summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2011-06-24ARM: pm: mach-s3c64xx: cleanup s3c_cpu_saveRussell King
s3c_cpu_save does not need to save any registers with the new cpu_suspend calling convention. Remove these redundant instructions. Acked-by: Frank Hofmann <frank.hofmann@tomtom.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: mach-exynos4: cleanup s3c_cpu_saveRussell King
s3c_cpu_save does not need to save any registers with the new cpu_suspend calling convention. Remove these redundant instructions. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: mach-s5pv210: cleanup s3c_cpu_saveRussell King
s3c_cpu_save does not need to save any registers with the new cpu_suspend calling convention. Remove these redundant instructions. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: plat-s3c24xx: cleanup s3c_cpu_saveRussell King
s3c_cpu_save does not need to save any registers with the new cpu_suspend calling convention. Remove these redundant instructions. Tested-by: Kukjin Kim <kgene.kim@samsung.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: sa1100: move cpu_suspend into C codeRussell King
We don't need a veneer for cpu_suspend, it can be called directly from C code now. Move it into sa11x0_pm_enter() along with the re-enabling of clock switching. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: move cpu_init() call into core codeRussell King
As we have core code dealing with CPU suspend/resume, we can re-initialize the CPUs exception banked registers via that code rather than having platforms deal with that level of detail. So, move the call to cpu_init() out of platform code into core code. Tested-by: Kevin Hilman <khilman@ti.com> Acked-by: Jean Pihet <j-pihet@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: convert cpu_suspend() to a normal functionRussell King
cpu_suspend() has a weird calling method which makes it only possible to call from assembly code: it returns with a modified stack pointer to finish the suspend, but on resume, it 'returns' via a provided pointer. We can make cpu_suspend() appear to be a normal function merely by swapping the resume pointer argument and the link register. Do so, and update all callers to take account of this more traditional behaviour. Acked-by: Frank Hofmann <frank.hofmann@tomtom.com> Tested-by: Kevin Hilman <khilman@ti.com> Acked-by: Jean Pihet <j-pihet@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: move sa1100 to use proper suspend func arg0Russell King
In the previous commit, we introduced an official way to supply an argument to the suspend function. Convert the sa1100 suspend code to use this method. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: rejig suspend follow-on function calling conventionRussell King
Save the suspend function pointer onto the stack for use when returning. Allocate r2 to pass an argument to the suspend function. Acked-by: Frank Hofmann <frank.hofmann@tomtom.com> Tested-by: Kevin Hilman <khilman@ti.com> Acked-by: Jean Pihet <j-pihet@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: reallocate registers to avoid r2, r3Russell King
Avoid using r2 and r3 in the suspend code, allowing these to be passed further into the function as arguments. Acked-by: Frank Hofmann <frank.hofmann@tomtom.com> Tested-by: Kevin Hilman <khilman@ti.com> Acked-by: Jean Pihet <j-pihet@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: preserve r4 - r11 across a suspendRussell King
Make cpu_suspend()..return function preserve r4 to r11 across a suspend cycle. This is in preparation of relieving platform support code from this task. Acked-by: Frank Hofmann <frank.hofmann@tomtom.com> Tested-by: Kevin Hilman <khilman@ti.com> Acked-by: Jean Pihet <j-pihet@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: extract common code from MULTI_CPU/!MULTI_CPU pathsRussell King
Very little code is different between these two paths now, so extract the common code. Acked-by: Frank Hofmann <frank.hofmann@tomtom.com> Tested-by: Kevin Hilman <khilman@ti.com> Acked-by: Jean Pihet <j-pihet@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: move return address (for cpu_resume) to top of stackRussell King
Move the return address for cpu_resume to the top of stack so that cpu_resume looks more like a normal function. Acked-by: Frank Hofmann <frank.hofmann@tomtom.com> Tested-by: Kevin Hilman <khilman@ti.com> Acked-by: Jean Pihet <j-pihet@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: make MULTI_CPU and !MULTI_CPU resume paths the sameRussell King
Eliminate the differences between MULTI_CPU and non-MULTI_CPU resume paths, making the saved structure identical irrespective of the way the kernel was configured. Acked-by: Frank Hofmann <frank.hofmann@tomtom.com> Tested-by: Kevin Hilman <khilman@ti.com> Acked-by: Jean Pihet <j-pihet@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: sa1100: no need to re-enable clock switchingRussell King
This is now taken care of by calling cpu_proc_init() in the resume path, so eliminate this unnecessary call. Tested-by: Kevin Hilman <khilman@ti.com> Acked-by: Jean Pihet <j-pihet@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: arrange for cpu_proc_init() to be called on resumeRussell King
