Michael S. Tsirkin [Mon, 25 Oct 2010 01:21:24 +0000 (03:21 +0200)]
KVM: Write protect memory after slot swap
I have observed the following bug trigger:
1. userspace calls GET_DIRTY_LOG
2. kvm_mmu_slot_remove_write_access is called and makes a page ro
3. page fault happens and makes the page writeable
fault is logged in the bitmap appropriately
4. kvm_vm_ioctl_get_dirty_log swaps slot pointers
a lot of time passes
5. guest writes into the page
6. userspace calls GET_DIRTY_LOG
At point (5), bitmap is clean and page is writeable,
thus, guest modification of memory is not logged
and GET_DIRTY_LOG returns an empty bitmap.
The rule is that all pages are either dirty in the current bitmap,
or write-protected, which is violated here.
It seems that just moving kvm_mmu_slot_remove_write_access down
to after the slot pointer swap should fix this bug.
KVM-Stable-Tag.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Wu Fengguang [Wed, 3 Nov 2010 17:56:49 +0000 (01:56 +0800)]
vmstat: fix offset calculation on void*
Fix regression introduced by commit
79da826aee6 ("writeback: report
dirty thresholds in /proc/vmstat").
The incorrect pointer arithmetic can result in problems like this:
BUG: unable to handle kernel paging request at
07c06d16
IP: [<
c050c336>] strnlen+0x6/0x20
Call Trace:
[<
c050a249>] ? string+0x39/0xe0
[<
c042be6b>] ? __wake_up_common+0x4b/0x80
[<
c050afcc>] ? vsnprintf+0x1ec/0x380
[<
c04b380e>] ? seq_printf+0x2e/0x60
[<
c04829a6>] ? vmstat_show+0x26/0x30
[<
c04b3bb6>] ? seq_read+0xa6/0x380
[<
c04b3b10>] ? seq_read+0x0/0x380
[<
c04d5d2f>] ? proc_reg_read+0x5f/0x90
[<
c049c4a1>] ? vfs_read+0xa1/0x140
[<
c04d5cd0>] ? proc_reg_read+0x0/0x90
[<
c049c981>] ? sys_read+0x41/0x70
[<
c0402bd0>] ? sysenter_do_call+0x12/0x26
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Michael Rubin <mrubin@google.com>
Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Wed, 3 Nov 2010 17:44:55 +0000 (13:44 -0400)]
Merge branch 'for-linus' of git://git./linux/kernel/git/tiwai/sound-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ASoC: tpa6130a2: Get rid of compile warning from tpa6130a2_power
ALSA: hda - MacBookAir3,1(3,2) alsa support
ASoC: fix the building issue of missing codec field in 'struct snd_soc_card'
ALSA: usb-audio - Support for Power/Status LED on Creative USB X-Fi S51
ALSA: asihpi - Unsafe memory management when allocating control cache
ASoC: Update WARN uses in wm_hubs
ASoC: Include cx20442 to SND_SOC_ALL_CODECS
ASoC: Fix SND_SOC_ALL_CODECS typo for jz4740
ASoC: Remove volatility from WM8900 POWER1 register
ALSA: lx6464es - make 1 bit signed bitfield unsigned
ALSA: cs46xx memory management fixes for cs46xx_dsp_spos_create()
ALSA: usb - driver neglects kmalloc return value check and may deref NULL
ASoC: tpa6130a2: Fix unbalanced regulator disables
ASoC: tlv320dac33: Mode1 FIFO auto configuration fix
ASoC: tlv320dac33: Limit the US_TO_SAMPLES macro
ASoC: tlv320dac33: Error handling for broken chip
ASoC: Check return value of struct_strtoul() in pmdown_time_set()
Takashi Iwai [Wed, 3 Nov 2010 14:51:26 +0000 (15:51 +0100)]
Merge branch 'fix/asoc' into for-linus
Jarkko Nikula [Wed, 3 Nov 2010 14:39:00 +0000 (16:39 +0200)]
ASoC: tpa6130a2: Get rid of compile warning from tpa6130a2_power
Patch "ASoC: tpa6130a2: Fix unbalanced regulator disables" introduced a
compiler warning "‘ret’ may be used uninitialized in this function".
Initialize ret to zero to get rid of it and making sure that the function
does not return any random error code when the code is falling through.
Signed-off-by: Jarkko Nikula <jhnikula@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Takashi Iwai [Wed, 3 Nov 2010 12:56:08 +0000 (13:56 +0100)]
Merge branch 'for-2.6.37' of git://git./linux/kernel/git/lrg/asoc-2.6 into fix/asoc
Edgar (gimli) Hucek [Wed, 3 Nov 2010 07:14:10 +0000 (08:14 +0100)]
ALSA: hda - MacBookAir3,1(3,2) alsa support
This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the alsa
sound system.
Signed-off-by: Edgar (gimli) Hucek <gimli@dark-green.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Michel Lespinasse [Tue, 2 Nov 2010 20:05:18 +0000 (13:05 -0700)]
Release page reference during page fault retry
This slipped by when unifying the filemap and swap versions of
lock_page_or_retry()...
Signed-off-by: Michel Lespinasse <walken@google.com>
Acked-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Theodore Ts'o [Tue, 2 Nov 2010 13:34:50 +0000 (09:34 -0400)]
ext4: Remove useless spinlock in ext4_getattr()
Linus noted, and complained to me, that doing while lots of "git diff"'s
of kernel sources, these spinlocks were responsible for 27% of the
spinlock cost on his two-processor system as reported by perf.
Git was doing lots of parallel stats, and this was putting a lot of
pressure on ext4_getattr(). A spinlock to protect a single
memory-to-memory copy is pointless, so remove it.
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Mark Brown [Tue, 2 Nov 2010 13:41:56 +0000 (09:41 -0400)]
Merge commit 'v2.6.37-rc1' into for-2.6.37
Eric Miao [Mon, 1 Nov 2010 21:10:07 +0000 (05:10 +0800)]
ASoC: fix the building issue of missing codec field in 'struct snd_soc_card'
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Arnd Bergmann [Thu, 28 Oct 2010 14:12:33 +0000 (16:12 +0200)]
preempt: fix kernel build with !CONFIG_BKL
The preempt count logic tries to take the BKL into account, which breaks
when CONFIG_BKL is not set.
Use the same preempt_count offset that we use without CONFIG_PREEMPT
when CONFIG_BKL is disabled.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reported-and-tested-by: Kirill A. Shutemov <kirill@shutemov.name>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Mandar Joshi [Tue, 2 Nov 2010 14:43:19 +0000 (14:43 +0000)]
ALSA: usb-audio - Support for Power/Status LED on Creative USB X-Fi S51
This patch adds support for Power/Status LED on Creative USB X-Fi S51.
