Jake Edge [Mon, 4 May 2009 18:51:14 +0000 (12:51 -0600)]
proc: avoid information leaks to non-privileged processes
By using the same test as is used for /proc/pid/maps and /proc/pid/smaps,
only allow processes that can ptrace() a given process to see information
that might be used to bypass address space layout randomization (ASLR).
These include eip, esp, wchan, and start_stack in /proc/pid/stat as well
as the non-symbolic output from /proc/pid/wchan.
ASLR can be bypassed by sampling eip as shown by the proof-of-concept
code at http://code.google.com/p/fuzzyaslr/ As part of a presentation
(http://www.cr0.org/paper/to-jt-linux-alsr-leak.pdf) esp and wchan were
also noted as possibly usable information leaks as well. The
start_stack address also leaks potentially useful information.
Cc: Stable Team <stable@kernel.org> Signed-off-by: Jake Edge <jake@lwn.net> Acked-by: Arjan van de Ven <arjan@linux.intel.com> Acked-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sat, 2 May 2009 23:52:50 +0000 (16:52 -0700)]
Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
* 'for-linus' of git://oss.sgi.com/xfs/xfs:
xfs: fix getbmap vs mmap deadlock
xfs: a couple getbmap cleanups
xfs: add more checks to superblock validation
xfs_file_last_byte() needs to acquire ilock
David Gibson [Thu, 30 Apr 2009 05:25:53 +0000 (15:25 +1000)]
Move dtc and libfdt sources from arch/powerpc/boot to scripts/dtc
The powerpc kernel always requires an Open Firmware like device tree
to supply device information. On systems without OF, this comes from
a flattened device tree blob. This blob is usually generated by dtc,
a tool which compiles a text description of the device tree into the
flattened format used by the kernel. Sometimes, the bootwrapper makes
small changes to the pre-compiled device tree blob (e.g. filling in
the size of RAM). To do this it uses the libfdt library.
Because these are only used on powerpc, the code for both these tools
is included under arch/powerpc/boot (these were imported and are
periodically updated from the upstream dtc tree).
However, the microblaze architecture, currently being prepared for
merging to mainline also uses dtc to produce device tree blobs. A few
other archs have also mentioned some interest in using dtc.
Therefore, this patch moves dtc and libfdt from arch/powerpc into
scripts, where it can be used by any architecture.
The vast bulk of this patch is a literal move, the rest is adjusting
the various Makefiles to use dtc and libfdt correctly from their new
locations.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sat, 2 May 2009 23:40:20 +0000 (16:40 -0700)]
Merge master.kernel.org:/home/rmk/linux-2.6-arm
* master.kernel.org:/home/rmk/linux-2.6-arm: (45 commits)
[ARM] 5489/1: ARM errata: Data written to the L2 cache can be overwritten with stale data
[ARM] 5490/1: ARM errata: Processor deadlock when a false hazard is created
[ARM] 5487/1: ARM errata: Stale prediction on replaced interworking branch
[ARM] 5488/1: ARM errata: Invalidation of the Instruction Cache operation can fail
davinci: DM644x: NAND: update partitioning
davinci: update DM644x support in preparation for more SoCs
davinci: DM644x: rename board file
davinci: update pin-multiplexing support
davinci: serial: generalize for more SoCs
davinci: DM355 IRQ Definitions
davinci: DM646x: add interrupt number and priorities
davinci: PSC: Clear bits in MDCTL reg before setting new bits
davinci: gpio bugfixes
davinci: add EDMA driver
davinci: timers: use clk_get_rate()
[ARM] pxa/littleton: add missing da9034 touchscreen support
[ARM] pxa/zylonite: configure GPIO18/19 correctly, used by 2 GPIO expanders
[ARM] pxa/zylonite: fix the issue of unused SDATA_IN_1 pin get AC97 not working
[ARM] pxa: make ads7846 on corgi and spitz to sync on HSYNC
[ARM] pxa: remove unused CPU_FREQ_PXA Kconfig symbol
...
