Commit Graph

414591 Commits

Author SHA1 Message Date
Geert Uytterhoeven 17fe0d9a28 spi: rspi: Convert to clk_prepare_enable/disable_unprepare
Get the driver ready for the migration to the common clock framework by
calling clk_prepare_enable() and clk_disable_unprepare().

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-27 20:07:38 +00:00
Geert Uytterhoeven 06a7a3cff0 spi: rspi: Add support for loopback mode
Add support for specifying loopback mode.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-27 20:07:38 +00:00
Geert Uytterhoeven 862d357f84 spi: rspi: Add support for RSPI on RZ/A1H
Add support for the RSPI variant in the RZ/A1H (r7s72100) SoC.

Main differences with RSPI on SH are:
  - Lack of TX only mode, hence we always have to use full duplex
    transfers,
  - The Data Register must be accessed used 8-bit operations.

RSPI on RZ is matched using the new "rspi-rz" platform device name.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-27 20:07:07 +00:00
Geert Uytterhoeven 9372220678 spi: rspi: Add support for more than one interrupt
Add support for multiple interrupts, based on the SDK reference code.
This is needed for RZ/A1H, which supports 3 interrupts.

When using multiple interrupts, they must be called "rx" (SPRI) and "tx"
(SPTI). The error interrupt (SPEI) is not used, as it matters for slave
mode only.

When using a single interrupt, it may be called "mux". If it cannot be
found, the first interrupt in the device's resources will be used.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-27 20:05:34 +00:00
Geert Uytterhoeven 340a15e6f0 spi: rspi: Merge qspi_send_pio() and qspi_receive_pio()
qspi_send_pio() and qspi_receive_pio() are very similar: they both send
and receive full duplex data to/from the hardware, but ignore the data
stream in the unused direction.
Merge them into qspi_transfer_out_in(), now supporting real full duplex.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-27 20:02:10 +00:00
Geert Uytterhoeven 8449fd76de spi: rspi: Merge rspi_send_pio() and rspi_receive_pio()
rspi_send_pio() and rspi_receive_pio() are very similar:
  - the former only sends data, using TX Only Mode,
  - the latter sends and receives full duplex data to/from the hardware,
    but uses dummy transmit data.
Merge them into rspi_transfer_out_in(), now supporting full duplex if
needed.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-27 20:02:10 +00:00
Geert Uytterhoeven eb557f7526 spi: rspi: Abstract transfer_one() for RSPI and QSPI
Split off qspi_transfer_one() (which doesn't support DMA yet) from
rspi_transfer_one().
Replace the abstraction of send_pio()/receive_pio() by the abstracrion of
transfer_one().

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-27 20:02:09 +00:00
Geert Uytterhoeven 35301c9960 spi: rspi: Add rspi_data_{out,in,out_in}() helpers
Add helpers rspi_data_{out,in,out_in}() to write, read, or write and
read data to/from the Data Register, taking care of waiting until data
or space is available in the buffers.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-27 20:02:09 +00:00
Geert Uytterhoeven 74da76865d spi: rspi: Abstract 8/16-bit Data Register access
Add rspi_{write,read}_data(), to abstract 8-bit (QSPI, and RSPI on RZ/A1H)
versus 16-bit (RSPI) Data Register access.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-27 20:02:09 +00:00
Geert Uytterhoeven 79d2349542 spi: rspi: Use core message handling
Let the generic SPI core handle SPI messages, calling into our
rspi_transfer_one() method.

