Annotation of /trunk/kernel26-alx/patches-3.10/0135-3.10.36-all-fixes.patch
Parent Directory | Revision Log
Revision 2672 -
(hide annotations)
(download)
Tue Jul 21 16:46:35 2015 UTC (9 years, 2 months ago) by niro
File size: 19285 byte(s)
Tue Jul 21 16:46:35 2015 UTC (9 years, 2 months ago) by niro
File size: 19285 byte(s)
-3.10.84-alx-r1
1 | niro | 2672 | diff --git a/Makefile b/Makefile |
2 | index 06b31fce1ff5..b5f4ef30f6e6 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 3 | ||
7 | PATCHLEVEL = 10 | ||
8 | -SUBLEVEL = 35 | ||
9 | +SUBLEVEL = 36 | ||
10 | EXTRAVERSION = | ||
11 | NAME = TOSSUG Baby Fish | ||
12 | |||
13 | diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h | ||
14 | index 095b21507b6a..60bd2748a7c9 100644 | ||
15 | --- a/arch/x86/include/asm/topology.h | ||
16 | +++ b/arch/x86/include/asm/topology.h | ||
17 | @@ -119,9 +119,10 @@ static inline void setup_node_to_cpumask_map(void) { } | ||
18 | |||
19 | extern const struct cpumask *cpu_coregroup_mask(int cpu); | ||
20 | |||
21 | -#ifdef ENABLE_TOPO_DEFINES | ||
22 | #define topology_physical_package_id(cpu) (cpu_data(cpu).phys_proc_id) | ||
23 | #define topology_core_id(cpu) (cpu_data(cpu).cpu_core_id) | ||
24 | + | ||
25 | +#ifdef ENABLE_TOPO_DEFINES | ||
26 | #define topology_core_cpumask(cpu) (per_cpu(cpu_core_map, cpu)) | ||
27 | #define topology_thread_cpumask(cpu) (per_cpu(cpu_sibling_map, cpu)) | ||
28 | |||
29 | diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c | ||
30 | index fc803ecbbce4..31262732db23 100644 | ||
31 | --- a/drivers/block/aoe/aoecmd.c | ||
32 | +++ b/drivers/block/aoe/aoecmd.c | ||
33 | @@ -899,7 +899,7 @@ bio_pageinc(struct bio *bio) | ||
34 | * but this has never been seen here. | ||
35 | */ | ||
36 | if (unlikely(PageCompound(page))) | ||
37 | - if (compound_trans_head(page) != page) { | ||
38 | + if (compound_head(page) != page) { | ||
39 | pr_crit("page tail used for block I/O\n"); | ||
40 | BUG(); | ||
41 | } | ||
42 | diff --git a/drivers/input/mouse/cypress_ps2.c b/drivers/input/mouse/cypress_ps2.c | ||
43 | index 888a81a7ea3d..0aaea7ad6cee 100644 | ||
44 | --- a/drivers/input/mouse/cypress_ps2.c | ||
45 | +++ b/drivers/input/mouse/cypress_ps2.c | ||
46 | @@ -410,7 +410,6 @@ static int cypress_set_input_params(struct input_dev *input, | ||
47 | __clear_bit(REL_X, input->relbit); | ||
48 | __clear_bit(REL_Y, input->relbit); | ||
49 | |||
50 | - __set_bit(INPUT_PROP_BUTTONPAD, input->propbit); | ||
51 | __set_bit(EV_KEY, input->evbit); | ||
52 | __set_bit(BTN_LEFT, input->keybit); | ||
53 | __set_bit(BTN_RIGHT, input->keybit); | ||
54 | diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c | ||
55 | index b2420ae19e14..c69c81608f43 100644 | ||
56 | --- a/drivers/input/mouse/synaptics.c | ||
57 | +++ b/drivers/input/mouse/synaptics.c | ||
58 | @@ -265,11 +265,22 @@ static int synaptics_identify(struct psmouse *psmouse) | ||
59 | * Read touchpad resolution and maximum reported coordinates | ||
60 | * Resolution is left zero if touchpad does not support the query | ||
61 | */ | ||
62 | + | ||
63 | +static const int *quirk_min_max; | ||
64 | + | ||