Linus Torvalds [Sat, 2 May 2009 23:38:30 +0000 (16:38 -0700)]
Merge branch 'x86-mce-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-tip
* 'x86-mce-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-tip:
x86, mce: fix boot logging logic
x86, mce: make polling timer interval per CPU
Linus Torvalds [Sat, 2 May 2009 23:35:45 +0000 (16:35 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: document the multi-touch (MT) protocol
Input: add detailed multi-touch finger data report protocol
Input: allow certain EV_ABS events to bypass all filtering
Input: bcm5974 - add documentation for the driver
Input: bcm5974 - augment debug information
Input: bcm5974 - Add support for the Macbook 5 (Unibody)
Input: bcm5974 - add quad-finger tapping
Input: bcm5974 - prepare for a new trackpad header type
Input: appletouch - fix DMA to/from stack buffer
Input: wacom - fix TabletPC touch bug
Input: lifebook - add DMI entry for Fujitsu B-2130
Input: ALPS - add signature for Toshiba Satellite Pro M10
Input: elantech - make sure touchpad is really in absolute mode
Input: elantech - provide a workaround for jumpy cursor on firmware 2.34
Input: ucb1400 - use disable_irq_nosync() in irq handler
Input: tsc2007 - use disable_irq_nosync() in irq handler
Input: sa1111ps2 - use disable_irq_nosync() in irq handlers
Input: omap-keypad - use disable_irq_nosync() in irq handler
Linus Torvalds [Sat, 2 May 2009 23:33:56 +0000 (16:33 -0700)]
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fixes
* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fixes:
kbuild, modpost: Check the section flags, to catch missing "ax"/"aw"
kbuild: fix comment in modpost.c
kbuild: fix scripts/setlocalversion with git
kbuild: fix Module.markers permission error under cygwin
docs: also clean index.html
kbuild: remove a tag file before it is regenerated
kbuild: "make prepare" should be "make modules_prepare"
kbuild: clean Module.markers and modules.order for out-of-tree modules
avr32: drop unused CLEAN_FILES
Linus Torvalds [Sat, 2 May 2009 23:30:47 +0000 (16:30 -0700)]
Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2
* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2:
ocfs2: Change repository in MAINTAINERS.
ocfs2: Fix a missing credit when deleting from indexed directories.
ocfs2/trivial: Remove unused variable in ocfs2_rename.
ocfs2: Add missing iput() during error handling in ocfs2_dentry_attach_lock()
ocfs2: Fix some printk() warnings.
ocfs2: Fix 2 warning during ocfs2 make.
ocfs2: Reserve 1 more cluster in expanding_inline_dir for indexed dir.
Linus Torvalds [Sat, 2 May 2009 23:29:47 +0000 (16:29 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: fix oops in hid_check_keys_pressed()
HID: fix possible deadlock in usbhid_close()
HID: Fix the support for apple mini aluminium keyboard
HID: Add support for the G25 force feedback wheel in native mode
HID: hidraw -- fix missing unlocks in unlocked_ioctl
ibft: fix the display of a few fields in the NIC attribute structure in sysfs
Fix the display of a few fields in the iBFT NIC attribute structure in
sysfs.
Ensure that, if the DHCP IP address and the subnet mask for the interface
is present in the iBFT NIC structure, the corresponding entries are
created in sysfs tree for the device. This would hence create the
additional entries in the tree based on the iBFT table and would not
delete any existing entries.
Signed-off-by: Ashutosh Naik <ashutosh.naik@gmail.com> Cc: Vishnu V <vishnu@chelsio.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Andrea Righi <righi.andrea@gmail.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: David Rientjes <rientjes@google.com> Cc: Dave Chinner <david@fromorbit.com> Cc: Christoph Lameter <cl@linux-foundation.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Randy Dunlap [Thu, 30 Apr 2009 22:08:53 +0000 (15:08 -0700)]
kernel-doc: restrict syntax for private: and public:
scripts/kernel-doc can (incorrectly) delete struct members that are
surrounded by /* ... */ <struct members> /* ... */ if there is a /*
private: */ comment in there somewhere also.
Fix that by making the "/* private:" only allow whitespace between /* and
"private:", not anything/everything in the world.
This fixes some erroneous kernel-doc warnings that popped up while
processing include/linux/usb/composite.h.
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Because NR_CPUS can be greater than 1000 and meminfo_proc_show() does
not check for underflow.
But NR_CPUS proportional isn't good calculation. In general,
possibility of lock contention is proportional to the number of online
cpus, not theorical maximum cpus (NR_CPUS).
The current kernel has generic percpu-counter stuff. using it is right
way. it makes code simplify and percpu_counter_read_positive() don't
make underflow issue.
Reported-by: Dave Hansen <dave@linux.vnet.ibm.com> Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Cc: Eric B Munson <ebmunson@us.ibm.com> Cc: Mel Gorman <mel@csn.ul.ie> Cc: Christoph Lameter <cl@linux-foundation.org> Cc: <stable@kernel.org> [All kernel versions] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Grant Likely [Thu, 30 Apr 2009 22:08:50 +0000 (15:08 -0700)]
of: make of_(un)register_platform_driver common code
Some drivers using of_register_platform_driver() wrapper break on sparc
because the wrapper isn't in the header file. This patch moves it from
Microblaze and PowerPC implementations and makes it common code.
