lockdep: fix oops in processing workqueue

Under memory load, on x86_64, with lockdep enabled, the workqueue's
process_one_work() has been seen to oops in __lock_acquire(), barfing
on a 0xffffffff00000000 pointer in the lockdep_map's class_cache[].

Because it's permissible to free a work_struct from its callout function,
the map used is an onstack copy of the map given in the work_struct: and
that copy is made without any locking.

Surprisingly, gcc (4.5.1 in Hugh's case) uses "rep movsl" rather than
"rep movsq" for that structure copy: which might race with a workqueue
user's wait_on_work() doing lock_map_acquire() on the source of the
copy, putting a pointer into the class_cache[], but only in time for
the top half of that pointer to be copied to the destination map.

Boom when process_one_work() subsequently does lock_map_acquire()
on its onstack copy of the lockdep_map.

Fix this, and a similar instance in call_timer_fn(), with a
lockdep_copy_map() function which additionally NULLs the class_cache[].

Note: this oops was actually seen on 3.4-next, where flush_work() newly
does the racing lock_map_acquire(); but Tejun points out that 3.4 and
earlier are already vulnerable to the same through wait_on_work().

* Patch orginally from Peter.  Hugh modified it a bit and wrote the
  description.

Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Reported-by: Hugh Dickins <hughd@google.com>
LKML-Reference: <alpine.LSU.2.00.1205070951170.1544@eggly.anvils>
Signed-off-by: Tejun Heo <tj@kernel.org>
fat: eliminate iterations in fat_search_long and __fat_readdir in case of EOD

From: Namjae Jeon <namjae.jeon@samsung.com>

When doing lookups via fat_search_long(), we can stop checking for
further entries if we detect End of Directory, i.e. if (de->name[0] ==
0x00).The current code traverses the cluster chain of a directory until a hit
is found or till the last cluster for that directory, ignoring the EOD
mark. Fix this.
Likewise,when readdir(3) is called, we can stop checking for further
entries in __fat_readdir() when we hit EOD.

Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
Signed-off-by: Ravishankar N <ravi.n1@samsung.com>
patch to linux kernel 3.0.63 (squashed)
commit a96dbfbcb58afeec72c2a0a03d205e0e1457ea3d
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Feb 11 08:27:49 2013 -0800

    Linux 3.0.63

commit b9094c6a669409df59b04105d7d257026c78cbba
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Thu Jan 17 10:32:16 2013 -0500

    USB: XHCI: fix memory leak of URB-private data

    commit 48c3375c5f69b1c2ef3d1051a0009cb9bce0ce24 upstream.

    This patch (as1640) fixes a memory leak in xhci-hcd.  The urb_priv
    data structure isn't always deallocated in the handle_tx_event()
    routine for non-control transfers.  The patch adds a kfree() call so
    that all paths end up freeing the memory properly.

    This patch should be backported to kernels as old as 2.6.36, that
    contain the commit 8e51adccd4c4b9ffcd509d7f2afce0a906139f75 "USB: xHCI:
    Introduce urb_priv structure"

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Reported-and-tested-by: Martin Mokrejs <mmokrejs@fold.natur.cuni.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 85b9c6b4d04c753deb257c849cd0b1f9ce0d5c4e
Author: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Date:   Fri Jan 11 11:19:07 2013 -0800

    xhci: Fix isoc TD encoding.

    commit 760973d2a74b93eb1697981f7448f0e62767cfc4 upstream.

    An isochronous TD is comprised of one isochronous TRB chained to zero or
    more normal TRBs.  Only the isoc TRB has the TBC and TLBPC fields.  The
    normal TRBs must set those fields to zeroes.  The code was setting the
    TBC and TLBPC fields for both isoc and normal TRBs.  Fix this.

    This should be backported to stable kernels as old as 3.0, that contain
    the commit b61d378f2da41c748aba6ca19d77e1e1c02bcea5 " xhci 1.0: Set
    transfer burst last packet count field."

