Merge branch 'akpm' (Andrew's patch-bomb)

Merge misc fixes from Andrew Morton.

* emailed from Andrew Morton <akpm@linux-foundation.org>: (4 patches)
  frv: delete incorrect task prototypes causing compile fail
  slub: missing test for partial pages flush work in flush_all()
  fs, proc: fix ABBA deadlock in case of execution attempt of map_files/ entries
  drivers/rtc/rtc-pl031.c: configure correct wday for 2000-01-01

diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index f074675..5bb4835 100644 (file)
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -247,7 +247,9 @@ good_area:
        return handle_mm_fault(mm, vma, addr & PAGE_MASK, flags);
 
 check_stack:
-       if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
+       /* Don't allow expansion below FIRST_USER_ADDRESS */
+       if (vma->vm_flags & VM_GROWSDOWN &&
+           addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr))
                goto good_area;
 out:
        return fault;

diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 2c7cf2f..aa78de8 100644 (file)
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -489,7 +489,8 @@ static void __init build_mem_type_table(void)
         */
        for (i = 0; i < ARRAY_SIZE(mem_types); i++) {
                mem_types[i].prot_pte |= PTE_EXT_AF;
-               mem_types[i].prot_sect |= PMD_SECT_AF;
+               if (mem_types[i].prot_sect)
+                       mem_types[i].prot_sect |= PMD_SECT_AF;
        }
        kern_pgprot |= PTE_EXT_AF;
        vecs_pgprot |= PTE_EXT_AF;

diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index bc683b8..b0197b2 100644 (file)
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -11,6 +11,7 @@
 #include <linux/types.h>
 #include <linux/cpu.h>
 #include <linux/cpu_pm.h>
+#include <linux/hardirq.h>
 #include <linux/kernel.h>
 #include <linux/notifier.h>
 #include <linux/signal.h>
@@ -432,7 +433,10 @@ void VFP_bounce(u32 trigger, u32 fpexc, struct pt_regs *regs)
 
 static void vfp_enable(void *unused)
 {
-       u32 access = get_copro_access();
+       u32 access;
+
+       BUG_ON(preemptible());
+       access = get_copro_access();
 
        /*
         * Enable full access to VFP (cp10 and cp11)
@@ -573,12 +577,6 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp,
         * entry.
         */
        hwstate->fpscr &= ~(FPSCR_LENGTH_MASK | FPSCR_STRIDE_MASK);
-
-       /*
-        * Disable VFP in the hwstate so that we can detect if it gets
-        * used.
-        */
-       hwstate->fpexc &= ~FPEXC_EN;
        return 0;
 }
 
@@ -591,12 +589,8 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp,
        unsigned long fpexc;
        int err = 0;
 
-       /*
-        * If VFP has been used, then disable it to avoid corrupting
-        * the new thread state.
-        */
-       if (hwstate->fpexc & FPEXC_EN)
-               vfp_flush_hwstate(thread);
+       /* Disable VFP to avoid corrupting the new thread state. */
+       vfp_flush_hwstate(thread);
 
        /*
         * Copy the floating point registers. There can be unused
@@ -657,7 +651,7 @@ static int __init vfp_init(void)
        unsigned int cpu_arch = cpu_architecture();
 
        if (cpu_arch >= CPU_ARCH_ARMv6)
-               vfp_enable(NULL);
+               on_each_cpu(vfp_enable, NULL, 1);
 
        /*
         * First check that there is a VFP that we can use.
@@ -678,8 +672,6 @@ static int __init vfp_init(void)
        } else {
                hotcpu_notifier(vfp_hotplug, 0);
 