Fixes this sparc64 allmodconfig build error (at least):
drivers/leds/leds-gpio.c: In function `gpio_led_init':
drivers/leds/leds-gpio.c:295: error: implicit declaration of function `of_register_platform_driver'
drivers/leds/leds-gpio.c: In function `gpio_led_exit':
drivers/leds/leds-gpio.c:311: error: implicit declaration of function `of_unregister_platform_driver'
Signed-off-by: Grant Likely <grant.likely@secretlab.ca> Acked-by: David S. Miller <davem@davemloft.net> Cc: Michal Simek <monstr@monstr.eu> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Cc: Richard Purdie <rpurdie@rpsys.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Ivan Kokshaysky [Thu, 30 Apr 2009 22:08:49 +0000 (15:08 -0700)]
alpha: binfmt_aout fix
This fixes the problem introduced by commit 3bfacef412 (get rid of
special-casing the /sbin/loader on alpha): osf/1 ecoff binary segfaults
when binfmt_aout built as module. That happens because aout binary
handler gets on the top of the binfmt list due to late registration, and
kernel attempts to execute the binary without preparatory work that must
be done by binfmt_loader.
Fixed by changing the registration order of the default binfmt handlers
using list_add_tail() and introducing insert_binfmt() function which
places new handler on the top of the binfmt list. This might be generally
useful for installing arch-specific frontends for default handlers or just
for overriding them.
Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Al Viro <viro@ZenIV.linux.org.uk> Cc: Richard Henderson <rth@twiddle.net Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Ivan Kokshaysky [Thu, 30 Apr 2009 22:08:48 +0000 (15:08 -0700)]
alpha: futex implementation
Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Al Viro <viro@ZenIV.linux.org.uk> Cc: Richard Henderson <rth@twiddle.net Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Ivan Kokshaysky [Thu, 30 Apr 2009 22:08:47 +0000 (15:08 -0700)]
alpha: exception table sorting
Exception fixups for sections other than .text (like one in futex_init())
break the natural ordering of fixup entries, so sorting is required.
Without that the result of the exception table search depends on phase of
the moon.
Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Al Viro <viro@ZenIV.linux.org.uk> Cc: Richard Henderson <rth@twiddle.net Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Ivan Kokshaysky [Thu, 30 Apr 2009 22:08:45 +0000 (15:08 -0700)]
alpha: titan and marvel build fixes
These platforms got broken after u64 => 'long long' conversion.
Apparently that change was compile-tested with 'make allmodconfig', but it
doesn't include systems that depend on !ALPHA_LEGACY_START_ADDRESS.
Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Al Viro <viro@ZenIV.linux.org.uk> Cc: Richard Henderson <rth@twiddle.net Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Stefan Bader [Thu, 30 Apr 2009 22:08:44 +0000 (15:08 -0700)]
vgacon: return the upper half of 512 character fonts
Uwe Geuder noted that he gets random bitmaps on a text console if he tried
to type extended characters (like the e acute). For him everything above
unicode 0xa0 was corrupted.
After some digging there seems to be a little culprit in vgacon since the
beginning of ages (well git). The function vgacon_font_get will store the
number of characters correctly in font->charcount but then calls to
vgacon_do_font_op(..., 0, 0). Which means only the lower 256 characters
are actually stored to the fontdata. The rest is left untouched. So the
next time that saved data is used, the garbled font appears. This happens
on every switch between text consoles.
pagemap: require aligned-length, non-null reads of /proc/pid/pagemap
The intention of commit aae8679b0ebcaa92f99c1c3cb0cd651594a43915
("pagemap: fix bug in add_to_pagemap, require aligned-length reads of
/proc/pid/pagemap") was to force reads of /proc/pid/pagemap to be a
multiple of 8 bytes, but now it allows to read 0 bytes, which actually
puts some data to user's buffer. According to POSIX, if count is zero,
read() should return zero and has no other results.
Signed-off-by: Vitaly Mayatskikh <v.mayatskih@gmail.com> Cc: Thomas Tuttle <ttuttle@google.com> Acked-by: Matt Mackall <mpm@selenic.com> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Nick Piggin [Thu, 30 Apr 2009 22:08:16 +0000 (15:08 -0700)]
mm: close page_mkwrite races
Change page_mkwrite to allow implementations to return with the page
locked, and also change it's callers (in page fault paths) to hold the
lock until the page is marked dirty. This allows the filesystem to have
full control of page dirtying events coming from the VM.