There is just one LED on the device. The LED can either be On or it
can be set to Blink. There doesn't seem to be a way to switch it off.
The control message to change LED status is similar to that of
audigy2nx except that the index is to be set to 0 and value is 1 for
Blink and 0 for On.
The 'Power LED' control in alsamixer when muted will cause the LED to
Blink continuously. When unmuted the LED will stay On. The Creative
driver under Windows sets the LED to blink whenever audio is muted.
This LED can be treated as the CMSS LED but I figured since there is
just one LED, it should be treated as the Power LED. Is that alright?
I've also changed the comment "Usb X-Fi" to "Usb X-Fi S51" as there
are other external X-Fi devices from Creative like Usb X-Fi Go and
Xmod. The volume knob and LED support patch doesn't apply to them.
Signed-off-by: Mandar Joshi <emailmandar@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Jesper Juhl [Fri, 29 Oct 2010 19:35:25 +0000 (21:35 +0200)]
ALSA: asihpi - Unsafe memory management when allocating control cache
I noticed that sound/pci/asihpi/hpicmn.c::hpi_alloc_control_cache() does
not check the return value from kmalloc(), which may fail.
If kmalloc() fails we'll dereference a null pointer and things will go bad
fast.
There are two memory allocations in that function and there's also the
problem that the first may succeed and the second may fail and nothing is
done about that either which will also go wrong down the line.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Eliot Blennerhassett <linux@audioscience.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Andy Whitcroft [Mon, 1 Nov 2010 21:01:44 +0000 (21:01 +0000)]
kconfig: sym_expand_string_value: allow for string termination when reallocing
When expanding a parameterised string we may run out of space, this
triggers a realloc. When computing the new allocation size we do not
allow for the terminating '\0'. Allow for this when calculating the new
length.
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Paul Mundt [Mon, 1 Nov 2010 20:29:21 +0000 (05:29 +0900)]
fs: logfs: Fix up MTD=y build.
Commit
7d945a3aa760 ("logfs get_sb, part 3") broke the logfs build when
CONFIG_MTD is set due to a mangled logfs_get_sb_mtd() definition.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Joe Perches [Sat, 30 Oct 2010 21:08:56 +0000 (14:08 -0700)]
ASoC: Update WARN uses in wm_hubs
Add missing newlines.
Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Jarkko Nikula [Fri, 29 Oct 2010 13:47:45 +0000 (16:47 +0300)]
ASoC: Include cx20442 to SND_SOC_ALL_CODECS
Signed-off-by: Jarkko Nikula <jhnikula@gmail.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Jarkko Nikula [Fri, 29 Oct 2010 13:47:44 +0000 (16:47 +0300)]
ASoC: Fix SND_SOC_ALL_CODECS typo for jz4740
Include jz4740.c to SND_SOC_ALL_CODECS when the dependencies are met.
Signed-off-by: Jarkko Nikula <jhnikula@gmail.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Mark Brown [Fri, 29 Oct 2010 22:41:17 +0000 (15:41 -0700)]
ASoC: Remove volatility from WM8900 POWER1 register
Not all bits can be read back from POWER1 so avoid corruption when using
a read/modify/write cycle by marking it non-volatile - the only thing we
read back from it is the chip revision which has diagnostic value only.
We can re-add later but that's a more invasive change than is suitable
for a bugfix.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Cc: stable@kernel.org
Linus Torvalds [Mon, 1 Nov 2010 11:54:12 +0000 (07:54 -0400)]
Linux 2.6.37-rc1
Linus Torvalds [Mon, 1 Nov 2010 11:53:19 +0000 (07:53 -0400)]
Merge branch 'for-linus' of git://www.jni.nu/cris
* 'for-linus' of git://www.jni.nu/cris:
CRIS: Add paths for CRISv10 serial driver
CRIS: Fix RS485 delay handling.
Add missing "struct" to in sizeof.
Linus Torvalds [Mon, 1 Nov 2010 11:50:43 +0000 (07:50 -0400)]
Merge branch 'next-spi' of git://git.secretlab.ca/git/linux-2.6
* 'next-spi' of git://git.secretlab.ca/git/linux-2.6:
spi/pl022: fix erroneous platform data in U300
spi: fixed odd static string conventions in core code
spi/bfin_spi: only request GPIO on first load
spi/bfin_spi: handle error/status changes after data interrupts
spi: enable spi_board_info to be registered after spi_master
Jesper Nilsson [Mon, 1 Nov 2010 10:01:14 +0000 (11:01 +0100)]
CRIS: Add paths for CRISv10 serial driver
Signed-off-by: Jesper Nilsson <jesper.nilsson@axis.com>
Tim Blechmann [Sun, 31 Oct 2010 18:46:19 +0000 (19:46 +0100)]
ALSA: lx6464es - make 1 bit signed bitfield unsigned
converts a 1 bit signed bitfield to an unsigned.
Reported-by: Dr. David Alan Gilbert <linux@treblig.org>
Signed-off-by: Tim Blechmann <tim@klingt.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Jesper Juhl [Fri, 29 Oct 2010 20:54:45 +0000 (22:54 +0200)]
ALSA: cs46xx memory management fixes for cs46xx_dsp_spos_create()
When reading through sound/pci/cs46xx/dsp_spos.c I noticed a couple of
things in cs46xx_dsp_spos_create().
It seems to me that we don't always free the various memory buffers we
allocate and we also do some work (structure member assignment) early,
that is completely pointless if some of the memory allocations fail and
we end up just aborting the whole thing.
I don't have hardware to test, so the patch below is compile tested only,
but it makes the following changes:
- Make sure we always free all allocated memory on failures.
- Don't do pointless work assigning to structure members before we know
all memory allocations, that may abort progress, have completed
successfully.
- Remove some trailing whitespace.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Tested-by: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Jesper Juhl [Fri, 29 Oct 2010 18:40:23 +0000 (20:40 +0200)]
ALSA: usb - driver neglects kmalloc return value check and may deref NULL
sound/usb/pcm.c::snd_usb_pcm_check_knot() fails to check the return value
from kmalloc() and may end up dereferencing a null pointer.
The patch below (compile tested only) should take care of that little
problem.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Linus Walleij [Thu, 21 Oct 2010 19:05:25 +0000 (21:05 +0200)]
spi/pl022: fix erroneous platform data in U300
This fixes an erroneous use of LSB first in the U300 machine, the
PL022 used in U300 is a standard ARM core that doesn't support this
bit so it should never have been set.