    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dac94241120407ebcd4bbc4523f2ec4edece0f92
Author: fangxiaozhi <huananhu@huawei.com>
Date:   Mon Feb 4 15:16:34 2013 +0800

    USB: storage: optimize to match the Huawei USB storage devices and support new switch command

    commit 200e0d994d9d1919b28c87f1a5fb99a8e13b8a0f upstream.

    1. Optimize the match rules with new macro for Huawei USB storage devices,
       to avoid to load USB storage driver for the modem interface
       with Huawei devices.
    2. Add to support new switch command for new Huawei USB dongles.

    Signed-off-by: fangxiaozhi <huananhu@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a215bd7ac53dd38293377108d9db824760317e10
Author: fangxiaozhi <huananhu@huawei.com>
Date:   Mon Feb 4 15:14:46 2013 +0800

    USB: storage: Define a new macro for USB storage match rules

    commit 07c7be3d87e5cdaf5f94c271c516456364ef286c upstream.

    1. Define a new macro for USB storage match rules:
        matching with Vendor ID and interface descriptors.

    Signed-off-by: fangxiaozhi <huananhu@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f3f2759e76bfbd10f1612cf7f3d9d6e16fee1782
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Wed Jan 30 16:36:40 2013 -0500

    USB: EHCI: fix bug in scheduling periodic split transfers

    commit 3e619d04159be54b3daa0b7036b0ce9e067f4b5d upstream.

    This patch (as1654) fixes a very old bug in ehci-hcd, connected with
    scheduling of periodic split transfers.  The calculations for
    full/low-speed bus usage are all carried out after the correction for
    bit-stuffing has been applied, but the values in the max_tt_usecs
    array assume it hasn't been.  The array should allow for allocation of
    up to 90% of the bus capacity, which is 900 us, not 780 us.

    The symptom caused by this bug is that any isochronous transfer to a
    full-speed device with a maxpacket size larger than about 980 bytes is
    always rejected with a -ENOSPC error.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9e268451a7fed8c0defbe08eb32e11228eecde58
Author: Daniele Palmas <dnlplm@gmail.com>
Date:   Mon Jan 28 16:48:54 2013 +0100

    USB: qcserial: add Telit Gobi QDL device

    commit 78796ae17eacedcdcaaeb03ba73d2e532a4c8f83 upstream.

    Add VID and PID for Telit Gobi QDL device

    Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b506463e8cfc30ec84859387e0c0f298e92fbcff
Author: Bjørn Mork <bjorn@mork.no>
Date:   Fri Feb 1 12:06:51 2013 +0100

    USB: option: add Changhong CH690

    commit d4fa681541aa7bf8570d03426dd7ba663a71c467 upstream.

    New device with 3 serial interfaces:

     If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend) Sub=ff Prot=ff
     If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend) Sub=ff Prot=ff
     If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend) Sub=ff Prot=ff
     If#= 3 Alt= 0 #EPs= 2 Cls=08(stor) Sub=06 Prot=50

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 216d45079874488861ee10aefd02fb6738c7c906
Author: Daniele Palmas <dnlplm@gmail.com>
Date:   Mon Jan 28 16:47:10 2013 +0100

    USB: option: add support for Telit LE920

    commit 03eb466f276ceef9dcf023dc5474db02af68aad9 upstream.

    Add PID and special handling for Telit LE920

    Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6b5410c3ae2b05fb92401436177f62b3aaad81d5
Author: Sven Killig <sven@killig.de>
Date:   Fri Feb 1 23:43:06 2013 +0100

    USB: ftdi_sio: add PID/VID entries for ELV WS 300 PC II

    commit c249f911406efcc7456cb4af79396726bf7b8c57 upstream.

    Add PID/VID entries for ELV WS 300 PC II weather station

    Signed-off-by: Sven Killig <sven@killig.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 62ddf7f6b7d47a0fd2758810815364da36893cd2
Author: Petr Kubánek <petr@kubanek.net>
Date:   Fri Feb 1 17:24:04 2013 +0100

    USB: ftdi_sio: add Zolix FTDI PID

    commit 0ba3b2ccc72b3df5c305d61f59d93ab0f0e87991 upstream.