cpu_proc_init() does processor specific initialization, which we do at boot time. We have been omitting to do this on resume, which causes some of this initialization to be skipped. We've also been skipping this on SMP initialization too. Ensure that cpu_proc_init() is always called appropriately by moving it into cpu_init(), and move cpu_init() to a more appropriate point in the boot initialization. Tested-by: Kevin Hilman <khilman@ti.com> Acked-by: Jean Pihet <j-pihet@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: ensure ARMv7 CPUs save and restore the TLS registerRussell King
Ensure that the TLS register is saved and restored over a suspend cycle, so that userspace programs don't see a corrupted TLS value. Tested-by: Kevin Hilman <khilman@ti.com> Acked-by: Jean Pihet <j-pihet@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-24ARM: pm: proc-v7: fix missing struct processor pointers for suspend codeRussell King
Add the missing suspend/resume pointers for the suspend code. This is needed when building for multiple CPUs. Tested-by: Kevin Hilman <khilman@ti.com> Acked-by: Jean Pihet <j-pihet@ti.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-21ARM: 6969/1: plat-iop: fix build errorLinus Walleij
The iop13xx_defconfig didn't build since the platform code uses defines from <asm/ptrace.h>. Simply add the include so it compiles. Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-21ARM: 6961/1: zImage: Add build-time check for correctly-sized proc_type entriesDave Martin
It is easy to mis-maintain the proc_types table such that the entries become wrongly-sized and misaligned when the kernel is built in Thumb-2. This patch adds an assembly-time check which will turn most common size/alignment mistakes in this table into build failures, to avoid having to debug the boot-time kernel hang which would happen if the resulting kernel were actually booted. Signed-off-by: Dave Martin <dave.martin@linaro.org> Acked-by: Nicolas Pitre <nicolas.pitre@linaro.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-21ARM: SMP: wait for CPU to be marked activeRussell King
When we bring a CPU online, we should wait for it to become active before entering the idle thread, so we know that the scheduler and thread migration is going to work. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-17ARM: 6963/1: Thumb-2: Relax relocation requirements for non-function symbolsDave Martin
The "Thumb bit" of a symbol is only really meaningful for function symbols (STT_FUNC). However, sometimes a branch is relocated against a non-function symbol; for example, PC-relative branches to anonymous assembler local symbols are typically fixed up against the start-of-section symbol, which is not a function symbol. Some inline assembler generates references of this type, such as fixup code generated by macros in <asm/uaccess.h>. The existing relocation code for R_ARM_THM_CALL/R_ARM_THM_JUMP24 interprets this case as an error, because the target symbol appears to be an ARM symbol; but this is really not the case, since the target symbol is just a base in these cases. The addend defines the precise offset to the target location, but since the addend is encoded in a non-interworking Thumb branch instruction, there is no explicit Thumb bit in the addend. Because these instructions never interwork, the implied Thumb bit in the addend is 1, and the destination is Thumb by definition. This patch removes the extraneous Thumb bit check for non-function symbols, enabling modules containing the affected relocation types to be loaded. No modification to the actual relocation code is required, since this code does not take bit[0] of the location->destination offset into account in any case. Function symbols are always checked for interworking conflicts, as before. Signed-off-by: Dave Martin <dave.martin@linaro.org> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-17ARM: 6962/1: mach-h720x: fix build errorLinus Walleij
The h7201/h7202 machines did not build since they define ARM_DMA_ZONE_OFFSET but do not select ZONE_DMA. Fix it up by selecting ZONE_DMA in their Kconfig. Cc: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-17ARM: 6959/1: SMP build fix for entry-macro-multi.SMagnus Damm
The assembly code in entry-macro-multi.S does not build without the include asm/assembler.h in the case of CONFIG_SMP=y. Fixes the rather theoretical SMP build of mach-shmobile/entry-intc.c: arch/arm/include/asm/entry-macro-multi.S: Assembler messages: arch/arm/include/asm/entry-macro-multi.S:20: Error: bad instruction `alt_smp(test_for_ipi r0,r6,r5,lr)' arch/arm/include/asm/entry-macro-multi.S:20: Error: bad instruction `alt_up_b(9997f)' make[1]: *** [arch/arm/mach-shmobile/entry-intc.o] Error 1 make: *** [arch/arm/mach-shmobile] Error 2 make: *** Waiting for unfinished jobs.... Signed-off-by: Magnus Damm <damm@opensource.se> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