65 | static int synaptics_resolution(struct psmouse *psmouse) | ||
66 | { | ||
67 | struct synaptics_data *priv = psmouse->private; | ||
68 | unsigned char resp[3]; | ||
69 | |||
70 | + if (quirk_min_max) { | ||
71 | + priv->x_min = quirk_min_max[0]; | ||
72 | + priv->x_max = quirk_min_max[1]; | ||
73 | + priv->y_min = quirk_min_max[2]; | ||
74 | + priv->y_max = quirk_min_max[3]; | ||
75 | + return 0; | ||
76 | + } | ||
77 | + | ||
78 | if (SYN_ID_MAJOR(priv->identity) < 4) | ||
79 | return 0; | ||
80 | |||
81 | @@ -1485,10 +1496,54 @@ static const struct dmi_system_id __initconst olpc_dmi_table[] = { | ||
82 | { } | ||
83 | }; | ||
84 | |||
85 | +static const struct dmi_system_id min_max_dmi_table[] __initconst = { | ||
86 | +#if defined(CONFIG_DMI) | ||
87 | + { | ||
88 | + /* Lenovo ThinkPad Helix */ | ||
89 | + .matches = { | ||
90 | + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), | ||
91 | + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix"), | ||
92 | + }, | ||
93 | + .driver_data = (int []){1024, 5052, 2258, 4832}, | ||
94 | + }, | ||
95 | + { | ||
96 | + /* Lenovo ThinkPad X240 */ | ||
97 | + .matches = { | ||
98 | + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), | ||
99 | + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X240"), | ||
100 | + }, | ||
101 | + .driver_data = (int []){1232, 5710, 1156, 4696}, | ||
102 | + }, | ||
103 | + { | ||
104 | + /* Lenovo ThinkPad T440s */ | ||
105 | + .matches = { | ||
106 | + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), | ||
107 | + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T440"), | ||
108 | + }, | ||
109 | + .driver_data = (int []){1024, 5112, 2024, 4832}, | ||
110 | + }, | ||
111 | + { | ||
112 | + /* Lenovo ThinkPad T540p */ | ||
113 | + .matches = { | ||
114 | + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), | ||
115 | + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T540"), | ||
116 | + }, | ||
117 | + .driver_data = (int []){1024, 5056, 2058, 4832}, | ||
118 | + }, | ||
119 | +#endif | ||
120 | + { } | ||
121 | +}; | ||
122 | + | ||
123 | void __init synaptics_module_init(void) | ||
124 | { | ||
125 | + const struct dmi_system_id *min_max_dmi; | ||
126 | + | ||
127 | impaired_toshiba_kbc = dmi_check_system(toshiba_dmi_table); | ||
128 | broken_olpc_ec = dmi_check_system(olpc_dmi_table); | ||
129 | + | ||
130 | + min_max_dmi = dmi_first_match(min_max_dmi_table); | ||
131 | + if (min_max_dmi) | ||
132 | + quirk_min_max = min_max_dmi->driver_data; | ||
133 | } | ||
134 | |||
135 | static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode) | ||
136 | diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c | ||
137 | index 4c842c320c2e..b604564dec5c 100644 | ||
138 | --- a/drivers/input/mousedev.c | ||
139 | +++ b/drivers/input/mousedev.c | ||
140 | @@ -67,7 +67,6 @@ struct mousedev { | ||
141 | struct device dev; | ||
142 | struct cdev cdev; | ||
143 | bool exist; | ||
144 | - bool is_mixdev; | ||
145 | |||
146 | struct list_head mixdev_node; | ||
147 | bool opened_by_mixdev; | ||
148 | @@ -77,6 +76,9 @@ struct mousedev { | ||
149 | int old_x[4], old_y[4]; | ||
