linux/drivers/staging/android, branch v4.1

staging: android: ion: fix wrong init of dma_buf_export_info

2015-04-21T09:17:16Z

Fixes: 817bd7253291 ("dma-buf: cleanup dma_buf_export() to make it easily extensible") Stupid copy-paste from me in the above patch leads to the following static checker warning: drivers/staging/android/ion/ion.c:1112 ion_share_dma_buf() error: potentially dereferencing uninitialized 'buffer'. drivers/staging/android/ion/ion.c 1103 struct dma_buf *ion_share_dma_buf(struct ion_client *client, 1104 struct ion_handle *handle) 1105 { 1106 struct ion_buffer *buffer; ^^^^^^ 1107 struct dma_buf *dmabuf; 1108 bool valid_handle; 1109 DEFINE_DMA_BUF_EXPORT_INFO(exp_info); 1110 1111 exp_info.ops = &dma_buf_ops; 1112 exp_info.size = buffer->size; ^^^^^^ 1113 exp_info.flags = O_RDWR; 1114 exp_info.priv = buffer; ^^^^^^ And here also. 1115 This patch corrects this stupidity. Reported-by: Dan Carpenter Reviewed-by: Dan Carpenter Acked-by: Greg Kroah-Hartman Signed-off-by: Sumit Semwal

dma-buf: cleanup dma_buf_export() to make it easily extensible

2015-04-21T09:17:16Z

At present, dma_buf_export() takes a series of parameters, which makes it difficult to add any new parameters for exporters, if required. Make it simpler by moving all these parameters into a struct, and pass the struct * as parameter to dma_buf_export(). While at it, unite dma_buf_export_named() with dma_buf_export(), and change all callers accordingly. Reviewed-by: Maarten Lankhorst Reviewed-by: Daniel Thompson Acked-by: Mauro Carvalho Chehab Acked-by: Dave Airlie Signed-off-by: Sumit Semwal

Merge branch 'for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-04-15T20:22:56Z

Pull second vfs update from Al Viro: "Now that net-next went in... Here's the next big chunk - killing ->aio_read() and ->aio_write(). There'll be one more pile today (direct_IO changes and generic_write_checks() cleanups/fixes), but I'd prefer to keep that one separate" * 'for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (37 commits) ->aio_read and ->aio_write removed pcm: another weird API abuse infinibad: weird APIs switched to ->write_iter() kill do_sync_read/do_sync_write fuse: use iov_iter_get_pages() for non-splice path fuse: switch to ->read_iter/->write_iter switch drivers/char/mem.c to ->read_iter/->write_iter make new_sync_{read,write}() static coredump: accept any write method switch /dev/loop to vfs_iter_write() serial2002: switch to __vfs_read/__vfs_write ashmem: use __vfs_read() export __vfs_read() autofs: switch to __vfs_write() new helper: __vfs_write() switch hugetlbfs to ->read_iter() coda: switch to ->read_iter/->write_iter ncpfs: switch to ->read_iter/->write_iter net/9p: remove (now-)unused helpers p9_client_attach(): set fid->uid correctly ...

ashmem: use __vfs_read()

2015-04-12T02:29:38Z

Signed-off-by: Al Viro

staging: android: ion_test: Add the MODULE_LICENSE macro

2015-04-03T13:13:52Z

Base on the file comment should define GPL v2 for ion test driver Signed-off-by: Phong Tran Signed-off-by: Greg Kroah-Hartman

staging: android: sync: Fix memory corruption in sync_timeline_signal().

2015-03-26T09:58:51Z

The android_fence_release() function checks for active sync points by calling list_empty() on the list head embedded on the sync point. However, it is only valid to use list_empty() on nodes that have been initialized with INIT_LIST_HEAD() or list_del_init(). Because the list entry has likely been removed from the active list by sync_timeline_signal(), there is a good chance that this WARN_ON_ONCE() will be hit due to dangling pointers pointing at freed memory (even though the sync drivers did nothing wrong) and memory corruption will ensue as the list entry is removed for a second time, corrupting the active list. This problem can be reproduced quite easily with CONFIG_DEBUG_LIST=y and fences with more than one sync point. Signed-off-by: Alistair Strachan Cc: Maarten Lankhorst Cc: Greg Kroah-Hartman Cc: Colin Cross Cc: stable Signed-off-by: Greg Kroah-Hartman

ion: improve ion_phys error message

2015-03-20T12:44:39Z

Clients often get confused when ion_phys errors out due to some heap being used that they didn't expect. Add the heap name and heap type to the error message to make it more obvious. Signed-off-by: Mitchel Humpherys Signed-off-by: Greg Kroah-Hartman

staging: android: ion: fix some format strings

2015-03-02T02:46:15Z

C99 says that a precision which is simply '.' with no following digits or * should be interpreted as 0, which means that these format strings actually mean 'print 16 spaces'. However, the kernel's printf implementation treats this case as if the precision was omitted. Don't rely on that quirk. Signed-off-by: Rasmus Villemoes Signed-off-by: Greg Kroah-Hartman

Merge tag 'staging-3.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2015-02-15T19:30:39Z