Cc: Kevin Wells <wellsk40@gmail.com>OA
Signed-off-by: Linus Walleij <linus.walleij@stericsson.com>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
Dmitry Torokhov [Sun, 31 Oct 2010 22:18:42 +0000 (15:18 -0700)]
Input: ir-keytable - fix uninitialized variable warning
We were forgetting to set up proper return value in success path causing
ir_getkeycode() to fail intermittently:
drivers/media/IR/ir-keytable.c: In function 'ir_getkeycode':
drivers/media/IR/ir-keytable.c:363: warning: 'retval' may be used
uninitialized in this function
Reported-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Mon, 1 Nov 2010 01:03:23 +0000 (21:03 -0400)]
Merge branch 'i2c-for-linus' of git://git./linux/kernel/git/jdelvare/staging
* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
i2c-i801: Add PCI idents for Patsburg 'IDF' SMBus controllers
i2c-i801: Handle multiple instances instead of keeping global state
i2c-i801: Add Intel Patsburg device ID
i2c: Drop unused I2C_CLASS_TV flags
Linus Torvalds [Mon, 1 Nov 2010 01:02:39 +0000 (21:02 -0400)]
Merge branch 'for-linus' of git://git./linux/kernel/git/dtor/input
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: appletouch - remove extra KERN_DEBUG use from dprintk
Input: bu21013_ts - fix null dereference in error handling
Input: ad7879 - prevent invalid finger data reports
Linus Torvalds [Mon, 1 Nov 2010 00:43:12 +0000 (20:43 -0400)]
Merge git://git./linux/kernel/git/jejb/scsi-misc-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (70 commits)
[SCSI] pmcraid: add support for set timestamp command and other fixes
[SCSI] pmcraid: remove duplicate struct member
[SCSI] qla4xxx: Fix cmd check in qla4xxx_cmd_wait
[SCSI] megaraid_sas: Version and documentation update
[SCSI] megaraid_sas: Add three times Online controller reset
[SCSI] megaraid_sas: Add input parameter for max_sectors
[SCSI] megaraid_sas: support devices update flag
[SCSI] libosd: write/read_sg_kern API
[SCSI] libosd: Support for scatter gather write/read commands
[SCSI] libosd: Free resources in reverse order of allocation
[SCSI] libosd: Fix bug in attr_page handling
[SCSI] lpfc 8.3.18: Update lpfc driver version to 8.3.18
[SCSI] lpfc 8.3.18: Add new WQE support
[SCSI] lpfc 8.3.18: Fix critical errors
[SCSI] lpfc 8.3.18: Adapter Shutdown and Unregistration cleanup
[SCSI] lpfc 8.3.18: Add logic to detect last devloss timeout
[SCSI] lpfc 8.3.18: Add support of received ELS commands
[SCSI] lpfc 8.3.18: FC/FCoE Discovery fixes
[SCSI] ipr: add definitions for a new adapter
[SCSI] bfa: fix comments for c files
...
Linus Torvalds [Mon, 1 Nov 2010 00:40:24 +0000 (20:40 -0400)]
Merge branches 'irq-core-for-linus' and 'core-locking-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip
* 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
genirq: Fix up irq_node() for irq_data changes.
genirq: Add single IRQ reservation helper
genirq: Warn if enable_irq is called before irq is set up
* 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
semaphore: Remove mutex emulation
staging: Final semaphore cleanup
jbd2: Convert jbd2_slab_create_sem to mutex
hpfs: Convert sbi->hpfs_creation_de to mutex
Fix up trivial change/delete conflicts with deleted 'dream' drivers
(drivers/staging/dream/camera/{mt9d112.c,mt9p012_fox.c,mt9t013.c,s5k3e2fx.c})
David Woodhouse [Sun, 31 Oct 2010 20:07:00 +0000 (21:07 +0100)]
i2c-i801: Add PCI idents for Patsburg 'IDF' SMBus controllers
These are the extra 'Integrated Device Function' SMBus controllers found
on the Patsburg chipset. Mention the absence of slave mode support.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
David Woodhouse [Sun, 31 Oct 2010 20:06:59 +0000 (21:06 +0100)]
i2c-i801: Handle multiple instances instead of keeping global state
It's poor form to keep driver state in global variables rather than
per-instance. It never really mattered in practice when there was only
one controller on the chipset, but the latest chipsets do have more
than one controller, so now we care.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Seth Heasley [Sun, 31 Oct 2010 20:06:59 +0000 (21:06 +0100)]
i2c-i801: Add Intel Patsburg device ID
Add support for the Intel Patsburg PCH SMBus Controller.
Signed-off-by: Seth Heasley <seth.heasley@intel.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Jean Delvare [Sun, 31 Oct 2010 20:06:59 +0000 (21:06 +0100)]
i2c: Drop unused I2C_CLASS_TV flags
There are no users left for I2C_CLASS_TV_ANALOG and
I2C_CLASS_TV_DIGITAL, so we can get rid of them.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Joe Perches [Sun, 31 Oct 2010 00:19:49 +0000 (17:19 -0700)]
Input: appletouch - remove extra KERN_DEBUG use from dprintk
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Christoph Hellwig [Sun, 31 Oct 2010 12:35:31 +0000 (08:35 -0400)]
locks: remove fl_copy_lock lock_manager operation
This one was only used for a nasty hack in nfsd, which has recently
been removed.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Christoph Hellwig [Sun, 31 Oct 2010 12:35:10 +0000 (08:35 -0400)]
locks: let the caller free file_lock on ->setlease failure
The caller allocated it, the caller should free it.
The only issue so far is that we could change the flp pointer even on an
error return if the fl_change callback failed. But we can simply move
the flp assignment after the fl_change invocation, as the callers don't
care about the flp return value if the setlease call failed.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Geert Uytterhoeven [Sun, 31 Oct 2010 09:56:23 +0000 (10:56 +0100)]
initramfs: Fix initramfs size for 32-bit arches
Commit
ffe8018c3424 ("initramfs: fix initramfs size calculation") broke
32-bit big-endian arches like (on ARAnyM):
VFS: Cannot open root device "hda1" or unknown-block(3,1)
Please append a correct "root=" boot option; here are the available partitions:
fe80
1059408 nfhd8 (driver?)
fe81 921600 nfhd8p1
00000000-0000-0000-0000-000000000nfhd8p1
fe82 137807 nfhd8p2
00000000-0000-0000-0000-000000000nfhd8p2
0200 3280 fd0 (driver?)
