- 09 Oct, 2007 13 commits
-
-
Pavel Emelyanov authored
This code is run under lock_kernel(), which is dropped during sleeping operations, so the following race is possible: CPU1: CPU2: vfs_setlease(); vfs_setlease(); lock_kernel(); lock_kernel(); /* spin */ generic_setlease(): ... for (before = ...) /* here we found some lease after * which we will insert the new one */ fl = locks_alloc_lock(); /* go to sleep in this allocation and * drop the BKL */ generic_setlease(): ... for (before = ...) /* here we find the "before" pointing * at the one we found on CPU1 */ ->fl_change(my_before, arg); lease_modify(); locks_free_lock(); /* and we freed it */ ... unlock_kernel(); locks_insert_lock(before, fl); /* OOPS! We have just tried to add the lease * at the tail of already removed one */ The similar races are already handled in other code - all the allocations are performed before any checks/updates. Thanks to Kamalesh Babulal for testing and for a bug report on an earlier version. Signed-off-by:Pavel Emelyanov <xemul@openvz.org> Signed-off-by:
J. Bruce Fields <bfields@citi.umich.edu> Cc: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
-
Pavel Emelyanov authored
This routine deletes all the elements from the list with the "while (!list_empty())" loop, and we already have a list_first_entry() macro to help it look nicer :) Signed-off-by: -
J. Bruce Fields authored
This comment wasn't updated when lease support was added, and it makes essentially the same mistake that the code made before a recent bugfix. Signed-off-by: -
Pavel Emelyanov authored
When the flock_lock_file() is called to change the flock from F_RDLCK to F_WRLCK or vice versa the existing flock can be removed without appropriate warning. Look: for_each_lock(inode, before) { struct file_lock *fl = *before; if (IS_POSIX(fl)) break; if (IS_LEASE(fl)) continue; if (filp != fl->fl_file) continue; if (request->fl_type == fl->fl_type) goto out; found = 1; locks_delete_lock(before); <<<<<< ! break; } if after this point the subsequent locks_alloc_lock() will fail the return code will be -ENOMEM, but the existing lock is already removed. This is a known feature that such "re-locking" is not atomic, but in the racy case the file should stay locked (although by some other process), but in this case the file will be unlocked. The proposal is to prepare the lock in advance keeping no chance to fail in the future code. Found during making the flocks pid-namespaces aware. (Note: Thanks to Reuben Farrelly for finding a bug in an earlier version of this patch.) Signed-off-by: -
J. Bruce Fields authored
There's no need for another variable local to this loop; we can use the variable (of the same name!) already declared at the top of the function, and not used till later (at which point it's initialized, so this is safe). Signed-off-by: -
J. Bruce Fields authored
The first argument to posix_locks_conflict() is meant to be a lock request, and the second a lock from an inode's lock request. It doesn't really make a difference which order you call them in, since the only asymmetric test in posix_lock_conflict() is the check whether the second argument is a posix lock--and every caller already does that check for some reason. But may as well fix posix_test_lock() to call posix_locks_conflict() with the arguments in the same order as everywhere else. Signed-off-by: -
Linus Torvalds authored
-
git://ftp.linux-mips.org/pub/scm/upstream-linusLinus Torvalds authored
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] Au1000: set the PCI controller IO base [MIPS] Alchemy: Fix USB initialization. [MIPS] IP32: Fix fatal typo in address computation.