-               smp_call_function(vfp_enable, NULL, 1);
-
                VFP_arch = (vfpsid & FPSID_ARCH_MASK) >> FPSID_ARCH_BIT;  /* Extract the architecture version */
                printk("implementor %02x architecture %d part %02x variant %x rev %x\n",
                        (vfpsid & FPSID_IMPLEMENTER_MASK) >> FPSID_IMPLEMENTER_BIT,

diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index d086a09..11c9166 100644 (file)
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -945,9 +945,10 @@ struct mce_info {
        atomic_t                inuse;
        struct task_struct      *t;
        __u64                   paddr;
+       int                     restartable;
 } mce_info[MCE_INFO_MAX];
 
-static void mce_save_info(__u64 addr)
+static void mce_save_info(__u64 addr, int c)
 {
        struct mce_info *mi;
 
@@ -955,6 +956,7 @@ static void mce_save_info(__u64 addr)
                if (atomic_cmpxchg(&mi->inuse, 0, 1) == 0) {
                        mi->t = current;
                        mi->paddr = addr;
+                       mi->restartable = c;
                        return;
                }
        }
@@ -1130,7 +1132,7 @@ void do_machine_check(struct pt_regs *regs, long error_code)
                        mce_panic("Fatal machine check on current CPU", &m, msg);
                if (worst == MCE_AR_SEVERITY) {
                        /* schedule action before return to userland */
-                       mce_save_info(m.addr);
+                       mce_save_info(m.addr, m.mcgstatus & MCG_STATUS_RIPV);
                        set_thread_flag(TIF_MCE_NOTIFY);
                } else if (kill_it) {
                        force_sig(SIGBUS, current);
@@ -1179,7 +1181,13 @@ void mce_notify_process(void)
 
        pr_err("Uncorrected hardware memory error in user-access at %llx",
                 mi->paddr);
-       if (memory_failure(pfn, MCE_VECTOR, MF_ACTION_REQUIRED) < 0) {
+       /*
+        * We must call memory_failure() here even if the current process is
+        * doomed. We still need to mark the page as poisoned and alert any
+        * other users of the page.
+        */
+       if (memory_failure(pfn, MCE_VECTOR, MF_ACTION_REQUIRED) < 0 ||
+                          mi->restartable == 0) {
                pr_err("Memory error not recovered");
                force_sig(SIGBUS, current);
        }

diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 3263b68..3188da3 100644 (file)
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -250,6 +250,10 @@ static int __acpi_bus_set_power(struct acpi_device *device, int state)
                return -ENODEV;
        }
 
+       /* For D3cold we should execute _PS3, not _PS4. */
+       if (state == ACPI_STATE_D3_COLD)
+               object_name[3] = '3';
+
        /*
         * Transition Power
         * ----------------

diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 330bb4d..0500f71 100644 (file)
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -660,7 +660,7 @@ int acpi_power_on_resources(struct acpi_device *device, int state)
 
 int acpi_power_transition(struct acpi_device *device, int state)
 {
-       int result;
+       int result = 0;
 
        if (!device || (state < ACPI_STATE_D0) || (state > ACPI_STATE_D3_COLD))
                return -EINVAL;
@@ -679,8 +679,11 @@ int acpi_power_transition(struct acpi_device *device, int state)
         * (e.g. so the device doesn't lose power while transitioning).  Then,
         * we dereference all power resources used in the current list.
         */
-       result = acpi_power_on_list(&device->power.states[state].resources);
-       if (!result)
+       if (state < ACPI_STATE_D3_COLD)
+               result = acpi_power_on_list(
+                       &device->power.states[state].resources);
+
+       if (!result && device->power.state < ACPI_STATE_D3_COLD)
                acpi_power_off_list(
                        &device->power.states[device->power.state].resources);
 

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 7417267..85cbfdc 100644 (file)
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -908,6 +908,10 @@ static int acpi_bus_get_power_flags(struct acpi_device *device)
        device->power.states[ACPI_STATE_D3].flags.valid = 1;
        device->power.states[ACPI_STATE_D3].power = 0;
 