0201 3280 fd1 (driver?)
0300
1059408 hda driver: ide-gd
0301 921600 hda1
00000000-0000-0000-0000-000000000hda1
0302 137807 hda2
00000000-0000-0000-0000-000000000hda2
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(3,1)
As pointed out by Kerstin Jonsson <kerstin.jonsson@ericsson.com>, this
is due to CONFIG_32BIT not being defined, so the initramfs size field is
done as a 64-bit quad. On little-endian (like x86) this doesn matter,
but on a big-endian machine the 32-bit reads will see the (zero) high
bits.
Only mips, s390, and score set CONFIG_32BIT for 32-bit builds, so fix it for
all other 32-bit arches by inverting the logic and testing for CONFIG_64BIT,
which should be defined on all 64-bit arches.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
[ I think we should just make it "u64" on all architectures and get
rid of the whole #ifdef CONFIG_xxBIT - Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sun, 31 Oct 2010 01:42:58 +0000 (18:42 -0700)]
Merge git://git./linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
isdn: mISDN: socket: fix information leak to userland
netdev: can: Change mail address of Hans J. Koch
pcnet_cs: add new_id
net: Truncate recvfrom and sendto length to INT_MAX.
RDS: Let rds_message_alloc_sgs() return NULL
RDS: Copy rds_iovecs into kernel memory instead of rereading from userspace
RDS: Clean up error handling in rds_cmsg_rdma_args
RDS: Return -EINVAL if rds_rdma_pages returns an error
net: fix rds_iovec page count overflow
can: pch_can: fix section mismatch warning by using a whitelisted name
can: pch_can: fix sparse warning
netxen_nic: Fix the tx queue manipulation bug in netxen_nic_probe
ip_gre: fix fallback tunnel setup
vmxnet: trivial annotation of protocol constant
vmxnet3: remove unnecessary byteswapping in BAR writing macros
ipv6/udp: report SndbufErrors and RcvbufErrors
phy/marvell: rename
88ec048 to 88e1318s and fix mscr1 addr
J. Bruce Fields [Sat, 30 Oct 2010 21:31:16 +0000 (17:31 -0400)]
nfsd4: initialize delegation pointer to lease
The NFSv4 server was initializing the dp->dl_flock pointer by the
somewhat ridiculous method of a locks_copy_lock callback.
Now that setlease uses the passed-in lock instead of doing a copy,
dl_flock no longer gets set, resulting in the lock leaking on delegation
release, and later possible hangs (among other problems).
So, initialize dl_flock and get rid of the callback.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
J. Bruce Fields [Sat, 30 Oct 2010 21:31:15 +0000 (17:31 -0400)]
locks: fix setlease methods to free passed-in lock
We modified setlease to require the caller to allocate the new lease in
the case of creating a new lease, but forgot to fix up the filesystem
methods.
Cc: Steven Whitehouse <swhiteho@redhat.com>
Cc: Steve French <sfrench@samba.org>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
J. Bruce Fields [Sat, 30 Oct 2010 21:31:14 +0000 (17:31 -0400)]
locks: fix leaks on setlease errors
We're depending on setlease to free the passed-in lease on failure.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
J. Bruce Fields [Sat, 30 Oct 2010 21:31:13 +0000 (17:31 -0400)]
locks: prevent ENOMEM on lease unlock
Removing a lock shouldn't require any allocations; a failure due to
ENOMEM leaves the caller with a choice between retrying or giving up and
leaking an unused lease.
Next we should split the other lease calls into add and delete cases.
I wanted to start with just the bugfix.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Härdeman [Sat, 30 Oct 2010 20:17:44 +0000 (22:17 +0200)]
drivers/media/IR/ir-keytable.c: fix binary search
The input-large-scancode patches changed the binary search in
drivers/media/IR/ir-keytable.c to use unsigned integers, but
signed integers are actually necessary for the algorithm to work.
Signed-off-by: David Härdeman <david@hardeman.nu>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Kulikov Vasiliy [Fri, 29 Oct 2010 23:04:33 +0000 (23:04 +0000)]
isdn: mISDN: socket: fix information leak to userland
Structure mISDN_devinfo is copied to userland with the field "name"
that has the last elements unitialized. It leads to leaking of
contents of kernel stack memory.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Hans J. Koch [Fri, 29 Oct 2010 12:33:57 +0000 (12:33 +0000)]
netdev: can: Change mail address of Hans J. Koch
My old mail address doesn't exist anymore. This changes all occurrences
to my new address.
Signed-off-by: Hans J. Koch <hjk@hansjkoch.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ken Kawasaki [Fri, 29 Oct 2010 12:17:51 +0000 (12:17 +0000)]
pcnet_cs: add new_id
pcnet_cs:
add new_id: "corega Ether CF-TD" 10Base-T PCMCIA card.
Signed-off-by: Ken Kawasaki <ken_kawasaki@spring.nifty.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Sat, 30 Oct 2010 23:43:10 +0000 (16:43 -0700)]
net: Truncate recvfrom and sendto length to INT_MAX.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Andy Grover [Thu, 28 Oct 2010 15:40:59 +0000 (15:40 +0000)]
RDS: Let rds_message_alloc_sgs() return NULL
Even with the previous fix, we still are reading the iovecs once
to determine SGs needed, and then again later on. Preallocating
space for sg lists as part of rds_message seemed like a good idea
but it might be better to not do this. While working to redo that
code, this patch attempts to protect against userspace rewriting
the rds_iovec array between the first and second accesses.
The consequences of this would be either a too-small or too-large
sg list array. Too large is not an issue. This patch changes all
callers of message_alloc_sgs to handle running out of preallocated
sgs, and fail gracefully.
Signed-off-by: Andy Grover <andy.grover@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Andy Grover [Thu, 28 Oct 2010 15:40:58 +0000 (15:40 +0000)]
RDS: Copy rds_iovecs into kernel memory instead of rereading from userspace
Change rds_rdma_pages to take a passed-in rds_iovec array instead
of doing copy_from_user itself.
Change rds_cmsg_rdma_args to copy rds_iovec array once only. This
eliminates the possibility of userspace changing it after our
sanity checks.
Implement stack-based storage for small numbers of iovecs, based
on net/socket.c, to save an alloc in the extremely common case.
Although this patch reduces iovec copies in cmsg_rdma_args to 1,
we still do another one in rds_rdma_extra_size. Getting rid of
that one will be trickier, so it'll be a separate patch.