2011-06-16Merge branch 'drm-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: use helper functions for fence read/write drm/radeon/kms: set DP link config properly for DP bridges drm/radeon/kms/atom: AdjustPixelClock fixes for DP bridges drm/radeon/kms: fix handling of DP to LVDS bridges drm/radeon/kms: issue blank/unblank commands for ext encoders drm/radeon/kms: fix support for DDC on dp bridges drm/radeon/kms: add support for load detection on dp bridges drm/radeon/kms: add missing external encoder action drm/radeon/kms: rework atombios_get_encoder_mode() drm/radeon/kms: fix num crtcs for Cedar and Caicos Revert "drm/i915: Enable GMBUS for post-gen2 chipsets" drivers/gpu/drm: use printk_ratelimited instead of printk_ratelimit drm/radeon: workaround a hw bug on some radeon chipsets with all-0 EDIDs. drm: make debug levels match in edid failure code. drm/radeon/kms: clear wb memory by default drm/radeon/kms: be more pedantic about the g5 quirk (v2) drm/radeon/kms: signed fix for evergreen thermal drm: populate irq_by_busid-member for pci
2011-06-17drm/radeon/kms: use helper functions for fence read/writeAlex Deucher
The existing code assumed scratch registers in a number of places while in most cases we are be using writeback and events rather than scratch registers. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-17drm/radeon/kms: set DP link config properly for DP bridgesAlex Deucher
DP clock and lanes were not set properly for DP bridges. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-17drm/radeon/kms/atom: AdjustPixelClock fixes for DP bridgesAlex Deucher
Need to set the external transmitter type properly in AdjustPixelClock to get the properly output. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-17drm/radeon/kms: fix handling of DP to LVDS bridgesAlex Deucher
They need to be treated like eDP rather than DP. May fix: https://bugzilla.kernel.org/show_bug.cgi?id=34822 Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-17drm/radeon/kms: issue blank/unblank commands for ext encodersAlex Deucher
Required for DPMS on some systems. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-17drm/radeon/kms: fix support for DDC on dp bridgesAlex Deucher
Need to set up the bridge for DDC prior to the i2c over aux transaction. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-17drm/radeon/kms: add support for load detection on dp bridgesAlex Deucher
dp to vga bridges for example. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-17drm/radeon/kms: add missing external encoder actionAlex Deucher
required for ddc. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-17drm/radeon/kms: rework atombios_get_encoder_mode()Alex Deucher
This should give us more reliable results if the table is called before an active device is set. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-17drm/radeon/kms: fix num crtcs for Cedar and CaicosAlex Deucher
Only support 4 rather than 6. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-17Revert "drm/i915: Enable GMBUS for post-gen2 chipsets"Jean Delvare
Revert commit 8f9a3f9b63b8cd3f03be9dc53533f90bd4120e5f. This fixes a hang when loading the eeprom driver (see bug #35572.) GMBUS will be re-enabled later, differently. Signed-off-by: Jean Delvare <khali@linux-fr.org> Reported-by: Marek Otahal <markotahal@gmail.com> Tested-by: Yermandu Patapitafious <yermandu.dev@gmail.com> Tested-by: Andrew Lutomirski <luto@mit.edu> Acked-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Dave Airlie <airlied@redhat.com>
2011-06-16Merge git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/linux-2.6-nsfdLinus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/linux-2.6-nsfd: proc: Fix Oops on stat of /proc/<zombie pid>/ns/net
2011-06-16migrate: don't account swapcache as shmemAndrea Arcangeli
swapcache will reach the below code path in migrate_page_move_mapping, and swapcache is accounted as NR_FILE_PAGES but it's not accounted as NR_SHMEM. Hugh pointed out we must use PageSwapCache instead of comparing mapping to &swapper_space, to avoid build failure with CONFIG_SWAP=n. Signed-off-by: Andrea Arcangeli <aarcange@redhat.com> Acked-by: Hugh Dickins <hughd@google.com> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-06-16Merge branch 'rc-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6 * 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6: kbuild: Call depmod.sh via shell perf: clear out make flags when calling kernel make kernelver
2011-06-16Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: AFS: Use i_generation not i_version for the vnode uniquifier AFS: Set s_id in the superblock to the volume name vfs: Fix data corruption after failed write in __block_write_begin() afs: afs_fill_page reads too much, or wrong data VFS: Fix vfsmount overput on simultaneous automount fix wrong iput on d_inode introduced by e6bc45d65d Delay struct net freeing while there's a sysfs instance refering to it afs: fix sget() races, close leak on umount ubifs: fix sget races ubifs: split allocation of ubifs_info into a separate function fix leak in proc_set_super()
2011-06-16Merge branch 'sh-fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-3.x * 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-3.x: sh: sh7724: Add USBHS DMAEngine support sh: ecovec: Add renesas_usbhs support sh, exec: remove redundant set_fs(USER_DS) drivers: sh: resume enabled clocks fix dmaengine: shdma: SH_DMAC_MAX_CHANNELS message fix sh: Fix up xchg/cmpxchg corruption with gUSA RB. sh: Remove compressed kernel libgcc dependency. sh: fix wrong icache/dcache address-array start addr in cache-debugfs.