rspi_assert_ssl() and rspi_negate_ssl() are absorbed into
rspi_prepare_message() and rspi_unprepare_message(), as they actually
enable/disable the whole SPI function, instead of just (de)asserting the
chip select line.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-27 20:02:09 +00:00
Geert Uytterhoeven 91949a2d4a spi: rspi: Remove unused mesg parameter from {send,receive}_pio()
Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-27 20:02:09 +00:00
Mark Brown 8b8b773e6b Merge commit 'spi/topic/sc18is602' into spi-linus 2014-01-23 13:14:15 +00:00
Mark Brown 341e6df6c8 Merge commit 'spi/fix/rcar' into spi-linus 2014-01-23 13:13:30 +00:00
Mark Brown 8aeab58e56 Merge remote-tracking branches 'spi/topic/pxa2xx', 'spi/topic/qspi', 'spi/topic/s3c24xx', 'spi/topic/s3c64xx', 'spi/topic/sh', 'spi/topic/tegra114', 'spi/topic/tegra20-sflash', 'spi/topic/tegra20-slink', 'spi/topic/txx9' and 'spi/topic/xcomm' into spi-linus 2014-01-23 13:07:14 +00:00
Mark Brown 907e26b6f5 Merge remote-tracking branches 'spi/topic/fsl-espi', 'spi/topic/gpio', 'spi/topic/hspi', 'spi/topic/mpc512x', 'spi/topic/msiof', 'spi/topic/nuc900', 'spi/topic/oc-tiny', 'spi/topic/omap', 'spi/topic/orion' and 'spi/topic/pci' into spi-linus 2014-01-23 13:07:09 +00:00
Mark Brown 36e66bf84f Merge remote-tracking branches 'spi/topic/bcm2835', 'spi/topic/bcm63xx', 'spi/topic/bcm63xx-hsspi', 'spi/topic/bitbang', 'spi/topic/bpw', 'spi/topic/clps711x', 'spi/topic/coldfire', 'spi/topic/davinci', 'spi/topic/dw' and 'spi/topic/falcon' into spi-linus 2014-01-23 13:07:05 +00:00
Mark Brown 1504d226f7 Merge remote-tracking branches 'spi/fix/bcm63xx', 'spi/fix/dspi', 'spi/fix/hspi', 'spi/fix/imx', 'spi/fix/msiof', 'spi/fix/pxa2xx', 'spi/fix/qspi', 'spi/topic/altera', 'spi/topic/ath79' and 'spi/topic/atmel' into spi-linus 2014-01-23 13:07:01 +00:00
Mark Brown 3c1039745e Merge remote-tracking branch 'spi/topic/core' into spi-linus 2014-01-23 13:07:01 +00:00
Mark Brown 7e2c225d58 Merge remote-tracking branch 'spi/fix/core' into spi-linus 2014-01-23 13:07:00 +00:00
Axel Lin 13a4279880 spi: core: Fix transfer failure when master->transfer_one returns positive value
master->transfer_one returns positive value is not a error.
So set ret to 0 when master->transfer_one returns positive value.
Otherwise, I hit "spi_master spi0: failed to transfer one message from queue"
error when my transfer_one callback returns 1.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-21 18:45:34 +00:00
Geert Uytterhoeven bd6857a0c6 spi: Correct set_cs() documentation
The documentation for spi_master.set_cs() says:

    assert or deassert chip select, true to assert

i.e. its "enable" parameter uses assertion-level logic.

This does not match the implementation of spi_set_cs(), which calls
spi_master.set_cs() with the wanted logic level of the chip select line,
which depends on the polarity of the chip select signal.

Correct the documentation to match the implementation.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-21 18:11:49 +00:00
Geert Uytterhoeven 0516712c65 spi: Clarify transfer_one() w.r.t. spi_finalize_current_transfer()
Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-21 18:11:49 +00:00
Geert Uytterhoeven 9e8f4882cc spi: Spelling s/finised/finished/
Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-21 18:11:45 +00:00
Axel Lin 463654cec2 spi: sc18is602: Convert to use bits_per_word_mask
Since commit 543bb25 "spi: add ability to validate xfer->bits_per_word in SPI
core", the driver can set bits_per_word_mask for the master then the SPI core
will reject transfers that attempt to use an unsupported bits_per_word value.
So we can remove the bits_per_word checking in sc18is602_check_transfer() and
let SPI core handle the checking.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-17 15:55:54 +00:00
Axel Lin 23061f1eb8 spi: Remove duplicate code to set default bits_per_word setting
The implementation in spi_setup() already set spi->bits_per_word = 8 when
spi->bits_per_word is 0 before calling spi->master->setup.
So we don't need to do it again in setup() callback.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Marek Vasut <marex@denx.de>
Acked-by: Barry Song <Baohua.Song@csr.com>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-17 15:54:22 +00:00
Mark Brown 81e53d0470 Merge branches 'topic/sc18is602' and 'topic/rspi' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi into spi-bpw 2014-01-17 15:52:17 +00:00
Mika Westerberg 382cebb02a spi/pxa2xx: fix compilation warning when !CONFIG_PM_SLEEP
CONFIG_PM will be set if either or both CONFIG_PM_SLEEP and
CONFIG_PM_RUNTIME is set. Compiling the driver with !CONFIG_PM_SLEEP causes
following compilation warning:

drivers/spi/spi-pxa2xx.c:1270:12: warning: ‘pxa2xx_spi_suspend’ defined but not used [-Wunused-function]

Fix this by using CONFIG_PM_SLEEP instead.

Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-16 14:07:48 +00:00
Axel Lin 350a9b3304 spi: clps711x: Add MODULE_ALIAS to support module auto-loading
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-14 14:21:43 +00:00
Geert Uytterhoeven fcb4ed749c spi: rspi: Add missing clk_disable() calls in error and cleanup paths
Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-14 14:14:54 +00:00
Mark Brown 13ea330010 Merge branch 'topic/rcar' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi into spi-rspi 2014-01-14 14:14:47 +00:00
Geert Uytterhoeven b7ed6b88b2 spi: rspi: Spelling s/transmition/transmission/
Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-14 14:02:11 +00:00
Geert Uytterhoeven 348e5153bc spi: rspi: Add support for specifying CPHA/CPOL
Add support for specifying the SPI clock phase and polarity, based on the
SDK reference code.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 17:24:04 +00:00
Mika Westerberg 483c319188 spi/pxa2xx: initialize DMA channels to -1 to prevent inadvertent match
Commit cddb339bad (spi/pxa2xx: convert to dma_request_slave_channel_compat())
converted the driver to use ACPI provided DMA helpers but it forgot to
initialize the platform data for the channels to -1. Failing to do so will
result inadvertent match in the filter function because 0 is a valid
channel number.

Prevent this from happening by initializing both platform data channels
correctly to -1.

Fixes: cddb339bad (spi/pxa2xx: convert to dma_request_slave_channel_compat())
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org
2014-01-13 12:39:19 +00:00
Geert Uytterhoeven fbe5072bbe spi: rspi: Add more QSPI register documentation
Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 12:10:01 +00:00
Geert Uytterhoeven 6ab4865b7e spi: rspi: Add more RSPI register documentation
Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 12:10:01 +00:00
Geert Uytterhoeven e2e5ed79fe spi: rspi: Remove dependency on DMAE for SHMOBILE
On ARM-based SHMOBILE, the rspi driver builds and works fine without the
DMA controller driver, hence relax the dependencies.

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 11:53:44 +00:00
Geert Uytterhoeven 3e83c19497 spi/s3c64xx: Correct indentation
Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 11:30:41 +00:00
Axel Lin 909e709c77 spi: sh: Use spi_sh_clear_bit() instead of open-coded
We have a spi_sh_clear_bit() function, there's no reason not to use it.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 11:26:28 +00:00
Geert Uytterhoeven f21524f5bc spi: bitbang: Grammar s/make to make/to make/
Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 11:24:21 +00:00
Geert Uytterhoeven c6c07b4f6d spi: sh-hspi: Spelling s/recive/receive/
Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 11:21:45 +00:00
Geert Uytterhoeven 1afd9989a6 spi: core: Improve tx/rx_nbits check comments
- Rephrase the comments about tx/rx_nbits validity checks,
  - Remove the stale comment about SPI_3WIRE (the code it refers to was
    removed in commit 368ca4e0c7 ("spi:
    Eliminate 3WIRE spi_transfer check")).

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 11:20:46 +00:00
Geert Uytterhoeven 269ccca8ec spi: Kill superfluous cast in spi_w8r16()
spi_write_then_read() takes a "void *" for rxbuf, so there's no need to
cast the buffer pointer to "u8 *".