Signed-off-by: Andy Grover <andy.grover@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Andy Grover [Thu, 28 Oct 2010 15:40:57 +0000 (15:40 +0000)]
RDS: Clean up error handling in rds_cmsg_rdma_args
We don't need to set ret = 0 at the end -- it's initialized to 0.
Also, don't increment s_send_rdma stat if we're exiting with an
error.
Signed-off-by: Andy Grover <andy.grover@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Andy Grover [Thu, 28 Oct 2010 15:40:56 +0000 (15:40 +0000)]
RDS: Return -EINVAL if rds_rdma_pages returns an error
rds_cmsg_rdma_args would still return success even if rds_rdma_pages
returned an error (or overflowed).
Signed-off-by: Andy Grover <andy.grover@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Thu, 28 Oct 2010 15:40:55 +0000 (15:40 +0000)]
net: fix rds_iovec page count overflow
As reported by Thomas Pollet, the rdma page counting can overflow. We
get the rdma sizes in 64-bit unsigned entities, but then limit it to
UINT_MAX bytes and shift them down to pages (so with a possible "+1" for
an unaligned address).
So each individual page count fits comfortably in an 'unsigned int' (not
even close to overflowing into signed), but as they are added up, they
might end up resulting in a signed return value. Which would be wrong.
Catch the case of tot_pages turning negative, and return the appropriate
error code.
Reported-by: Thomas Pollet <thomas.pollet@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Andy Grover <andy.grover@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Marc Kleine-Budde [Sat, 30 Oct 2010 23:28:16 +0000 (16:28 -0700)]
can: pch_can: fix section mismatch warning by using a whitelisted name
This patch fixes the following section mismatch warning:
WARNING: drivers/net/can/pch_can.o(.data+0x18):
Section mismatch in reference from the variable pch_can_pcidev
to the variable .devinit.rodata:pch_pci_tbl
The variable pch_can_pcidev references
the variable __devinitconst pch_pci_tbl
This is actually a false positive which is fixed by giving the offending
variable a whitelisted name, it's renamed to "pch_can_pci_driver".
This makes sense because the variable is of the type "struct pci_driver".
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Marc Kleine-Budde [Sat, 30 Oct 2010 23:27:48 +0000 (16:27 -0700)]
can: pch_can: fix sparse warning
This patch fixes the following sparse warning:
drivers/net/can/pch_can.c:231:26: warning: incorrect type in argument 1 (different address spaces)
drivers/net/can/pch_can.c:231:26: expected unsigned int [usertype] *addr
drivers/net/can/pch_can.c:231:26: got unsigned int [noderef] <asn:2>*<noident>
Let pch_can_bit_{set,clear} first parameter be a void __iomem pointer.
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Denis Kirjanov [Sat, 30 Oct 2010 23:24:25 +0000 (16:24 -0700)]
netxen_nic: Fix the tx queue manipulation bug in netxen_nic_probe
We should not stop the egress queue during probe because it is wrong.
Signed-off-by: Denis Kirjanov <dkirjanov@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Sat, 30 Oct 2010 23:21:28 +0000 (16:21 -0700)]
ip_gre: fix fallback tunnel setup
Before making the fallback tunnel visible to lookups, we should make
sure it is completely setup, once ipgre_tunnel_init() had been called
and tstats per_cpu pointer allocated.
move rcu_assign_pointer(ign->tunnels_wc[0], tunnel); from
ipgre_fb_tunnel_init() to ipgre_init_net()
Based on a patch from Pavel Emelyanov
Reported-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Harvey Harrison [Sat, 30 Oct 2010 23:19:45 +0000 (16:19 -0700)]
vmxnet: trivial annotation of protocol constant
Noticed by sparse:
drivers/net/vmxnet3/vmxnet3_drv.c:876:38: warning: cast from restricted __be16
drivers/net/vmxnet3/vmxnet3_drv.c:876:38: warning: cast from restricted __be16
drivers/net/vmxnet3/vmxnet3_drv.c:876:24: warning: restricted __be16 degrades to integer
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Harvey Harrison [Sat, 30 Oct 2010 23:19:18 +0000 (16:19 -0700)]
vmxnet3: remove unnecessary byteswapping in BAR writing macros
readl/writel swap to little-endian internally.
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Sat, 30 Oct 2010 23:17:23 +0000 (16:17 -0700)]
ipv6/udp: report SndbufErrors and RcvbufErrors
commit
a18135eb9389 (Add UDP_MIB_{SND,RCV}BUFERRORS handling.)
forgot to make the necessary changes in net/ipv6/proc.c to report
additional counters in /proc/net/snmp6
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Sat, 30 Oct 2010 18:50:37 +0000 (11:50 -0700)]
Merge branch 'for-linus' of git://git.infradead.org/users/eparis/notify
* 'for-linus' of git://git.infradead.org/users/eparis/notify: (22 commits)
Ensure FMODE_NONOTIFY is not set by userspace
make fanotify_read() restartable across signals
fsnotify: remove alignment padding from fsnotify_mark on 64 bit builds
fs/notify/fanotify/fanotify_user.c: fix warnings
fanotify: Fix FAN_CLOSE comments
fanotify: do not recalculate the mask if the ignored mask changed
fanotify: ignore events on directories unless specifically requested
fsnotify: rename FS_IN_ISDIR to FS_ISDIR
fanotify: do not send events for irregular files
fanotify: limit number of listeners per user
fanotify: allow userspace to override max marks
fanotify: limit the number of marks in a single fanotify group
fanotify: allow userspace to override max queue depth
fsnotify: implement a default maximum queue depth
fanotify: ignore fanotify ignore marks if open writers
fanotify: allow userspace to flush all marks
fsnotify: call fsnotify_parent in perm events
fsnotify: correctly handle return codes from listeners
fanotify: use __aligned_u64 in fanotify userspace metadata
fanotify: implement fanotify listener ordering
...
Linus Torvalds [Sat, 30 Oct 2010 18:43:26 +0000 (11:43 -0700)]
Merge branches 'perf-fixes-for-linus' and 'x86-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip
* 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
jump label: Add work around to i386 gcc asm goto bug
x86, ftrace: Use safe noops, drop trap test
jump_label: Fix unaligned traps on sparc.
jump label: Make arch_jump_label_text_poke_early() optional
jump label: Fix error with preempt disable holding mutex
oprofile: Remove deprecated use of flush_scheduled_work()
oprofile: Fix the hang while taking the cpu offline
jump label: Fix deadlock b/w jump_label_mutex vs. text_mutex
jump label: Fix module __init section race
* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86: Check irq_remapped instead of remapping_enabled in destroy_irq()
Lino Sanfilippo [Fri, 29 Oct 2010 10:02:17 +0000 (12:02 +0200)]
Ensure FMODE_NONOTIFY is not set by userspace
In fsnotify_open() ensure that FMODE_NONOTIFY is never set by userspace.
Also always call fsnotify_parent and fsnotify.
Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Eric Paris <eparis@redhat.com>
Lino Sanfilippo [Fri, 29 Oct 2010 10:06:42 +0000 (12:06 +0200)]
make fanotify_read() restartable across signals
In fanotify_read() return -ERESTARTSYS instead of -EINTR to
make read() restartable across signals (BSD semantic).
Signed-off-by: Eric Paris <eparis@redhat.com>
Jarkko Nikula [Thu, 28 Oct 2010 11:05:40 +0000 (14:05 +0300)]
ASoC: tpa6130a2: Fix unbalanced regulator disables
This driver has unbalanced regulator_disable when doing module loading and
unloading. This is because tpa6130a2_probe followed by tpa6130a2_remove
calls twice tpa6130a2_power(0). Fix this by implementing a state checking
in tpa6130a2_power.
Signed-off-by: Jarkko Nikula <jhnikula@gmail.com>
Cc: Peter Ujfalusi <peter.ujfalusi@nokia.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Peter Ujfalusi <peter.ujfalusi@nokia.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Peter Ujfalusi [Fri, 29 Oct 2010 06:49:37 +0000 (09:49 +0300)]
ASoC: tlv320dac33: Mode1 FIFO auto configuration fix
Do not allow invalid (too big) nSample value, when FIFO Mode1
and automatic fifo configuration has been selected.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@nokia.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Peter Ujfalusi [Fri, 29 Oct 2010 11:07:25 +0000 (14:07 +0300)]
ASoC: tlv320dac33: Limit the US_TO_SAMPLES macro
Limit the time window to maximum 1s in the macro.
The driver deals with much shorter times (<200ms).
This will fix a rare division by zero bug in Mode1.
This could happen, when the work is not executed in
time (within mode1_latency) after the interrupt.
In this case the DAC33 will not receive the needed
nSample command in time, and enters to an unknown
state, and won't recover.
In such event the time window will increase, and
eventually going to be bigger than 1s, resulting
devision by zero.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@nokia.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Peter Ujfalusi [Tue, 26 Oct 2010 08:45:59 +0000 (11:45 +0300)]
ASoC: tlv320dac33: Error handling for broken chip
Correct/Implement handling of broken chip.
Fail the soc_prope if the communication with the chip
fails (can not read chip ID).
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@nokia.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Linus Torvalds [Sat, 30 Oct 2010 16:05:48 +0000 (09:05 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/mason/btrfs-unstable
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable: (39 commits)
Btrfs: deal with errors from updating the tree log
Btrfs: allow subvol deletion by unprivileged user with -o user_subvol_rm_allowed
Btrfs: make SNAP_DESTROY async
Btrfs: add SNAP_CREATE_ASYNC ioctl
Btrfs: add START_SYNC, WAIT_SYNC ioctls
Btrfs: async transaction commit
Btrfs: fix deadlock in btrfs_commit_transaction
Btrfs: fix lockdep warning on clone ioctl
Btrfs: fix clone ioctl where range is adjacent to extent
Btrfs: fix delalloc checks in clone ioctl
Btrfs: drop unused variable in block_alloc_rsv
Btrfs: cleanup warnings from gcc 4.6 (nonbugs)
Btrfs: Fix variables set but not read (bugs found by gcc 4.6)
Btrfs: Use ERR_CAST helpers
Btrfs: use memdup_user helpers
Btrfs: fix raid code for removing missing drives
Btrfs: Switch the extent buffer rbtree into a radix tree
Btrfs: restructure try_release_extent_buffer()
Btrfs: use the flusher threads for delalloc throttling
Btrfs: tune the chunk allocation to 5% of the FS as metadata
...
Fix up trivial conflicts in fs/btrfs/super.c and fs/fs-writeback.c, and
remove use of INIT_RCU_HEAD in fs/btrfs/extent_io.c (that init macro was
useless and removed in commit
5e8067adfdba: "rcu head remove init")
Linus Torvalds [Sat, 30 Oct 2010 15:55:52 +0000 (08:55 -0700)]
fs-writeback.c: unify some common code
The btrfs merge looks like hell, because it changes fs-writeback.c, and
the crazy code has this repeated "estimate number of dirty pages"
counting that involves three different helper functions. And it's done
in two different places.
Just unify that whole calculation as a "get_nr_dirty_pages()" helper
function, and the merge result will look half-way decent.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Sat, 30 Oct 2010 15:35:35 +0000 (08:35 -0700)]
Merge branch 'audit.b64' of git://git./linux/kernel/git/viro/audit-current
* 'audit.b64' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current:
audit mmap
audit: make link()/linkat() match "attribute change" predicate
audit: Use rcu for task lookup protection
audit: Do not send uninitialized data for AUDIT_TTY_GET
audit: Call tty_audit_push_task() outside preempt disabled
in untag_chunk() we need to do alloc_chunk() a bit earlier
audit: make functions static
Audit: add support to match lsm labels on user audit messages
Linus Torvalds [Sat, 30 Oct 2010 15:31:35 +0000 (08:31 -0700)]
Merge git://git.infradead.org/mtd-2.6
* git://git.infradead.org/mtd-2.6: (82 commits)
mtd: fix build error in m25p80.c
mtd: Remove redundant mutex from mtd_blkdevs.c
MTD: Fix wrong check register_blkdev return value
Revert "mtd: cleanup Kconfig dependencies"
mtd: cfi_cmdset_0002: make sector erase command variable
mtd: cfi_cmdset_0002: add CFI detection for SST 38VF640x chips
mtd: cfi_util: add support for switching SST 39VF640xB chips into QRY mode
mtd: cfi_cmdset_0001: use defined value of P_ID_INTEL_PERFORMANCE instead of hardcoded one
block2mtd: dubious assignment
P4080/mtd: Fix the freescale lbc issue with 36bit mode
P4080/eLBC: Make Freescale elbc interrupt common to elbc devices
mtd: phram: use KBUILD_MODNAME
mtd: OneNAND: S5PC110: Fix double call suspend & resume function
mtd: nand: fix MTD_MODE_RAW writes
jffs2: use kmemdup
mtd: sm_ftl: cosmetic, use bool when possible
mtd: r852: remove useless pci powerup/down from suspend/resume routines
mtd: blktrans: fix a race vs kthread_stop
mtd: blktrans: kill BKL
mtd: allow to unload the mtdtrans module if its block devices aren't open
...