2011-06-16Merge branch 'rmobile-fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-3.x * 'rmobile-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-3.x: ARM: mach-shmobile: mackerel: tidyup usbhs driver settings ARM: mach-shmobile: Correct SCIF port types for SH7367. ARM: mach-shmobile: sh73a0 gic_arch_extn.irq_set_wake() fix ARM: mach-shmobile: Mackerel USB platform data update ARM: mach-shmobile: AG5EVM SDHI1 platform data update
2011-06-16Merge branch 'fbdev-fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-3.x * 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-3.x: fbdev: sh_mobile_hdmi: fix regression: statically enable RTPM fbdev/atyfb: Fix 2 defined-but-not-used warnings efifb: Fix call to wrong unregister function video: s3c-fb: move enabling channel for window video: s3c-fb: fix virtual resolution checking video: s3c-fb: fix misleading kfree in remove function
2011-06-16Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: SELinux: skip file_name_trans_write() when policy downgraded. selinux: fix case of names with whitespace/multibytes on /selinux/create
2011-06-16AFS: Use i_generation not i_version for the vnode uniquifierDavid Howells
Store the AFS vnode uniquifier in the i_generation field, not the i_version field of the inode struct. i_version can then be given the AFS data version number. Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2011-06-16AFS: Set s_id in the superblock to the volume nameDavid Howells
Set s_id in the superblock to the name of the AFS volume that this superblock corresponds to. Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2011-06-16vfs: Fix data corruption after failed write in __block_write_begin()Jan Kara
I've got a report of a file corruption from fsxlinux on ext3. The important operations to the page were: mapwrite to a hole partial write to the page read - found the page zeroed from the end of the normal write The culprit seems to be that if get_block() fails in __block_write_begin() (e.g. transient ENOSPC in ext3), the function does ClearPageUptodate(page). Thus when we retry the write, the logic in __block_write_begin() thinks zeroing of the page is needed and overwrites old data. In fact, I don't see why we should ever need to zero the uptodate bit here - either the page was uptodate when we entered __block_write_begin() and it should stay so when we leave it, or it was not uptodate and noone had right to set it uptodate during __block_write_begin() so it remains !uptodate when we leave as well. So just remove clearing of the bit. Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2011-06-16afs: afs_fill_page reads too much, or wrong dataAnton Blanchard
afs_fill_page should read the page that is about to be written but the current implementation has a number of issues. If we aren't extending the file we always read PAGE_CACHE_SIZE at offset 0. If we are extending the file we try to read the entire file. Change afs_fill_page to read PAGE_CACHE_SIZE at the right offset, clamped to i_size. While here, avoid calling afs_fill_page when we are doing a PAGE_CACHE_SIZE write. Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2011-06-16staging: fix iio builds when IIO_RING_BUFFER is not enabledRandy Dunlap
Fix build by moving enum list outside of #ifdef CONFIG_IIO_RING_BUFFER. drivers/staging/iio/accel/adis16201_core.c:413: error: 'ADIS16201_SCAN_SUPPLY' undeclared here (not in a function) drivers/staging/iio/accel/adis16201_core.c:417: error: 'ADIS16201_SCAN_TEMP' undeclared here (not in a function) .. drivers/staging/iio/accel/adis16203_core.c:374: error: 'ADIS16203_SCAN_SUPPLY' undeclared here (not in a function) drivers/staging/iio/accel/adis16203_core.c:378: error: 'ADIS16203_SCAN_AUX_ADC' undeclared here (not in a function) .. Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Acked-by: Jonathan Cameron <jic23@cam.ac.uk> Cc: linux-iio@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-06-16VFS: Fix vfsmount overput on simultaneous automountAl Viro