    Add support for Zolix Omni 1509 monochromator custom USB-RS232 converter.

    Signed-off-by: Petr Kubánek <petr@kubanek.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 76913678c4d2fe2876865b7ed944178db324db1f
Author: Jan Luebbe <jlu@pengutronix.de>
Date:   Mon Feb 4 14:28:53 2013 -0800

    drivers/rtc/rtc-isl1208.c: call rtc_update_irq() from the alarm irq handler

    commit 72fca4a4b32dc778b5b885c3498700e42b610d49 upstream.

    Previously the alarm event was not propagated into the RTC subsystem.
    By adding a call to rtc_update_irq, this fixes a timeout problem with
    the hwclock utility.

    Signed-off-by: Jan Luebbe <jlu@pengutronix.de>
    Cc: Alessandro Zummo <a.zummo@towertech.it>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 466affeee2693763724e1ee351788455cfd1ba41
Author: Vyacheslav Dubeyko <slava@dubeyko.com>
Date:   Mon Feb 4 14:28:41 2013 -0800

    nilfs2: fix fix very long mount time issue

    commit a9bae189542e71f91e61a4428adf6e5a7dfe8063 upstream.

    There exists a situation when GC can work in background alone without
    any other filesystem activity during significant time.

    The nilfs_clean_segments() method calls nilfs_segctor_construct() that
    updates superblocks in the case of NILFS_SC_SUPER_ROOT and
    THE_NILFS_DISCONTINUED flags are set.  But when GC is working alone the
    nilfs_clean_segments() is called with unset THE_NILFS_DISCONTINUED flag.
    As a result, the update of superblocks doesn't occurred all this time
    and in the case of SPOR superblocks keep very old values of last super
    root placement.

    SYMPTOMS:

    Trying to mount a NILFS2 volume after SPOR in such environment ends with
    very long mounting time (it can achieve about several hours in some
    cases).

    REPRODUCING PATH:

    1. It needs to use external USB HDD, disable automount and doesn't
       make any additional filesystem activity on the NILFS2 volume.

    2. Generate temporary file with size about 100 - 500 GB (for example,
       dd if=/dev/zero of=<file_name> bs=1073741824 count=200).  The size of
       file defines duration of GC working.

    3. Then it needs to delete file.

    4. Start GC manually by means of command "nilfs-clean -p 0".  When you
       start GC by means of such way then, at the end, superblocks is updated
       by once.  So, for simulation of SPOR, it needs to wait sometime (15 -
       40 minutes) and simply switch off USB HDD manually.

    5. Switch on USB HDD again and try to mount NILFS2 volume.  As a
       result, NILFS2 volume will mount during very long time.

    REPRODUCIBILITY: 100%

    FIX:

    This patch adds checking that superblocks need to update and set
    THE_NILFS_DISCONTINUED flag before nilfs_clean_segments() call.

    Reported-by: Sergey Alexandrov <splavgm@gmail.com>
    Signed-off-by: Vyacheslav Dubeyko <slava@dubeyko.com>
    Tested-by: Vyacheslav Dubeyko <slava@dubeyko.com>
    Acked-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
    Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b19f432c33a8ee49f46e5fab79cf86f745661318
Author: Jan Beulich <JBeulich@suse.com>
Date:   Wed Jan 30 07:55:53 2013 +0000

    x86-64: Replace left over sti/cli in ia32 audit exit code

    commit 40a1ef95da85843696fc3ebe5fce39b0db32669f upstream.

    For some reason they didn't get replaced so far by their
    paravirt equivalents, resulting in code to be run with
    interrupts disabled that doesn't expect so (causing, in the
    observed case, a BUG_ON() to trigger) when syscall auditing is
    enabled.

    David (Cc-ed) came up with an identical fix, so likely this can
    be taken to count as an ack from him.