150 | int frac_dx, frac_dy; | ||
151 | unsigned long touch; | ||
152 | + | ||
153 | + int (*open_device)(struct mousedev *mousedev); | ||
154 | + void (*close_device)(struct mousedev *mousedev); | ||
155 | }; | ||
156 | |||
157 | enum mousedev_emul { | ||
158 | @@ -116,9 +118,6 @@ static unsigned char mousedev_imex_seq[] = { 0xf3, 200, 0xf3, 200, 0xf3, 80 }; | ||
159 | static struct mousedev *mousedev_mix; | ||
160 | static LIST_HEAD(mousedev_mix_list); | ||
161 | |||
162 | -static void mixdev_open_devices(void); | ||
163 | -static void mixdev_close_devices(void); | ||
164 | - | ||
165 | #define fx(i) (mousedev->old_x[(mousedev->pkt_count - (i)) & 03]) | ||
166 | #define fy(i) (mousedev->old_y[(mousedev->pkt_count - (i)) & 03]) | ||
167 | |||
168 | @@ -428,9 +427,7 @@ static int mousedev_open_device(struct mousedev *mousedev) | ||
169 | if (retval) | ||
170 | return retval; | ||
171 | |||
172 | - if (mousedev->is_mixdev) | ||
173 | - mixdev_open_devices(); | ||
174 | - else if (!mousedev->exist) | ||
175 | + if (!mousedev->exist) | ||
176 | retval = -ENODEV; | ||
177 | else if (!mousedev->open++) { | ||
178 | retval = input_open_device(&mousedev->handle); | ||
179 | @@ -446,9 +443,7 @@ static void mousedev_close_device(struct mousedev *mousedev) | ||
180 | { | ||
181 | mutex_lock(&mousedev->mutex); | ||
182 | |||
183 | - if (mousedev->is_mixdev) | ||
184 | - mixdev_close_devices(); | ||
185 | - else if (mousedev->exist && !--mousedev->open) | ||
186 | + if (mousedev->exist && !--mousedev->open) | ||
187 | input_close_device(&mousedev->handle); | ||
188 | |||
189 | mutex_unlock(&mousedev->mutex); | ||
190 | @@ -459,21 +454,29 @@ static void mousedev_close_device(struct mousedev *mousedev) | ||
191 | * stream. Note that this function is called with mousedev_mix->mutex | ||
192 | * held. | ||
193 | */ | ||
194 | -static void mixdev_open_devices(void) | ||
195 | +static int mixdev_open_devices(struct mousedev *mixdev) | ||
196 | { | ||
197 | - struct mousedev *mousedev; | ||
198 | + int error; | ||
199 | + | ||
200 | + error = mutex_lock_interruptible(&mixdev->mutex); | ||
201 | + if (error) | ||
202 | + return error; | ||
203 | |||
204 | - if (mousedev_mix->open++) | ||
205 | - return; | ||
206 | + if (!mixdev->open++) { | ||
207 | + struct mousedev *mousedev; | ||
208 | |||
209 | - list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) { | ||
210 | - if (!mousedev->opened_by_mixdev) { | ||
211 | - if (mousedev_open_device(mousedev)) | ||
212 | - continue; | ||
213 | + list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) { | ||
214 | + if (!mousedev->opened_by_mixdev) { | ||
215 | + if (mousedev_open_device(mousedev)) | ||
216 | + continue; | ||
217 | |||
218 | - mousedev->opened_by_mixdev = true; | ||
219 | + mousedev->opened_by_mixdev = true; | ||
220 | + } | ||
221 | } | ||
222 | } | ||
223 | + | ||
224 | + mutex_unlock(&mixdev->mutex); | ||
225 | + return 0; | ||
226 | } | ||
227 | |||
228 | /* | ||
229 | @@ -481,19 +484,22 @@ static void mixdev_open_devices(void) | ||
230 | * device. Note that this function is called with mousedev_mix->mutex | ||
231 | * held. | ||
232 | */ | ||