Rather than simply hold the page locked over the page_mkwrite call, we
call page_mkwrite with the page unlocked and allow callers to return with
it locked, so filesystems can avoid LOR conditions with page lock.
The problem with the current scheme is this: a filesystem that wants to
associate some metadata with a page as long as the page is dirty, will
perform this manipulation in its ->page_mkwrite. It currently then must
return with the page unlocked and may not hold any other locks (according
to existing page_mkwrite convention).
In this window, the VM could write out the page, clearing page-dirty. The
filesystem has no good way to detect that a dirty pte is about to be
attached, so it will happily write out the page, at which point, the
filesystem may manipulate the metadata to reflect that the page is no
longer dirty.
It is not always possible to perform the required metadata manipulation in
->set_page_dirty, because that function cannot block or fail. The
filesystem may need to allocate some data structure, for example.
And the VM cannot mark the pte dirty before page_mkwrite, because
page_mkwrite is allowed to fail, so we must not allow any window where the
page could be written to if page_mkwrite does fail.
This solution of holding the page locked over the 3 critical operations
(page_mkwrite, setting the pte dirty, and finally setting the page dirty)
closes out races nicely, preventing page cleaning for writeout being
initiated in that window. This provides the filesystem with a strong
synchronisation against the VM here.
- Sage needs this race closed for ceph filesystem.
- Trond for NFS (http://bugzilla.kernel.org/show_bug.cgi?id=12913).
- I need it for fsblock.
- I suspect other filesystems may need it too (eg. btrfs).
- I have converted buffer.c to the new locking. Even simple block allocation
under dirty pages might be susceptible to i_size changing under partial page
at the end of file (we also have a buffer.c-side problem here, but it cannot
be fixed properly without this patch).
- Other filesystems (eg. NFS, maybe btrfs) will need to change their
page_mkwrite functions themselves.
[ This also moves page_mkwrite another step closer to fault, which should
eventually allow page_mkwrite to be moved into ->fault, and thus avoiding a
filesystem calldown and page lock/unlock cycle in __do_fault. ]
[akpm@linux-foundation.org: fix derefs of NULL ->mapping] Cc: Sage Weil <sage@newdream.net> Cc: Trond Myklebust <trond.myklebust@fys.uio.no> Signed-off-by: Nick Piggin <npiggin@suse.de> Cc: Valdis Kletnieks <Valdis.Kletnieks@vt.edu> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
atomic: fix atomic_long_cmpxchg/xchg for 64 bit architectures
On a linux-next allyesconfig build:
kernel/trace/ring_buffer.c:1726:
warning: passing argument 1 of 'atomic_cmpxchg' from incompatible pointer type
linux-next/arch/s390/include/asm/atomic.h:112:
note: expected 'struct atomic_t *' but argument is of type 'struct atomic64_t *'
atomic_long_cmpxchg and atomic_long_xchg are incorrectly defined for 64
bit architectures. They should be mapped to the atomic64_* variants.
Ian Kent [Thu, 30 Apr 2009 22:08:09 +0000 (15:08 -0700)]
autofs4: fix incorrect return in autofs4_mount_busy()
Fix an obvious incorrect return status in autofs4_mount_busy().
Signed-off-by: Ian Kent <raven@themaw.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Robert Moore [Sat, 2 May 2009 18:48:37 +0000 (11:48 -0700)]
acpica: validate package element more carefully in acpi_rs_get_pci_routing_table_length
acpi_rs_get_pci_routing_table_length is not performing sufficient
validation on the package returned from _PRT. It assumes a package of
packages and fails/faults if this is not the case.
We should validate each subpackage when extracted from the parent
package, and not accept objects of the wrong type, since that will just
cause the scanning to fail (likely with a kernel oops).
This can only happen with a serious BIOS bug, and is accompanied by a
warning something like this:
ACPI Warning (nspredef-0949): \_SB_.PCI0.PEG4._PRT: Return Package type mismatch at index 0 - found Integer, expected Package [20090320]
Hirokazu Takata [Sat, 2 May 2009 11:29:00 +0000 (20:29 +0900)]
m32r: build fix for __stringify macro
This patch fixes the following build error of 2.6.30-rc3-git2:
AS arch/m32r/kernel/head.o
In file included from /include/linux/init.h:7,
from /arch/m32r/kernel/head.S:11:
/include/linux/stringify.h:9: error: syntax error in macro parameter list
/include/linux/stringify.h:10: error: syntax error in macro parameter list
This build error was caused at __HEAD macro in arch/m32r/kernel/head.S,
which uses __stringify() macro.