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 11:20:21 +00:00
Axel Lin 5a33d30ff1 spi: ti-qspi: Fixup driver name
The driver name in current code looks like a compatible string which is not
the naming convention for platform drivers.
Fix it and also add modalias since this driver can be built as a module.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Sourav Poddar <sourav.poddar@ti.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 10:16:16 +00:00
Axel Lin 3ab5462054 spi: ti-qspi: Simplify qspi_write_msg and qspi_read_msg implementation
Make the unit of wlen to be byte, and simplify the code to avoid duplicate
code for different wlen cases.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Sourav Poddar <sourav.poddar@ti.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 10:15:13 +00:00
Mark Brown d3fbd45701 spi: Use bitfields for multiple data lines
Trent Piepho observed that since the current realistic maximum number of
data lines is four we can pack the spi_transfer struct more efficiently
if we use a bitfield for the number of bits, allowing the fields to fit
in a single byte along with cs_change.

If space becomes an issue further optimiation is possible by only using
the constants and packing the values chosen for them.

Reported-by: Trent Piepho <tpiepho@gmail.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 10:13:28 +00:00
Axel Lin 646d79b2d7 spi: altera: Remove unneeded NULL checking for hw->bitbang.master
We already has NULL test for master after calling spi_alloc_master().

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
2014-01-13 10:12:45 +00:00
Linus Torvalds 7e22e91102 Linux 3.13-rc8 2014-01-12 17:04:18 +07:00
Steven Rostedt 3dc91d4338 SELinux: Fix possible NULL pointer dereference in selinux_inode_permission()
While running stress tests on adding and deleting ftrace instances I hit
this bug:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
  IP: selinux_inode_permission+0x85/0x160
  PGD 63681067 PUD 7ddbe067 PMD 0
  Oops: 0000 [#1] PREEMPT
  CPU: 0 PID: 5634 Comm: ftrace-test-mki Not tainted 3.13.0-rc4-test-00033-gd2a6dde-dirty #20
  Hardware name:                  /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006
  task: ffff880078375800 ti: ffff88007ddb0000 task.ti: ffff88007ddb0000
  RIP: 0010:[<ffffffff812d8bc5>]  [<ffffffff812d8bc5>] selinux_inode_permission+0x85/0x160
  RSP: 0018:ffff88007ddb1c48  EFLAGS: 00010246
  RAX: 0000000000000000 RBX: 0000000000800000 RCX: ffff88006dd43840
  RDX: 0000000000000001 RSI: 0000000000000081 RDI: ffff88006ee46000
  RBP: ffff88007ddb1c88 R08: 0000000000000000 R09: ffff88007ddb1c54
  R10: 6e6576652f6f6f66 R11: 0000000000000003 R12: 0000000000000000
  R13: 0000000000000081 R14: ffff88006ee46000 R15: 0000000000000000
  FS:  00007f217b5b6700(0000) GS:ffffffff81e21000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033^M
  CR2: 0000000000000020 CR3: 000000006a0fe000 CR4: 00000000000007f0
  Call Trace:
    security_inode_permission+0x1c/0x30
    __inode_permission+0x41/0xa0
    inode_permission+0x18/0x50
    link_path_walk+0x66/0x920
    path_openat+0xa6/0x6c0
    do_filp_open+0x43/0xa0
    do_sys_open+0x146/0x240
    SyS_open+0x1e/0x20
    system_call_fastpath+0x16/0x1b
  Code: 84 a1 00 00 00 81 e3 00 20 00 00 89 d8 83 c8 02 40 f6 c6 04 0f 45 d8 40 f6 c6 08 74 71 80 cf 02 49 8b 46 38 4c 8d 4d cc 45 31 c0 <0f> b7 50 20 8b 70 1c 48 8b 41 70 89 d9 8b 78 04 e8 36 cf ff ff
  RIP  selinux_inode_permission+0x85/0x160
  CR2: 0000000000000020

Investigating, I found that the inode->i_security was NULL, and the
dereference of it caused the oops.

in selinux_inode_permission():

	isec = inode->i_security;

	rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);

Note, the crash came from stressing the deletion and reading of debugfs
files.  I was not able to recreate this via normal files.  But I'm not
sure they are safe.  It may just be that the race window is much harder
to hit.

