aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2009-03-01r8169: read MAC address from EEPROM on init (2nd attempt)Ivan Vecera
This is 2nd attempt to implement the initialization/reading of MAC address from EEPROM. The first used PCI's VPD and there were some problems, some devices are not able to read EEPROM content by VPD. The 2nd one uses direct access to EEPROM through bit-banging interface and my testing results seem to be much better. I tested 5 systems each with different Realtek NICs and I didn't find any problem. AFAIK Francois's NICs also works fine. Original description: This fixes the problem when MAC address is set by ifconfig or by ip link commands and this address is stored in the device after reboot. The power-off is needed to get right MAC address. This is problem when Xen daemon is running because it renames the device name from ethX to pethX and sets its MAC address to FE:FF:FF:FF:FF:FF. After reboot the device is still using FE:FF:FF:FF:FF:FF. Signed-off-by: Ivan Vecera <ivecera@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-03-02selinux: Fix a panic in selinux_netlbl_inode_permission()Paul Moore
Rick McNeal from LSI identified a panic in selinux_netlbl_inode_permission() caused by a certain sequence of SUNRPC operations. The problem appears to be due to the lack of NULL pointer checking in the function; this patch adds the pointer checks so the function will exit safely in the cases where the socket is not completely initialized. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
2009-03-01Merge branch 'x86/pat' into x86/coreIngo Molnar
2009-03-01Merge branch 'x86/urgent' into x86/patIngo Molnar
2009-03-01Revert "gpu/drm, x86, PAT: PAT support for io_mapping_*"Ingo Molnar
This reverts commit 17581ad812a9abb0182260374ef2e52d4a808a64. Sitsofe Wheeler reported that /dev/dri/card0 is MIA on his EeePC 900 and bisected it to this commit. Graphics card is an i915 in an EeePC 900: 00:02.0 VGA compatible controller [0300]: Intel Corporation Mobile 915GM/GMS/910GML Express Graphics Controller [8086:2592] (rev 04) ( Most likely the ioremap() of the driver failed and hence the card did not initialize. ) Reported-by: Sitsofe Wheeler <sitsofe@yahoo.com> Bisected-by: Sitsofe Wheeler <sitsofe@yahoo.com> Cc: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com> Cc: Suresh Siddha <suresh.b.siddha@intel.com> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2009-03-01tcp: fix retrans_out leaksIlpo Järvinen
There's conflicting assumptions in shifting, the caller assumes that dupsack results in S'ed skbs (or a part of it) for sure but never gave a hint to tcp_sacktag_one when dsack is actually in use. Thus DSACK retrans_out -= pcount was not taken and the counter became out of sync. Remove obstacle from that information flow to get DSACKs accounted in tcp_sacktag_one as expected. Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Tested-by: Denys Fedoryshchenko <denys@visp.net.lb> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-03-01net headers: export dcbnl.hChris Leech
The DCB netlink interface is required for building the userspace tools available at e1000.sourceforge.net Signed-off-by: Chris Leech <christopher.leech@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-03-01net headers: cleanup dcbnl.hChris Leech
1) add an include for <linux/types.h> 2) change dcbmsg.dcb_family from unsigned char to __u8 to be more consistent with use of kernel types Signed-off-by: Chris Leech <christopher.leech@intel.com> Acked-by: Sam Ravnborg <sam@ravnborg.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-03-01netpoll: Add drop checks to all entry pointsHerbert Xu
The netpoll entry checks are required to ensure that we don't receive normal packets when invoked via netpoll. Unfortunately it only ever worked for the netif_receive_skb/netif_rx entry points. The VLAN (and subsequently GRO) entry point didn't have the check and therefore can trigger all sorts of weird problems. This patch adds the netpoll check to all entry points. I'm still uneasy with receiving at all under netpoll (which apparently is only used by the out-of-tree kdump code). The reason is it is perfectly legal to receive all data including headers into highmem if netpoll is off, but if you try to do that with netpoll on and someone gets a printk in an IRQ handler you're going to get a nice BUG_ON. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-03-01bootmem, x86: further fixes for arch-specific bootmem wrappingTejun Heo
Impact: fix new breakages introduced by previous fix Commit c132937556f56ee4b831ef4b23f1846e05fde102 tried to clean up bootmem arch wrapper but it wasn't quite correct. Before the commit, the followings were broken. * Low level interface functions prefixed with __ ignored arch preference. * reserve_bootmem(...) can't be mapped into reserve_bootmem_node(NODE_DATA(0)->bdata, ...) because the node is not preference here. The region specified MUST fall into the specified region; otherwise, it will panic. After the commit, * If allocation fails for the arch preferred node, it should fallback to whatever is available. Instead, it simply failed allocation. There are too many internal details to allow generic wrapping and still keep things simple for archs. Plus, all that arch wants is a way to prefer certain node over another. This patch drops the generic wrapping around alloc_bootmem_core() and add alloc_bootmem_core() instead. If necessary, arch can define bootmem_arch_referred_node() macro or function which takes all allocation information and returns the preferred node. bootmem generic code will always try the preferred node first and then fallback to other nodes as usual. Breakages noted and changes reviewed by Johannes Weiner. Signed-off-by: Tejun Heo <tj@kernel.org> Acked-by: Johannes Weiner <hannes@cmpxchg.org>
2009-03-01alpha: fix typo in recent early vmalloc changeTejun Heo
Impact: fix build Add missing 'o' in variable name. Compile tested. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Ingo Molnar <mingo@elte.hu> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
2009-03-01percpu: kill compile warning in pcpu_populate_chunk()Tejun Heo
Impact: remove compile warning Mark local variable map_end in pcpu_populate_chunk() with uninitialized_var(). The variable is always used in tandem with map_start and guaranteed to be initialized before use but gcc doesn't understand that. Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Ingo Molnar <mingo@elte.hu>
2009-02-28x86: remove double copy of show_cpuinfo_core for 32 and 64 bitJaswinder Singh Rajput
Impact: unification show_cpuinfo_core is identical for 32 and 64 bit and can be unified, and CONFIG_X86_HT inherently depends on CONFIG_X86_SMP. Signed-off-by: Jaswinder Singh Rajput <jaswinderrajput@gmail.com> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-02-28Merge branch 'master' of /home/davem/src/GIT/linux-2.6/David S. Miller
2009-02-28Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
2009-02-28Input: elantech - touchpad driver miss-recognising logitech miceArjan Opmeer
Some Logitech mice react to the magic knock like Elantech touchpad would. This leads to those mice being misdetected as Elantech touchpads. Add a version query to elantech_detect() to distinguish the two. [dtor@mail.ru: - lower severity of some messages - when we are not sure yet if device is Elantech or not not responding to knock is not an error. ] Signed-off-by: Arjan Opmeer <arjan@opmeer.net> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
2009-02-28Input: synaptics - ensure we reset the device on resumeAndy Whitcroft
When resuming from suspend newer Synaptics touchpads do not recover correctly. Analysis of the resume sequence as applied in Linux was compared to that of other operating systems. This indicated that the other OSs were resetting the mouse before attempting to detect it (for all Synaptics touchpads, old and new). Applying this same modification fixes these newer Synaptics touchpads and brings the driver into line with common OS reset behaviour. Signed-off-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
2009-02-28Input: usbtouchscreen - fix eGalax HID ignoringDaniel Ritz
Commit ec42d4481e36cbdb5b2801f957e678211a9e5ae2 broke usbtouchscreen for some eGalax/EETI devices that claim to be HID, but are not. Devices confirmed to be real HID have the class set to HID and the protocol set to 'mouse'. Some have HID class but protocol set to 'none'. Those are not HID and should be driven by usbtouchscreen. Fix the device ignoring macro by adding match for the protocol too. Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
2009-02-28x86: i915 needs pgprot_writecombine() and is_io_mapping_possible()Ingo Molnar
Impact: build fix Theodore Ts reported that the i915 driver needs these symbols: ERROR: "pgprot_writecombine" [drivers/gpu/drm/i915/i915.ko] undefined! ERROR: "is_io_mapping_possible" [drivers/gpu/drm/i915/i915.ko] undefined! Reported-by: Theodore Ts'o <tytso@mit.edu> wrote: Signed-off-by: Ingo Molnar <mingo@elte.hu>
2009-02-28x86: signal: introduce helper align_sigframe()Hiroshi Shimamoto
Impact: cleanup Introduce helper align_sigframe() to align stack pointer for signal frame. Signed-off-by: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2009-02-28x86: signal: unify get_sigframe()Hiroshi Shimamoto
Impact: cleanup Unify get_sigframe(). Signed-off-by: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2009-02-28x86: signal: use 16 bytes boundary for rt_sigframeHiroshi Shimamoto
Impact: cleanup Supporting xsave/xrestore introduces 64 bytes boundary for save_i387_xstate(). 16 bytes boundary is OK for rt_sigframe. Signed-off-by: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2009-02-28x86: signal: intrroduce get_sigframe() and replace get_sigstack()Hiroshi Shimamoto
Impact: cleanup Introduce get_sigframe() like 32-bit to replace get_sigstack(). Move the i387 stuff into get_sigframe(). Signed-off-by: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2009-02-28x86: signal: add __user annotationHiroshi Shimamoto
Impact: cleanup Add missing __user annotation to the parameter of get_sigframe(). Also change cast type to void __user * of *fpstate. Signed-off-by: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com> Signed-off-by: Ingo Molnar <mingo@elte.hu>
2009-02-27x86, fixmap: unify fixmap.hGustavo F. Padovan
Impact: unification This patch unify fixmap_32.h and fixmap_64.h into fixmap.h. Things that we can't merge now are using CONFIG_X86_{32,64} (e.g.:vsyscall and EFI) Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Acked-by: Glauber Costa <gcosta@redhat.com> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-02-27x86, fixmap: prepare fixmap_32.h for unificationGustavo F. Padovan
Impact: cleanup Just prepare fixmap for later mechanic unification. No real modification on code. text data bss dec hex filename 3831152 353188 372736 4557076 458914 vmlinux-32.after 3831152 353188 372736 4557076 458914 vmlinux-32.before Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Acked-by: Glauber Costa <gcosta@redhat.com> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-02-27x86, fixmap: prepare fixmap_64.h for unificationGustavo F. Padovan
Impact: cleanup Just prepare fixmap for later mechanic unification. No real modification on code. text data bss dec hex filename 4312362 527192 421924 5261478 5048a6 vmlinux-64.after 4312362 527192 421924 5261478 5048a6 vmlinux-64.before Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Acked-by: Glauber Costa <gcosta@redhat.com> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-02-27x86, fixmap: add CONFIG_EFIGustavo F. Padovan
Impact: new fixmap allocation FIX_EFI_IO_MAP_FIRST_PAGE is used only when EFI is enabled. Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Acked-by: Glauber Costa <gcosta@redhat.com> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-02-27x86, fixmap: add CONFIG_X86_{LOCAL,IO}_APICGustavo F. Padovan
Impact: New fixmap allocations Add CONFIG_X86_{LOCAL,IO}_APIC to enum fixed_address. FIX_APIC_BASE is used only when CONFIG_X86_LOCAL_APIC is enabled and FIX_IO_APIC_BASE_* are used only when CONFIG_X86_IO_APIC is enabled. Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Acked-by: Glauber Costa <gcosta@redhat.com> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-02-27x86, fixmap: define reserve_top_address for x86_64Gustavo F. Padovan
Impact: new interface (not yet use) Define reserve_top_address for x86_64; only for later x86 integration. Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Acked-by: Glauber Costa <gcosta@redhat.com> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-02-27x86, fixmap: define FIXADDR_BOOT_* and redefine FIX_ADDR_SIZEGustavo F. Padovan
Impact: new interface, not yet used Now, with these macros, x86_64 code can know where start the permanent and non-permanent fixed mapped address. This patch make these macros equal fixmap_32.h for future x86 integration. Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Acked-by: Glauber Costa <gcosta@redhat.com> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-02-27x86, fixmap: rename __FIXADDR_SIZE and __FIXADDR_BOOT_SIZEGustavo F. Padovan
Impact: rename Rename __FIXADDR_SIZE to FIXADDR_SIZE and __FIXADDR_BOOT_SIZE to FIXADDR_BOOT_SIZE. Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Acked-by: Glauber Costa <gcosta@redhat.com> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
2009-02-27Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: Staging: w35und: fix usb_control_msg() error handling in wb35_probe() Staging: w35und: fix registration with wlan stack Staging: panel: fix oops on panel_cleanup_module Staging: rtl8187se: Fix oops and memory poison caused by builtin ieee80211. Staging: rtl8187se: fix Kconfig dependencies
2009-02-27Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (21 commits) USB: musb: fix srp sysfs entry deletion USB: musb: resume suspended root hub on disconnect USB: musb: use right poll limit for low speed devices USB: musb: be careful with 64K+ transfer lengths, host side USB: musb: fix data toggle saving with shared FIFO USB: musb: host endpoint_disable() oops fixes USB: musb: fix urb_dequeue() method USB: musb: fix musb_host_tx() for shared endpoint FIFO USB: musb: be careful with 64K+ transfer lengths (gadget side) usb: musb: make Davinci *work* in mainline USB: usb_get_string should check the descriptor type USB: gadget: fix build error in omap_apollon_2420_defconfig USB: g_file_storage: automatically disable stalls under Atmel USB: usb-storage: add IGNORE_RESIDUE flag for Genesys Logic adapters USB: Quirk for Hummingbird huc56s / Conexant ACM modem USB: serial: add support for second revision of Ericsson F3507G WWAN card USB: cdc-acm: add usb id for motomagx phones USB: option: add BenQ 3g modem information usb: gadget: obex: select correct ep descriptors USB: EHCI: slow down ITD reuse ...
2009-02-27Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linusLinus Torvalds
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: Revert "MIPS: Print irq handler description" MIPS: CVE-2009-0029: Enable syscall wrappers. MIPS: Alchemy: In plat_time_init() t reaches -1, tested: 0 MIPS: Only allow Cavium OCTEON to be configured for boards that support it
2009-02-27Merge branch 'x86-fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: enable DMAR by default xen: disable interrupts early, as start_kernel expects gpu/drm, x86, PAT: io_mapping_create_wc and resource_size_t gpu/drm, x86, PAT: Handle io_mapping_create_wc() errors in a clean way x86, Voyager: fix compile by lifting the degeneracy of phys_cpu_present_map x86, doc: fix references to Documentation/x86/i386/boot.txt
2009-02-27Merge branch 'sh/for-2.6.29' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh/for-2.6.29' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: sh: ap325rxa: Revert ov772x support. serial: sh-sci: fix overrun error handling for SH7785 SCIF. sh: Storage class should be before const qualifier
2009-02-27Merge branch 'for_linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: V4L/DVB (10696): Remove outdated README for the flexcop-driver V4L/DVB (10695): Update Technisat card documentation V4L/DVB (10694): [PATCH] software IRQ watchdog for Flexcop B2C2 DVB PCI cards V4L/DVB (10663): soc-camera: fix S_CROP breakage on PXA and SuperH V4L/DVB (10659): em28xx: register device to soundcard for sysfs
2009-02-27Fix FREEZE/THAW compat_ioctl regressionChristoph Hellwig
Commit 8e961870bb9804110d5c8211d5d9d500451c4518 removed the FREEZE/THAW handling in xfs_compat_ioctl but never added any compat handler back, so now any freeze/thaw request from a 32-bit binary ond 64-bit userspace will fail. As these ioctls are 32/64-bit compatible two simple COMPATIBLE_IOCTL entries in fs/compat_ioctl.c will do the job. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-27hpilo: new pci deviceDavid Altobelli
Future iLO devices will have an HP vendor id. Signed-off-by: David Altobelli <david.altobelli@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-27checkpatch: version 0.28Andy Whitcroft