-
Trond Myklebust authored
The recent fix for a circular lock dependency unfortunately introduced a potential memory leak in the event where the call to nlmsvc_lookup_host fails for some reason. Thanks to Roel Kluin for spotting this. Signed-off-by:
Trond Myklebust <Trond.Myklebust@netapp.com> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
Jeff Garzik authored
The recent mv_fill_sg() rewrite, to fix a data corruption problem related to IOMMU virtual merging, forgot to account for the potentially-increased size of the scatter/gather table after its run. Additionally, the DMA boundary is reduced from 0xffffffff to 0xffff to more closely match the needs of mv_fill_sg(). Signed-off-by:
Jeff Garzik <jgarzik@redhat.com> Signed-off-by:
-
Florian Fainelli authored
The PCI controller IO base was not set in the au1000 pci code. Signed-off-by:
Felix Fietkau <nbd@openwrt.org> Signed-off-by:
John Crispin <blogic@openwrt.org> Signed-off-by:
Florian Fainelli <florian.fainelli@telecomint.eu> Signed-off-by:
Ralf Baechle <ralf@linux-mips.org>
-
Florian Fainelli authored
This patch fixes a wrong ifdef in the board setup code, leading to the GPIO pin not being pulled high, and thus the USB switch not being powered at all. This finishes the rename of CONFIG_USB_OHCI to CONFIG_USB_OHCI_HCD, which started in 2005 (before 2.6.12-rc2), then probably because things were working anyway for most people got forgotten. [Ralf: Paolo's original patch didn't fix the module case, Florian's patch only fixed MTX1 etc. so this is a combined patch plus some cleanups.] Cc: Giuseppe Patanè <giuseppe.patane@tvblob.com> Cc: Ralf Baechle <ralf@linux-mips.org> Signed-off-by:
Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it> Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
-
Giuseppe Sacco authored
Signed-off-by:
Giuseppe Sacco <eppesuig@debian.org> Signed-off-by:
-
- 08 Oct, 2007 11 commits
-
-
Maarten Bressers authored
When building a custom keymap, after setting GENERATE_KEYMAP := 1 in drivers/char/Makefile, the kernel build fails like this: CC drivers/char/vt.o make[2]: *** No rule to make target `drivers/char/%.map', needed by `drivers/char/defkeymap.c'. Stop. make[1]: *** [drivers/char] Error 2 make: *** [drivers] Error 2 This was caused by commit af8b1287, which deleted a necessary colon from the Makefile rule that generates the keymap, since that rule contains both a target and a target-pattern. The following patch puts the colon back: Signed-off-by:Maarten Bressers <mbres@gentoo.org> Cc: Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Sam Ravnborg <sam@ravnborg.org> Signed-off-by:
-
Karsten Keil authored
Fix against access random data bytes outside the dev->chanmap array. Thanks to Oliver Neukum for pointing me to this issue. Signed-off-by:
Karsten Keil <kkeil@suse.de> Signed-off-by:
-
Linus Torvalds authored
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [IPv6]: Fix ICMPv6 redirect handling with target multicast address [PKT_SCHED] cls_u32: error code isn't been propogated properly [ROSE]: Fix rose.ko oops on unload [TCP]: Fix fastpath_cnt_hint when GSO skb is partially ACKed
-
Yan Zheng authored
When IOCB_FLAG_RESFD flag is set and iocb->aio_resfd is incorrect, statement 'goto out_put_req' is executed. At label 'out_put_req', aio_put_req(..) is called, which requires 'req->ki_filp' set. Signed-off-by: Yan Zheng<yanzheng@21cn.com> Cc: Zach Brown <zach.brown@oracle.com> Signed-off-by:
-
Yan Zheng authored
find_lock_page increases page's usage count, we should decrease it before return VM_FAULT_SIGBUS Signed-off-by: Yan Zheng<yanzheng@21cn.com> Cc: Nick Piggin <nickpiggin@yahoo.com.au> Signed-off-by:
-
Yan Zheng authored
The test for VM_CAN_NONLINEAR always fails Signed-off-by: Yan Zheng<yanzheng@21cn.com> Signed-off-by:
-
Peter Zijlstra authored
All the current page_mkwrite() implementations also set the page dirty. Which results in the set_page_dirty_balance() call to _not_ call balance, because the page is already found dirty. This allows us to dirty a _lot_ of pages without ever hitting balance_dirty_pages(). Not good (tm). Force a balance call if ->page_mkwrite() was successful. Signed-off-by:
Peter Zijlstra <a.p.zijlstra@chello.nl> Signed-off-by:
-
Brian Haley authored
When the ICMPv6 Target address is multicast, Linux processes the redirect instead of dropping it. The problem is in this code in ndisc_redirect_rcv(): if (ipv6_addr_equal(dest, target)) { on_link = 1; } else if (!(ipv6_addr_type(target) & IPV6_ADDR_LINKLOCAL)) { ND_PRINTK2(KERN_WARNING "ICMPv6 Redirect: target address is not link-local.\n"); return; } This second check will succeed if the Target address is, for example, FF02::1 because it has link-local scope. Instead, it should be checking if it's a unicast link-local address, as stated in RFC 2461/4861 Section 8.1: - The ICMP Target Address is either a link-local address (when redirected to a router) or the same as the ICMP Destination Address (when redirected to the on-link destination). I know this doesn't explicitly say unicast link-local address, but it's implied. This bug is preventing Linux kernels from achieving IPv6 Logo Phase II certification because of a recent error that was found in the TAHI test suite - Neighbor Disovery suite test 206 (v6LC.2.3.6_G) had the multicast address in the Destination field instead of Target field, so we were passing the test. This won't be the case anymore. The patch below fixes this problem, and also fixes ndisc_send_redirect() to not send an invalid redirect with a multicast address in the Target field. I re-ran the TAHI Neighbor Discovery section to make sure Linux passes all 245 tests now. Signed-off-by:Brian Haley <brian.haley@hp.com> Acked-by:
David L Stevens <dlstevens@us.ibm.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Stephen Hemminger authored
Signed-off-by:
Stephen Hemminger <shemminger@linux-foundation.org> Signed-off-by:
-
Alexey Dobriyan authored
Commit a3d38402 aka "[AX.25]: Fix unchecked rose_add_loopback_neigh uses" transformed rose_loopback_neigh var into statically allocated one. However, on unload it will be kfree's which can't work. Steps to reproduce: modprobe rose rmmod rose BUG: unable to handle kernel NULL pointer dereference at virtual address 00000008 printing eip: c014c664 *pde = 00000000 Oops: 0000 [#1] PREEMPT DEBUG_PAGEALLOC Modules linked in: rose ax25 fan ufs loop usbhid rtc snd_intel8x0 snd_ac97_codec ehci_hcd ac97_bus uhci_hcd thermal usbcore button processor evdev sr_mod cdrom CPU: 0 EIP: 0060:[<c014c664>] Not tainted VLI EFLAGS: 00210086 (2.6.23-rc9 #3) EIP is at kfree+0x48/0xa1 eax: 00000556 ebx: c1734aa0 ecx: f6a5e000 edx: f7082000 esi: 00000000 edi: f9a55d20 ebp: 00200287 esp: f6a5ef28 ds: 007b es: 007b fs: 0000 gs: 0033 ss: 0068 Process rmmod (pid: 1823, ti=f6a5e000 task=f7082000 task.ti=f6a5e000) Stack: f9a55d20 f9a5200c 00000000 00000000 00000000 f6a5e000 f9a5200c f9a55a00 00000000 bf818cf0 f9a51f3f f9a55a00 00000000 c0132c60 65736f72 00000000 f69f9630 f69f9528 c014244a f6a4e900 00200246 f7082000 c01025e6 00000000 Call Trace: [<f9a5200c>] rose_rt_free+0x1d/0x49 [rose] [<f9a5200c>] rose_rt_free+0x1d/0x49 [rose] [<f9a51f3f>] rose_exit+0x4c/0xd5 [rose] [<c0132c60>] sys_delete_module+0x15e/0x186 [<c014244a>] remove_vma+0x40/0x45 [<c01025e6>] sysenter_past_esp+0x8f/0x99 [<c012bacf>] trace_hardirqs_on+0x118/0x13b [<c01025b6>] sysenter_past_esp+0x5f/0x99 ======================= Code: 05 03 1d 80 db 5b c0 8b 03 25 00 40 02 00 3d 00 40 02 00 75 03 8b 5b 0c 8b 73 10 8b 44 24 18 89 44 24 04 9c 5d fa e8 77 df fd ff <8b> 56 08 89 f8 e8 84 f4 fd ff e8 bd 32 06 00 3b 5c 86 60 75 0f EIP: [<c014c664>] kfree+0x48/0xa1 SS:ESP 0068:f6a5ef28 Signed-off-by:
Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by:
-
Ilpo Järvinen authored
When only GSO skb was partially ACKed, no hints are reset, therefore fastpath_cnt_hint must be tweaked too or else it can corrupt fackets_out. The corruption to occur, one must have non-trivial ACK/SACK sequence, so this bug is not very often that harmful. There's a fackets_out state reset in TCP because fackets_out is known to be inaccurate and that fixes the issue eventually anyway. In case there was also at least one skb that got fully ACKed, the fastpath_skb_hint is set to NULL which causes a recount for fastpath_cnt_hint (the old value won't be accessed anymore), thus it can safely be decremented without additional checking. Reported by Cedric Le Goater <clg@fr.ibm.com> Signed-off-by:
Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by:
-
- 07 Oct, 2007 12 commits
-
-
Dmitry Torokhov authored
We should only reparent to a class former class devices that form the base of class hierarchy. Nested devices should still grow from their real parents. Signed-off-by:
Dmitry Torokhov <dtor@mail.ru> Tested-by:
Andrey Borzenkov <arvidjaar@mail.ru> Tested-by:
Anssi Hannula <anssi.hannula@gmail.com> Signed-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6Linus Torvalds authored
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6: firewire: point to migration document
-
Attila Kinali authored
Add the manufacturer and card id of teltonica pcmcia modems to serial_cs.c Signed-off-by:
Attila Kinali <attila@kinali.ch> Acked-by:
Alan Cox <alan@redhat.com> Signed-off-by:
-
Pavel Machek authored
Document sequence of keypresses that actually works. Yes, this changed year-or-so ago. Signed-off-by:
Pavel Machek <pavel@suse.cz> Signed-off-by:
-
Al Viro authored
Async signals should not be reported as sent by current in audit log. As it is, we call audit_signal_info() too early in check_kill_permission(). Note that check_kill_permission() has that test already - it needs to know if it should apply current-based permission checks. So the solution is to move the call of audit_signal_info() between those. Bogosity in question is easily reproduced - add a rule watching for e.g. kill(2) from specific process (so that audit_signal_info() would not short-circuit to nothing), say load_policy, watch the bogus OBJ_PID entry in audit logs claiming that write(2) on selinuxfs file issued by load_policy(8) had somehow managed to send a signal to syslogd... Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk> Acked-by:
Steve Grubb <sgrubb@redhat.com> Acked-by:
Eric Paris <eparis@redhat.com> Signed-off-by:
-
Alexey Dobriyan authored
Modulat lguest started giving linking errors MODPOST 1 modules ERROR: "kasprintf" [drivers/lguest/lg.ko] undefined! Signed-off-by:
Alexey Dobriyan <adobriyan@sw.ru> Cc: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by:
-
Peter Zijlstra authored
Provide some documentation for CONFIG_LOCK_STAT. Signed-off-by:
Ingo Molnar <mingo@elte.hu> Cc: "Randy.Dunlap" <rdunlap@xenotime.net> Cc: Rob Landley <rob@landley.net> Signed-off-by:
-
Rafal Bilski authored
VIA C3 Ezra-T has RevisionID equal to 1, but it needs RevisionKey to be 0 or CPU will ignore new frequency and will continue to work at old frequency. New "revid_errata" option will force RevisionKey to be set to 0, whatever RevisionID is. Additionaly "Longhaul" will not silently ignore unsuccessful transition. It will try to check if "revid_errata" or "disable_acpi_c3" options need to be enabled for this processor/system. Same for Longhaul ver. 2 support. It will be disabled if none of above options will work. Best case scenario (with patch apllied and v2 enabled): longhaul: VIA C3 'Ezra' [C5C] CPU detected. Longhaul v2 supported. longhaul: Using northbridge support. longhaul: VRM 8.5 longhaul: Max VID=1.350 Min VID=1.050, 13 possible voltage scales longhaul: f: 300000 kHz, index: 0, vid: 1050 mV [...] longhaul: Voltage scaling enabled. Worst case scenario: longhaul: VIA C3 'Ezra-T' [C5M] CPU detected. Powersaver supported. longhaul: Using northbridge support. longhaul: Using ACPI support. longhaul: VRM 8.5 longhaul: Claims to support voltage scaling but min & max are both 1.250. Voltage scaling disabled longhaul: Failed to set requested frequency! longhaul: Enabling "Ignore Revision ID" option. longhaul: Failed to set requested frequency! longhaul: Disabling ACPI C3 support. longhaul: Disabling "Ignore Revision ID" option. longhaul: Failed to set requested frequency! longhaul: Enabling "Ignore Revision ID" option. [akpm@linux-foundation.org: coding-style cleanups] Signed-off-by:
Rafal Bilski <rafalbilski@interia.pl> Signed-off-by:
Dave Jones <davej@redhat.com> Signed-off-by:
-
Anton Blanchard authored
When using /proc/timer_stats on ppc64 I noticed the events/sec field wasnt accurate. Sometimes the integer part was incorrect due to rounding (we werent taking the fractional seconds into consideration). The fraction part is also wrong, we need to pad the printf statement and take the bottom three digits of 1000 times the value. Signed-off-by:
Anton Blanchard <anton@samba.org> Acked-by:
-
Linus Torvalds authored
It turns out that there are a few other five-second timers in the kernel, and if the timers get in sync, the load-average can get artificially inflated by events that just happen to coincide. So just offset the load average calculation it by a timer tick. Noticed by Anders Boström, for whom the coincidence started triggering on one of his machines with the JBD jiffies rounding code (JBD is one of the subsystems that also end up using a 5-second timer by default). Tested-by:
Anders Boström <anders@bostrom.dyndns.org> Cc: Chuck Ebbert <cebbert@redhat.com> Cc: Arjan van de Ven <arjan@linux.intel.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
-
Linus Torvalds authored
We should generally prefer to return ERESTARTNOHAND rather than EINTR, so that processes with unhandled signals that get ignored don't return EINTR. This can help with X startup issues: Fatal server error: xf86OpenConsole: VT_WAITACTIVE failed: Interrupted system call although the real fix is having the X server always retry EINTR regardless (since EINTR does happen for signals that have handlers installed). Keithp has a patch for that. Regardless, ERESTARTNOHAND is the correct thing to use. Signed-off-by: -
Stefan Richter authored
Signed-off-by:Stefan Richter <stefanr@s5r6.in-berlin.de>
-
- 06 Oct, 2007 4 commits
-
-
git://ftp.linux-mips.org/pub/scm/upstream-linusLinus Torvalds authored
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: [MIPS] IP32: Enable PCI bridges
-
Kyle McMartin authored
This reverts commit f443675a, which breaks horribly if you aren't running an unreleased xf86-video-intel driver out of git. Signed-off-by:
Kyle McMartin <kyle@mcmartin.ca> Cc: Dave Airlie <airlied@linux.ie> Cc: Zhenyu Wang <zhenyu.z.wang@intel.com> Acked-by:
Keith Packard <keithp@keithp.com> Signed-off-by:
-
Benjamin Herrenschmidt authored
The PCI device table in the powermac IDE driver isn't properly terminated. Depending on how your kernel is linked and other random factors, you can end up with this driver matched against any other PCI device in your system, possibly crashing at boot. Thanks to Heikki for tracking this down with me, the bug have been there for some time, though it rarely hurts due to luck. In this case, the switch from .22 to .23-rc9 is causing it to show up due to differences in the resulting layout of .data I suppose. Signed-off-by:
Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <pmac@au1.ibm.com> Cc: Bartlomiej Zolnierkiewicz <B.Zolnierkiewicz@elka.pw.edu.pl> Cc: Heikki Lindholm <holindho@cs.helsinki.fi> Signed-off-by:
-
Jeremy Fitzhardinge authored
When pinning and unpinning pagetables, we must protect them against being used by other CPUs, lest they see the pagetable in an intermediate read-only-but-not-pinned state. When using split pte locks, doing this properly would require taking all the pte locks for the pagetable while pinning, but this may overflow the PREEMPT_BITS part of the preempt counter if the process has mapped more than about 512M of memory. However, failing to take the pte locks causes write-protect faults when the pageout code is trying to clear the Access bit on a pte which is part of a freshy created and still being pinned process after fork. This is a short-term fix until the problem is solved properly. Signed-off-by:
Jeremy Fitzhardinge <jeremy@xensource.com> Acked-by:
Rik van Riel <riel@redhat.com> Acked-by:
Hugh Dickins <hugh@veritas.com> Cc: David Rientjes <rientjes@google.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Andi Kleen <ak@suse.de> Cc: Keir Fraser <keir@xensource.com> Cc: Jan Beulich <jbeulich@novell.com> Signed-off-by:
-