Remove -traditional option from EXTRA_AFLAGS for the m32r,
because the __stringify() macro depends on the gcc's variadic macro
extension function, due to commit:
Jiri Kosina [Fri, 1 May 2009 22:02:57 +0000 (00:02 +0200)]
HID: fix oops in hid_check_keys_pressed()
If the device is not claimed by hid-input (i.e devices driver by userspace
hiddev/hidraw-based drivers, or completely detached from HID
and driver by libusb), we must not check the hid->inptus, as it
is not guaranteed to be initialized, as this is performed only for devices
handled by hid-input.
Anders Kaseorg [Thu, 23 Apr 2009 20:49:33 +0000 (16:49 -0400)]
kbuild, modpost: Check the section flags, to catch missing "ax"/"aw"
When you put
.section ".foo"
in an assembly file instead of
.section "foo", "ax"
, one of the possible symptoms is that modpost will see an
ld-generated section name ".foo.1" in section_rel() or section_rela().
But this heuristic has two problems: it will miss a bad section that
has no relocations, and it will incorrectly flag many gcc-generated
sections as bad when compiling with -ffunction-sections
-fdata-sections.
On mips it fixes a lot of bogus warnings with gcc 4.4.0 lije this one:
WARNING: crypto/cryptd.o (.text.T.349): unexpected section name.
So instead of checking whether the section name matches a particular
pattern, we directly check for a missing SHF_ALLOC in the section
flags.
Signed-off-by: Anders Kaseorg <andersk@mit.edu> Tested-by: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
kbuild: fix Module.markers permission error under cygwin
While building the kernel, we end-up calling modpost with -K and -M
options for the same file (Modules.markers). This is resulting in
modpost's main function calling read_markers() and then write_markers() on
the same file.
We then have read_markers() mmap'ing the file, and writer_markers()
opening that same file for writing.
The issue is that read_markers() exits without munmap'ing the file and is
as a matter holding a reference on Modules.markers. When write_markers()
is opening that very same file for writing, we still have a reference on
it and cygwin (Windows?) is then making fopen() fail with EPERM.
Calling release_file() before exiting read_markers() clears that reference
(and memory leak) and fopen() then succeeds.
Tested on both cygwin (1.3.22) and Linux. Also ran modpost within
valgrind on Linux to make sure that the munmap'ed file was not accessed
after read_markers()
Signed-off-by: Cedric Hombourger <chombourger@gmail.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Matt Kraai [Wed, 22 Apr 2009 03:38:23 +0000 (20:38 -0700)]
kbuild: remove a tag file before it is regenerated
If a tag file is not removed before it is regenerated, the newly
generated data is appended to the old, which preserves stale data and
makes the tag file grow over time.
Signed-off-by: Matt Kraai <kraai@ftbfs.org> Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Joel Becker [Thu, 30 Apr 2009 00:55:08 +0000 (17:55 -0700)]
ocfs2: Fix a missing credit when deleting from indexed directories.
The ocfs2 directory index updates two blocks when we remove an entry -
the dx root and the dx leaf. OCFS2_DELETE_INODE_CREDITS was only
accounting for the dx leaf. This shows up when ocfs2_delete_inode()
runs out of credits in jbd2_journal_dirty_metadata() at
"J_ASSERT_JH(jh, handle->h_buffer_credits > 0);".
The test that caught this was running dirop_file_racer from the
ocfs2-test suite with a 250-character filename PREFIX. Run on a 512B
blocksize, it forces the orphan dir index to grow large enough to
trigger.
Signed-off-by: Joel Becker <joel.becker@oracle.com>
[ARM] 5489/1: ARM errata: Data written to the L2 cache can be overwritten with stale data
This patch is a workaround for the 460075 Cortex-A8 (r2p0) erratum. It
configures the L2 cache auxiliary control register so that the Write
Allocate mode for the L2 cache is disabled.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
[ARM] 5490/1: ARM errata: Processor deadlock when a false hazard is created
This patch adds a workaround for the 458693 Cortex-A8 (r2p0)
erratum. It sets the corresponding bits in the auxiliary control
register so that the PLD instruction becomes a NOP.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ide-cd: fix REQ_QUIET tests in cdrom_decode_status
Original patch (dfa4411cc3a690011cab90e9a536938795366cf9) was buggy.
This is a more proper fix which introduces blk_rq_quiet() macro
alleviating the need for dumb, too short caching variables.
Thanks to Helge Deller and Bart for debugging this.
xfs_getbmap (or rather the formatters called by it) copy out the getbmap
structures under the ilock, which can deadlock against mmap. This has
been reported via bugzilla a while ago (#717) and has recently also
shown up via lockdep.