233 | -static void mixdev_close_devices(void) | ||
234 | +static void mixdev_close_devices(struct mousedev *mixdev) | ||
235 | { | ||
236 | - struct mousedev *mousedev; | ||
237 | + mutex_lock(&mixdev->mutex); | ||
238 | |||
239 | - if (--mousedev_mix->open) | ||
240 | - return; | ||
241 | + if (!--mixdev->open) { | ||
242 | + struct mousedev *mousedev; | ||
243 | |||
244 | - list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) { | ||
245 | - if (mousedev->opened_by_mixdev) { | ||
246 | - mousedev->opened_by_mixdev = false; | ||
247 | - mousedev_close_device(mousedev); | ||
248 | + list_for_each_entry(mousedev, &mousedev_mix_list, mixdev_node) { | ||
249 | + if (mousedev->opened_by_mixdev) { | ||
250 | + mousedev->opened_by_mixdev = false; | ||
251 | + mousedev_close_device(mousedev); | ||
252 | + } | ||
253 | } | ||
254 | } | ||
255 | + | ||
256 | + mutex_unlock(&mixdev->mutex); | ||
257 | } | ||
258 | |||
259 | |||
260 | @@ -522,7 +528,7 @@ static int mousedev_release(struct inode *inode, struct file *file) | ||
261 | mousedev_detach_client(mousedev, client); | ||
262 | kfree(client); | ||
263 | |||
264 | - mousedev_close_device(mousedev); | ||
265 | + mousedev->close_device(mousedev); | ||
266 | |||
267 | return 0; | ||
268 | } | ||
269 | @@ -550,7 +556,7 @@ static int mousedev_open(struct inode *inode, struct file *file) | ||
270 | client->mousedev = mousedev; | ||
271 | mousedev_attach_client(mousedev, client); | ||
272 | |||
273 | - error = mousedev_open_device(mousedev); | ||
274 | + error = mousedev->open_device(mousedev); | ||
275 | if (error) | ||
276 | goto err_free_client; | ||
277 | |||
278 | @@ -861,16 +867,21 @@ static struct mousedev *mousedev_create(struct input_dev *dev, | ||
279 | |||
280 | if (mixdev) { | ||
281 | dev_set_name(&mousedev->dev, "mice"); | ||
282 | + | ||
283 | + mousedev->open_device = mixdev_open_devices; | ||
284 | + mousedev->close_device = mixdev_close_devices; | ||
285 | } else { | ||
286 | int dev_no = minor; | ||
287 | /* Normalize device number if it falls into legacy range */ | ||
288 | if (dev_no < MOUSEDEV_MINOR_BASE + MOUSEDEV_MINORS) | ||
289 | dev_no -= MOUSEDEV_MINOR_BASE; | ||
290 | dev_set_name(&mousedev->dev, "mouse%d", dev_no); | ||
291 | + | ||
292 | + mousedev->open_device = mousedev_open_device; | ||
293 | + mousedev->close_device = mousedev_close_device; | ||
294 | } | ||
295 | |||
296 | mousedev->exist = true; | ||
297 | - mousedev->is_mixdev = mixdev; | ||
298 | mousedev->handle.dev = input_get_device(dev); | ||
299 | mousedev->handle.name = dev_name(&mousedev->dev); | ||
300 | mousedev->handle.handler = handler; | ||
301 | @@ -919,7 +930,7 @@ static void mousedev_destroy(struct mousedev *mousedev) | ||
302 | device_del(&mousedev->dev); | ||
303 | mousedev_cleanup(mousedev); | ||
304 | input_free_minor(MINOR(mousedev->dev.devt)); | ||
305 | - if (!mousedev->is_mixdev) | ||
306 | + if (mousedev != mousedev_mix) | ||
307 | input_unregister_handle(&mousedev->handle); | ||
308 | put_device(&mousedev->dev); | ||
309 | } | ||
310 | diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c | ||
311 | index 254f255204f9..a602aeeb3acb 100644 | ||
