way that its memory usage
increases in easy page-sized chunks. The overall algorithm expands the allowed
size in powers of two, in order to amortize the cost of invoking vmalloc() for
larger allocation sizes. Namely, the following sizes for the fdarray are
considered, and the smallest that accommodates the requested fd count is
chosen:

    pagesize / 4
    pagesize / 2
    pagesize      <- memory allocator switch point
    pagesize * 2
    pagesize * 4
    ...etc...

Unlike the current implementation, this allocation scheme does not require a
loop to compute the optimal fdarray size, and can be done in efficient
straightline code.

Furthermore, since the fdarray overflows the pagesize boundary long before any
of the fdsets do, it makes sense to optimize run-time by allocating both
fdsets in a single swoop.  Even together, they will still be, by far, smaller
than the fdarray.  The fdtable->open_fds is now used as the anchor for the
fdset memory allocation.

Signed-off-by: Vadim Lobanov <vlobanov@speakeasy.net>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Dipankar Sarma <dipankar@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-12-10 09:57:22 -08:00
Vadim Lobanov
4fd45812cb [PATCH] fdtable: Remove the free_files field
An fdtable can either be embedded inside a files_struct or standalone (after
being expanded).  When an fdtable is being discarded after all RCU references
to it have expired, we must either free it directly, in the standalone case,
or free the files_struct it is contained within, in the embedded case.

Currently the free_files field controls this behavior, but we can get rid of
it entirely, as all the necessary information is already recorded.  We can
distinguish embedded and standalone fdtables using max_fds, and if it is
embedded we can divine the relevant files_struct using container_of().

Signed-off-by: Vadim Lobanov <vlobanov@speakeasy.net>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Dipankar Sarma <dipankar@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-12-10 09:57:22 -08:00
Vadim Lobanov
bbea9f6966 [PATCH] fdtable: Make fdarray and fdsets equal in size
Currently, each fdtable supports three dynamically-sized arrays of data: the
fdarray and two fdsets.  The code allows the number of fds supported by the
fdarray (fdtable->max_fds) to differ from the number of fds supported by each
of the fdsets (fdtable->max_fdset).

In practice, it is wasteful for these two sizes to differ: whenever we hit a
limit on the smaller-capacity structure, we will reallocate the entire fdtable
and all the dynamic arrays within it, so any delta in the memory used by the
larger-capacity structure will never be touched at all.

Rather than hogging this excess, we shouldn't even allocate it in the first
place, and keep the capacities of the fdarray and the fdsets equal.  This
patch removes fdtable->max_fdset.  As an added bonus, most of the supporting
code becomes simpler.

Signed-off-by: Vadim Lobanov <vlobanov@speakeasy.net>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Dipankar Sarma <dipankar@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-12-10 09:57:22 -08:00
Christoph Lameter
8b7d91eb7f [PATCH] Move filep_cachep to include/file.h
filp_cachep is only used in fs/file_table.c and in fs/dcache.c where
it is defined.

Move it to related definitions in linux/file.h.

Signed-off-by: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-12-07 08:39:23 -08:00
Christoph Lameter
5d6538fcf2 [PATCH] Move files_cachep to include/file.h
Proper place is in file.h since files_cachep uses are rated to file I/O.

Signed-off-by: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-12-07 08:39:22 -08:00
Kirill Korotaev
3b9b8ab65d [PATCH] Fix unserialized task->files changing
Fixed race on put_files_struct on exec with proc.  Restoring files on
current on error path may lead to proc having a pointer to already kfree-d
files_struct.

->files changing at exit.c and khtread.c are safe as exit_files() makes all
things under lock.

Found during OpenVZ stress testing.

[akpm@osdl.org: add export]
Signed-off-by: Pavel Emelianov <xemul@openvz.org>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-09-29 09:18:12 -07:00
Eric Dumazet
0c9e63fd38 [PATCH] Shrinks sizeof(files_struct) and better layout
1) Reduce the size of (struct fdtable) to exactly 64 bytes on 32bits
   platforms, lowering kmalloc() allocated space by 50%.

2) Reduce the size of (files_struct), using a special 32 bits (or
   64bits) embedded_fd_set, instead of a 1024 bits fd_set for the
   close_on_exec_init and open_fds_init fields.  This save some ram (248
   bytes per task) as most tasks dont open more than 32 files.  D-Cache
   footprint for such tasks is also reduced to the minimum.

3) Reduce size of allocated fdset.  Currently two full pages are
   allocated, that is 32768 bits on x86 for example, and way too much.  The
   minimum is now L1_CACHE_BYTES.