Pull staging drivers patches from Greg KH: "Here's the big staging driver tree update for 3.20-rc1. Lots of little things in here, adding up to lots of overall cleanups. The IIO driver updates are also in here as they cross the staging tree boundry a lot. I2O has moved into staging as well, as a plan to drop it from the tree eventually as that's a dead subsystem. All of this has been in linux-next with no reported issues for a while" * tag 'staging-3.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (740 commits) staging: lustre: lustre: libcfs: define symbols as static staging: rtl8712: Do coding style cleanup staging: lustre: make obd_updatemax_lock static staging: rtl8188eu: core: switch with redundant cases staging: rtl8188eu: odm: conditional setting with no effect staging: rtl8188eu: odm: condition with no effect staging: ft1000: fix braces warning staging: sm7xxfb: fix remaining CamelCase staging: sm7xxfb: fix CamelCase staging: rtl8723au: multiple condition with no effect - if identical to else staging: sm7xxfb: make smtc_scr_info static staging/lustre/mdc: Initialize req in mdc_enqueue for !it case staging/lustre/clio: Do not allow group locks with gid 0 staging/lustre/llite: don't add to page cache upon failure staging/lustre/llite: Add exception entry check after radix_tree staging/lustre/libcfs: protect kkuc_groups from write access staging/lustre/fld: refer to MDT0 for fld lookup in some cases staging/lustre/llite: Solve a race to access lli_has_smd in read case staging/lustre/ptlrpc: hold rq_lock when modify rq_flags staging/lustre/lnet: portal spreading rotor should be unsigned ...

oom: add helpers for setting and clearing TIF_MEMDIE

2015-02-12T01:06:03Z

This patchset addresses a race which was described in the changelog for 5695be142e20 ("OOM, PM: OOM killed task shouldn't escape PM suspend"): : PM freezer relies on having all tasks frozen by the time devices are : getting frozen so that no task will touch them while they are getting : frozen. But OOM killer is allowed to kill an already frozen task in order : to handle OOM situtation. In order to protect from late wake ups OOM : killer is disabled after all tasks are frozen. This, however, still keeps : a window open when a killed task didn't manage to die by the time : freeze_processes finishes. The original patch hasn't closed the race window completely because that would require a more complex solution as it can be seen by this patchset. The primary motivation was to close the race condition between OOM killer and PM freezer _completely_. As Tejun pointed out, even though the race condition is unlikely the harder it would be to debug weird bugs deep in the PM freezer when the debugging options are reduced considerably. I can only speculate what might happen when a task is still runnable unexpectedly. On a plus side and as a side effect the oom enable/disable has a better (full barrier) semantic without polluting hot paths. I have tested the series in KVM with 100M RAM: - many small tasks (20M anon mmap) which are triggering OOM continually - s2ram which resumes automatically is triggered in a loop echo processors > /sys/power/pm_test while true do echo mem > /sys/power/state sleep 1s done - simple module which allocates and frees 20M in 8K chunks. If it sees freezing(current) then it tries another round of allocation before calling try_to_freeze - debugging messages of PM stages and OOM killer enable/disable/fail added and unmark_oom_victim is delayed by 1s after it clears TIF_MEMDIE and before it wakes up waiters. - rebased on top of the current mmotm which means some necessary updates in mm/oom_kill.c. mark_tsk_oom_victim is now called under task_lock but I think this should be OK because __thaw_task shouldn't interfere with any locking down wake_up_process. Oleg? As expected there are no OOM killed tasks after oom is disabled and allocations requested by the kernel thread are failing after all the tasks are frozen and OOM disabled. I wasn't able to catch a race where oom_killer_disable would really have to wait but I kinda expected the race is really unlikely. [ 242.609330] Killed process 2992 (mem_eater) total-vm:24412kB, anon-rss:2164kB, file-rss:4kB [ 243.628071] Unmarking 2992 OOM victim. oom_victims: 1 [ 243.636072] (elapsed 2.837 seconds) done. [ 243.641985] Trying to disable OOM killer [ 243.643032] Waiting for concurent OOM victims [ 243.644342] OOM killer disabled [ 243.645447] Freezing remaining freezable tasks ... (elapsed 0.005 seconds) done. [ 243.652983] Suspending console(s) (use no_console_suspend to debug) [ 243.903299] kmem_eater: page allocation failure: order:1, mode:0x204010 [...] [ 243.992600] PM: suspend of devices complete after 336.667 msecs [ 243.993264] PM: late suspend of devices complete after 0.660 msecs [ 243.994713] PM: noirq suspend of devices complete after 1.446 msecs [ 243.994717] ACPI: Preparing to enter system sleep state S3 [ 243.994795] PM: Saving platform NVS memory [ 243.994796] Disabling non-boot CPUs ... The first 2 patches are simple cleanups for OOM. They should go in regardless the rest IMO. Patches 3 and 4 are trivial printk -> pr_info conversion and they should go in ditto. The main patch is the last one and I would appreciate acks from Tejun and Rafael. I think the OOM part should be OK (except for __thaw_task vs. task_lock where a look from Oleg would appreciated) but I am not so sure I haven't screwed anything in the freezer code. I have found several surprises there. This patch (of 5): This patch is just a preparatory and it doesn't introduce any functional change. Note: I am utterly unhappy about lowmemory killer abusing TIF_MEMDIE just to wait for the oom victim and to prevent from new killing. This is just a side effect of the flag. The primary meaning is to give the oom victim access to the memory reserves and that shouldn't be necessary here. Signed-off-by: Michal Hocko Cc: Tejun Heo Cc: David Rientjes Cc: Johannes Weiner Cc: Oleg Nesterov Cc: Cong Wang Cc: "Rafael J. Wysocki" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds