aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2009-01-18devices cgroup: allow mkfifoSerge E. Hallyn
commit 0b82ac37b889ec881b645860da3775118effb3ca upstream. The devcgroup_inode_permission() hook in the devices whitelist cgroup has always bypassed access checks on fifos. But the mknod hook did not. The devices whitelist is only about block and char devices, and fifos can't even be added to the whitelist, so fifos can't be created at all except by tasks which have 'a' in their whitelist (meaning they have access to all devices). Fix the behavior by bypassing access checks to mkfifo. Signed-off-by: Serge E. Hallyn <serue@us.ibm.com> Cc: Li Zefan <lizf@cn.fujitsu.com> Cc: Pavel Emelyanov <xemul@openvz.org> Cc: Paul Menage <menage@google.com> Cc: Lai Jiangshan <laijs@cn.fujitsu.com> Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Cc: James Morris <jmorris@namei.org> Reported-by: Daniel Lezcano <dlezcano@fr.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18sched_clock: prevent scd->clock from moving backwards, take #2Thomas Gleixner
commit 1c5745aa380efb6417b5681104b007c8612fb496 upstream. Redo: 5b7dba4: sched_clock: prevent scd->clock from moving backwards which had to be reverted due to s2ram hangs: ca7e716: Revert "sched_clock: prevent scd->clock from moving backwards" ... this time with resume restoring GTOD later in the sequence taken into account as well. The "timekeeping_suspended" flag is not very nice but we cannot call into GTOD before it has been properly resumed and the scheduler will run very early in the resume sequence. Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18md: fix bitmap-on-external-file bug.NeilBrown
commit 538452700d95480c16e7aa6b10ff77cd937d33f4 upstream. commit a2ed9615e3222645007fc19991aedf30eed3ecfd fixed a bug with 'internal' bitmaps, but in the process broke 'in a file' bitmaps. So they are broken in 2.6.28 This fixes it, and needs to go in 2.6.28-stable. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18minix: fix add link's wrong position calculationEvgeniy Dushistov
commit d6b54841f4ddd836c886d1e6ac381cf309ee98a3 upstream. Fix the add link method. The oosition in the directory was calculated in wrong way - it had the incorrect shift direction. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Evgeniy Dushistov <dushistov@mail.ru> Cc: Nick Piggin <nickpiggin@yahoo.com.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18dm log: fix dm_io_client leak on error pathsTakahiro Yasui
commit c7a2bd19b7c1e0bd2c7604c53d2583e91e536948 upstream. In create_log_context function, dm_io_client_destroy function needs to be called, when memory allocation of disk_header, sync_bits and recovering_bits failed, but dm_io_client_destroy is not called. Signed-off-by: Takahiro Yasui <tyasui@redhat.com> Acked-by: Jonathan Brassow <jbrassow@redhat.com> Signed-off-by: Alasdair G Kergon <agk@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18dm raid1: fix error countJonathan Brassow
commit d460c65a6a9ec9e0d284864ec3a9a2d1b73f0e43 upstream. Always increase the error count when I/O on a leg of a mirror fails. The error count is used to decide whether to select an alternative mirror leg. If the target doesn't use the "handle_errors" feature, the error count is not updated and the bio can get requeued forever by the read callback. Fix it by increasing error_count before the handle_errors feature checking. Signed-off-by: Milan Broz <mbroz@redhat.com> Signed-off-by: Jonathan Brassow <jbrassow@redhat.com> Signed-off-by: Alasdair G Kergon <agk@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18cgroups: fix a race between cgroup_clone and umountLi Zefan
commit 7b574b7b0124ed344911f5d581e9bc2d83bbeb19 upstream. The race is calling cgroup_clone() while umounting the ns cgroup subsys, and thus cgroup_clone() might access invalid cgroup_fs, or kill_sb() is called after cgroup_clone() created a new dir in it. The BUG I triggered is BUG_ON(root->number_of_cgroups != 1); ------------[ cut here ]------------ kernel BUG at kernel/cgroup.c:1093! invalid opcode: 0000 [#1] SMP ... Process umount (pid: 5177, ti=e411e000 task=e40c4670 task.ti=e411e000) ... Call Trace: [<c0493df7>] ? deactivate_super+0x3f/0x51 [<c04a3600>] ? mntput_no_expire+0xb3/0xdd [<c04a3ab2>] ? sys_umount+0x265/0x2ac [<c04a3b06>] ? sys_oldumount+0xd/0xf [<c0403911>] ? sysenter_do_call+0x12/0x31 ... EIP: [<c0456e76>] cgroup_kill_sb+0x23/0xe0 SS:ESP 0068:e411ef2c ---[ end trace c766c1be3bf944ac ]--- Cc: Serge E. Hallyn <serue@us.ibm.com> Signed-off-by: Li Zefan <lizf@cn.fujitsu.com> Cc: Paul Menage <menage@google.com> Cc: "Serge E. Hallyn" <serue@us.ibm.com> Cc: Balbir Singh <balbir@in.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18fs: symlink write_begin allocation context fixNick Piggin
commit 54566b2c1594c2326a645a3551f9d989f7ba3c5e upstream. With the write_begin/write_end aops, page_symlink was broken because it could no longer pass a GFP_NOFS type mask into the point where the allocations happened. They are done in write_begin, which would always assume that the filesystem can be entered from reclaim. This bug could cause filesystem deadlocks. The funny thing with having a gfp_t mask there is that it doesn't really allow the caller to arbitrarily tinker with the context in which it can be called. It couldn't ever be GFP_ATOMIC, for example, because it needs to take the page lock. The only thing any callers care about is __GFP_FS anyway, so turn that into a single flag. Add a new flag for write_begin, AOP_FLAG_NOFS. Filesystems can now act on this flag in their write_begin function. Change __grab_cache_page to accept a nofs argument as well, to honour that flag (while we're there, change the name to grab_cache_page_write_begin which is more instructive and does away with random leading underscores). This is really a more flexible way to go in the end anyway -- if a filesystem happens to want any extra allocations aside from the pagecache ones in ints write_begin function, it may now use GFP_KERNEL (rather than GFP_NOFS) for common case allocations (eg. ocfs2_alloc_write_ctxt, for a random example). [kosaki.motohiro@jp.fujitsu.com: fix ubifs] [kosaki.motohiro@jp.fujitsu.com: fix fuse] Signed-off-by: Nick Piggin <npiggin@suse.de> Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> [ Cleaned up the calling convention: just pass in the AOP flags untouched to the grab_cache_page_write_begin() function. That just simplifies everybody, and may even allow future expansion of the logic. - Linus ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18vmalloc.c: fix flushing in vmap_page_range()Adam Lackorzynski
commit 2e4e27c7d082b2198b63041310609d7191185a9d upstream. The flush_cache_vmap in vmap_page_range() is called with the end of the range twice. The following patch fixes this for me. Signed-off-by: Adam Lackorzynski <adam@os.inf.tu-dresden.de> Cc: Nick Piggin <nickpiggin@yahoo.com.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18x86: fix incorrect __read_mostly on _boot_cpu_pdaRavikiran G Thirumalai
commit 26799a63110dcbe81291ea53178f6b4810d07424 upstream. The pda rework (commit 3461b0af025251bbc6b3d56c821c6ac2de6f7209) to remove static boot cpu pdas introduced a performance bug. _boot_cpu_pda is the actual pda used by the boot cpu and is definitely not "__read_mostly" and ended up polluting the read mostly section with writes. This bug caused regression of about 8-10% on certain syscall intensive workloads. Signed-off-by: Ravikiran Thirumalai <kiran@scalex86.org> Acked-by: Mike Travis <travis@sgi.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18x86, UV: remove erroneous BAU initializationCliff Wickman
commit 46814dded1b972a07b1609d81632eef3009fbb10 upstream. Impact: fix crash on x86/UV UV is the SGI "UltraViolet" machine, which is x86_64 based. BAU is the "Broadcast Assist Unit", used for TLB shootdown in UV. This patch removes the allocation and initialization of an unused table. This table is left over from a development test mode. It is unused in the present code. And it was incorrectly initialized: 8 entries allocated but 17 initialized, causing slab corruption. This patch should go into 2.6.27 and 2.6.28 as well as the current tree. Diffed against 2.6.28 (linux-next, 12/30/08) Signed-off-by: Cliff Wickman <cpw@sgi.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18USB: emi26: fix oops on loadMarcin Slusarz
commit 327d74f6b65ddc8a042c43c11fdd4be0bb354668 upstream. Fix oops introduced by commit ae93a55bf948753de0bb8e43fa9c027f786abb05 (emi26: use request_firmware()): usb 1-1: new full speed USB device using uhci_hcd and address 2 usb 1-1: configuration #1 chosen from 1 choice emi26 - firmware loader 1-1:1.0: emi26_probe start usb 1-1: firmware: requesting emi26/loader.fw usb 1-1: firmware: requesting emi26/bitstream.fw usb 1-1: firmware: requesting emi26/firmware.fw usb 1-1: emi26_set_reset - 1 usb 1-1: emi26_set_reset - 0 BUG: unable to handle kernel NULL pointer dereference at 00000000 IP: [<f80dc487>] emi26_probe+0x2f7/0x620 [emi26] *pde = 00000000 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/pci0000:00/0000:00:1d.0/usb1/1-1/firmware/1-1/loading Modules linked in: emi26(+) ipv6 cpufreq_ondemand coretemp arc4 ecb iwl3945 irtty_sir sir_dev nsc_ircc ehci_hcd uhci_hcd mac80211 irda usbcore snd_hda_intel thinkpad_acpi rfkill hwmon led_class e1000e snd_pcm cfg80211 snd_timer crc_ccitt snd snd_page_alloc aes_generic Pid: 5082, comm: modprobe Not tainted (2.6.28 #2) 17023QG EIP: 0060:[<f80dc487>] EFLAGS: 00010206 CPU: 0 EIP is at emi26_probe+0x2f7/0x620 [emi26] EAX: 0000015c EBX: 00000000 ECX: c1ffd9c0 EDX: 00000000 ESI: 0000015c EDI: f6bb215c EBP: f6bb0400 ESP: f00ebcfc DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Process modprobe (pid: 5082, ti=f00ea000 task=f5c7c700 task.ti=f00ea000) Stack: 0000015c 000000a5 f6a67cb8 f80dc7e0 c01c6262 fbef2986 f6bb2000 00008fe0 0000015c f715f748 f715f740 f715f738 f715f748 f6a67c00 f80dd040 f80dcfc0 f6bb0400 fbacb290 f6a67c94 fbae0160 c01c70bf 00000000 f6a67c1c 00000000 Call Trace: [<c01c6262>] sysfs_add_one+0x12/0x50 [<fbacb290>] usb_probe_interface+0xa0/0x140 [usbcore] [<c01c70bf>] sysfs_create_link+0xf/0x20 [<c02dead2>] driver_probe_device+0x82/0x180 [<fbac9eeb>] usb_match_id+0x3b/0x50 [usbcore] [<c02dec4e>] __driver_attach+0x7e/0x80 [<c02de27a>] bus_for_each_dev+0x3a/0x60 [<c02de956>] driver_attach+0x16/0x20 [<c02debd0>] __driver_attach+0x0/0x80 [<c02de7b1>] bus_add_driver+0x1a1/0x220 [<c02dee4d>] driver_register+0x4d/0x120 [<c024e622>] idr_get_empty_slot+0xf2/0x290 [<fbacab71>] usb_register_driver+0x81/0x100 [usbcore] [<f806c000>] emi26_init+0x0/0x14 [emi26] [<c0101126>] do_one_initcall+0x36/0x1b0 [<c01c5e70>] sysfs_ilookup_test+0x0/0x10 [<c0197a61>] ifind+0x31/0x90 [<c01c6229>] __sysfs_add_one+0x59/0x80 [<c01c64e4>] sysfs_addrm_finish+0x14/0x1c0 [<c0175ca3>] __vunmap+0xa3/0xd0 [<c014b854>] load_module+0x1544/0x1640 [<c014b9d7>] sys_init_module+0x87/0x1b0 [<c0187f41>] sys_read+0x41/0x70 [<c01032a5>] sysenter_do_call+0x12/0x21 [<c03d0000>] wait_for_common+0x40/0x110 Code: 66 c1 e8 08 66 09 d0 75 a5 31 d2 89 e8 e8 72 fc ff ff 85 c0 0f 88 9a 02 00 00 b8 fa 00 00 00 e8 30 46 05 c8 8b 74 24 28 8b 5e 04 <8b> 03 89 44 24 1c 0f c8 89 44 24 1c 0f b7 4b 04 c7 44 24 20 00 EIP: [<f80dc487>] emi26_probe+0x2f7/0x620 [emi26] SS:ESP 0068:f00ebcfc ---[ end trace 2eefa13825431230 ]--- After the last "package" of firmware data is sent to the device, we dereference NULL pointer (on access to rec->addr). Fix it. Reported--by: David Flatz <david@upcs.at> Tested-by: David Flatz <david@upcs.at> Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18SCSI: eata: fix the data buffer accessors conversion regressionFUJITA Tomonori
commit 20c09df7eb9c92a40e0ecf654b6e8f14c8583b9e upstream. This fixes the regression introduced by the commit 58e2a02eb18393e76a469580fedf7caec190eb5e (eata: convert to use the data buffer accessors), reported: http://marc.info/?t=122987621300006&r=1&w=2 - fix DMA_NONE handling in map_dma() - this driver can't use scsi_dma_map since host->shost_gendev.parent is not set properly (it uses scsi_register). Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Reported-by: Arthur Marsh <arthur.marsh@internode.on.net> Tested-by: Arthur Marsh <arthur.marsh@internode.on.net> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18tx4939ide: Do not use zero count PRD entryAtsushi Nemoto
commit a0fce792b55b260589c3d77293a224e84395ec07 upstream. This fixes data corruption on some heavy load. Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Cc: sshtylyov@ru.mvista.com Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18tx493[89]ide: Fix length for __ide_flush_dcache_rangeAtsushi Nemoto
commit f26f6ceacaaf017a677138cbca7ab076b565ca87 upstream. This fixes data corruption on PIO mode. Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Cc: sshtylyov@ru.mvista.com Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18iwlwifi: use GFP_KERNEL to allocate Rx SKB memoryZhu Yi
commit f1bc4ac61f2c08515afd80c6dc3962aa6d0b138b upstream. Previously we allocate Rx SKB with GFP_ATOMIC flag. This is because we need to hold a spinlock to protect the two rx_used and rx_free lists operation in the rxq. spin_lock(); ... element = rxq->rx_used.next; element->skb = alloc_skb(..., GFP_ATOMIC); list_del(element); list_add_tail(&element->list, &rxq->rx_free); ... spin_unlock(); After spliting the rx_used delete and rx_free insert into two operations, we don't require the skb allocation in an atomic context any more (the function itself is scheduled in a workqueue). spin_lock(); ... element = rxq->rx_used.next; list_del(element); ... spin_unlock(); ... element->skb = alloc_skb(..., GFP_KERNEL); ... spin_lock() ... list_add_tail(&element->list, &rxq->rx_free); ... spin_unlock(); This patch should fix the "iwlagn: Can not allocate SKB buffers" warning we see recently. Signed-off-by: Zhu Yi <yi.zhu@intel.com> Acked-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18ring-buffer: fix dangling commit raceSteven Rostedt
commit a8ccf1d6f60e3e6ae63122e02378cd4d40dd4aac upstream. Impact: fix stuck trace-buffers If an interrupt comes in during the rb_set_commit_to_write and pushes the tail page forward just at the right time, the commit updates will miss the adding of the interrupt data. This will cause the commit pointer to cease from moving forward. Thanks to Jiaying Zhang for finding this race. Reported-by: Jiaying Zhang <jiayingz@google.com> Signed-off-by: Steven Rostedt <srostedt@redhat.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18ring-buffer: prevent false positive warningSteven Rostedt
commit 98db8df777438e16ad0f44a0fba05ebbdb73db8d upstream. Impact: eliminate false WARN_ON message If an interrupt goes off after the setting of the local variable tail_page and before incrementing the write index of that page, the interrupt could push the commit forward to the next page. Later a check is made to see if interrupts pushed the buffer around the entire ring buffer by comparing the next page to the last commited page. This can produce a false positive if the interrupt had pushed the commit page forward as stated above. Thanks to Jiaying Zhang for finding this race. Reported-by: Jiaying Zhang <jiayingz@google.com> Signed-off-by: Steven Rostedt <srostedt@redhat.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18CIFS: make sure that DFS pathnames are properly formedSteve French
commit c6fbba0546d3ead18d4a623e76e28bcbaa66a325 upstream. The paths in a DFS request are supposed to only have a single preceding backslash, but we are sending them with a double backslash. This is exposing a bug in Windows where it also sends a path in the response that has a double backslash. The existing code that builds the mount option string however expects a double backslash prefix in a couple of places when it tries to use the path returned by build_path_from_dentry. Fix compose_mount_options to expect properly formed DFS paths (single backslash at front). Also clean up error handling in that function. There was a possible NULL pointer dereference and situations where a partially built option string would be returned. Tested against Samba 3.0.28-ish server and Samba 3.3 and Win2k8. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve French <sfrench@us.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18x86: default to SWIOTLB=y on x86_64Joerg Roedel
commit a1afd01c175324656d0e8f1c82ea94b474953c04 upstream. Impact: fixes korg bugzilla 11980 A kernel for a 64bit x86 system should always contain the swiotlb code in case it is booted on a machine without any hardware IOMMU supported by the kernel and more than 4GB of RAM. This patch changes Kconfig to always compile swiotlb into the kernel for x86_64. Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18x86: fix intel x86_64 llc_shared_map/cpu_llc_id anomoliesSuresh Siddha
commit 345077cd98ff5532b2d1158013c3fec7b1ae85ec upstream. Impact: fix wrong cache sharing detection on platforms supporting > 8 bit apicid's In the presence of extended topology eumeration leaf 0xb provided by cpuid, 32bit extended initial_apicid in cpuinfo_x86 struct will be updated by detect_extended_topology(). At this instance, we should also reinit the apicid (which could also potentially be extended to 32bit). With out this there will potentially be duplicate apicid's populated in the per cpu's cpuinfo_x86 struct, resulting in wrong cache sharing topology etc detected by init_intel_cacheinfo(). Reported-by: Dimitri Sivanich <sivanich@sgi.com> Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com> Acked-by: Dimitri Sivanich <sivanich@sgi.com> Signed-off-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18ALSA: hda - Fix typos for AD1882 codecsClemens Fruhwirth
commit c247ed6f5205f9feebd276c4cbe45018b10f19fa upstream. Fixed typos of codec-id checks for AD1882/AD1882A. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18ALSA: caiaq - Fix Oops with MIDITakashi Iwai
commit f3f80a9205da74fa56d613f4c14b88b6e4e6caa8 upstream. The snd-usb-caiaq driver causes Oops occasionally when accessing MIDI devices. This patch fixes the Oops and invalid URB submission errors as well. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18ALSA: hda - Add quirk for HP6730B laptopTakashi Iwai
commit 11d518e07d700eeb5bcec36bfd5f501e405230dd upstream. Added model=laptop for HP 6730B laptop with AD1984A codec. Reference: Novell bnc#457909 https://bugzilla.novell.com/show_bug.cgi?id=457909 Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-18ALSA: hda - Add quirk for another HP dv7Takashi Iwai
commit 69dfaefee4a2dfdfee3488a306403fe1e51f0be5 upstream. Added the model=hp-m4 quirk for another HP dv7 (103c:30fc) with IDT 92HD71b* codec. Reference: Novell bnc#461108 https://bugzilla.novell.com/show_bug.cgi?id=461108 Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2008-12-24Linux 2.6.28v2.6.28Linus Torvalds
Happy holidays..
2008-12-24Merge branch 'for_linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: V4L/DVB (9920): em28xx: fix NULL pointer dereference in call to VIDIOC_INT_RESET command V4L/DVB (9908a): MAINTAINERS: mark linux-uvc-devel as subscribers only V4L/DVB (9906): v4l2-compat: test for unlocked_ioctl as well. V4L/DVB (9885): drivers/media Kconfig's: fix bugzilla #12204 V4L/DVB (9875): gspca - main: Fix vidioc_s_jpegcomp locking. V4L/DVB (9781): [PATCH] Cablestar 2 I2C retries (fix CableStar2 support) V4L/DVB (9780): dib0700: Stop repeating after user stops pushing button
2008-12-24Merge branch 'x86-fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: disable X86_PTRACE_BTS
2008-12-24Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - Add missing terminators in patch_sigmatel.c
2008-12-24ALSA: hda - Add missing terminators in patch_sigmatel.cHerton Ronaldo Krzesinski
Signed-off-by: Herton Ronaldo Krzesinski <herton@mandriva.com.br> Cc: stable@kernel.org Signed-off-by: Takashi Iwai <tiwai@suse.de>
2008-12-24x86: disable X86_PTRACE_BTSIngo Molnar
there's a new ptrace arch level feature in .28: config X86_PTRACE_BTS bool "Branch Trace Store" it has broken fork() handling: the old DS area gets copied over into a new task without clearing it. Fixes exist but they came too late: c5dee61: x86, bts: memory accounting bf53de9: x86, bts: add fork and exit handling and are queued up for v2.6.29. This shows that the facility is still not tested well enough to release into a stable kernel - disable it for now and reactivate in .29. In .29 the hardware-branch-tracer will use the DS/BTS facilities too - hopefully resulting in better code. Signed-off-by: Ingo Molnar <mingo@elte.hu>
2008-12-23parisc: disable UP-optimized flush_tlb_mmKyle McMartin
flush_tlb_mm's "optimized" uniprocessor case of allocating a new context for userspace is exposing a race where we can suddely return to a syscall with the protection id and space id out of sync, trapping on the next userspace access. Debugged-by: James Bottomley <James.Bottomley@HansenPartnership.com> Tested-by: Helge Deller <deller@gmx.de> Signed-off-by: Kyle McMartin <kyle@mcmartin.ca> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-23Merge branch 'drm-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon: fix correctness of irq_enabled check for radeon.
2008-12-23edac: fix edac core deadlock when removing a deviceHarry Ciao
When deleting an edac device, we have to wait for its edac_dev.work to be completed before deleting the whole edac_dev structure. Since we have no idea which work in current edac_poller's workqueue is the work we are conerned about, we wait for all work in the edac_poller's workqueue to be proceseed. This is done via flush_cpu_workqueue() which inserts a wq_barrier into the tail of the workqueue and then sleeping on the completion of this wq_barrier. The edac_poller will wake up sleepers when it is found. EDAC core creates only one kernel worker thread, edac_poller, to run the works of all current edac devices. They share the same callback function of edac_device_workq_function(), which would grab the mutex of device_ctls_mutex first before it checks the device. This is exactly where edac_poller and rmmod would have a great chance to deadlock. In below call trace of rmmod > ... > edac_device_del_device > edac_device_workq_teardown > flush_workqueue > flush_cpu_workqueue, device_ctls_mutex would have already been grabbed by edac_device_del_device(). So, on one hand rmmod would sleep on the completion of a wq_barrier, holding device_ctls_mutex; on the other hand edac_poller would be blocked on the same mutex when it's running any one of works of existing edac evices(Note, this edac_dev.work is likely to be totally irrelevant to the one that is being removed right now)and never would have a chance to run the work of above wq_barrier to wake rmmod up. edac_device_workq_teardown() should not be called within the critical region of device_ctls_mutex. Just like is done in edac_pci_del_device() and edac_mc_del_mc(), where edac_pci_workq_teardown() and edac_mc_workq_teardown() are called after related mutex are released. Moreover, an edac_dev.work should check first if it is being removed. If this is the case, then it should bail out immediately. Since not all of existing edac devices are to be removed, this "shutting flag" should be contained to edac device being removed. The current edac_dev.op_state can be used to serve this purpose. The original deadlock problem and the solution have been witnessed and tested on actual hardware. Without the solution, rmmod an edac driver would result in below deadlock: root@localhost:/root> rmmod mv64x60_edac EDAC DEBUG: mv64x60_dma_err_remove() EDAC DEBUG: edac_device_del_device() EDAC DEBUG: find_edac_device_by_dev() (hang for a moment) INFO: task edac-poller:2030 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. edac-poller D 00000000 0 2030 2 Call Trace: [df159dc0] [c0071e3c] free_hot_cold_page+0x17c/0x304 (unreliable) [df159e80] [c000a024] __switch_to+0x6c/0xa0 [df159ea0] [c03587d8] schedule+0x2f4/0x4d8 [df159f00] [c03598a8] __mutex_lock_slowpath+0xa0/0x174 [df159f40] [e1030434] edac_device_workq_function+0x28/0xd8 [edac_core] [df159f60] [c003beb4] run_workqueue+0x114/0x218 [df159f90] [c003c674] worker_thread+0x5c/0xc8 [df159fd0] [c004106c] kthread+0x5c/0xa0 [df159ff0] [c0013538] original_kernel_thread+0x44/0x60 INFO: task rmmod:2062 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. rmmod D 0ff2c9fc 0 2062 1839 Call Trace: [df119c00] [c0437a74] 0xc0437a74 (unreliable) [df119cc0] [c000a024] __switch_to+0x6c/0xa0 [df119ce0] [c03587d8] schedule+0x2f4/0x4d8 [df119d40] [c03591dc] schedule_timeout+0xb0/0xf4 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-23cgroups: avoid accessing uninitialized data in failure pathLi Zefan
If cgroup_get_rootdir() failed, free_cg_links() will be called in the failure path, but tmp_cg_links hasn't been initialized at that time. I introduced this bug in the 2.6.27 merge window. Signed-off-by: Li Zefan <lizf@cn.fujitsu.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Cc: Paul Menage <menage@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-23cgroups: suppress bogus warning messagesSharyathi Nagesh
Remove spurious warning messages that are thrown onto the console during cgroup operations. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Sharyathi Nagesh <sharyathi@in.ibm.com> Acked-by: Serge E. Hallyn <serge@hallyn.com> Cc: Paul Menage <menage@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-23w1: fix slave selection on big-endian systemsEvgeniy Polyakov
During test of the w1-gpio driver i found that in "w1.c:679 w1_slave_found()" the device id is converted to little-endian with "cpu_to_le64()", but its not converted back to cpu format in "w1_io.c:293 w1_reset_select_slave()". Based on a patch created by Andreas Hummel. [akpm@linux-foundation.org: remove unneeded cast] Reported-by: Andreas Hummel <andi_hummel@gmx.de> Signed-off-by: Evgeniy Polyakov <zbr@ioremap.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-23rtc: rtc-isl1208: reject invalid datesChris Elston
This patch for the rtc-isl1208 driver makes it reject invalid dates. Signed-off-by: Chris Elston <celston@katalix.com> [a.zummo@towertech.it: added comment explaining the check] Signed-off-by: Alessandro Zummo <a.zummo@towertech.it> Cc: Hebert Valerio Riedel <hvr@gnu.org> Cc: David Brownell <david-b@pacbell.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-23V4L/DVB (9920): em28xx: fix NULL pointer dereference in call to ↵Devin Heitmueller
VIDIOC_INT_RESET command Fix a NULL pointer dereference that would occur if the video decoder tied to the em28xx supports the VIDIOC_INT_RESET call (for example: the cx25840 driver) Signed-off-by: Devin Heitmueller <dheitmueller@linuxtv.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2008-12-23drm/radeon: fix correctness of irq_enabled check for radeon.Dave Airlie
This check was introduced with the logic the wrong way around. Fixes regression: http://bugzilla.kernel.org/show_bug.cgi?id=12216 Tested-by: François Valenduc <francois.valenduc@tvcablenet.be> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-22Merge branch 'release' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: ACPI: don't cond_resched() when irqs_disabled() ACPI: fix 2.6.28 acpi.debug_level regression
2008-12-22Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6: drivers/ide/{cs5530.c,sc1200.c}: Move a dereference below a NULL test
2008-12-22drivers/ide/{cs5530.c,sc1200.c}: Move a dereference below a NULL testJulia Lawall
In each case, if the NULL test is necessary, then the dereference should be moved below the NULL test. The semantic patch that makes this change is as follows: (http://www.emn.fr/x-info/coccinelle/) // <smpl> @@ type T; expression E; identifier i,fld; statement S; @@ - T i = E->fld; + T i; ... when != E when != i if (E == NULL) S + i = E->fld; // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2008-12-22Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linusLinus Torvalds
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: MIPS: MIPS64R2: Fix buggy __arch_swab64 MIPS: Fix preprocessor warnings flaged by GCC 4.4
2008-12-22Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: ppp: fix segfaults introduced by netdev_priv changes net: Fix module refcount leak in kernel_accept()
2008-12-22MIPS: MIPS64R2: Fix buggy __arch_swab64David Daney
The way the code is written it was assuming dshd has the function of a hypothetical dshw instruction ... Signed-off-by: David Daney <ddaney@caviumnetworks.com> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2008-12-22MIPS: Fix preprocessor warnings flaged by GCC 4.4David Daney
Signed-off-by: David Daney <ddaney@caviumnetworks.com> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2008-12-20Null pointer deref with hrtimer_try_to_cancel()Thomas Gleixner
Impact: Prevent kernel crash with posix timer clockid CLOCK_MONOTONIC_RAW commit 2d42244ae71d6c7b0884b5664cf2eda30fb2ae68 (clocksource: introduce CLOCK_MONOTONIC_RAW) introduced a new clockid, which is only available to read out the raw not NTP adjusted system time. The above commit did not prevent that a posix timer can be created with that clockid. The timer_create() syscall succeeds and initializes the timer to a non existing hrtimer base. When the timer is deleted either by timer_delete() or by the exit() cleanup the kernel crashes. Prevent the creation of timers for CLOCK_MONOTONIC_RAW by setting the posix clock function to no_timer_create which returns an error code. Reported-and-tested-by: Eric Sesterhenn <snakebyte@gmx.de> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-20Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: fs/9p: change simple_strtol to simple_strtoul 9p: convert d_iname references to d_name.name 9p: Remove potentially bad parameter from function entry debug print.
2008-12-20Merge branch 'x86-fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: fix resume (S2R) broken by Intel microcode module, on A110L x86 gart: don't complain if no AMD GART found AMD IOMMU: panic if completion wait loop fails AMD IOMMU: set cmd buffer pointers to zero manually x86: re-enable MCE on secondary CPUS after suspend/resume AMD IOMMU: allocate rlookup_table with __GFP_ZERO
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-04-24 18:42:17 +0000