Fix up trivial whitespace-introduced conflict in drivers/mtd/mtdchar.c
Linus Torvalds [Sat, 30 Oct 2010 15:26:25 +0000 (08:26 -0700)]
Merge branch 'devel' of /home/rmk/linux-2.6-arm
* 'devel' of master.kernel.org:/home/rmk/linux-2.6-arm: (215 commits)
ARM: memblock: setup lowmem mappings using memblock
ARM: memblock: move meminfo into find_limits directly
ARM: memblock: convert free_highpages() to use memblock
ARM: move freeing of highmem pages out of mem_init()
ARM: memblock: convert memory detail printing to use memblock
ARM: memblock: use memblock to free memory into arm_bootmem_init()
ARM: memblock: use memblock when initializing memory allocators
ARM: ensure membank array is always sorted
ARM: 6466/1: implement flush_icache_all for the rest of the CPUs
ARM: 6464/2: fix spinlock recursion in adjust_pte()
ARM: fix memblock breakage
ARM: 6465/1: Fix data abort accessing proc_info from __lookup_processor_type
ARM: 6460/1: ixp2000: fix type of ixp2000_timer_interrupt
ARM: 6449/1: Fix for compiler warning of uninitialized variable.
ARM: 6445/1: fixup TCM memory types
ARM: imx: Add wake functionality to GPIO
ARM: mx5: Add gpio-keys to mx51 babbage board
ARM: imx: Add gpio-keys to plat-mxc
mx31_3ds: Fix spi registration
mx31_3ds: Fix the logic for detecting the debug board
...
Vasiliy Kulikov [Sat, 30 Oct 2010 14:22:49 +0000 (18:22 +0400)]
ipc: shm: fix information leak to userland
The shmid_ds structure is copied to userland with shm_unused{,2,3}
fields unitialized. It leads to leaking of contents of kernel stack
memory.
Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
wu zhangjin [Sat, 30 Oct 2010 15:19:35 +0000 (08:19 -0700)]
fs/compat.c: fix build on MIPS/s390
The definition of PAGE_CACHE_MASK in <linux/pagemap.h> is needed to use
MAX_RW_COUNT, and on x86-64 that gets done indirectly through the
architecture header includes. But on MIPS and s390 that doesn't happen,
and we need to make sure that fs/compat.c includes pagemap.h explicitly.
Introduced in commit
435f49a518c7 ("readv/writev: do the same
MAX_RW_COUNT truncation that read/write does").
Reported-by: Sachin Sant <sachinp@in.ibm.com> (S390)
Reported-by: wu zhangjin <wuzhangjin@gmail.com> (MIPS)
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Al Viro [Sat, 30 Oct 2010 06:54:44 +0000 (02:54 -0400)]
audit mmap
Normal syscall audit doesn't catch 5th argument of syscall. It also
doesn't catch the contents of userland structures pointed to be
syscall argument, so for both old and new mmap(2) ABI it doesn't
record the descriptor we are mapping. For old one it also misses
flags.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 11 Nov 2009 15:09:41 +0000 (10:09 -0500)]
audit: make link()/linkat() match "attribute change" predicate
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Thomas Gleixner [Wed, 9 Dec 2009 14:19:41 +0000 (14:19 +0000)]
audit: Use rcu for task lookup protection
Protect the task lookups in audit_receive_msg() with rcu_read_lock()
instead of tasklist_lock and use lock/unlock_sighand to protect
against the exit race.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Eric Paris <eparis@redhat.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Thomas Gleixner [Wed, 9 Dec 2009 14:19:35 +0000 (14:19 +0000)]
audit: Do not send uninitialized data for AUDIT_TTY_GET
audit_receive_msg() sends uninitialized data for AUDIT_TTY_GET when
the task was not found.
Send reply only when task was found.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Eric Paris <eparis@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Thomas Gleixner [Wed, 9 Dec 2009 14:19:31 +0000 (14:19 +0000)]
audit: Call tty_audit_push_task() outside preempt disabled
While auditing all tasklist_lock read_lock sites I stumbled over the
following call chain:
audit_prepare_user_tty()
read_lock(&tasklist_lock);
tty_audit_push_task();
mutex_lock(&buf->mutex);
--> buf->mutex is locked with preemption disabled.
Solve this by acquiring a reference to the task struct under
rcu_read_lock and call tty_audit_push_task outside of the preempt
disabled region.
Move all code which needs to be protected by sighand lock into
tty_audit_push_task() and use lock/unlock_sighand as we do not hold
tasklist_lock.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Eric Paris <eparis@redhat.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Andres Salomon [Sat, 30 Oct 2010 04:04:19 +0000 (21:04 -0700)]
mtd: fix build error in m25p80.c
While building an x86 distro kernel, I hit the following:
Kernel: arch/x86/boot/bzImage is ready (#7)
ERROR: "of_mtd_parse_partitions" [drivers/mtd/devices/m25p80.ko]
undefined!
of_mtd_parse_partitions is defined with MTD_OF_PARTS, and that's only
built on PPC and microblaze. The code in question should be wrapped w/
a stricter #ifdef.
Signed-off-by: Andres Salomon <dilinger@queued.net>
Acked-by: Grant Likely <grant.likely@secretlab.ca>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sat, 30 Oct 2010 11:39:21 +0000 (12:39 +0100)]
mtd: Remove redundant mutex from mtd_blkdevs.c
In commit
2a48fc0ab24241755dc93bfd4f01d68efab47f5a ('block: autoconvert
trivial BKL users to private mutex'), Arnd replaced the BKL usage with a
mutex. However, Maxim has already provided a better fix in commit
480792b7bf188c29b8d4b10fee65c3a06ec5dbf7 ('mtd: blktrans: kill BKL'),
which was simply to remove the BKL without replacing it — since he'd
already made it do all necessary locking for itself.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Woodhouse [Sat, 30 Oct 2010 11:35:11 +0000 (12:35 +0100)]
Merge branch 'master' of git://git./linux/kernel/git/torvalds/linux-2.6.git
Conflicts:
drivers/mtd/mtd_blkdevs.c
Merge Grant's device-tree bits so that we can apply the subsequent fixes.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Chris Mason [Sat, 30 Oct 2010 11:34:24 +0000 (07:34 -0400)]
Btrfs: deal with errors from updating the tree log
During unlink we remove any references to the inode from
the tree log. It can return -ENOENT and other errors,
and this changes the unlink code to deal with it.