Signed-off-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-27checkpatch: add __ref as a sparse modifierAndy Whitcroft
Add __ref as a sparse modifier. Signed-off-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-27checkpatch: extend attribute testing to all modifiersAndy Whitcroft
We should allow testing of all modifiers not just attributes. Extend testing and test for all the know modifiers. Signed-off-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-27checkpatch: a modifier is not an identifier at the end of a typeAndy Whitcroft
We must make sure we do not misrecognise a modifier as an Identifier when trying to match types. Prevent us matching this: void * __ref Signed-off-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-27checkpatch: pointer type star may have modifiers followingAndy Whitcroft
We may have any modifier following a pointer type star. Handle this: void * __user * __user foo; Signed-off-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-27checkpatch: correctly handle type spacing in the face of modifiersAndy Whitcroft
We need to handle interspersed modifiers in the middle of pointer types, for example: void * __user * __user bar; Signed-off-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-27checkpatch: do not warn about -p0 patches when checking filesAndy Whitcroft
We are triggering the -p0 check for our own diffs generated using --file command line option. Suppress this check for files. Signed-off-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-27checkpatch: make in_atomic ok in the coreAndy Whitcroft
We say that in_atomic() is ok in the core kernel, but then always report it regardless of where in the kernel it is. Keep quiet if it is used in kernel/*. Signed-off-by: Andy Whitcroft <apw@canonical.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-27mm: fix lazy vmap purging (use-after-free error)Vegard Nossum
I just got this new warning from kmemcheck: WARNING: kmemcheck: Caught 32-bit read from freed memory (c7806a60) a06a80c7ecde70c1a04080c700000000a06709c1000000000000000000000000 f f f f f f f f f f f f f f f f f f f f f f f f f f f f f f f f ^ Pid: 0, comm: swapper Not tainted (2.6.29-rc4 #230) EIP: 0060:[<c1096df7>] EFLAGS: 00000286 CPU: 0 EIP is at __purge_vmap_area_lazy+0x117/0x140 EAX: 00070f43 EBX: c7806a40 ECX: c1677080 EDX: 00027b66 ESI: 00002001 EDI: c170df0c EBP: c170df00 ESP: c178830c DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 CR0: 80050033 CR2: c7806b14 CR3: 01775000 CR4: 00000690 DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 DR6: 00004000 DR7: 00000000 [<c1096f3e>] free_unmap_vmap_area_noflush+0x6e/0x70 [<c1096f6a>] remove_vm_area+0x2a/0x70 [<c1097025>] __vunmap+0x45/0xe0 [<c10970de>] vunmap+0x1e/0x30 [<c1008ba5>] text_poke+0x95/0x150 [<c1008ca9>] alternatives_smp_unlock+0x49/0x60 [<c171ef47>] alternative_instructions+0x11b/0x124 [<c171f991>] check_bugs+0xbd/0xdc [<c17148c5>] start_kernel+0x2ed/0x360 [<c171409e>] __init_begin+0x9e/0xa9 [<ffffffff>] 0xffffffff It happened here: $ addr2line -e vmlinux -i c1096df7 mm/vmalloc.c:540 Code: list_for_each_entry(va, &valist, purge_list) __free_vmap_area(va); It's this instruction: mov 0x20(%ebx),%edx Which corresponds to a dereference of va->purge_list.next: (gdb) p ((struct vmap_area *) 0)->purge_list.next Cannot access memory at address 0x20 It seems that we should use "safe" list traversal here, as the element is freed inside the loop. Please verify that this is the right fix. Acked-by: Nick Piggin <npiggin@suse.de> Signed-off-by: Vegard Nossum <vegard.nossum@gmail.com> Cc: Pekka Enberg <penberg@cs.helsinki.fi> Cc: Ingo Molnar <mingo@elte.hu> Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com> Cc: <stable@kernel.org> [2.6.28.x] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-02-27mm: vmap fix overflowNick Piggin
The new vmap allocator can wrap the address and get confused in the case of large allocations or VMALLOC_END near the end of address space. Problem reported by Christoph Hellwig on a 32-bit XFS workload. Signed-off-by: Nick Piggin <npiggin@suse.de> Reported-by: Christoph Hellwig <hch@lst.de> Cc: <stable@kernel.org> [2.6.28.x] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>