    Reported-by: Peter Moody <pmoody@google.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Cc: David Vrabel <david.vrabel@citrix.com>
    Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Link: http://lkml.kernel.org/r/5108E01902000078000BA9C5@nat28.tlf.novell.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Cc: David Vrabel <david.vrabel@citrix.com>
    Tested-by: Peter Moody <pmoody@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aec2043d5287d064872491da54e89dc429cc9509
Author: liu chuansheng <chuansheng.liu@intel.com>
Date:   Thu Jan 31 22:13:00 2013 +0800

    drm/radeon: Calling object_unrefer() when creating fb failure

    commit f2d68cf4daa4de97d400d94836b907e35228e54f upstream.

    When kzalloc() failed in radeon_user_framebuffer_create(), need to
    call object_unreference() to match the object_reference().

    Signed-off-by: liu chuansheng <chuansheng.liu@intel.com>
    Signed-off-by: xueminsu <xuemin.su@intel.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dfd365b9521a33e63210824d31838b9c8b258d4a
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Jan 29 16:36:47 2013 -0500

    drm/radeon: add quirk for RV100 board

    commit 9200ee4941a6e5d1ec5df88982243686882dff3f upstream.

    vbios says external TMDS while the board is actually
    internal TMDS.

    fixes:
    https://bugs.freedesktop.org/show_bug.cgi?id=60037

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ed1d34ff0dc2d2a92764c1a6f07b4a182ef6b88a
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu Jan 31 09:00:52 2013 -0500

    drm/radeon/evergreen+: wait for the MC to settle after MC blackout

    commit ed39fadd6df01095378e499fac3674883f16b853 upstream.

    Some chips seem to need a little delay after blacking out
    the MC before the requests actually stop.

    May fix:
    https://bugs.freedesktop.org/show_bug.cgi?id=56139
    https://bugs.freedesktop.org/show_bug.cgi?id=57567

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ext4: prevent kernel panic in case of uninitialized jinode

ext4: prevent kernel panic in case of uninitialized jinode

In some cases the kernel crash occurs during system suspend/resume:

[ 4095.041351] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 4095.050689] pgd = c0004000
[ 4095.053985] [00000000] *pgd=00000000
[ 4095.058807] Internal error: Oops: 5 [#1] PREEMPT SMP
[ 4095.064483] Modules linked in: wl12xx mac80211 pvrsrvkm_sgx540_120 cfg80211 compat [last unloaded: wl12xx_sdio]
[ 4095.064575] CPU: 1    Tainted: G    B        (3.0.31-01807-gfac16a0 #1)
[ 4095.064605] PC is at jbd2_journal_file_inode+0x38/0x118
[ 4095.064666] LR is at mpage_da_map_and_submit+0x48c/0x618
[ 4095.064697] pc : [<c01da5a8>]    lr : [<c01aeac0>]    psr: 60000013
[ 4095.064697] sp : c6e07c80  ip : c6e07ca0  fp : c6e07c9c
[ 4095.064727] r10: 00000001  r9 : c6e06000  r8 : 00000179
[ 4095.064758] r7 : c6e07ca0  r6 : c73b8400  r5 : 00000000  r4 : c59a7d80
[ 4095.064758] r3 : 00000038  r2 : 00000800  r1 : 00000000  r0 : c7754fc0
[ 4095.064788] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
[ 4095.064819] Control: 10c5387d  Table: 86cc804a  DAC: 00000015
[ 4095.064849]
[ 4095.064849] PC: 0xc01da528:
[ 4095.064880] a528  0a000003 e3a05000 e1a00005 e24bd020 e89da9f0 e5951010 e3e06000 e14b22dc
.....
[ 4095.070373] 7fe0: c00a48ac 00000013 00000000 c6e07ff8 c00a48ac c00c0a94 84752f09 60772177
[ 4095.070404] Backtrace:
[ 4095.070465] [<c01da570>] (jbd2_journal_file_inode+0x0/0x118) from [<c01aeac0>] (mpage_da_map_and_submit+0x48c/0x618)
[ 4095.070495]  r7:c6e07ca0 r6:c6e07d00 r5:c6e07d90 r4:c7754fc0
[ 4095.070556] [<c01ae634>] (mpage_da_map_and_submit+0x0/0x618) from [<c01af40c>] (ext4_da_writepages+0x2a4/0x5c8)
[ 4095.070617] [<c01af168>] (ext4_da_writepages+0x0/0x5c8) from [<c0112af4>] (do_writepages+0x34/0x40)
[ 4095.070678] [<c0112ac0>] (do_writepages+0x0/0x40) from [<c01645a4>] (writeback_single_inode+0xd4/0x288)
[ 4095.070709] [<c01644d0>] (writeback_single_inode+0x0/0x288) from [<c0164ed4>] (writeback_sb_inodes+0xb4/0x184)
[ 4095.070770] [<c0164e20>] (writeback_sb_inodes+0x0/0x184) from [<c01655a0>] (writeback_inodes_wb+0xc4/0x13c)
[ 4095.070831] [<c01654dc>] (writeback_inodes_wb+0x0/0x13c) from [<c01658f0>] (wb_writeback+0x2d8/0x464)
[ 4095.070861] [<c0165618>] (wb_writeback+0x0/0x464) from [<c0165cb8>] (wb_do_writeback+0x23c/0x2c4)
[ 4095.070922] [<c0165a7c>] (wb_do_writeback+0x0/0x2c4) from [<c0165df4>] (bdi_writeback_thread+0xb4/0x2dc)
[ 4095.070953] [<c0165d40>] (bdi_writeback_thread+0x0/0x2dc) from [<c00c0b18>] (kthread+0x90/0x98)
[ 4095.071014] [<c00c0a88>] (kthread+0x0/0x98) from [<c00a48ac>] (do_exit+0x0/0x72c)
[ 4095.071044]  r7:00000013 r6:c00a48ac r5:c00c0a88 r4:c78c7ec4
[ 4095.071105] Code: e89da8f0 e5963000 e3130002 1afffffa (e5913000)
[ 4095.071166] ---[ end trace 7fe9f9b727e5cf78 ]---
[ 4095.071197] Kernel panic - not syncing: Fatal exception

The probably reason of such behaviour is an inode opened in READ mode
has been marked as 'dirty' somehow and written back by ext4_da_writepages.
Cause jinode == NULL it could lead to the kernel panic.

The patch prevents kernel panic and helps to investigate the problem
providing an inode number.

Change-Id: I1d77a011b580db682b8e2d122ef3d5e44e0ce5c7
Signed-off-by: Volodymyr Mieshkov <volodymyr.mieshkov@ti.com>
workqueue: change BUG_ON() to WARN_ON()

This BUG_ON() can be triggered if you call schedule_work() before
calling INIT_WORK().  It is a bug definitely, but it's nicer to just
print a stack trace and return.

Reported-by: Matt Renzelmann <mjr@cs.wisc.edu>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
workqueue: Catch more locking problems with flush_work()

If a workqueue is flushed with flush_work() lockdep checking can
be circumvented. For example:

 static DEFINE_MUTEX(mutex);

 static void my_work(struct work_struct *w)
 {
         mutex_lock(&mutex);
         mutex_unlock(&mutex);
 }

 static DECLARE_WORK(work, my_work);

 static int __init start_test_module(void)
 {
         schedule_work(&work);
         return 0;
 }
 module_init(start_test_module);

 static void __exit stop_test_module(void)
 {
         mutex_lock(&mutex);
         flush_work(&work);
         mutex_unlock(&mutex);
 }
 module_exit(stop_test_module);

would not always print a warning when flush_work() was called.
In this trivial example nothing could go wrong since we are
guaranteed module_init() and module_exit() don't run concurrently,
but if the work item is schedule asynchronously we could have a
scenario where the work item is running just at the time flush_work()
is called resulting in a classic ABBA locking problem.

Add a lockdep hint by acquiring and releasing the work item
lockdep_map in flush_work() so that we always catch this
potential deadlock scenario.

Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Reviewed-by: Yong Zhang <yong.zhang0@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>