[Kudos to dhowells for tracking that crap down] If two processes attempt to cause automounting on the same mountpoint at the same time, the vfsmount holding the mountpoint will be left with one too few references on it, causing a BUG when the kernel tries to clean up. The problem is that lock_mount() drops the caller's reference to the mountpoint's vfsmount in the case where it finds something already mounted on the mountpoint as it transits to the mounted filesystem and replaces path->mnt with the new mountpoint vfsmount. During a pathwalk, however, we don't take a reference on the vfsmount if it is the same as the one in the nameidata struct, but do_add_mount() doesn't know this. The fix is to make sure we have a ref on the vfsmount of the mountpoint before calling do_add_mount(). However, if lock_mount() doesn't transit, we're then left with an extra ref on the mountpoint vfsmount which needs releasing. We can handle that in follow_managed() by not making assumptions about what we can and what we cannot get from lookup_mnt() as the current code does. The callers of follow_managed() expect that reference to path->mnt will be grabbed iff path->mnt has been changed. follow_managed() and follow_automount() keep track of whether such reference has been grabbed and assume that it'll happen in those and only those cases that'll have us return with changed path->mnt. That assumption is almost correct - it breaks in case of racing automounts and in even harder to hit race between following a mountpoint and a couple of mount --move. The thing is, we don't need to make that assumption at all - after the end of loop in follow_manage() we can check if path->mnt has ended up unchanged and do mntput() if needed. The BUG can be reproduced with the following test program: #include <stdio.h> #include <sys/types.h> #include <sys/stat.h> #include <unistd.h> #include <sys/wait.h> int main(int argc, char **argv) { int pid, ws; struct stat buf; pid = fork(); stat(argv[1], &buf); if (pid > 0) wait(&ws); return 0; } and the following procedure: (1) Mount an NFS volume that on the server has something else mounted on a subdirectory. For instance, I can mount / from my server: mount warthog:/ /mnt -t nfs4 -r On the server /data has another filesystem mounted on it, so NFS will see a change in FSID as it walks down the path, and will mark /mnt/data as being a mountpoint. This will cause the automount code to be triggered. !!! Do not look inside the mounted fs at this point !!! (2) Run the above program on a file within the submount to generate two simultaneous automount requests: /tmp/forkstat /mnt/data/testfile (3) Unmount the automounted submount: umount /mnt/data (4) Unmount the original mount: umount /mnt At this point the kernel should throw a BUG with something like the following: BUG: Dentry ffff880032e3c5c0{i=2,n=} still in use (1) [unmount of nfs4 0:12] Note that the bug appears on the root dentry of the original mount, not the mountpoint and not the submount because sys_umount() hasn't got to its final mntput_no_expire() yet, but this isn't so obvious from the call trace: [<ffffffff8117cd82>] shrink_dcache_for_umount+0x69/0x82 [<ffffffff8116160e>] generic_shutdown_super+0x37/0x15b [<ffffffffa00fae56>] ? nfs_super_return_all_delegations+0x2e/0x1b1 [nfs] [<ffffffff811617f3>] kill_anon_super+0x1d/0x7e [<ffffffffa00d0be1>] nfs4_kill_super+0x60/0xb6 [nfs] [<ffffffff81161c17>] deactivate_locked_super+0x34/0x83 [<ffffffff811629ff>] deactivate_super+0x6f/0x7b [<ffffffff81186261>] mntput_no_expire+0x18d/0x199 [<ffffffff811862a8>] mntput+0x3b/0x44 [<ffffffff81186d87>] release_mounts+0xa2/0xbf [<ffffffff811876af>] sys_umount+0x47a/0x4ba [<ffffffff8109e1ca>] ? trace_hardirqs_on_caller+0x1fd/0x22f [<ffffffff816ea86b>] system_call_fastpath+0x16/0x1b as do_umount() is inlined. However, you can see release_mounts() in there. Note also that it may be necessary to have multiple CPU cores to be able to trigger this bug. Tested-by: Jeff Layton <jlayton@redhat.com> Tested-by: Ian Kent <raven@themaw.net> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>