linux, branch v2.6.34-rc4

Linux 2.6.34-rc4

2010-04-13T01:41:35Z

Merge branch 'anonvma'

2010-04-13T01:39:58Z

* anonvma: anonvma: when setting up page->mapping, we need to pick the _oldest_ anonvma anon_vma: clone the anon_vma chain in the right order vma_adjust: fix the copying of anon_vma chains Simplify and comment on anon_vma re-use for anon_vma_prepare()

Merge master.kernel.org:/home/rmk/linux-2.6-arm

2010-04-13T01:37:34Z

* master.kernel.org:/home/rmk/linux-2.6-arm: (21 commits) ARM: Fix ioremap_cached()/ioremap_wc() for SMP platforms ARM: 6043/1: AT91 slow-clock resume: Don't wait for a disabled PLL to lock ARM: 6031/1: fix Thumb-2 decompressor ARM: 6029/1: ep93xx: gpio.c: local functions should be static ARM: 6028/1: ARM: add MAINTAINERS for U300 ARM: 6024/1: bcmring: fix missing down on semaphore in dma.c MXC: mach_armadillo5x0: Add USB Host support. ARM mach-mx3: duplicated include ARM mach-mx3: duplicated include imx31: add watchdog device on litekit board. imx3: Add watchdog platform device support MXC: mach-mx31_3ds: add support for freescale mc13783 power management device. MXC: mach-mx31_3ds: Add SPI1 device support. MXC: mach-mx31_3ds: Add support for on board NAND Flash. MXC: mach-mx31_3ds: Update variable names over recent mach name modification. imx31: fix parent clock for rtc i.MX51: remove NFC AXI static mapping i.MX51: determine silicon revision dynamically i.MX51: map TZIC dynamically i.MX51: Use correct clock for gpt ...

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable

2010-04-13T01:37:04Z

* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable: Btrfs: make sure the chunk allocator doesn't create zero length chunks Btrfs: fix data enospc check overflow

Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6

2010-04-13T01:36:49Z

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6: quota: Fix possible dq_flags corruption quota: Hide warnings about writes to the filesystem before quota was turned on ext3: symlink must be handled via filesystem specific operation ext2: symlink must be handled via filesystem specific operation

Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-udf-2.6

2010-04-13T01:36:34Z

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-udf-2.6: udf: add speciffic ->setattr callback udf: potential integer overflow

Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus

2010-04-13T01:36:11Z

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: (36 commits) MIPS: Calculate proper ebase value for 64-bit kernels MIPS: Alchemy: DB1200: Remove custom wait implementation MIPS: Big Sur: Make defconfig more useful. MIPS: Fix __vmalloc() etc. on MIPS for non-GPL modules MIPS: Sibyte: Fix M3 TLB exception handler workaround. MIPS: BCM63xx: Fix build failure in board_bcm963xx.c MIPS: uasm: Add OR instruction. MIPS: Sibyte: Apply M3 workaround only on affected chip types and versions. MIPS: BCM63xx: Initialize gpio_out_low & out_high to current value at boot. MIPS: BCM63xx: Register SSB SPROM fallback in board's first stage callback MIPS: BCM63xx: Fix typo in cpu-feature-overrides file. MIPS: BCM63xx: Add support for second uart. MIPS: BCM63xx: Fix double gpio registration. MIPS: BCM63xx: Add DWVS0 board MIPS: BCM63xx: Add the RTA1025W-16 BCM6348-based board to suppported boards. MIPS: BCM63xx: Fix BCM6338 and BCM6345 gpio count MIPS: libgcc.h: Checkpatch cleanup MIPS: Loongson-2F: Flush the branch target history in BTB and RAS MIPS: Move signal trampolines off of the stack. MIPS: Preliminary VDSO ...

Merge branch 'for-2.6.34' of git://linux-nfs.org/~bfields/linux

2010-04-13T01:34:56Z

* 'for-2.6.34' of git://linux-nfs.org/~bfields/linux: svcrdma: RDMA support not yet compatible with RPC6

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2

2010-04-13T01:34:25Z

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2: nilfs2: fix typo "numer" -> "number" in alloc.c nilfs2: Remove an uninitialization warning in nilfs_btree_propagate_v() nilfs2: fix a wrong type conversion in nilfs_ioctl()

anonvma: when setting up page->mapping, we need to pick the _oldest_ anonvma

2010-04-13T00:54:13Z

Otherwise we might be mapping in a page in a new mapping, but that page (through the swapcache) would later be mapped into an old mapping too. The page->mapping must be the case that works for everybody, not just the mapping that happened to page it in first. Here's the scenario: - page gets allocated/mapped by process A. Let's call the anon_vma we associate the page with 'A' to keep it easy to track. - Process A forks, creating process B. The anon_vma in B is 'B', and has a chain that looks like 'B' -> 'A'. Everything is fine. - Swapping happens. The page (with mapping pointing to 'A') gets swapped out (perhaps not to disk - it's enough to assume that it's just not mapped any more, and lives entirely in the swap-cache) - Process B pages it in, which goes like this: do_swap_page -> page = lookup_swap_cache(entry); ... set_pte_at(mm, address, page_table, pte); page_add_anon_rmap(page, vma, address); And think about what happens here! In particular, what happens is that this will now be the "first" mapping of that page, so page_add_anon_rmap() used to do if (first) __page_set_anon_rmap(page, vma, address); and notice what anon_vma it will use? It will use the anon_vma for process B! What happens then? Trivial: process 'A' also pages it in (nothing happens, it's not the first mapping), and then process 'B' execve's or exits or unmaps, making anon_vma B go away. End result: process A has a page that points to anon_vma B, but anon_vma B does not exist any more. This can go on forever. Forget about RCU grace periods, forget about locking, forget anything like that. The bug is simply that page->mapping points to an anon_vma that was correct at one point, but was _not_ the one that was shared by all users of that possible mapping. Changing it to always use the deepest anon_vma in the anonvma chain gets us to the safest model. This can be improved in certain cases: if we know the page is private to just this particular mapping (for example, it's a new page, or it is the only swapcache entry), we could pick the top (most specific) anon_vma. But that's a future optimization. Make it _work_ reliably first. Reviewed-by: Rik van Riel Acked-by: Johannes Weiner Tested-by: Borislav Petkov [ "What do you know, I think you fixed it!" ] Signed-off-by: Linus Torvalds