So allocate a temporary buffer to format the kernel getbmap structures
into and then copy them out after dropping the locks.
A little problem with this is that we limit the number of extents we
can copy out by the maximum allocation size, but I see no real way
around that.
Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Eric Sandeen <sandeen@sandeen.net> Reviewed-by: Felix Blyakher <felixb@sgi.com> Signed-off-by: Felix Blyakher <felixb@sgi.com>
- reshuffle various conditionals for data vs attr fork to make the code
more readable
- do fine-grainded goto-based error handling
- exit early from conditionals instead of keeping a long else branch around
- allow kmem_alloc to fail
Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Eric Sandeen <sandeen@sandeen.net> Reviewed-by: Felix Blyakher <felixb@sgi.com> Signed-off-by: Felix Blyakher <felixb@sgi.com>
Olaf Weber [Fri, 17 Apr 2009 21:12:45 +0000 (16:12 -0500)]
xfs: add more checks to superblock validation
There had been reports where xfs filesystem was randomly
corrupted with fsfuzzer, and xfs failed to handle it
gracefully. This patch fixes couple of reported problem
by providing additional checks in the superblock
validation routine.
Signed-off-by: Olaf Weber <olaf@sgi.com> Reviewed-by: Josef 'Jeff' Sipek <jeffpc@josefsipek.net> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Felix Blyakher <felixb@sgi.com>
The problem here is that xfs_file_last_byte() does not acquire the
inode lock and can therefore race with another thread that is modifying
the extext list. While xfs_bmap_last_offset() is trying to lookup
what was the last extent some extents were merged and the extent list
shrunk so the index we lookup is now beyond the end of the extent list
and potentially in a freed buffer.
Signed-off-by: Lachlan McIlroy <lmcilroy@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Felix Blyakher <felixb@sgi.com> Signed-off-by: Felix Blyakher <felixb@sgi.com>
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6:
eCryptfs: Fix min function comparison warning
ecryptfs: fix printk format warning
V4L/DVB (11652): au0828: fix kernel oops regression on USB disconnect.
A regression was introduced in hg changeset 33810c734a0d, which resulted in
a kernel panic whenever the device was disconnected from USB. The call to
4l2_device_register() was overwriting the pointer for usb_set_intfdata(), so
when au0828_usb_disconnect() was called, the usb_get_intfdata() returned a
pointer to the v4l2_device instead of the au0828_dev structure.
Jean Delvare [Fri, 17 Apr 2009 13:56:51 +0000 (10:56 -0300)]
V4L/DVB (11568): cx18: Fix the handling of i2c bus registration error
* Return actual error values as returned by the i2c subsystem, rather
than 0 or 1.
* If the registration of the second bus fails, unregister the first one
before exiting, otherwise we are leaking resources.
Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Andy Walls <awalls@radix.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Currently drivers/media drivers are linked very early - directly after
base, block, misc, and mfd and before ata, scsi, ide, input, firewire,
usb, and i2c. This breaks static build of video4linux drivers, that use
generic CPU i2c adapter drivers and the v4l2-subdev subsystem, because
during video4linux probing the v4l2-subdev core requires a struct
i2c_adapter context, which cannot be satisfied before the i2c subsystem is
initialised. Moving drivers/media after drivers/i2c fixes this problem.
The best way to trigger action is by submitting a patch:-) So, let's see
what comes out of it - on the one hand I don't see any reason why media
has to be linked this early, and nobody was able to give me one yesterday
as this problem has been discussed on linux-media, OTOH, maybe indeed it
would be better to move i2c the whole way up above media, but that'd be
much bigger of a change, I think.
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Andy Walls [Tue, 14 Apr 2009 00:43:31 +0000 (21:43 -0300)]
V4L/DVB (11494): cx18: Send correct input routing value to external audio multiplexers
A late v4l2_subdev framework change accidentally sent the audio input
routing value to the external multiplexer, instead of the muxer input routing
value to the external multiplexer. This change corrects that error.
Signed-off-by: Andy Walls <awalls@radix.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Oliver Neukum [Wed, 29 Apr 2009 15:12:12 +0000 (17:12 +0200)]
HID: fix possible deadlock in usbhid_close()
This patch switches usbhid_close() from flush_scheduled_work() to canceling
the outstanding work. This fixes a possible deadlock due to work taking
the mutex usbhid_close() holds. Lockdep reported the problem.