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Frank Li [Tue, 26 Oct 2010 03:02:19 +0000 (11:02 +0800)]
MTD: Fix wrong check register_blkdev return value
register_blkdev return 1..255 when major = 0.
if (ret ) {
printk(KERN_WARNING "Unable to register %s block device on major %d: %d\n",
tr->name, tr->major, ret);
mutex_unlock(&mtd_table_mutex);
return ret;
}
Above code will return fail when register_blkdev return allocated major number.
Signed-off-by: Frank Li <Frank.Li@freescale.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Thomas Gleixner [Tue, 7 Sep 2010 14:34:01 +0000 (14:34 +0000)]
semaphore: Remove mutex emulation
Semaphores used as mutexes have been deprecated for years. Now that
all users are either converted to real semaphores or to mutexes remove
the cruft.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Christoph Hellwig <hch@infradead.org>
LKML-Reference: <
20100907125057.
562399240@linutronix.de>
Thomas Gleixner [Sat, 30 Oct 2010 09:06:57 +0000 (11:06 +0200)]
staging: Final semaphore cleanup
Fixup the last remaining users of DECLARE_MUTEX and init_MUTEX.
Scripted conversion, resulting code is binary equivalent.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
LKML-Reference: <
20100907125057.
278833764@linutronix.de>
Thomas Gleixner [Sat, 16 Oct 2010 20:34:39 +0000 (22:34 +0200)]
jbd2: Convert jbd2_slab_create_sem to mutex
jbd2_slab_create_sem is used as a mutex, so make it one.
[ akpm muttered: We may as well make it local to
jbd2_journal_create_slab() also. ]
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Ted Ts'o <tytso@mit.edu>
Cc: Andrew Morton <akpm@linux-foundation.org>
LKML-Reference: <alpine.LFD.2.00.
1010162231480.2496@localhost6.localdomain6>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Ingo Molnar [Sat, 30 Oct 2010 08:43:08 +0000 (10:43 +0200)]
Merge branch 'tip/perf/jump-label-2' of git://git./linux/kernel/git/rostedt/linux-2.6-trace into perf/urgent
Yinghai Lu [Sat, 30 Oct 2010 08:19:29 +0000 (01:19 -0700)]
x86: Check irq_remapped instead of remapping_enabled in destroy_irq()
Russ Anderson reported:
| There is a regression that is causing a NULL pointer dereference
| in free_irte when shutting down xpc. git bisect narrowed it down
| to git commit
d585d06(intr_remap: Simplify the code further), which
| changed free_irte(). Reverse applying the patch fixes the problem.
We need to use irq_remapped() for each irq instead of checking only
intr_remapping_enabled as there might be non remapped irqs even when
remapping is enabled.
[ tglx: use cfg instead of retrieving it again. Massaged changelog ]
Reported-bisected-and-tested-by: Russ Anderson <rja@sgi.com>
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Cc: Suresh Siddha <suresh.b.siddha@intel.com>
LKML-Reference: <
4CCBD511.40607@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Thomas Gleixner [Tue, 7 Sep 2010 14:32:56 +0000 (14:32 +0000)]
hpfs: Convert sbi->hpfs_creation_de to mutex
sbi->hpfs_creation_de is used as mutex so make it a mutex.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Christoph Hellwig <hch@infradead.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
LKML-Reference: <
20100907125056.
228874895@linutronix.de>
Al Viro [Sat, 30 Oct 2010 06:18:32 +0000 (02:18 -0400)]
in untag_chunk() we need to do alloc_chunk() a bit earlier
... while we are not holding spinlocks.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Stephen Hemminger [Thu, 21 Oct 2010 00:23:50 +0000 (17:23 -0700)]
audit: make functions static
I was doing some namespace checks and found some simple stuff in
audit that could be cleaned up. Make some functions static, and
put const on make_reply payload arg.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Miloslav Trmac [Thu, 16 Sep 2010 22:14:11 +0000 (18:14 -0400)]
Audit: add support to match lsm labels on user audit messages
Add support for matching by security label (e.g. SELinux context) of
the sender of an user-space audit record.
The audit filter code already allows user space to configure such
filters, but they were ignored during evaluation. This patch implements
evaluation of these filters.
For example, after application of this patch, PAM authentication logs
caused by cron can be disabled using
auditctl -a user,never -F subj_type=crond_t
Signed-off-by: Miloslav Trmac <mitr@redhat.com>
Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Linus Torvalds [Sat, 30 Oct 2010 01:58:00 +0000 (18:58 -0700)]
Merge branches 'x86-fixes-for-linus' and 'x86-uv-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip
* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86, alternative: Call stop_machine_text_poke() on all cpus
x86-32: Restore irq stacks NUMA-aware allocations
x86, memblock: Fix early_node_mem with big reserved region.
* 'x86-uv-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86, uv: More Westmere support on SGI UV
x86, uv: Enable Westmere support on SGI UV
Linus Torvalds [Sat, 30 Oct 2010 01:57:04 +0000 (18:57 -0700)]
Merge branches 'msm-fixes' and 'msm-video' of git://codeaurora.org/quic/kernel/dwalker/linux-msm
* 'msm-fixes' of git://codeaurora.org/quic/kernel/dwalker/linux-msm:
msm: Kconfig: drop unused config options
msm: fix compile failure when no debug uart is selected
msm: fix debug-macro.S build failure
msm: timer: Decrease shift on timer clocksource
arm: mach-msm: fix error handling in msm_iommu_probe()
msm: fix Kconfig target board selection
msm: fix compile failure on struct membank node member
* 'msm-video' of git://codeaurora.org/quic/kernel/dwalker/linux-msm:
drivers/video/msm/mddi.c: Remove multiple KERN_<level> uses
drivers: msm: video: add dev_set_name call
drivers: video: msm: fix hang on disable_irq
Sage Weil [Fri, 29 Oct 2010 19:46:43 +0000 (15:46 -0400)]
Btrfs: allow subvol deletion by unprivileged user with -o user_subvol_rm_allowed
Add a mount option user_subvol_rm_allowed that allows users to delete a
(potentially non-empty!) subvol when they would otherwise we allowed to do
an rmdir(2). We duplicate the may_delete() checks from the core VFS code
to implement identical security checks (minus the directory size check).
We additionally require that the user has write+exec permission on the
subvol root inode.
Signed-off-by: Sage Weil <sage@newdream.net>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
projects / linux-2.6-microblaze.git / log