312 | --- a/drivers/net/ethernet/marvell/mvneta.c | ||
313 | +++ b/drivers/net/ethernet/marvell/mvneta.c | ||
314 | @@ -119,7 +119,7 @@ | ||
315 | #define MVNETA_GMAC_MAX_RX_SIZE_MASK 0x7ffc | ||
316 | #define MVNETA_GMAC0_PORT_ENABLE BIT(0) | ||
317 | #define MVNETA_GMAC_CTRL_2 0x2c08 | ||
318 | -#define MVNETA_GMAC2_PSC_ENABLE BIT(3) | ||
319 | +#define MVNETA_GMAC2_PCS_ENABLE BIT(3) | ||
320 | #define MVNETA_GMAC2_PORT_RGMII BIT(4) | ||
321 | #define MVNETA_GMAC2_PORT_RESET BIT(6) | ||
322 | #define MVNETA_GMAC_STATUS 0x2c10 | ||
323 | @@ -655,7 +655,7 @@ static void mvneta_port_sgmii_config(struct mvneta_port *pp) | ||
324 | u32 val; | ||
325 | |||
326 | val = mvreg_read(pp, MVNETA_GMAC_CTRL_2); | ||
327 | - val |= MVNETA_GMAC2_PSC_ENABLE; | ||
328 | + val |= MVNETA_GMAC2_PCS_ENABLE; | ||
329 | mvreg_write(pp, MVNETA_GMAC_CTRL_2, val); | ||
330 | } | ||
331 | |||
332 | diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c | ||
333 | index 6f3fbc48a6c7..22080eb6aff6 100644 | ||
334 | --- a/drivers/vfio/vfio_iommu_type1.c | ||
335 | +++ b/drivers/vfio/vfio_iommu_type1.c | ||
336 | @@ -138,12 +138,12 @@ static bool is_invalid_reserved_pfn(unsigned long pfn) | ||
337 | if (pfn_valid(pfn)) { | ||
338 | bool reserved; | ||
339 | struct page *tail = pfn_to_page(pfn); | ||
340 | - struct page *head = compound_trans_head(tail); | ||
341 | + struct page *head = compound_head(tail); | ||
342 | reserved = !!(PageReserved(head)); | ||
343 | if (head != tail) { | ||
344 | /* | ||
345 | * "head" is not a dangling pointer | ||
346 | - * (compound_trans_head takes care of that) | ||
347 | + * (compound_head takes care of that) | ||
348 | * but the hugepage may have been split | ||
349 | * from under us (and we may not hold a | ||
350 | * reference count on the head page so it can | ||
351 | diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c | ||
352 | index 21dff8f236f6..f9e11df768d5 100644 | ||
353 | --- a/fs/ext4/inode.c | ||
354 | +++ b/fs/ext4/inode.c | ||
355 | @@ -38,6 +38,7 @@ | ||
356 | #include <linux/slab.h> | ||
357 | #include <linux/ratelimit.h> | ||
358 | #include <linux/aio.h> | ||
359 | +#include <linux/bitops.h> | ||
360 | |||
361 | #include "ext4_jbd2.h" | ||
362 | #include "xattr.h" | ||
363 | @@ -4044,18 +4045,20 @@ int ext4_get_inode_loc(struct inode *inode, struct ext4_iloc *iloc) | ||
364 | void ext4_set_inode_flags(struct inode *inode) | ||
365 | { | ||
366 | unsigned int flags = EXT4_I(inode)->i_flags; | ||
367 | + unsigned int new_fl = 0; | ||
368 | |||
369 | - inode->i_flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC); | ||
370 | if (flags & EXT4_SYNC_FL) | ||
371 | - inode->i_flags |= S_SYNC; | ||
372 | + new_fl |= S_SYNC; | ||
373 | if (flags & EXT4_APPEND_FL) | ||
374 | - inode->i_flags |= S_APPEND; | ||
375 | + new_fl |= S_APPEND; | ||
376 | if (flags & EXT4_IMMUTABLE_FL) | ||
377 | - inode->i_flags |= S_IMMUTABLE; | ||
378 | + new_fl |= S_IMMUTABLE; | ||
379 | if (flags & EXT4_NOATIME_FL) | ||
380 | - inode->i_flags |= S_NOATIME; | ||
381 | + new_fl |= S_NOATIME; | ||
382 | if (flags & EXT4_DIRSYNC_FL) | ||