Signed-off-by: Oliver Neukum <oliver@neukum.org>
-- Signed-off-by: Jiri Kosina <jkosina@suse.cz>
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (24 commits)
e100: do not go D3 in shutdown unless system is powering off
netfilter: revised locking for x_tables
Bluetooth: Fix connection establishment with low security requirement
Bluetooth: Add different pairing timeout for Legacy Pairing
Bluetooth: Ensure that HCI sysfs add/del is preempt safe
net: Avoid extra wakeups of threads blocked in wait_for_packet()
net: Fix typo in net_device_ops description.
ipv4: Limit size of route cache hash table
Add reference to CAPI 2.0 standard
Documentation/isdn/INTERFACE.CAPI
update Documentation/isdn/00-INDEX
ixgbe: Fix WoL functionality for 82599 KX4 devices
veth: prevent oops caused by netdev destructor
xfrm: wrong hash value for temporary SA
forcedeth: tx timeout fix
net: Fix LL_MAX_HEADER for CONFIG_TR_MODULE
mlx4_en: Handle page allocation failure during receive
mlx4_en: Fix cleanup flow on cq activation
vlan: update vlan carrier state for admin up/down
netfilter: xt_recent: fix stack overread in compat code
...
HID: Fix the support for apple mini aluminium keyboard
Quirks for the apple mini keyboard was recently added but keyboard
was recognized as a powerbook keyboard. Adjusted boundary to the lowest
product id for the apple mini keyboard to get the right translation.
e100: do not go D3 in shutdown unless system is powering off
After experimenting with kexec with the last merges after 2.6.29, I've
had some problems when probing e100. It would not read the eeprom. After
some bisects, I realized this has been like that since forever (at least
2.6.18). The problem is that shutdown is doing the same thing that
suspend does and puts the device in D3 state. I couldn't find a way to
get the device back to a sane state in the probe function. So, based on
some similar patches from Rafael J. Wysocki for e1000, e1000e, and ixgbe,
I wrote this one for e100.
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com> Acked-by: "Rafael J. Wysocki" <rjw@sisk.pl> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
The x_tables are organized with a table structure and a per-cpu copies
of the counters and rules. On older kernels there was a reader/writer
lock per table which was a performance bottleneck. In 2.6.30-rc, this
was converted to use RCU and the counters/rules which solved the performance
problems for do_table but made replacing rules much slower because of
the necessary RCU grace period.
This version uses a per-cpu set of spinlocks and counters to allow to
table processing to proceed without the cache thrashing of a global
reader lock and keeps the same performance for table updates.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Merge branch 'drm-intel-next' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel
* 'drm-intel-next' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel:
drm/i915: fix up error path leak in i915_cmdbuffer
drm/i915: fix unpaired i915 device mutex on entervt failure.
drm/i915: add support for G41 chipset
drm/i915: Enable ASLE if present
drm/i915: Unregister ACPI video driver when exiting
drm/i915: Register ACPI video even when not modesetting
drm/i915: fix transition to I915_TILING_NONE
drm/i915: Don't let an oops get triggered from irq_emit without dma init.
drm/i915: allow tiled front buffers on 965+
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: (21 commits)
RDMA/nes: Update iw_nes version
RDMA/nes: Fix error path in nes_accept()
RDMA/nes: Fix hang issues for large cluster dynamic connections
RDMA/nes: Increase rexmit timeout interval
RDMA/nes: Check for sequence number wrap-around
RDMA/nes: Do not set apbvt entry for loopback
RDMA/nes: Fix unused variable compile warning when INFINIBAND_NES_DEBUG=n
RDMA/nes: Fix fw_ver in /sys
RDMA/nes: Set trace length to 1 inch for SFP_D
RDMA/nes: Enable repause timer for port 1
RDMA/nes: Correct CDR loop filter setting for port 1
RDMA/nes: Modify thermo mitigation to flip SerDes1 ref clk to internal
RDMA/nes: Fix resource issues in nes_create_cq() and nes_destroy_cq()
RDMA/nes: Remove root_256()'s unused pbl_count_256 parameter
mlx4_core: Fix memory leak in mlx4_enable_msi_x()
IB/mthca: Fix timeout for INIT_HCA and a few other commands
RDMA/cxgb3: Don't zero QP attrs when moving to IDLE
RDMA/nes: Fix bugs in nes_reg_phys_mr()
RDMA/nes: Fix compiler warning at nes_verbs.c:1955
IPoIB: Disable NAPI while CQ is being drained
...