+       /* Set D3cold's explicit_set flag if _PS3 exists. */
+       if (device->power.states[ACPI_STATE_D3_HOT].flags.explicit_set)
+               device->power.states[ACPI_STATE_D3_COLD].flags.explicit_set = 1;
+
        acpi_bus_init_power(device);
 
        return 0;

diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 37caa88..8d8908d 100644 (file)
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -493,7 +493,11 @@ out:
 static void e1000_down_and_stop(struct e1000_adapter *adapter)
 {
        set_bit(__E1000_DOWN, &adapter->flags);
-       cancel_work_sync(&adapter->reset_task);
+
+       /* Only kill reset task if adapter is not resetting */
+       if (!test_bit(__E1000_RESETTING, &adapter->flags))
+               cancel_work_sync(&adapter->reset_task);
+
        cancel_delayed_work_sync(&adapter->watchdog_task);
        cancel_delayed_work_sync(&adapter->phy_info_task);
        cancel_delayed_work_sync(&adapter->fifo_stall_task);

diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 1929c0c..61e2fef 100644 (file)
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -223,7 +223,7 @@ static int acpi_pci_set_power_state(struct pci_dev *dev, pci_power_t state)
                [PCI_D0] = ACPI_STATE_D0,
                [PCI_D1] = ACPI_STATE_D1,
                [PCI_D2] = ACPI_STATE_D2,
-               [PCI_D3hot] = ACPI_STATE_D3_HOT,
+               [PCI_D3hot] = ACPI_STATE_D3,
                [PCI_D3cold] = ACPI_STATE_D3
        };
        int error = -EINVAL;

diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 7ed58e2..f286955 100644 (file)
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -169,6 +169,7 @@ static struct se_device *fd_create_virtdevice(
        inode = file->f_mapping->host;
        if (S_ISBLK(inode->i_mode)) {
                struct request_queue *q;
+               unsigned long long dev_size;
                /*
                 * Setup the local scope queue_limits from struct request_queue->limits
                 * to pass into transport_add_device_to_core_hba() as struct se_dev_limits.
@@ -183,13 +184,12 @@ static struct se_device *fd_create_virtdevice(
                 * one (1) logical sector from underlying struct block_device
                 */
                fd_dev->fd_block_size = bdev_logical_block_size(inode->i_bdev);
-               fd_dev->fd_dev_size = (i_size_read(file->f_mapping->host) -
+               dev_size = (i_size_read(file->f_mapping->host) -
                                       fd_dev->fd_block_size);
 
                pr_debug("FILEIO: Using size: %llu bytes from struct"
                        " block_device blocks: %llu logical_block_size: %d\n",
-                       fd_dev->fd_dev_size,
-                       div_u64(fd_dev->fd_dev_size, fd_dev->fd_block_size),
+                       dev_size, div_u64(dev_size, fd_dev->fd_block_size),
                        fd_dev->fd_block_size);
        } else {
                if (!(fd_dev->fbd_flags & FBDF_HAS_SIZE)) {
@@ -605,10 +605,20 @@ static u32 fd_get_device_type(struct se_device *dev)
 static sector_t fd_get_blocks(struct se_device *dev)
 {
        struct fd_dev *fd_dev = dev->dev_ptr;
-       unsigned long long blocks_long = div_u64(fd_dev->fd_dev_size,
-                       dev->se_sub_dev->se_dev_attrib.block_size);
+       struct file *f = fd_dev->fd_file;
+       struct inode *i = f->f_mapping->host;
+       unsigned long long dev_size;
+       /*
+        * When using a file that references an underlying struct block_device,
+        * ensure dev_size is always based on the current inode size in order
+        * to handle underlying block_device resize operations.
+        */
+       if (S_ISBLK(i->i_mode))
+               dev_size = (i_size_read(i) - fd_dev->fd_block_size);
+       else
+               dev_size = fd_dev->fd_dev_size;
 
-       return blocks_long;
+       return div_u64(dev_size, dev->se_sub_dev->se_dev_attrib.block_size);
 }
 
 static struct se_subsystem_api fileio_template = {

diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 86f0c3b..c3148b1 100644 (file)
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -220,6 +220,9 @@ int target_scsi2_reservation_release(struct se_task *task)
        if (dev->dev_reserved_node_acl != sess->se_node_acl)
                goto out_unlock;
 