383 | - inode->i_flags |= S_DIRSYNC; | ||
384 | + new_fl |= S_DIRSYNC; | ||
385 | + set_mask_bits(&inode->i_flags, | ||
386 | + S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC, new_fl); | ||
387 | } | ||
388 | |||
389 | /* Propagate flags from i_flags to EXT4_I(inode)->i_flags */ | ||
390 | diff --git a/fs/proc/page.c b/fs/proc/page.c | ||
391 | index b8730d9ebaee..2a8cc94bb641 100644 | ||
392 | --- a/fs/proc/page.c | ||
393 | +++ b/fs/proc/page.c | ||
394 | @@ -121,7 +121,7 @@ u64 stable_page_flags(struct page *page) | ||
395 | * just checks PG_head/PG_tail, so we need to check PageLRU to make | ||
396 | * sure a given page is a thp, not a non-huge compound page. | ||
397 | */ | ||
398 | - else if (PageTransCompound(page) && PageLRU(compound_trans_head(page))) | ||
399 | + else if (PageTransCompound(page) && PageLRU(compound_head(page))) | ||
400 | u |= 1 << KPF_THP; | ||
401 | |||
402 | /* | ||
403 | diff --git a/include/linux/bitops.h b/include/linux/bitops.h | ||
404 | index a3b6b82108b9..c1dde8e00d25 100644 | ||
405 | --- a/include/linux/bitops.h | ||
406 | +++ b/include/linux/bitops.h | ||
407 | @@ -185,6 +185,21 @@ static inline unsigned long __ffs64(u64 word) | ||
408 | |||
409 | #ifdef __KERNEL__ | ||
410 | |||
411 | +#ifndef set_mask_bits | ||
412 | +#define set_mask_bits(ptr, _mask, _bits) \ | ||
413 | +({ \ | ||
414 | + const typeof(*ptr) mask = (_mask), bits = (_bits); \ | ||
415 | + typeof(*ptr) old, new; \ | ||
416 | + \ | ||
417 | + do { \ | ||
418 | + old = ACCESS_ONCE(*ptr); \ | ||
419 | + new = (old & ~mask) | bits; \ | ||
420 | + } while (cmpxchg(ptr, old, new) != old); \ | ||
421 | + \ | ||
422 | + new; \ | ||
423 | +}) | ||
424 | +#endif | ||
425 | + | ||
426 | #ifndef find_last_bit | ||
427 | /** | ||
428 | * find_last_bit - find the last set bit in a memory region | ||
429 | diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h | ||
430 | index 528454c2caa9..a193bb3e4138 100644 | ||
431 | --- a/include/linux/huge_mm.h | ||
432 | +++ b/include/linux/huge_mm.h | ||
433 | @@ -159,23 +159,6 @@ static inline int hpage_nr_pages(struct page *page) | ||
434 | return HPAGE_PMD_NR; | ||
435 | return 1; | ||
436 | } | ||
437 | -static inline struct page *compound_trans_head(struct page *page) | ||
438 | -{ | ||
439 | - if (PageTail(page)) { | ||
440 | - struct page *head; | ||
441 | - head = page->first_page; | ||
442 | - smp_rmb(); | ||
443 | - /* | ||
444 | - * head may be a dangling pointer. | ||
445 | - * __split_huge_page_refcount clears PageTail before | ||
446 | - * overwriting first_page, so if PageTail is still | ||
447 | - * there it means the head pointer isn't dangling. | ||
448 | - */ | ||
449 | - if (PageTail(page)) | ||
450 | - return head; | ||
451 | - } | ||
452 | - return page; | ||
453 | -} | ||
454 | |||
455 | extern int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma, | ||
456 | unsigned long addr, pmd_t pmd, pmd_t *pmdp); | ||
457 | @@ -205,7 +188,6 @@ static inline int split_huge_page(struct page *page) | ||
458 | do { } while (0) | ||
459 | #define split_huge_page_pmd_mm(__mm, __address, __pmd) \ | ||
460 | do { } while (0) | ||