What seems to have happened (and what I have traced), is the file is
being opened at the same time the file or directory is being deleted.
As the dentry and inode locks are not held during the path walk, nor is
the inodes ref counts being incremented, there is nothing saving these
structures from being discarded except for an rcu_read_lock().

The rcu_read_lock() protects against freeing of the inode, but it does
not protect freeing of the inode_security_struct.  Now if the freeing of
the i_security happens with a call_rcu(), and the i_security field of
the inode is not changed (it gets freed as the inode gets freed) then
there will be no issue here.  (Linus Torvalds suggested not setting the
field to NULL such that we do not need to check if it is NULL in the
permission check).

Note, this is a hack, but it fixes the problem at hand.  A real fix is
to restructure the destroy_inode() to call all the destructor handlers
from the RCU callback.  But that is a major job to do, and requires a
lot of work.  For now, we just band-aid this bug with this fix (it
works), and work on a more maintainable solution in the future.

Link: http://lkml.kernel.org/r/20140109101932.0508dec7@gandalf.local.home
Link: http://lkml.kernel.org/r/20140109182756.17abaaa8@gandalf.local.home

Cc: stable@vger.kernel.org
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-01-12 16:53:13 +07:00
Hugh Dickins eecc1e426d thp: fix copy_page_rep GPF by testing is_huge_zero_pmd once only
We see General Protection Fault on RSI in copy_page_rep: that RSI is
what you get from a NULL struct page pointer.

  RIP: 0010:[<ffffffff81154955>]  [<ffffffff81154955>] copy_page_rep+0x5/0x10
  RSP: 0000:ffff880136e15c00  EFLAGS: 00010286
  RAX: ffff880000000000 RBX: ffff880136e14000 RCX: 0000000000000200
  RDX: 6db6db6db6db6db7 RSI: db73880000000000 RDI: ffff880dd0c00000
  RBP: ffff880136e15c18 R08: 0000000000000200 R09: 000000000005987c
  R10: 000000000005987c R11: 0000000000000200 R12: 0000000000000001
  R13: ffffea00305aa000 R14: 0000000000000000 R15: 0000000000000000
  FS:  00007f195752f700(0000) GS:ffff880c7fc20000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000093010000 CR3: 00000001458e1000 CR4: 00000000000027e0
  Call Trace:
    copy_user_huge_page+0x93/0xab
    do_huge_pmd_wp_page+0x710/0x815
    handle_mm_fault+0x15d8/0x1d70
    __do_page_fault+0x14d/0x840
    do_page_fault+0x2f/0x90
    page_fault+0x22/0x30

do_huge_pmd_wp_page() tests is_huge_zero_pmd(orig_pmd) four times: but
since shrink_huge_zero_page() can free the huge_zero_page, and we have
no hold of our own on it here (except where the fourth test holds
page_table_lock and has checked pmd_same), it's possible for it to
answer yes the first time, but no to the second or third test.  Change
all those last three to tests for NULL page.

(Note: this is not the same issue as trinity's DEBUG_PAGEALLOC BUG
in copy_page_rep with RSI: ffff88009c422000, reported by Sasha Levin
in https://lkml.org/lkml/2013/3/29/103.  I believe that one is due
to the source page being split, and a tail page freed, while copy
is in progress; and not a problem without DEBUG_PAGEALLOC, since
the pmd_same check will prevent a miscopy from being made visible.)

Fixes: 97ae17497e ("thp: implement refcounting for huge zero page")
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: stable@vger.kernel.org # v3.10 v3.11 v3.12
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-01-12 16:47:15 +07:00
Ming Lei 518d00b749 block: null_blk: fix queue leak inside removing device
When queue_mode is NULL_Q_MQ and null_blk is being removed,
blk_cleanup_queue() isn't called to cleanup queue, so the queue
allocated won't be freed.

This patch calls blk_cleanup_queue() for MQ to drain all pending
requests first and release the reference counter of queue kobject, then
blk_mq_free_queue() will be called in queue kobject's release handler
when queue kobject's reference counter drops to zero.

Signed-off-by: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-01-12 16:22:42 +07:00