Introduced by commit 6f335cab0431d5df4995bcd4fd952d4c746d5a86 ("m68k:
convert to use __HEAD and HEAD_TEXT macros."), which started using
__HEAD without adding the appropriate include.
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6:
regulator: Fix default constraints for fixed voltage regulators
regulator/bq24022: fix bug in is_enabled function
regulator/virtual: fix strings compare predicates
regulator core: fix double-free in regulator_register() error path
drivers/regulator: fix when type is different from REGULATOR_VOLTAGE or REGULATOR_CURRENT
unreachable code in drms_uA_update()
regulator: fix header file missing kernel-doc
Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
powerpc/ps3: Fix build error on UP
powerpc/cell: Select PCI for IBM_CELL_BLADE AND CELLEB
powerpc: ppc32 needs elf_read_implies_exec()
powerpc/86xx: Add device_type entry to soc for ppc9a
powerpc/44x: Correct memory size calculation for denali-based boards
maintainers: Fix PowerPC 4xx git tree
powerpc: fix for long standing bug noticed by gcc 4.4.0
Revert "powerpc: Add support for early tlbilx opcode"
Tim Abbott [Tue, 28 Apr 2009 15:47:15 +0000 (11:47 -0400)]
powerpc: Revert switch to TEXT_TEXT in linker script
Commit edada399 broke the build on 64-bit powerpc because it moved the
__ftr_alt_* sections of a file away from the .text section, causing
link failures due to relative conditional branch targets being too far
away from the branch instructions. This happens on pretty much all
64-bit powerpc configs.
This change reverts commit edada399 while preserving the update from
the *.refok sections to .ref.text that has happened since.
Signed-off-by: Tim Abbott <tabbott@mit.edu> Requested-by: Paul Mackerras <paulus@samba.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
st driver uses blk_rq_map_user() in order to just build a request out
of page frames. In this case, map_data->offset is a non zero value and
iov[0].iov_base is NULL. We need to increase nr_pages for that.
hd dance around local irq and HD_IRQ enable without achieving much.
It ends up transferring data from irq handler with both local irq and
HD_IRQ disabled. The only place it actually does something is while
transferring the first block of a request which it does with HD_IRQ
disabled but local irq enabled.
Unfortunately, the dancing is horribly broken from locking POV. IRQ
and timeout handlers access block queue without grabbing the queue
lock and running the driver in SMP configuration crashes the whole
machine pretty quickly.
Remove meaningless irq enable/disable dancing and add proper locking
in issue, irq and timeout paths.
drivers/block/mg_disk.c: In function ‘mg_dump_status’:
drivers/block/mg_disk.c:265: warning: format ‘%ld’ expects type ‘long int’, but
argument 2 has type ‘sector_t’
Mark Brown [Tue, 28 Apr 2009 10:09:38 +0000 (11:09 +0100)]
regulator: Fix default constraints for fixed voltage regulators
Default voltage constraints were being provided for fixed voltage
regulator where board constraints were not provided but these constraints
used INT_MIN as the default minimum voltage which is not a valid value
since it is less than zero. Use 1uV instead.
Also set the default values we set in the constraints themselves since
otherwise the max_uV constraint we determine will not be stored in the
actual constraint strucutre and will therefore not be used.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Mike Rapoport [Sun, 26 Apr 2009 08:49:30 +0000 (11:49 +0300)]
regulator/virtual: fix strings compare predicates
Signed-off-by: Mike Rapoport <mike@compulab.co.il> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Paul Walmsley [Sat, 25 Apr 2009 11:28:36 +0000 (05:28 -0600)]
regulator core: fix double-free in regulator_register() error path
During regulator registration, any error after device_register() will
cause a double-free on the struct regulator_dev 'rdev'. The bug is in
drivers/regulator/core.c:regulator_register():
device_unregister() calls regulator_dev_release() which frees rdev. The
subsequent kfree corrupts memory and causes some OMAP3 systems to oops on
boot in regulator_get().
Applies against 2.6.30-rc3.
Signed-off-by: Paul Walmsley <paul@pwsan.com> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Diego Liziero [Tue, 14 Apr 2009 01:04:47 +0000 (03:04 +0200)]
drivers/regulator: fix when type is different from REGULATOR_VOLTAGE or REGULATOR_CURRENT
When regulator_desc->type is something different from REGULATOR_VOLTAGE or REGULATOR_CURRENT
the if should probably return ERR_PTR(-EINVAL)
The semantic patch that makes this change is as follows:
(http://www.emn.fr/x-info/coccinelle/)
@@ expression E; constant C; @@
(
- !E == C
+ E != C
)
Signed-off-by: Diego Liziero <diegoliz@gmail.com> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
projects / mirror_ubuntu-disco-kernel.git / log