461 | -#define compound_trans_head(page) compound_head(page) | ||
462 | static inline int hugepage_madvise(struct vm_area_struct *vma, | ||
463 | unsigned long *vm_flags, int advice) | ||
464 | { | ||
465 | diff --git a/include/linux/mm.h b/include/linux/mm.h | ||
466 | index 3bf21c3502d0..a9a48309f045 100644 | ||
467 | --- a/include/linux/mm.h | ||
468 | +++ b/include/linux/mm.h | ||
469 | @@ -361,8 +361,18 @@ static inline void compound_unlock_irqrestore(struct page *page, | ||
470 | |||
471 | static inline struct page *compound_head(struct page *page) | ||
472 | { | ||
473 | - if (unlikely(PageTail(page))) | ||
474 | - return page->first_page; | ||
475 | + if (unlikely(PageTail(page))) { | ||
476 | + struct page *head = page->first_page; | ||
477 | + | ||
478 | + /* | ||
479 | + * page->first_page may be a dangling pointer to an old | ||
480 | + * compound page, so recheck that it is still a tail | ||
481 | + * page before returning. | ||
482 | + */ | ||
483 | + smp_rmb(); | ||
484 | + if (likely(PageTail(page))) | ||
485 | + return head; | ||
486 | + } | ||
487 | return page; | ||
488 | } | ||
489 | |||
490 | diff --git a/mm/ksm.c b/mm/ksm.c | ||
491 | index b6afe0c440d8..784d1e4bc385 100644 | ||
492 | --- a/mm/ksm.c | ||
493 | +++ b/mm/ksm.c | ||
494 | @@ -444,7 +444,7 @@ static void break_cow(struct rmap_item *rmap_item) | ||
495 | static struct page *page_trans_compound_anon(struct page *page) | ||
496 | { | ||
497 | if (PageTransCompound(page)) { | ||
498 | - struct page *head = compound_trans_head(page); | ||
499 | + struct page *head = compound_head(page); | ||
500 | /* | ||
501 | * head may actually be splitted and freed from under | ||
502 | * us but it's ok here. | ||
503 | diff --git a/mm/memory-failure.c b/mm/memory-failure.c | ||
504 | index e386beefc994..59c62fa75c5a 100644 | ||
505 | --- a/mm/memory-failure.c | ||
506 | +++ b/mm/memory-failure.c | ||
507 | @@ -1544,7 +1544,7 @@ int soft_offline_page(struct page *page, int flags) | ||
508 | { | ||
509 | int ret; | ||
510 | unsigned long pfn = page_to_pfn(page); | ||
511 | - struct page *hpage = compound_trans_head(page); | ||
512 | + struct page *hpage = compound_head(page); | ||
513 | |||
514 | if (PageHWPoison(page)) { | ||
515 | pr_info("soft offline: %#lx page already poisoned\n", pfn); | ||
516 | diff --git a/mm/page_alloc.c b/mm/page_alloc.c | ||
517 | index 2ee0fd313f03..0ab02fb8e9b1 100644 | ||
518 | --- a/mm/page_alloc.c | ||
519 | +++ b/mm/page_alloc.c | ||
520 | @@ -360,9 +360,11 @@ void prep_compound_page(struct page *page, unsigned long order) | ||
521 | __SetPageHead(page); | ||
522 | for (i = 1; i < nr_pages; i++) { | ||
523 | struct page *p = page + i; | ||
524 | - __SetPageTail(p); | ||
525 | set_page_count(p, 0); | ||
526 | p->first_page = page; | ||
527 | + /* Make sure p->first_page is always valid for PageTail() */ | ||
528 | + smp_wmb(); | ||
529 | + __SetPageTail(p); | ||
530 | } | ||
531 | } | ||
532 | |||
533 | diff --git a/mm/swap.c b/mm/swap.c | ||
534 | index ea58dbde788e..4e35f3ff0427 100644 | ||
535 | --- a/mm/swap.c | ||
536 | +++ b/mm/swap.c | ||
537 | @@ -81,7 +81,7 @@ static void put_compound_page(struct page *page) | ||