UP and SMP should benefit from this patch, because most tasks will touch
only one cache line when open()/close() stdin/stdout/stderr (0/1/2),
(next_fd, close_on_exec_init, open_fds_init, fd_array[0 ..  2] being in the
same cache line)

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-03-23 07:38:09 -08:00
Dipankar Sarma
529bf6be5c [PATCH] fix file counting
I have benchmarked this on an x86_64 NUMA system and see no significant
performance difference on kernbench.  Tested on both x86_64 and powerpc.

The way we do file struct accounting is not very suitable for batched
freeing.  For scalability reasons, file accounting was
constructor/destructor based.  This meant that nr_files was decremented
only when the object was removed from the slab cache.  This is susceptible
to slab fragmentation.  With RCU based file structure, consequent batched
freeing and a test program like Serge's, we just speed this up and end up
with a very fragmented slab -

llm22:~ # cat /proc/sys/fs/file-nr
587730  0       758844

At the same time, I see only a 2000+ objects in filp cache.  The following
patch I fixes this problem.

This patch changes the file counting by removing the filp_count_lock.
Instead we use a separate percpu counter, nr_files, for now and all
accesses to it are through get_nr_files() api.  In the sysctl handler for
nr_files, we populate files_stat.nr_files before returning to user.

Counting files as an when they are created and destroyed (as opposed to
inside slab) allows us to correctly count open files with RCU.

Signed-off-by: Dipankar Sarma <dipankar@in.ibm.com>
Cc: "Paul E. McKenney" <paulmck@us.ibm.com>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-03-08 14:14:01 -08:00
Eric Dumazet
95e861db3e [PATCH] reorder struct files_struct
The file_lock spinlock sits close to mostly read fields of 'struct
files_struct'

In SMP (and NUMA) environments, each time a thread wants to open or close
a file, it has to acquire the spinlock, thus invalidating the cache line
containing this spinlock on other CPUS.  So other threads doing
read()/write()/...  calls that use RCU to access the file table are going
to ask further memory (possibly NUMA) transactions to read again this
memory line.

Move the spinlock to another cache line, so that concurrent threads can
share the cache line containing 'count' and 'fdt' fields.

It's worth up to 9% on a microbenchmark using a 4-thread 2-package x86
machine.  See
http://marc.theaimsgroup.com/?l=linux-kernel&m=112680448713342&w=2

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-11-13 18:14:10 -08:00
Pekka J Enberg
2109a2d1b1 [PATCH] mm: rename kmem_cache_s to kmem_cache
This patch renames struct kmem_cache_s to kmem_cache so we can start using
it instead of kmem_cache_t typedef.

Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-11-07 07:53:24 -08:00
Dipankar Sarma
ab2af1f500 [PATCH] files: files struct with RCU
Patch to eliminate struct files_struct.file_lock spinlock on the reader side
and use rcu refcounting rcuref_xxx api for the f_count refcounter.  The
updates to the fdtable are done by allocating a new fdtable structure and
setting files->fdt to point to the new structure.  The fdtable structure is
protected by RCU thereby allowing lock-free lookup.  For fd arrays/sets that
are vmalloced, we use keventd to free them since RCU callbacks can't sleep.  A
global list of fdtable to be freed is not scalable, so we use a per-cpu list.
If keventd is already handling the current cpu's work, we use a timer to defer
queueing of that work.

Since the last publication, this patch has been re-written to avoid using
explicit memory barriers and use rcu_assign_pointer(), rcu_dereference()
premitives instead.  This required that the fd information is kept in a
separate structure (fdtable) and updated atomically.

Signed-off-by: Dipankar Sarma <dipankar@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-09 13:57:55 -07:00
Dipankar Sarma
badf16621c [PATCH] files: break up files struct
In order for the RCU to work, the file table array, sets and their sizes must
be updated atomically.  Instead of ensuring this through too many memory
barriers, we put the arrays and their sizes in a separate structure.  This
patch takes the first step of putting the file table elements in a separate
structure fdtable that is embedded withing files_struct.  It also changes all
the users to refer to the file table using files_fdtable() macro.  Subsequent
applciation of RCU becomes easier after this.

Signed-off-by: Dipankar Sarma <dipankar@in.ibm.com>
Signed-Off-By: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-09 13:57:55 -07:00
Linus Torvalds
1da177e4c3 Linux-2.6.12-rc2
Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.

Let it rip!
2005-04-16 15:20:36 -07:00