+       if (dev->dev_res_bin_isid != sess->sess_bin_isid)
+               goto out_unlock;
+
        dev->dev_reserved_node_acl = NULL;
        dev->dev_flags &= ~DF_SPC2_RESERVATIONS;
        if (dev->dev_flags & DF_SPC2_RESERVATIONS_WITH_ISID) {

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 8e139c9..57b8159 100644 (file)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1799,10 +1799,15 @@ static int tid_fd_revalidate(struct dentry *dentry, struct nameidata *nd)
        if (task) {
                files = get_files_struct(task);
                if (files) {
+                       struct file *file;
                        rcu_read_lock();
-                       if (fcheck_files(files, fd)) {
+                       file = fcheck_files(files, fd);
+                       if (file) {
+                               unsigned i_mode, f_mode = file->f_mode;
+
                                rcu_read_unlock();
                                put_files_struct(files);
+
                                if (task_dumpable(task)) {
                                        rcu_read_lock();
                                        cred = __task_cred(task);
@@ -1813,7 +1818,14 @@ static int tid_fd_revalidate(struct dentry *dentry, struct nameidata *nd)
                                        inode->i_uid = 0;
                                        inode->i_gid = 0;
                                }
-                               inode->i_mode &= ~(S_ISUID | S_ISGID);
+
+                               i_mode = S_IFLNK;
+                               if (f_mode & FMODE_READ)
+                                       i_mode |= S_IRUSR | S_IXUSR;
+                               if (f_mode & FMODE_WRITE)
+                                       i_mode |= S_IWUSR | S_IXUSR;
+                               inode->i_mode = i_mode;
+
                                security_task_to_inode(task, inode);
                                put_task_struct(task);
                                return 1;
@@ -1837,8 +1849,6 @@ static struct dentry *proc_fd_instantiate(struct inode *dir,
        struct dentry *dentry, struct task_struct *task, const void *ptr)
 {
        unsigned fd = *(const unsigned *)ptr;
-       struct file *file;
-       struct files_struct *files;
        struct inode *inode;
        struct proc_inode *ei;
        struct dentry *error = ERR_PTR(-ENOENT);
@@ -1848,25 +1858,6 @@ static struct dentry *proc_fd_instantiate(struct inode *dir,
                goto out;
        ei = PROC_I(inode);
        ei->fd = fd;
-       files = get_files_struct(task);
-       if (!files)
-               goto out_iput;
-       inode->i_mode = S_IFLNK;
-
-       /*
-        * We are not taking a ref to the file structure, so we must
-        * hold ->file_lock.
-        */
-       spin_lock(&files->file_lock);
-       file = fcheck_files(files, fd);
-       if (!file)
-               goto out_unlock;
-       if (file->f_mode & FMODE_READ)
-               inode->i_mode |= S_IRUSR | S_IXUSR;
-       if (file->f_mode & FMODE_WRITE)
-               inode->i_mode |= S_IWUSR | S_IXUSR;
-       spin_unlock(&files->file_lock);
-       put_files_struct(files);
 
        inode->i_op = &proc_pid_link_inode_operations;
        inode->i_size = 64;
@@ -1879,12 +1870,6 @@ static struct dentry *proc_fd_instantiate(struct inode *dir,
 
  out:
        return error;
-out_unlock:
-       spin_unlock(&files->file_lock);
-       put_files_struct(files);
-out_iput:
-       iput(inode);
-       goto out;
 }
 
 static struct dentry *proc_lookupfd_common(struct inode *dir,

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 1272a88..6589e11 100644 (file)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -851,8 +851,7 @@ new_segment:
 wait_for_sndbuf:
                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
-               if (copied)
-                       tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+               tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
 
                if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                        goto do_error;