538 | { | ||
539 | if (unlikely(PageTail(page))) { | ||
540 | /* __split_huge_page_refcount can run under us */ | ||
541 | - struct page *page_head = compound_trans_head(page); | ||
542 | + struct page *page_head = compound_head(page); | ||
543 | |||
544 | if (likely(page != page_head && | ||
545 | get_page_unless_zero(page_head))) { | ||
546 | @@ -219,7 +219,7 @@ bool __get_page_tail(struct page *page) | ||
547 | */ | ||
548 | unsigned long flags; | ||
549 | bool got = false; | ||
550 | - struct page *page_head = compound_trans_head(page); | ||
551 | + struct page *page_head = compound_head(page); | ||
552 | |||
553 | if (likely(page != page_head && get_page_unless_zero(page_head))) { | ||
554 | /* Ref to put_compound_page() comment. */ | ||
555 | diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c | ||
556 | index a99b6c3427b0..59359bec328a 100644 | ||
557 | --- a/net/netfilter/nf_conntrack_proto_dccp.c | ||
558 | +++ b/net/netfilter/nf_conntrack_proto_dccp.c | ||
559 | @@ -428,7 +428,7 @@ static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb, | ||
560 | const char *msg; | ||
561 | u_int8_t state; | ||
562 | |||
563 | - dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh); | ||
564 | + dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); | ||
565 | BUG_ON(dh == NULL); | ||
566 | |||
567 | state = dccp_state_table[CT_DCCP_ROLE_CLIENT][dh->dccph_type][CT_DCCP_NONE]; | ||
568 | @@ -486,7 +486,7 @@ static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb, | ||
569 | u_int8_t type, old_state, new_state; | ||
570 | enum ct_dccp_roles role; | ||
571 | |||
572 | - dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh); | ||
573 | + dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); | ||
574 | BUG_ON(dh == NULL); | ||
575 | type = dh->dccph_type; | ||
576 | |||
577 | @@ -577,7 +577,7 @@ static int dccp_error(struct net *net, struct nf_conn *tmpl, | ||
578 | unsigned int cscov; | ||
579 | const char *msg; | ||
580 | |||
581 | - dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh); | ||
582 | + dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); | ||
583 | if (dh == NULL) { | ||
584 | msg = "nf_ct_dccp: short packet "; | ||
585 | goto out_invalid; | ||
586 | diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c | ||
587 | index eb99458f5b68..8cf1cd2fadaa 100644 | ||
588 | --- a/virt/kvm/kvm_main.c | ||
589 | +++ b/virt/kvm/kvm_main.c | ||
590 | @@ -105,12 +105,12 @@ bool kvm_is_mmio_pfn(pfn_t pfn) | ||
591 | if (pfn_valid(pfn)) { | ||
592 | int reserved; | ||
593 | struct page *tail = pfn_to_page(pfn); | ||
594 | - struct page *head = compound_trans_head(tail); | ||
595 | + struct page *head = compound_head(tail); | ||
596 | reserved = PageReserved(head); | ||
597 | if (head != tail) { | ||
598 | /* | ||
599 | * "head" is not a dangling pointer | ||
600 | - * (compound_trans_head takes care of that) | ||
601 | + * (compound_head takes care of that) | ||
602 | * but the hugepage may have been splitted | ||
603 | * from under us (and we may not hold a | ||
604 | * reference count on the head page so it can |